Function at 0x4016ea
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45a62e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3704
call fcn.0043ddc0
mov eax, dword [0x47d9a0]
xor eax, esp
mov dword [esp + 0x3700], eax
push ebx
push esi
push edi
mov eax, dword [0x47d9a0]
xor eax, esp
push eax
lea eax, [esp + 0x3718]
mov dword fs:[0], eax
xor esi, esi
push esi
mov dword [esp + 0x40], ecx
call fcn.0041df44
mov dword [esp], 0x4016d9
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0040166a
call fcn.0041f9ca
test eax, eax
jne 0x401788
push esi
push esi
push str.Unable_to_initialize_OLE._nTerminating_application_
call fcn.0041d048
xor eax, eax
mov ecx, dword [esp + 0x3718]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3700]
xor ecx, esp
call fcn.00436e5a
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov ebx, 0x462fac
push ebx
call fcn.00402eee
call fcn.0041422b
pop ecx
mov dword [esp + 0x20], esi
call fcn.00416120
cmp eax, esi
je 0x4017b7
call fcn.00402a5e
cmp eax, 1
je 0x401764
call fcn.0041bb36
push eax
lea ecx, [esp + 0x34]
call fcn.00405f08
and dword [esp + 0x3720], 0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ebx
call fcn.00402eee
push ecx
mov byte [esp + 0x3728], 1
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x463300
call fcn.00402eee
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x372c], 0
call fcn.0041560d
add esp, 0xc
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x3724], 2
call fcn.00403190
mov byte [esp + 0x3720], 0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004010ea
push 0
lea ecx, [esp + 0x34]
call fcn.004032a1
push eax
call fcn.00406899
pop ecx
push 2
pop eax
call fcn.00406c0d
lea edi, [esp + 0x2c]
lea esi, [esp + 0x10]
call fcn.00414d5c
mov esi, eax
mov byte [esp + 0x3720], 3
call fcn.00414cab
push eax
push dword [esi]
push str.OS_version:__s__Server:_d
call fcn.004074db
mov byte [esp + 0x372c], 0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004010ea
lea eax, [esp + 0x10]
push eax
call fcn.00416804
pop ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004010ea
call fcn.0041bb36
push eax
lea ecx, [esp + 0x3c]
call fcn.00405f08
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x3724], 4
call fcn.00416804
pop ecx
mov byte [esp + 0x3720], 5
push dword [eax]
lea ecx, [esp + 0x1c]
call fcn.00402f32
mov dword [esp + 0x10], eax
lea esi, [esp + 0x14]
mov byte [esp + 0x3720], 6
call fcn.00414d5c
mov esi, eax
mov byte [esp + 0x3720], 7
mov eax, dword [esp + 0x10]
push dword [eax]
call fcn.00414cab
push eax
push dword [esi]
lea eax, [esp + 0x44]
push str.meeting.zoho.com
push dword [esp + 0x40]
push str.Name:JoinEXE_Version:_s_Build:_s_OS:_s_Server:_d_TimeStamp:_s
push eax
call fcn.00403880
mov ecx, dword [esp + 0x30]
add esp, 0x1c
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004010ea
mov byte [esp + 0x3720], 4
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.004010ea
push ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], esp
mov ecx, esp
push eax
call fcn.00403172
call fcn.0040a5fb
pop ecx
push dword [0x4822b8]
push str.Logging_Started._Path_:_s
call fcn.004074db
pop ecx
pop ecx
push 0
lea ecx, [esp + 0x34]
call fcn.004032a1
push eax
push 0x481f68
call fcn.00437bc2
pop ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00402eee
mov esi, 0x482408
mov ecx, esi
call fcn.00419cb1
push dword [0x4822bc]
push str.App_dir_:_s
call fcn.004074db
pop ecx
pop ecx
call fcn.00401279
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0
call fcn.00402eee
call fcn.0040288d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Settings.conf
call fcn.00402eee
push esi
call fcn.00419a3b
call fcn.00419dbc
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
call fcn.00402eee
call fcn.00419d53
call fcn.004197a4
mov eax, dword [0x481070]
mov dword [esp + 0x10], eax
call fcn.00417b31
xor eax, eax
inc eax
cmp dword [0x481070], eax
mov dword [esp + 0x18], eax
jle 0x402031
mov esi, eax
mov eax, dword [0x481078]
mov edi, esi
shl edi, 2
push dword [edi + eax]
push str._cmdlog
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401a48
call fcn.00407729
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._gateway
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401a8b
cmp dword [0x481070], esi
jl 0x402020
mov eax, dword [0x481078]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [edi + eax + 4]
call fcn.00402eee
call fcn.00401190
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._gatewayport
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401ac8
cmp dword [0x481070], esi
jl 0x402020
mov eax, dword [0x481078]
push dword [edi + eax + 4]
call fcn.00437189
pop ecx
mov dword [0x48242c], eax
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push 0x46349c
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401aef
mov dword [0x4823ec], 1
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._proxyserver
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401b31
cmp dword [0x481070], esi
jl 0x401b22
mov eax, dword [0x481078]
push dword [edi + eax + 4]
mov ecx, 0x4823d0
call fcn.00403458
mov dword [0x4823e0], 3
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._LanguageId
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401b6c
mov eax, dword [0x481078]
push dword [edi + eax + 4]
call fcn.00437189
test eax, eax
pop ecx
je 0x401b6c
mov esi, eax
call fcn.00402cf8
mov esi, dword [esp + 0x18]
mov dword [0x482414], eax
mov eax, dword [0x481078]
push dword [edi + eax]
push str._proxyPac
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401bae
cmp dword [0x481070], esi
jl 0x401b9f
mov eax, dword [0x481078]
push dword [edi + eax + 4]
mov ecx, 0x4823e4
call fcn.00403458
mov dword [0x4823e0], 1
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._proxyport
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401beb
cmp dword [0x481070], esi
jl 0x402020
mov eax, dword [0x481078]
push dword [edi + eax + 4]
call fcn.00437189
pop ecx
mov dword [0x4823d8], eax
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._proxyusername
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401c27
cmp dword [0x481070], esi
jl 0x402020
mov ecx, 0x4823b0
mov eax, dword [0x481078]
push dword [edi + eax + 4]
call fcn.00403458
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._proxypassword
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401c52
cmp dword [0x481070], esi
jl 0x402020
mov ecx, 0x4823b4
jmp 0x401c14
mov eax, dword [0x481078]
push dword [edi + eax]
push str._InstallCustomerPlugin
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x402019
mov eax, dword [0x481078]
push dword [edi + eax]
push str._ICP
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x402019
mov eax, dword [0x481078]
push dword [edi + eax]
push 0x463580
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x402008
mov eax, dword [0x481078]
push dword [edi + eax]
push str._viewer
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x402008
mov eax, dword [0x481078]
push dword [edi + eax]
push 0x463598
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x401ff7
mov eax, dword [0x481078]
push dword [edi + eax]
push str._agent
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x401ff7
mov eax, dword [0x481078]
push dword [edi + eax]
push str._CAK
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401d60
cmp dword [0x481070], esi
jl 0x402020
mov eax, dword [0x481078]
push dword [edi + eax + 4]
lea ecx, [esp + 0x30]
call fcn.00402eee
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x482538
mov byte [esp + 0x3724], 8
call fcn.00403190
mov byte [esp + 0x3720], 4
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.004010ea
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._UNC
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401d87
mov dword [0x4822d8], 1
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._dir
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401e1d
push ebx
lea ecx, [esp + 0x28]
call fcn.00402eee
mov byte [esp + 0x3720], 9
cmp dword [0x481070], esi
jl 0x401dcb
mov eax, dword [0x481078]
push dword [edi + eax + 4]
lea ecx, [esp + 0x28]
call fcn.00403458
push dword [esp + 0x24]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401dec
push ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.00403172
jmp 0x401e07
push dword [esp + 0x24]
push str.Dir_path_is_invalid.
call fcn.00407571
pop ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push ebx
call fcn.00402eee
call fcn.0040288d
mov byte [esp + 0x3720], 4
mov ecx, dword [esp + 0x24]
jmp 0x401d53
mov eax, dword [0x481078]
push dword [edi + eax]
push str._UPDATE
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x402150
mov eax, dword [0x481078]
push dword [edi + eax]
push str._UpdateDS
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401edd
call fcn.004147dc
xor esi, esi
cmp eax, esi
je 0x4021b7
push str.Updating...__UpdateDS
call fcn.00407571
pop ecx
lea esi, [esp + 0x20]
lea edi, [esp + 0x28]
mov dword [0x4822ac], 1
call fcn.0041459d
push 0
mov ecx, edi
mov byte [esp + 0x3724], 0xb
call fcn.004032a1
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esp + 0x28]
push str.Updating...__UpdateDS_:_s
call fcn.00407571
pop ecx
mov eax, edi
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
call fcn.0040288d
mov byte [esp + 0x3720], 4
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.004010ea
mov esi, dword [esp + 0x18]
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._UpdateURS
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401f2d
call fcn.004147dc
test eax, eax
je 0x4021c5
push str.Updating...__UpdateDS
call fcn.00407571
mov ecx, esp
mov dword [esp + 0x20], esp
push 0
mov dword [0x4822b0], 1
call fcn.00402eee
call fcn.0040288d
jmp 0x402020
mov eax, dword [0x481078]
push dword [edi + eax]
push str._UnInstallURS
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x4021dd
mov eax, dword [0x481078]
push dword [edi + eax]
push 0x4637ac
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
je 0x402263
mov eax, dword [0x481078]
push dword [edi + eax]
push str._auth
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x401fd3
push ebx
lea ecx, [esp + 0x18]
call fcn.00402eee
mov byte [esp + 0x3720], 0xf
cmp dword [0x481070], esi
jl 0x401fbf
mov eax, dword [0x481078]
push dword [edi + eax + 4]
lea ecx, [esp + 0x18]
call fcn.00403458
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
call fcn.00419ce0
mov byte [esp + 0x3720], 4
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004010ea
mov eax, dword [0x481078]
push dword [edi + eax]
push str._URS
call fcn.00437d6f
test eax, eax
pop ecx
pop ecx
jne 0x402020
mov dword [0x48252c], 1
jmp 0x402020
cmp dword [0x481070], esi
jl 0x402020
mov byte [0x482420], 1
jmp 0x402020
cmp dword [0x481070], esi
jl 0x402020
mov byte [0x482420], 0
jmp 0x402020
mov byte [0x482427], 1
inc esi
cmp esi, dword [0x481070]
mov dword [esp + 0x18], esi
jl 0x401a21
call fcn.00402ea6
test al, al
jne 0x402045
push str.ZohoTray_:_Problem_with_setting_Resource_Olnly_DLL
call fcn.004074db
pop ecx
call fcn.0041478f
test eax, eax
mov dword [0x481f60], eax
mov edi, str.join.exe
jne 0x4020c8
mov ebx, dword [0x482414]
lea eax, [esp + 0x20]
push 0x234a
push eax
call fcn.004165c1
pop ecx
pop ecx
push 0
mov byte [esp + 0x3724], 0x10
mov eax, dword [eax]
push 4
push eax
call fcn.0041d048
mov byte [esp + 0x3720], 4
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010ea
cmp esi, 6
jne 0x402331
push str.Some_other_instance_running._Terminating_them_and_starting_our_process
call fcn.004074db
pop ecx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edi
call fcn.00402eee
call fcn.0041499e
pop ecx
pop ecx
mov ebx, 0x462fac
lea eax, [esp + 0x53c]
push eax
call fcn.004080a1
mov byte [esp + 0x3720], 0x11
call fcn.00409dda
lea eax, [esp + 0x34]
push eax
call fcn.0041493d
pop ecx
mov byte [esp + 0x3720], 0x12
push dword [esp + 0x10]
push dword [esp + 0x38]
push str.CommandLineArgs_:__s_arglen:_d
call fcn.004074db
pop ecx
pop ecx
lea eax, [esp + 0x38]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
push dword [esp + 0x14]
call fcn.00402b50
cmp eax, 1
jne 0x402340
push str.Exe_launched
call fcn.004074db
pop ecx
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.004010ea
lea esi, [esp + 0x53c]
call fcn.004081aa
jmp 0x402195
lea esi, [esp + 0x20]
lea edi, [esp + 0x14]
call fcn.0041459d
push 0
mov ecx, edi
mov byte [esp + 0x3724], 0xa
call fcn.004032a1
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ecx
mov eax, edi
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
call fcn.0040288d
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004010ea
xor esi, esi
inc esi
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.004010ea
mov eax, esi
jmp 0x401764
push esi
push esi
push str.Automatic_update_has_failed_
call fcn.0041d048
jmp 0x402198
call fcn.00402a5e
mov edi, eax
push edi
push str.Applcation_restarted_as_UAC_elevated_process:_d
call fcn.00407571
pop ecx
pop ecx
xor esi, esi
jmp 0x402198
call fcn.004147dc
xor esi, esi
cmp eax, esi
jne 0x4021fe
call fcn.00402a5e
mov edi, eax
push edi
push str.Applcation_restarted_as_UAC_elevated_process:_d
call fcn.00407571
pop ecx
pop ecx
jmp 0x402198
push str.uninstalling_urs
call fcn.00407571
pop ecx
lea eax, [esp + 0x10]
push eax
call fcn.0041ab3c
mov byte [esp + 0x3720], 0xc
call fcn.0041b09a
push str.Uninstalling_service_and_quitting_tray
call fcn.00407571
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Zoho_Assist_Unattended_Support
call fcn.00402eee
push 0x85
call fcn.0041537e
pop ecx
pop ecx
push esi
push esi
push str.The_Unattended_Agent_is_now_removed.
call fcn.0041d048
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004010ea
jmp 0x402198
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
lea ecx, [esp + 0x28]
call fcn.00402eee
mov byte [esp + 0x3720], 0xd
cmp dword [0x481070], esi
jl 0x40229a
mov eax, dword [0x481078]
push dword [eax + esi*4 + 4]
lea ecx, [esp + 0x28]
call fcn.00403458
push dword [esp + 0x24]
and dword [esp + 0x24], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402318
push 0x104
lea eax, [esp + 0x3508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x20]
push eax
push ecx
lea eax, [esp + 0x350c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00402eee
push ecx
lea eax, [esp + 0x30]
mov dword [esp + 0x48], esp
mov ecx, esp
push eax
mov byte [esp + 0x3730], 0xe
call fcn.00403172
mov byte [esp + 0x372c], 0xd
call fcn.004144fc
add esp, 0xc
push eax
push dword [esp + 0x24]
push str.Exe_updated:er:_d_:_res___d
call fcn.00407571
add esp, 0xc
jmp 0x402328
push dword [esp + 0x24]
push str.invalid_path_file:_s
call fcn.00407571
pop ecx
pop ecx
mov ecx, dword [esp + 0x24]
jmp 0x40218d
push str.Another_instance_running._User_chose_to_quit_application
call fcn.004074db
jmp 0x4021d8
cmp dword [0x4823ec], 1
jne 0x4024ae
call fcn.0041bb36
push eax
lea ecx, [esp + 0x1c]
call fcn.00405f08
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x3724], 0x13
call fcn.00401174
mov byte [esp + 0x3720], 0x14
movzx ecx, byte [0x482420]
push ecx
push dword [eax]
lea eax, [esp + 0x20]
push str.Join_Start_k_s_Role_d_UpdateTypeSilent
push eax
call fcn.00403880
mov byte [esp + 0x3730], 0x13
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004010ea
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
lea ecx, [esp + 0x540]
call fcn.0040947f
cmp eax, 7
je 0x402403
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.meeting.zoho.com
call fcn.00402eee
lea eax, [esp + 0x540]
push eax
call fcn.0040abb9
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
lea ecx, [esp + 0x540]
call fcn.0040947f
call fcn.0041bb36
push eax
lea ecx, [esp + 0x18]
call fcn.00405f08
push ecx
mov byte [esp + 0x3724], 0x15
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00401174
mov edi, 0x482290
push edi
call fcn.00404c76
test eax, eax
je 0x402452
lea eax, [esp + 0x14]
push eax
xor ecx, ecx
call fcn.0040565a
push dword [esp + 0x14]
push str.Silent_Update_:__s
call fcn.004074db
pop ecx
pop ecx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.UpTypeSilent
call fcn.00402eee
mov byte [esp + 0x3728], 0x16
movzx eax, byte [0x482420]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00401174
mov ecx, edi
mov byte [esp + 0x3730], 0x15
call fcn.004041ab
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004010ea
jmp 0x402136
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402eee
push ebx
lea ecx, [esp + 0x48]
mov byte [esp + 0x3724], 0x17
call fcn.00402eee
mov byte [esp + 0x3720], 0x18
call fcn.0041bb36
push eax
lea ecx, [esp + 0x24]
call fcn.00405f08
mov byte [esp + 0x3720], 0x19
cmp dword [0x4827c0], 0
je 0x4025dd
push str.Preparing_for_first_time_installation
call fcn.00407571
pop ecx
call fcn.0041bb36
push eax
lea ecx, [esp + 0x18]
call fcn.00405f08
lea esi, [esp + 0x10]
mov byte [esp + 0x3720], 0x1a
call fcn.00414411
push edi
mov byte [esp + 0x3724], 0x1b
push dword [eax]
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.00403880
mov byte [esp + 0x3730], 0x1a
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004010ea
push 0x104
lea eax, [esp + 0x3508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x350c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00402eee
push ecx
mov byte [esp + 0x372c], 0x1c
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esp
mov ecx, esp
push eax
call fcn.00403172
mov byte [esp + 0x372c], 0x1a
call fcn.004144fc
add esp, 0xc
push dword [esp + 0x10]
push str.Join_exe_copied_Exe_copied:_d
call fcn.00407571
pop ecx
pop ecx
call fcn.004013bb
mov byte [esp + 0x3720], 0x19
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004010ea
mov esi, dword [esp + 0x20]
cmp dword [esi - 0xc], 5
jle 0x4025fd
push ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x20], esp
mov ecx, esp
push eax
call fcn.00403172
call fcn.00419d53
push ebx
lea ecx, [esp + 0x44]
call fcn.00402eee
push str.After_GetConnection
mov byte [esp + 0x3724], 0x1d
call fcn.004074db
pop ecx
lea ebx, [esp + 0x4c]
call fcn.0040bf97
mov ecx, dword [esp + 0x3c]
mov eax, ebx
mov byte [esp + 0x3720], 0x1e
mov dword [ecx + 0x20], eax
mov ecx, ebx
call fcn.0041f4e7
mov eax, ebx
push eax
mov byte [esp + 0x3724], 0x1d
call fcn.0040c103
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.004010ea
lea ecx, [esi - 0x10]
call fcn.004010ea
mov ecx, dword [esp + 0x44]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.004010ea
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.004010ea
lea esi, [esp + 0x53c]
call fcn.004081aa
jmp 0x4021d9