Function at 0x4c1680
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4dec
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x4de8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x24]
push ebx
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x30]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x5c], edx
mov edx, dword [ebp + 0x2c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [ebp + 0x34]
mov dword [esp + 0x60], eax
or eax, 0xffffffff
xor ebx, ebx
push ebx
mov dword [esp + 0x68], edi
mov dword [esp + 0x5c], edx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], eax
call fcn.005e0ab6
add esp, 4
mov dword [esp + 0x1d4], edx
push esi
lea edx, [esp + 0x1e4]
push edx
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp edi, ebx
je 0x4c175b
mov esi, edi
mov ecx, 0x50
lea edi, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
jmp 0x4c1771
push 0x140
lea eax, [esp + 0x94]
push ebx
push eax
call fcn.005dfd60
add esp, 0xc
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4c177b
mov dword [eax], ebx
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4c1785
mov byte [eax], bl
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4c178f
mov byte [eax], bl
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4c1799
mov byte [eax], bl
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4c17a3
mov byte [eax], bl
push 0x641d9c
cmp dword [esp + 0x4c], ebx
je 0x4c17c4
mov edi, dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call esi
add edi, 5
mov dword [esp + 0x10], edi
jmp 0x4c17e3
lea ecx, [esp + 0x45f4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x45f5]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x13e8]
push ecx
lea edx, [esp + 0x1e4]
push edx
mov byte [esp + 0x39f8], bl
mov byte [esp + 0x27f0], bl
mov byte [esp + 0x13f0], bl
mov byte [esp + 0x17f0], bl
mov byte [eax], bl
mov byte [esp + 0x2ff0], bl
call fcn.004da790
add esp, 8
cmp byte [esp + 0x13e8], bl
je 0x4c297c
lea eax, [esp + 0x27e8]
push eax
lea ecx, [esp + 0x1e4]
push ecx
call fcn.004e1490
lea edx, [esp + 0x1e8]
push edx
lea eax, [esp + 0x27f4]
push eax
call fcn.004afbc0
add esp, 0x10
test eax, eax
jne 0x4c297c
lea ecx, [esp + 0x27e8]
push ecx
lea edx, [esp + 0x2fec]
push edx
call esi
lea eax, [esp + 0x2fe8]
push 0x2e
push eax
call fcn.005e0940
xor edi, edi
add esp, 8
cmp eax, edi
je 0x4c1892
mov byte [eax], bl
lea ecx, [esp + 0x1e0]
push ecx
lea edx, [esp + 0x33ec]
push edx
call esi
lea eax, [esp + 0x33e8]
push 0x5c
push eax
call fcn.005e0a00
mov esi, eax
add esp, 8
cmp esi, edi
je 0x4c18e9
lea ecx, [esp + 0x33e8]
push 0x5c
push ecx
mov byte [esi], bl
call fcn.005e0a00
add esp, 8
cmp eax, edi
je 0x4c18e9
inc eax
push eax
mov byte [esi], 0x5c
call fcn.004b0020
add esp, 4
test eax, eax
jne 0x4c297c
lea edx, [esp + 0x13e8]
push edx
call fcn.004af270
add esp, 4
cmp eax, 1
je 0x4c1922
push str.autorun
call fcn.004dd6c0
push eax
lea eax, [esp + 0x27f0]
push str.autorun
push eax
call fcn.004dd670
add esp, 0x10
test eax, eax
jne 0x4c1927
mov ebx, 1
lea ecx, [esp + 0x1e0]
push ecx
call fcn.004e9d50
test eax, eax
je 0x4c197d
push edi
call fcn.00503120
test eax, eax
je 0x4c196a
push edi
push edi
push edi
call fcn.00504d70
test eax, eax
jne 0x4c297c
lea edx, [esp + 0x1e0]
mov esi, 1
push edx
mov dword [esp + 0x1c], esi
call fcn.00502ab0
jmp 0x4c1981
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x1e0]
push edx
call fcn.00502ab0
jmp 0x4c1981
mov esi, dword [esp + 0x18]
cmp ebx, edi
jne 0x4c1e14
mov ebx, 1
cmp dword [ebp + 0x20], ebx
jne 0x4c1abe
lea eax, [esp + 0x13e8]
push eax
call fcn.004afa70
add esp, 4
test eax, eax
jne 0x4c1abe
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x244]
push edi
push ecx
call fcn.004c1560
add esp, 0x6c
test eax, eax
jne 0x4c1abe
push edi
push edi
push edi
lea edx, [esp + 0x30]
push edx
push edi
lea eax, [esp + 0x1f4]
push eax
mov dword [esp + 0x48], ebx
call fcn.00508b00
cmp eax, ebx
jne 0x4c1ab9
mov dword [esp + 0x50], ebx
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x13e8]
push 0x641d98
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c1a28
mov dword [esp + 0x44], ebx
cmp dword [esp + 0x30], edi
jne 0x4c1ec5
lea ecx, [esp + 0x13e8]
push 0x641d94
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c1a9a
lea edx, [esp + 0x13e8]
push 0x61dda0
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c1a9a
lea eax, [esp + 0x13e8]
push 0x641d90
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c1a9a
lea ecx, [esp + 0x13e8]
push 0x640470
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c1e99
cmp dword [ebp + 0x20], ebx
jne 0x4c1e99
push edi
push edi
push edi
lea edx, [esp + 0x30]
push edx
push edi
lea eax, [esp + 0x1f4]
push eax
jmp 0x4c1eb0
cmp eax, 3
je 0x4c1ac5
cmp esi, edi
jmp 0x4c2975
lea ecx, [esp + 0x20]
push ecx
push edi
push edi
push edi
lea edx, [esp + 0x44]
push edx
push edi
push edi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x200]
push ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x44], edi
call fcn.004b8f20
add esp, 0x24
cmp eax, ebx
jne 0x4c1e14
cmp dword [esp + 0x2c], edi
jne 0x4c1e14
push 0x3ff
lea edx, [esp + 0x2bed]
push edi
push edx
mov byte [esp + 0x2bf4], 0
call fcn.005dfd60
push 0x3ff
lea eax, [esp + 0x5f1]
push edi
push eax
mov byte [esp + 0x5f8], 0
call fcn.005dfd60
add esp, 0x18
cmp dword [esp + 0x34], edi
jne 0x4c1ccf
lea ecx, [esp + 0x2be8]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x5e0]
push edx
push edi
push 0x64168c
lea eax, [esp + 0x2bf4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
cmp byte [esp + 0x5e0], 0
je 0x4c1ba7
push edi
push edi
push 0x100000
push edi
lea ecx, [esp + 0x5f0]
push ecx
lea edx, [esp + 0x1f4]
push edx
call fcn.004eb140
add esp, 0x18
cmp eax, edi
jne 0x4c1bc0
lea eax, [esp + 0x5e0]
push 2
push eax
call fcn.005025d0
add esp, 8
cmp esi, edi
jmp 0x4c2975
push edi
push edi
push edi
lea ecx, [esp + 0x30]
push ecx
push edi
lea edx, [esp + 0x5f4]
push edx
call fcn.00508b00
cmp eax, ebx
jne 0x4c1c53
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x50]
push 1
push edx
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0x68]
push ecx
push edx
push eax
lea ecx, [esp + 0x60c]
push ecx
call fcn.004c1680
lea edx, [esp + 0x610]
push 2
push edx
mov esi, eax
call fcn.005025d0
add esp, 0x38
cmp dword [esp + 0x18], edi
je 0x4c1c3c
call fcn.00504780
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4de8]
xor ecx, esp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x4c1cef
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x38]
push ecx
push edi
push edi
lea edx, [esp + 0x30]
push edx
push edi
push edi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x600]
push ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0xa0], edi
call fcn.004b8f20
add esp, 0x24
cmp dword [esp + 0x34], edi
je 0x4c1e02
cmp eax, ebx
jne 0x4c1e02
cmp dword [esp + 0x2c], edi
jne 0x4c1e02
cmp dword [esp + 0x20], edi
je 0x4c1e02
push 2
lea edx, [esp + 0x5e4]
push edx
call fcn.005025d0
add esp, 8
cmp esi, edi
je 0x4c1cd8
call fcn.00504780
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4de8]
xor ecx, esp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp eax, 0xe
jne 0x4c1da3
lea eax, [esp + 0x5e0]
push edi
push eax
call fcn.004a93d0
add esp, 8
cmp eax, ebx
jne 0x4c1e02
push 0x207
lea ecx, [esp + 0x11e5]
push edi
push ecx
mov byte [esp + 0x11ec], 0
call fcn.005dfd60
push edi
lea edx, [esp + 0x11f0]
push edx
lea eax, [esp + 0x5f4]
push eax
call fcn.004a9680
add esp, 0x18
cmp byte [esp + 0x11e0], 0
je 0x4c1e02
push edi
lea ecx, [esp + 0x11e4]
push edi
push ecx
call fcn.004b0510
add esp, 0xc
test eax, eax
je 0x4c1e02
lea edx, [esp + 0x5e0]
push 2
push edx
call fcn.005025d0
add esp, 8
cmp esi, edi
je 0x4c1cd8
call fcn.00504780
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4de8]
xor ecx, esp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x4c1e02
push 0x103
lea eax, [esp + 0x11e5]
push edi
push eax
mov byte [esp + 0x11ec], 0
call fcn.005dfd60
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1200]
push edx
lea eax, [esp + 0x604]
push edi
push eax
mov dword [esp + 0x4c], edi
call fcn.004ba3d0
add esp, 0x2c
test eax, eax
je 0x4c1e02
cmp dword [esp + 0x20], edi
je 0x4c1e02
push 2
lea ecx, [esp + 0x5e4]
push ecx
jmp 0x4c1cc7
lea edx, [esp + 0x5e0]
push 2
push edx
call fcn.005025d0
add esp, 8
mov ebx, 1
push ebx
push edi
push 0x2c
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x3a00]
push ecx
push 0x688958
mov dword [esp + 0x6c], edi
call fcn.004e1380
or esi, 0xffffffff
add esp, 0x18
cmp dword [esp + 0x54], esi
je 0x4c1a0b
jmp 0x4c1e50
lea edx, [esp + 0x13e8]
push edx
lea eax, [esp + 0x39f4]
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c1a07
push ebx
push edi
push 0x2c
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x3a00]
push edx
push 0x688958
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x54], esi
jne 0x4c1e50
jmp 0x4c1a0b
cmp dword [esp + 0x14], edi
jne 0x4c1ec5
push edi
push edi
push edi
lea ecx, [esp + 0x30]
push ecx
push edi
lea edx, [esp + 0x1f4]
push edx
mov dword [esp + 0x48], ebx
call fcn.00508b00
cmp eax, ebx
jne 0x4c1ec5
mov dword [esp + 0x14], ebx
mov dword [esp + 0x50], ebx
cmp dword [esp + 0x64], edi
jne 0x4c1eea
push edi
lea eax, [esp + 0x94]
push eax
push edi
lea ecx, [esp + 0x1ec]
push ecx
call fcn.004e4d70
test eax, eax
je 0x4c2971
cmp dword [esp + 0xac], edi
ja 0x4c2971
mov eax, dword [esp + 0xb0]
cmp eax, edi
je 0x4c2971
cmp dword [ebp + 0x20], ebx
jne 0x4c1f16
cmp eax, 0xa00000
ja 0x4c2971
mov ecx, dword [esp + 0xa8]
lea edx, [esp + 0x17e8]
push edx
mov edx, dword [esp + 0xa8]
lea eax, [esp + 0x8c]
push eax
push ecx
push edx
mov byte [esp + 0x17f8], 0
call fcn.004e1a00
mov eax, dword [esp + 0x9c]
mov ebx, dword [esp + 0x1e4]
mov edi, dword [ebp + 0x1c]
mov esi, dword [esp + 0x1e0]
add esp, 0x10
cmp ebx, eax
jl 0x4c1f7f
mov ecx, dword [esp + 0x88]
jg 0x4c1f6f
cmp esi, ecx
jbe 0x4c1f7f
push ebx
push esi
push eax
push ecx
call fcn.004daa30
add esp, 0x10
cmp eax, edi
jle 0x4c1fd7
mov edx, dword [esp + 0x98]
lea eax, [esp + 0x17e8]
push eax
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x84]
push ecx
push edx
push eax
mov byte [esp + 0x17f8], 0
call fcn.004e1a00
mov ecx, dword [esp + 0x94]
add esp, 0x10
cmp ebx, ecx
jl 0x4c1fed
mov eax, dword [esp + 0x80]
jg 0x4c1fc7
cmp esi, eax
jbe 0x4c1fed
push ebx
push esi
push ecx
push eax
call fcn.004daa30
add esp, 0x10
cmp eax, edi
jg 0x4c1fed
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4c1fe5
mov dword [eax], 1
mov dword [esp + 0x1c], 1
cmp dword [ebp + 0x20], 1
jne 0x4c1ffb
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x90], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4c208e
cmp dword [esp + 0x44], 0
jne 0x4c208e
push 0x61cdd0
lea ecx, [esp + 0x1d4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [esp + 0x90], 2
je 0x4c2042
push 0x641d8c
lea edx, [esp + 0x1d4]
push edx
call ebx
test byte [esp + 0x90], 4
je 0x4c205b
push 0x66d7e4
lea eax, [esp + 0x1d4]
push eax
call ebx
push 0x61cdcc
lea ecx, [esp + 0x1d4]
push ecx
call ebx
cmp byte [esp + 0x1d2], 0x5d
je 0x4c208e
lea edx, [esp + 0x1d0]
push edx
lea eax, [esp + 0x17ec]
push eax
mov dword [esp + 0x24], 1
call ebx
cmp dword [esp + 0x14], 1
mov byte [esp + 0x1fe8], 0
mov byte [esp + 0x49f0], 0
mov byte [esp + 0x1be8], 0
mov byte [esp + 0x35f0], 0
mov byte [esp + 0x23e8], 0
mov byte [esp + 0xde0], 0
mov byte [esp + 0x3df0], 0
mov byte [esp + 0x9e0], 0
mov byte [esp + 0x41f0], 0
jne 0x4c2326
push 0
lea ecx, [esp + 0x3df4]
push ecx
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x9f0]
push ecx
lea edx, [esp + 0x4204]
push edx
lea eax, [esp + 0x3608]
push eax
lea ecx, [esp + 0x2404]
push ecx
lea edx, [esp + 0xe00]
push edx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x2014]
push edx
lea eax, [esp + 0x4a20]
push eax
lea ecx, [esp + 0x1c1c]
push ecx
lea edx, [esp + 0x218]
push edx
call fcn.005052b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esp + 0xde0], 0
mov dword [esp + 0x74], eax
jne 0x4c21a0
push 0
lea eax, [esp + 0x35f4]
push str.RealNetworks
push eax
call fcn.004f5880
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2194
push str.RealNetworks
lea ecx, [esp + 0xde4]
push ecx
call esi
cmp byte [esp + 0xde0], 0
je 0x4c21b9
jmp 0x4c21a6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4c21b9
lea edx, [esp + 0xde0]
push edx
push eax
call esi
cmp byte [esp + 0x1be8], 0
je 0x4c21d6
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4c21d6
lea ecx, [esp + 0x1be8]
push ecx
push eax
call esi
cmp byte [esp + 0x9e0], 0
je 0x4c21f3
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4c21f3
lea edx, [esp + 0x9e0]
push edx
push eax
call esi
cmp byte [esp + 0x3df0], 0
je 0x4c2210
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4c2210
lea ecx, [esp + 0x3df0]
push ecx
push eax
call esi
cmp byte [esp + 0xde0], 0
je 0x4c22a2
cmp byte [esp + 0x9e0], 0
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x1be8]
push edx
je 0x4c226f
lea eax, [esp + 0x9e4]
push eax
mov eax, dword [esp + 0xb8]
lea ecx, [esp + 0xde8]
push ecx
lea edx, [esp + 0x17f4]
push edx
push eax
lea ecx, [esp + 0x1f4]
push ecx
push str._s___d____s___s___s__v_s_
push edi
call fcn.005dfb23
add esp, 0x20
jmp 0x4c2356
mov edx, dword [esp + 0xb4]
lea eax, [esp + 0xde4]
push eax
lea ecx, [esp + 0x17f0]
push ecx
push edx
lea eax, [esp + 0x1f0]
push eax
push str._s___d____s___s__v_s_
push edi
call fcn.005dfb23
add esp, 0x1c
jmp 0x4c2356
cmp byte [esp + 0x9e0], 0
je 0x4c22e8
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x1be8]
push ecx
mov ecx, dword [esp + 0xb4]
lea edx, [esp + 0x9e4]
push edx
lea eax, [esp + 0x17f0]
push eax
push ecx
lea edx, [esp + 0x1f0]
push edx
push str._s___d____s___s__v_s_
push edi
call fcn.005dfb23
add esp, 0x1c
jmp 0x4c2356
cmp byte [esp + 0x1be8], 0
je 0x4c232c
mov edx, dword [esp + 0xb0]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x1be8]
push eax
lea ecx, [esp + 0x17ec]
push ecx
push edx
lea eax, [esp + 0x1ec]
push eax
push str._s___d____s__v_s_
push edi
call fcn.005dfb23
add esp, 0x18
jmp 0x4c2356
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0xb0]
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x17e8]
push ecx
push edx
lea eax, [esp + 0x1e8]
push eax
push str._s___d____s
push edi
call fcn.005dfb23
add esp, 0x14
cmp byte [esp + 0xde0], 0
je 0x4c242d
lea ecx, [esp + 0xde0]
push ecx
lea edx, [esp + 0x5e4]
push edx
call esi
lea eax, [esp + 0x5e0]
push eax
call fcn.004dd6c0
push eax
lea ecx, [esp + 0x5e8]
push ecx
call fcn.004d86c0
push 0
lea edx, [esp + 0xdf0]
push 0x641d1c
push edx
call fcn.004f5880
add esp, 0x18
cmp eax, 0xffffffff
je 0x4c242d
push 0
lea eax, [esp + 0x5e4]
push str.Microsoft_Corp
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4c23e9
push 0
lea ecx, [esp + 0x5e4]
push str.Microsoft_Research
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2425
cmp byte [esp + 0x23e8], 0
je 0x4c242d
lea edx, [esp + 0x23e8]
push 0x641d1c
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4c2425
lea eax, [esp + 0x23e8]
push str.Microsoft_Windows
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c242d
mov dword [esp + 0x1c], 1
cmp byte [esp + 0x9e0], 0
je 0x4c24b0
cmp byte [esp + 0x1be8], 0
je 0x4c24b0
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xde0]
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x9e4]
push edx
push eax
push ecx
call fcn.004a5b90
add esp, 0x10
test eax, eax
jne 0x4c24b0
cmp dword [esp + 0x1c], eax
jne 0x4c24b0
cmp byte [esp + 0xde0], al
je 0x4c24b0
push eax
lea edx, [esp + 0x9e4]
push 0x612760
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4c24ad
push 0
lea eax, [esp + 0x9e4]
push str.kaspersky
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c24b0
mov byte [edi], 0
push 0
lea ecx, [esp + 0xde4]
push str.Ziff
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4c24e8
push 0
lea edx, [esp + 0x1fec]
push str.Magazine
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c24eb
mov byte [edi], 0
push 0
lea eax, [esp + 0x9e4]
push str.Inno
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2526
push 0
lea ecx, [esp + 0x1fec]
push str.setup_uninstall
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2526
mov byte [edi], 0
cmp dword [esp + 0x38], 0
jne 0x4c2538
cmp dword [esp + 0x28], 0
je 0x4c263f
cmp byte [edi], 0
je 0x4c25a6
cmp byte [esp + 0x2fe8], 0
je 0x4c263b
cmp byte [esp + 0x1fe8], 0
jne 0x4c25d1
cmp byte [esp + 0x9e0], 0
jne 0x4c256d
cmp byte [esp + 0x23e8], 0
je 0x4c263b
mov edx, dword [esp + 0x10]
cmp byte [edx], 0
je 0x4c25a6
cmp byte [esp + 0x9e0], 0
je 0x4c25fd
push 0
lea eax, [esp + 0x2fec]
push eax
lea ecx, [esp + 0x9e8]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c25fd
mov edx, dword [esp + 0x10]
mov byte [edx], 0
mov esi, dword [esp + 0x40]
cmp dword [esp + 0x18], 0
je 0x4c1c3c
call fcn.00504780
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4de8]
xor ecx, esp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
push 0
lea edx, [esp + 0x2fec]
push edx
lea eax, [esp + 0x1ff0]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c256d
mov ecx, dword [esp + 0x10]
mov byte [ecx], 0
jmp 0x4c25a6
mov eax, dword [esp + 0x10]
cmp byte [eax], 0
je 0x4c25a6
cmp byte [esp + 0x23e8], 0
je 0x4c263b
push 0
lea ecx, [esp + 0x2fec]
push ecx
lea edx, [esp + 0x23f0]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c263b
mov eax, dword [esp + 0x10]
mov byte [eax], 0
jmp 0x4c25a6
mov edi, dword [esp + 0x10]
cmp byte [edi], 0
je 0x4c25a6
mov ecx, dword [esp + 0x10]
push 0x60cc70
push ecx
call ebx
mov eax, dword [esp + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x4c2683
cmp dword [eax], 1
jne 0x4c2683
mov edi, dword [esp + 0x5c]
mov dword [eax], ebx
cmp edi, ebx
je 0x4c2687
cmp byte [edi], bl
je 0x4c2687
push 1
push 0x60cc70
push edi
call fcn.004e1620
add esp, 0xc
jmp 0x4c2687
mov edi, dword [esp + 0x5c]
cmp byte [esp + 0xde0], bl
jne 0x4c26b9
cmp dword [esp + 0x78], ebx
jne 0x4c26b9
push ebx
lea edx, [esp + 0x1fec]
push str.MFC_Application
push edx
call fcn.004f5880
add esp, 0xc
mov dword [esp + 0x3c], 1
cmp eax, 0xffffffff
je 0x4c26bd
mov dword [esp + 0x3c], ebx
lea eax, [esp + 0x27e8]
push eax
lea ecx, [esp + 0x23ec]
push ecx
lea edx, [esp + 0x41f8]
push edx
lea eax, [esp + 0x1ff4]
push eax
lea ecx, [esp + 0xdf0]
push ecx
call fcn.004a5c60
mov esi, eax
dec esi
add esp, 0x14
neg esi
sbb esi, esi
inc esi
cmp byte [esp + 0x1fe8], bl
je 0x4c273b
lea edx, [esp + 0x1fe8]
push 0x20
push edx
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4c273b
cmp byte [esp + 0x35f0], bl
je 0x4c273b
lea eax, [esp + 0x35f0]
push 0x20
push eax
call fcn.005e0940
add esp, 8
mov dword [esp + 0x44], 1
test eax, eax
je 0x4c273f
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xde0]
push ecx
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x9e4]
push edx
push eax
push ecx
call fcn.004a5b90
mov ebx, eax
dec ebx
add esp, 0x10
neg ebx
sbb ebx, ebx
inc ebx
cmp dword [esp + 0x70], 1
jne 0x4c279a
cmp byte [esp + 0x9e0], 0
je 0x4c2793
lea edx, [esp + 0x9e0]
push str.test
push edx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x4c279a
mov eax, 1
jmp 0x4c279c
xor eax, eax
cmp dword [esp + 0x38], 0
jne 0x4c27b1
cmp dword [esp + 0x28], 0
jne 0x4c27b1
mov ecx, 1
jmp 0x4c27b3
xor ecx, ecx
test eax, eax
jne 0x4c27d8
cmp dword [esp + 0x3c], eax
jne 0x4c27d8
cmp byte [esp + 0x1be8], al
je 0x4c27d8
test esi, esi
jne 0x4c27d8
cmp dword [esp + 0x44], esi
jne 0x4c27d8
test ebx, ebx
jne 0x4c27d8
test ecx, ecx
je 0x4c27e6
cmp dword [esp + 0x14], 0
je 0x4c27e6
cmp dword [esp + 0x74], 5
jne 0x4c27f1
cmp dword [esp + 0x1c], 1
jne 0x4c288f
mov eax, dword [esp + 0x48]
mov esi, 1
test eax, eax
je 0x4c2878
test edi, edi
je 0x4c2812
cmp byte [edi], 0
je 0x4c2812
push esi
push eax
push edi
call fcn.004e1620
add esp, 0xc
cmp dword [esp + 0x14], esi
jne 0x4c25aa
push 0x3ff
lea edx, [esp + 0x2bed]
push 0
push edx
mov byte [esp + 0x2bf4], 0
call fcn.005dfd60
add esp, 0xc
cmp dword [esp + 0x30], 0
jne 0x4c2861
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
push 0
lea ecx, [esp + 0x1f4]
push ecx
call fcn.00508b00
cmp eax, 1
je 0x4c286a
mov eax, dword [esp + 0x50]
cmp eax, 1
jne 0x4c28b5
cmp dword [esp + 0x24], 0
jne 0x4c28d9
xor esi, esi
jmp 0x4c25aa
test edi, edi
je 0x4c2812
cmp byte [edi], 0
je 0x4c2812
push 1
lea eax, [esp + 0x45f4]
jmp 0x4c2808
test edi, edi
je 0x4c25a6
cmp byte [edi], 0
je 0x4c25a6
mov ecx, dword [esp + 0x10]
push 1
push ecx
push edi
call fcn.004e1620
add esp, 0xc
jmp 0x4c25a6
test eax, eax
jne 0x4c291d
lea edx, [esp + 0x13e8]
push 0x641c98
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c291d
xor esi, esi
jmp 0x4c25aa
lea eax, [esp + 0x13e8]
push 0x61d3f4
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4c291d
cmp byte [esp + 0x9e0], al
je 0x4c291d
push eax
lea ecx, [esp + 0x9e4]
push str.Assembly_imported
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c291d
xor esi, esi
jmp 0x4c25aa
push str.unins
call fcn.004dd6c0
push eax
lea edx, [esp + 0x27f0]
push str.unins
push edx
call fcn.004dd670
add esp, 0x10
test eax, eax
jne 0x4c2948
xor esi, esi
jmp 0x4c25aa
lea eax, [esp + 0x2be8]
push eax
lea ecx, [esp + 0x1e4]
push 0
push ecx
call fcn.00506880
add esp, 0xc
test eax, eax
je 0x4c25aa
xor esi, esi
jmp 0x4c25aa
cmp dword [esp + 0x18], edi
je 0x4c297c
call fcn.00504780
mov ecx, dword [esp + 0x4df4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret