Function at 0x4286d0
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x4b93f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x2a4], ebx
mov dword [ebx + 0x5e0], 3
mov edi, dword [0x4c10bc]
mov eax, edi
mov edx, dword [0x4c10b8]
sub eax, edx
sar eax, 2
test eax, eax
je 0x428746
mov eax, dword [edx + esi*4]
cmp byte [eax + 0x24], 0
je 0x42873a
cmp byte [eax + 0x25], 0
je 0x42873a
cmp byte [eax + 0x29], 0
je 0x42873a
push eax
mov ecx, ebx
call fcn.0040e7e0
mov edi, dword [0x4c10bc]
mov edx, dword [0x4c10b8]
mov eax, edi
inc esi
sub eax, edx
sar eax, 2
cmp esi, eax
jb 0x428711
sub edi, edx
xor esi, esi
sar edi, 2
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x428793
push 5
call edi
mov ecx, dword [0x4c10b8]
mov eax, dword [ecx + esi*4]
cmp byte [eax + 0x24], 0
je 0x428784
cmp byte [eax + 0x25], 0
je 0x428784
cmp byte [eax + 0x29], 0
je 0x428784
push eax
mov ecx, ebx
call fcn.0040d4c0
mov ecx, dword [0x4c10b8]
mov eax, dword [0x4c10bc]
inc esi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x428757
push 0x32
call edi
mov ecx, ebx
call fcn.0041af60
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4287b3
push 0
push 0
push 0x10
push dword [ebx + 4]
call esi
cmp byte [0x4c103a], 0
je 0x428854
mov eax, dword [0x4c10a4]
lea edx, [ebp - 0x294]
mov dword [ebp - 0x298], 1
sub edx, eax
mov dword [ebp - 0x214], 0x64
mov dword [ebp - 0x210], 2
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4287f0
mov eax, dword [0x4bbed4]
lea edx, [ebp - 0x20c]
sub edx, eax
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x428810
lea eax, [ebp - 0x298]
mov dword [ebp - 0x2cc], 0x4a
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2cc]
push eax
push dword [ebx + 4]
mov dword [ebp - 0x2c8], 0x294
push 0x4a
push dword [0x4c1044]
call esi
call fcn.0041ca70
mov dword [ebp - 0x2e0], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x4298d1
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebx + 0x13c]
xor esi, esi
sub ecx, dword [ebx + 0x138]
mov dword [ebp - 0x2d0], esi
lea edi, [eax + 0x10]
mov eax, 0x2aaaaaab
imul ecx
mov dword [ebp - 0x2a8], edi
lea ebx, [esi - 1]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x429889
nop dword [eax]
mov edx, dword [ebp - 0x2a4]
lea ecx, [esi + esi*2]
shl ecx, 2
mov dword [ebp - 0x2bc], ecx
add ecx, dword [edx + 0x138]
cmp byte [ecx + 8], 0
jne 0x429853
mov eax, dword [ecx + 4]
cmp dword [eax - 0xc], 0
je 0x428b02
mov ebx, dword [ecx + 4]
lea eax, [ebp - 0x2cc]
push eax
push ecx
mov ecx, dword [ebx - 0x10]
lea esi, [ebx - 0x10]
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov eax, dword [ecx]
mov dword [ebp - 0x29c], esp
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x42892d
cmp ecx, dword [esi]
jne 0x42892d
lock inc dword [eax]
jmp 0x428966
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x4298e0
mov ecx, dword [edi]
mov dword [esi + 4], ecx
mov eax, dword [edi]
lea ecx, [eax*2 + 2]
push ecx
lea eax, [eax*2 + 2]
push ebx
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00437560
add esp, 0x10
mov ecx, dword [ebp - 0x29c]
lea eax, [esi + 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2a4]
call fcn.0040b940
mov eax, dword [ebp - 0x2c8]
xor edi, edi
mov ebx, dword [ebp - 0x2cc]
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x2b0], eax
test eax, eax
je 0x428a51
mov esi, ebx
mov dword [ebp - 0x2b4], esi
call fcn.00402250
test eax, eax
je 0x4298d1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push dword [esi]
add eax, 0x10
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2a4]
push dword [eax + 0x594]
lea eax, [ebp - 0x2ac]
push 0x4a649c
push eax
call fcn.0041ad10
mov esi, dword [ebp - 0x2ac]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x428a13
inc edi
cmp edi, 0x32
jle 0x428a0b
xor edi, edi
jmp 0x428a13
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x428a2b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x29c]
add dword [ebp - 0x2b4], 4
inc esi
cmp esi, dword [ebp - 0x2b0]
mov dword [ebp - 0x29c], esi
mov esi, dword [ebp - 0x2b4]
jb 0x4289b1
test ebx, ebx
je 0x428aff
mov edi, dword [ebp - 0x2c8]
mov esi, ebx
cmp ebx, edi
je 0x428a8e
or ebx, 0xffffffff
mov edx, dword [esi]
mov eax, ebx
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428a81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, edi
jne 0x428a68
mov ebx, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x2c4]
sub eax, ebx
sar eax, 2
cmp eax, 0x3fffffff
ja 0x4298db
shl eax, 2
cmp eax, 0x1000
jb 0x428ad8
test bl, 0x1f
jne 0x4298db
mov eax, dword [ebx - 4]
cmp eax, ebx
jae 0x4298db
sub ebx, eax
cmp ebx, 4
jb 0x4298db
cmp ebx, 0x23
ja 0x4298db
mov ebx, eax
push ebx
call fcn.00448f28
add esp, 4
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x2a4]
mov edi, dword [ebp - 0x2bc]
mov eax, dword [ecx + 0x138]
push dword [eax + edi]
lea eax, [ebp - 0x2a8]
push dword [ecx + 0x594]
push 0x4a656c
push eax
call fcn.0041ad10
mov eax, dword [ebp - 0x2a4]
add esp, 0x10
mov esi, dword [eax + 0x138]
mov eax, dword [esi + edi]
add esi, edi
mov edi, dword [eax - 0xc]
test edi, edi
js 0x4298e5
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x428b66
push edi
mov ecx, esi
call fcn.004024d0
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.0046b5d9
mov eax, dword [esi]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x4298e5
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [esi]
mov word [eax + edi*2], cx
mov ecx, str.tempmon
mov eax, dword [esi]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x428bb7
test dx, dx
je 0x428bb3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x428bb7
add eax, 4
add ecx, 4
test dx, dx
jne 0x428b91
xor eax, eax
jmp 0x428bbc
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x429836
mov eax, dword [ebp - 0x2a4]
mov esi, dword [eax + 0x138]
add esi, dword [ebp - 0x2bc]
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
test edi, edi
js 0x4298e5
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x428c01
push edi
mov ecx, esi
call fcn.004024d0
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.0046b5d9
mov eax, dword [esi]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x4298e5
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [esi]
mov word [eax + edi*2], cx
mov ecx, str.netmaster
mov eax, dword [esi]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x428c56
test dx, dx
je 0x428c52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x428c56
add eax, 4
add ecx, 4
test dx, dx
jne 0x428c30
xor eax, eax
jmp 0x428c5b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x429836
mov eax, dword [ebp - 0x2a4]
mov esi, dword [eax + 0x138]
add esi, dword [ebp - 0x2bc]
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
test edi, edi
js 0x4298e5
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or eax, ecx
jge 0x428ca0
push edi
mov ecx, esi
call fcn.004024d0
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.0046b5d9
mov eax, dword [esi]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x4298e5
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [esi]
mov word [eax + edi*2], cx
mov ecx, str.saayaa
mov eax, dword [esi]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x428cf6
test dx, dx
je 0x428cf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x428cf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x428cd0
xor eax, eax
jmp 0x428cfb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x429182
lea ecx, [ebp - 0x304]
call fcn.00408110
push ecx
mov ecx, esp
push str.explorer.exe
call fcn.00403710
push ecx
mov esi, esp
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.0044c180
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00403710
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x308]
call fcn.0042b620
mov ecx, dword [ebp - 0x2a4]
lea eax, [ebp - 0x2d8]
push eax
call fcn.0041d690
mov edi, dword [ebp - 0x2a8]
mov edx, dword [eax]
lea ebx, [edi - 0x10]
lea esi, [edx - 0x10]
cmp esi, ebx
je 0x428e2d
cmp dword [ebx + 0xc], 0
jl 0x428e18
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x428e18
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x428dba
cmp ecx, dword [esi]
jne 0x428dba
mov edi, esi
lock inc dword [eax]
jmp 0x428df6
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4298e0
mov ecx, dword [esi + 4]
lea eax, [esi + 0x10]
mov dword [edi + 4], ecx
mov edx, dword [esi + 4]
lea ecx, [edx*2 + 2]
push ecx
push eax
lea eax, [edx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00437560
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x428e0d
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0x10
mov dword [ebp - 0x2a8], edi
jmp 0x428e2d
push dword [edx - 0xc]
lea ecx, [ebp - 0x2a8]
push edx
call fcn.00402620
mov edi, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x2d8]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428e4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429128
mov eax, dword [ebp - 0x2b8]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x2b4], ecx
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x428e7b
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x428e8f
call fcn.00402250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x4298d1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x29c], esi
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x2ac], ecx
lea ebx, [ecx + 1]
test ebx, ebx
js 0x4298e5
mov ecx, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub ecx, ebx
or ecx, edx
jge 0x428ee2
push ebx
lea ecx, [ebp - 0x29c]
call fcn.004024d0
mov esi, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x2b8]
mov ebx, dword [ebp - 0x2ac]
add ebx, ebx
push ebx
push eax
push ebx
push esi
call fcn.00437560
push 2
push 0x4a4a84
lea eax, [ebx + esi]
push 2
push eax
call fcn.00437560
mov eax, dword [ebp - 0x2ac]
add esp, 0x20
inc eax
cmp eax, dword [esi - 8]
jg 0x4298e5
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [esi - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x2b0], eax
test ecx, ecx
je 0x428f39
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x428f4d
call fcn.00402250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x4298d1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [edi - 0xc]
add eax, 0x10
mov ebx, dword [esi - 0xc]
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x2a0], ebx
lea edx, [ebx + ecx]
test edx, edx
js 0x4298e5
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x428f97
push edx
lea ecx, [ebp - 0x29c]
call fcn.004024d0
add ebx, ebx
push ebx
push esi
mov esi, dword [ebp - 0x29c]
push ebx
push esi
call fcn.00437560
mov eax, dword [ebp - 0x2ac]
add eax, eax
push eax
push edi
push eax
lea eax, [ebx + esi]
push eax
call fcn.00437560
mov eax, dword [ebp - 0x2a0]
add esp, 0x20
add eax, dword [ebp - 0x2ac]
cmp eax, dword [esi - 8]
jg 0x4298e5
mov edx, dword [ebp - 0x2b0]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428ff8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x2b4]
push ecx
mov dword [ebp - 0x2b0], esp
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
mov ecx, eax
lea eax, [ebx + 0xc]
jl 0x429020
cmp ecx, dword [ebx]
jne 0x429020
lock inc dword [eax]
jmp 0x429066
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x4298e0
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 4]
mov ebx, dword [ebp - 0x2a0]
lea ecx, [edx*2 + 2]
push ecx
push eax
lea eax, [edx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.00437560
add esp, 0x10
mov ecx, dword [ebp - 0x2b0]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [ebp - 0x308]
call fcn.0041cfd0
add esi, 0xfffffff0
push dword [eax]
push ecx
mov ecx, dword [esi]
mov dword [ebp - 0x2a0], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x4290ac
cmp ecx, dword [esi]
jne 0x4290ac
mov ebx, esi
lock inc dword [eax]
jmp 0x4290e1
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x4298e0
mov ecx, dword [esi + 4]
lea eax, [esi + 0x10]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push ecx
lea eax, [ebx + 0x10]
push eax
call fcn.00437560
add esp, 0x10
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebx + 0x10]
mov dword [ecx], eax
call fcn.0043d150
mov edx, dword [ebp - 0x2dc]
or ebx, 0xffffffff
add esp, 8
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429114
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429128
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2b8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429145
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2f4]
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov esi, dword [edx]
je 0x42974b
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x42976e
cmp dword [eax - 8], 0
jl 0x4298e5
xor ecx, ecx
mov dword [eax - 0xc], 0
mov word [eax], cx
jmp 0x42974b
mov eax, dword [ebp - 0x2a4]
mov edi, dword [ebp - 0x2bc]
mov esi, dword [eax + 0x138]
add esi, edi
cmp byte [esi + 9], 0
je 0x42978d
cmp dword [ebp - 0x2e0], 0x13
jl 0x42978d
lea ecx, [ebp - 0x304]
call fcn.00408110
push ecx
mov ecx, esp
push str.explorer.exe
call fcn.00403710
push ecx
mov esi, esp
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.0044c180
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00403710
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x308]
call fcn.0042b620
mov edx, dword [ebp - 0x2a4]
push str.mytime
mov eax, dword [edx + 0x138]
push dword [eax + edi]
call fcn.0046b1da
add esp, 8
test eax, eax
jne 0x429430
lea ecx, [ebp - 0x320]
call fcn.00408110
push str.SoftwareRuanMeiMyTime
lea ecx, [ebp - 0x2d4]
call fcn.00403710
mov esi, dword [ebp - 0x2d4]
push 1
push ecx
mov dword [ebp - 0x318], VariantClear
mov ebx, esp
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x429284
cmp ecx, dword [esi - 0x10]
jne 0x429284
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x4292bd
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4298e0
mov ecx, dword [esi - 0xc]
mov dword [edi + 4], ecx
mov edx, dword [esi - 0xc]
lea ecx, [edx*2 + 2]
push ecx
lea eax, [edx*2 + 2]
push esi
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00437560
add esp, 0x10
lea eax, [edi + 0x10]
lea ecx, [ebp - 0x320]
mov dword [ebx], eax
call fcn.00430ea0
mov edx, dword [ebp - 0x2d4]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4292ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push 0x4a1628
call fcn.00403710
push ecx
mov ecx, esp
push str.Install_Dir
call fcn.00403710
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x320]
call fcn.0042c9f0
mov esi, dword [ebp - 0x2c0]
cmp dword [esi - 0xc], 0
je 0x4293b3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4293b3
push ecx
mov ecx, esp
push str.mytime.exe
call fcn.00403710
push ecx
add esi, 0xfffffff0
mov edi, esp
push esi
call fcn.00403380
add eax, 0x10
lea ecx, [ebp - 0x308]
add esp, 4
mov dword [edi], eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.0042b620
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00409a20
mov edx, dword [ebp - 0x2e4]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429390
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x2c0]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4293b3
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00409a20
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4293ca
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x310]
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov esi, dword [edx]
je 0x429419
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x4293fc
cmp dword [eax - 8], 0
jl 0x4298e5
xor ecx, ecx
mov dword [eax - 0xc], 0
mov word [eax], cx
jmp 0x429419
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42940f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429430
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x2e8]
mov ecx, dword [edi - 0x10]
lea eax, [edi - 0x10]
mov dword [ebp - 0x2b4], eax
test ecx, ecx
je 0x42944f
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x429463
call fcn.00402250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x4298d1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ebx, dword [edi - 0xc]
mov dword [ebp - 0x2a0], ebx
lea esi, [eax + 0x10]
lea edx, [ebx + 1]
mov dword [ebp - 0x29c], esi
test edx, edx
js 0x4298e5
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4294aa
push edx
lea ecx, [ebp - 0x29c]
call fcn.004024d0
mov esi, dword [ebp - 0x29c]
add ebx, ebx
push ebx
push edi
push ebx
push esi
call fcn.00437560
push 2
push 0x4a4a84
lea eax, [ebx + esi]
push 2
push eax
call fcn.00437560
mov eax, dword [ebp - 0x2a0]
add esp, 0x20
inc eax
cmp eax, dword [esi - 8]
jg 0x4298e5
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea eax, [esi - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x2b0], eax
test ecx, ecx
je 0x4294fb
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x42950f
call fcn.00402250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x4298d1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov edi, dword [ebp - 0x2a8]
add eax, 0x10
mov ebx, dword [esi - 0xc]
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x2a0], ebx
mov ecx, dword [edi - 0xc]
mov dword [ebp - 0x2ac], ecx
lea edx, [ebx + ecx]
test edx, edx
js 0x4298e5
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x42955f
push edx
lea ecx, [ebp - 0x29c]
call fcn.004024d0
add ebx, ebx
push ebx
push esi
mov esi, dword [ebp - 0x29c]
push ebx
push esi
call fcn.00437560
mov eax, dword [ebp - 0x2ac]
add eax, eax
push eax
push edi
push eax
lea eax, [ebx + esi]
push eax
call fcn.00437560
mov eax, dword [ebp - 0x2a0]
add esp, 0x20
add eax, dword [ebp - 0x2ac]
cmp eax, dword [esi - 8]
jg 0x4298e5
mov edx, dword [ebp - 0x2b0]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4295c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x2b4]
push ecx
mov dword [ebp - 0x2a0], esp
mov ecx, dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x4295ea
cmp ecx, dword [ebx]
jne 0x4295ea
mov eax, ebx
lock inc dword [edx]
jmp 0x429636
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov dword [ebp - 0x29c], eax
test eax, eax
je 0x4298e0
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 4]
lea ecx, [edx*2 + 2]
push ecx
push eax
lea eax, [edx*2 + 2]
push eax
mov eax, dword [ebp - 0x29c]
add eax, 0x10
push eax
call fcn.00437560
mov eax, dword [ebp - 0x29c]
add esp, 0x10
mov ecx, dword [ebp - 0x2a0]
add eax, 0x10
mov dword [ecx], eax
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x308]
call fcn.0041cfd0
add esi, 0xfffffff0
push dword [eax]
push ecx
mov ecx, dword [esi]
mov dword [ebp - 0x2b0], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x42967c
cmp ecx, dword [esi]
jne 0x42967c
mov eax, esi
lock inc dword [edx]
jmp 0x4296bd
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x2a0], edx
test edx, edx
je 0x4298e0
mov ecx, dword [esi + 4]
lea eax, [esi + 0x10]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push ecx
lea eax, [edx + 0x10]
push eax
call fcn.00437560
mov eax, dword [ebp - 0x2a0]
add esp, 0x10
mov ecx, dword [ebp - 0x2b0]
add eax, 0x10
mov dword [ecx], eax
call fcn.0043d150
mov edx, dword [ebp - 0x2ec]
add esp, 8
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4296ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429703
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x429718
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2f4]
cmp dword [eax - 0xc], 0
lea edx, [eax - 0x10]
mov esi, dword [edx]
je 0x429748
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x42976b
cmp dword [eax - 8], 0
jl 0x4298e5
xor ecx, ecx
mov dword [eax - 0xc], 0
mov word [eax], cx
or ebx, 0xffffffff
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x429853
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x429853
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x429781
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
jmp 0x42974b
mov eax, dword [esi]
mov edi, dword [eax - 0xc]
test edi, edi
js 0x4298e5
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4297b3
push edi
mov ecx, esi
call fcn.004024d0
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.0046b5d9
mov eax, dword [esi]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x4298e5
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [esi]
mov word [eax + edi*2], cx
mov ecx, str.pcmaster
mov eax, dword [esi]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x429806
test dx, dx
je 0x429802
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x429806
add eax, 4
add ecx, 4
test dx, dx
jne 0x4297e0
xor eax, eax
jmp 0x42980b
sbb eax, eax
or eax, 1
mov edi, dword [ebp - 0x2a8]
push 5
push 0
test eax, eax
jne 0x42982f
mov eax, dword [ebp - 0x2a4]
cmp byte [eax + 0x5dd], 0
jne 0x42982f
push str._fromrmup__hide
jmp 0x429845
push str._fromrmup
jmp 0x429845
mov edi, dword [ebp - 0x2a8]
push 5
push 0
push str.__tray
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x2a4]
inc dword [ebp - 0x2d0]
mov esi, dword [ebp - 0x2d0]
mov ecx, dword [eax + 0x13c]
sub ecx, dword [eax + 0x138]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x4288b0
cmp byte [0x4c103c], 0
je 0x4298a7
mov eax, dword [ebp - 0x2a4]
push 0
push 0
push 0x10
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4298bc
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004495f3
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402080
call fcn.00454ed1
call fcn.004026d0
push 0x80070057
call fcn.00402080
int3