Function at 0x402e60
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f4
mov eax, dword [0x427024]
xor eax, esp
mov dword [esp + 0x1f0], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x190]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edi
call fcn.00411170
push 0x64
call fcn.00415b51
cmp dword [esp + 0x1b4], 0x10
lea ecx, [esp + 0x1a0]
cmovae ecx, dword [esp + 0x1a0]
sub esp, 8
push ecx
mov ecx, eax
call fcn.0040a870
mov esi, eax
mov eax, dword [0x427710]
test eax, eax
jne 0x402ef3
push 0x1c
call fcn.00415b51
xorps xmm0, xmm0
add esp, 4
mov ecx, eax
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
call fcn.0040bc50
mov dword [0x427710], eax
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 0x10]
call fcn.004066a0
call fcn.00406800
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push dword [esp + 0x28]
push str.process_session_id__d
push 0x41a650
call fcn.004027d0
add esp, 0xc
cmp dword [esp + 0x28], 0
jne 0x402fc9
call fcn.00409f30
mov esi, eax
push esi
push str.Received_session_id__d
push 0x41a650
call fcn.004027d0
add esp, 0xc
cmp esi, 0xffffffff
je 0x402fb7
mov ecx, esi
call fcn.0040b930
mov esi, eax
test esi, esi
je 0x402fc9
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov ecx, esi
call fcn.0040bb30
add esp, 0xc
test al, al
je 0x402fa6
push str.self_re_launch:_success____
push 0x41a650
call fcn.004027d0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.self_re_launch:_fail____
push 0x41a650
call fcn.004027d0
jmp 0x402fc6
push str.possible_launch_from_msi.
push 0x41a650
call fcn.00402740
add esp, 8
push 0
xor bl, bl
mov byte [esp + 0x15], 0
push 0x41a5e1
lea ecx, [esp + 0xe0]
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], 0
mov byte [esp + 0xe0], bl
call fcn.00405620
push 0
push 0x41a5e1
mov ecx, 0x427720
call fcn.00405620
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403014
sub edi, ecx
sar edi, 1
lea esi, [edi + 1]
push esi
call fcn.00415dff
add esp, 4
mov dword [esp + 0x28], eax
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [esp + 0x34]
add esp, 0xc
push edi
push dword [esp + 0x30]
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
add esp, 0xc
xor edi, edi
push 0x41a6d0
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov esi, eax
add esp, 8
test esi, esi
je 0x403195
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test edi, edi
jne 0x4030cf
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push str.token0:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
cmp byte [esi], 0
jne 0x4030ae
xor ecx, ecx
push ecx
push esi
lea ecx, [esp + 0xe0]
call fcn.00405620
jmp 0x403175
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4030b3
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0xe0]
call fcn.00405620
jmp 0x403175
cmp edi, 1
jne 0x40311b
push esi
push str.token1:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
cmp byte [esi], 0
jne 0x4030ff
xor ecx, ecx
push ecx
push esi
mov ecx, 0x427720
call fcn.00405620
jmp 0x403175
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403104
sub ecx, edx
push ecx
push esi
mov ecx, 0x427720
call fcn.00405620
jmp 0x403175
cmp edi, 2
jne 0x403147
push esi
call eax
add esp, 4
mov esi, eax
push esi
push str.token2:__d
push 0x41a650
call fcn.004027d0
add esp, 0xc
cmp esi, 1
jne 0x403175
mov byte [esp + 0x11], 1
jmp 0x403175
cmp edi, 3
jne 0x403175
push esi
call eax
add esp, 4
mov esi, eax
push esi
push str.token3:__d
push 0x41a650
call fcn.004027d0
add esp, 0xc
movzx ebx, bl
cmp esi, 1
mov eax, 1
cmove ebx, eax
push 0x41a6d0
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov esi, eax
add esp, 8
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
inc edi
test esi, esi
jne 0x403072
push dword [esp + 0x28]
call fcn.00415b4c
add esp, 4
mov dword [esp + 0xa4], 0xf
lea ecx, [esp + 0x90]
mov dword [esp + 0xa0], 0
mov byte [esp + 0x90], 0
push 0
push 0x41a5e1
call fcn.00405620
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x4c], 0xf
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.00405720
push 1
sub esp, 8
lea ecx, [esp + 0x3c]
call fcn.004055b0
test eax, eax
jle 0x40324d
lea ecx, [eax + 1]
cmp dword [esp + 0x40], ecx
jae 0x403222
push str.invalid_string_position
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
cmp dword [esp + 0x44], 0x10
lea eax, [esp + 0x30]
mov dword [esp + 0x40], ecx
cmovae eax, dword [esp + 0x30]
push 0xffffffffffffffff
push 0
mov byte [eax + ecx], 0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x9c]
call fcn.00405720
push 0xb
push str.license.txt
lea ecx, [esp + 0x38]
call fcn.00405840
push 7
push str.log.csv
lea ecx, [esp + 0x98]
call fcn.00405840
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x168]
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
push ecx
push eax
mov byte [esp + 0x1a], 0
call edi
add esp, 8
test eax, eax
jne 0x4032cf
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
push ecx
push eax
call edi
xor ecx, ecx
add esp, 8
test eax, eax
cmove ecx, dword [esp + 0x17c]
test ecx, ecx
setg byte [esp + 0x12]
jmp 0x4034f5
push 0
push 0x41a5e1
lea ecx, [esp + 0x98]
call fcn.00405620
test bl, bl
je 0x4034f5
push str.SOFTWAREPoliciesWindows_ProvisioningPath
lea ecx, [esp + 0xac]
call fcn.00404f00
cmp dword [esp + 0xbc], 8
lea ecx, [esp + 0x24]
push ecx
push 0x201
lea eax, [esp + 0xb0]
mov dword [esp + 0x2c], 0
cmovae eax, dword [esp + 0xb0]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push str.open_reg:__d
push 0x41a650
call fcn.004027d0
mov eax, dword [esp + 0x30]
add esp, 0xc
test eax, eax
je 0x40349d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
push 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0
push ecx
push 0
push 0x41a778
push eax
mov dword [esp + 0x40], 0
call ebx
push dword [esp + 0x1c]
push str.len_lic_path:__d
push 0x41a650
call fcn.004027d0
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x4033f6
inc eax
push eax
call fcn.00415dff
mov ecx, dword [esp + 0x20]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x30]
push eax
push 0
push 0x41a778
push dword [esp + 0x38]
call ebx
push esi
lea ecx, [esp + 0x34]
call fcn.00404f60
push esi
push str.License_path:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
push esi
call fcn.00415b4c
add esp, 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0
lea eax, [esp + 0x30]
push eax
push 0
push str.Status
push dword [esp + 0x38]
call ebx
push dword [esp + 0x20]
push str.len_status_path:__d
push 0x41a650
call fcn.004027d0
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
je 0x403493
inc eax
push eax
call fcn.00415dff
mov ecx, dword [esp + 0x24]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x30]
push eax
push 0
push str.Status
push dword [esp + 0x38]
call ebx
push esi
lea ecx, [esp + 0x94]
call fcn.00404f60
push esi
push str.Status_path:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
push esi
call fcn.00415b4c
add esp, 4
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
push ecx
push eax
call edi
test eax, eax
sete al
movzx eax, al
push eax
push str.License_file_exists:__d
push 0x41a650
call fcn.004027d0
mov eax, dword [esp + 0xd0]
add esp, 0x14
mov byte [esp + 0x12], 1
mov byte [esp + 0x11], 1
cmp eax, 8
jb 0x4034f5
inc eax
push eax
push dword [esp + 0xac]
call fcn.00405b30
push 0x88
mov byte [esp + 0x17], 0
call fcn.00415b51
add esp, 4
mov esi, eax
push 0x88
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov ecx, esi
call fcn.00410b40
mov esi, eax
mov ecx, esi
call fcn.00411550
push 2
lea eax, [esp + 0x154]
mov ecx, esi
push eax
call fcn.00411200
push 3
lea eax, [esp + 0x13c]
mov ecx, esi
push eax
call fcn.00411200
cmp dword [esp + 0x164], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x150]
cmovae eax, dword [esp + 0x150]
push ecx
push eax
call edi
add esp, 8
test eax, eax
je 0x40359d
cmp dword [esp + 0x14c], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x138]
cmovae eax, dword [esp + 0x138]
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4035a2
mov byte [esp + 0x13], 1
test esi, esi
je 0x4035bb
mov ecx, esi
call fcn.00410f40
push 0x88
push esi
call fcn.00415df1
add esp, 8
push str.create_stealth_manager
push 0x41a650
call fcn.004027d0
push 0x88
call fcn.00415b51
add esp, 0xc
mov esi, eax
push 0x88
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov ecx, esi
call fcn.00410b40
push str.load_name_map
push 0x41a650
mov ebx, eax
call fcn.004027d0
add esp, 8
mov ecx, ebx
call fcn.004120e0
push str.get_filename
push 0x41a650
call fcn.004027d0
add esp, 8
lea eax, [esp + 0x120]
mov ecx, ebx
push 2
push eax
call fcn.00411200
push 3
lea eax, [esp + 0x10c]
mov ecx, ebx
push eax
call fcn.00411200
cmp byte [esp + 0x12], 0
jne 0x403c07
cmp dword [esp + 0xe8], 3
jbe 0x403670
cmp dword [esp + 0xec], 0x10
lea ecx, [esp + 0xd8]
cmovae ecx, dword [esp + 0xd8]
call fcn.0040d020
cmp dword [esp + 0x134], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x120]
cmovae eax, dword [esp + 0x120]
push ecx
push eax
call edi
add esp, 8
test eax, eax
je 0x403b88
cmp dword [esp + 0x11c], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x108]
cmovae eax, dword [esp + 0x108]
push ecx
push eax
call edi
add esp, 8
test eax, eax
je 0x403b88
cmp byte [esp + 0x13], 0
jne 0x403b88
cmp byte [esp + 0x11], 0
je 0x40376d
push str.install_silent_mode
push 0x41a650
call fcn.004027d0
push 0x40
call fcn.00415dff
add esp, 0xc
mov esi, eax
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 1
push str._s_d
push esi
call fcn.00402530
add esp, 0xc
lea ecx, [esp + 0xf0]
push esi
call fcn.00405120
push esi
call fcn.00415b4c
add esp, 4
lea edx, [esp + 0xf0]
lea ecx, [esp + 0xa8]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x403749
mov eax, dword [eax]
mov ecx, eax
call fcn.004029d0
lea ecx, [esp + 0xa8]
call fcn.00404ec0
lea ecx, [esp + 0xf0]
call fcn.00404fe0
jmp 0x40435c
push 0x427720
lea ecx, [esp + 0x4c]
call fcn.00405180
cmp dword [esp + 0x5c], 0x10
lea ecx, [esp + 0x48]
mov eax, dword [esp + 0x58]
cmovae ecx, dword [esp + 0x48]
cmp byte [ecx + eax - 1], 0x5c
je 0x4037a2
push 0x41a704
lea ecx, [esp + 0x4c]
call fcn.00404fa0
push str.version.txt
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x7c]
call fcn.00406430
add esp, 4
lea ecx, [esp + 0x60]
push 0x41a5e1
call fcn.00405120
cmp dword [esp + 0x8c], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x78]
cmovae eax, dword [esp + 0x78]
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x40386b
cmp dword [esp + 0x8c], 0x10
lea ecx, [esp + 0x78]
cmovae ecx, dword [esp + 0x78]
call fcn.0040cf80
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
je 0x40385c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
test eax, eax
je 0x40385c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
lea esi, [eax + 1]
push esi
call fcn.00415dff
add esp, 4
mov edi, eax
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x34]
add esp, 0xc
mov edx, dword [edx]
push esi
mov esi, dword [esp + 0x2c]
mov ecx, esi
push edi
call dword [edx + 0x18]
push edi
lea ecx, [esp + 0x64]
call fcn.00404f60
push edi
call fcn.00415b4c
add esp, 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push 0x41a5e1
lea ecx, [esp + 0x1e8]
call fcn.00405120
push 0x41a5e1
lea ecx, [esp + 0x1d0]
call fcn.00405120
push 0x41a5e1
lea ecx, [esp + 0x1b8]
call fcn.00405120
sub esp, 0x18
mov ecx, esp
push 0x41a61c
call fcn.00405120
sub esp, 0x18
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.00405180
lea ecx, [esp + 0x120]
call fcn.0040c580
add esp, 0x30
lea ecx, [esp + 0x60]
push eax
call fcn.00405020
lea ecx, [esp + 0xf0]
call fcn.00404fe0
sub esp, 0x18
lea eax, [esp + 0x78]
mov ecx, esp
push eax
call fcn.00405180
lea ecx, [esp + 0x108]
call fcn.0040c440
add esp, 0x18
lea ecx, [esp + 0x60]
push eax
call fcn.00405020
lea ecx, [esp + 0xf0]
call fcn.00404fe0
mov eax, dword [esp + 0x70]
inc eax
push eax
call fcn.00415dff
mov ecx, dword [esp + 0x74]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x60]
cmp dword [esp + 0x74], 0x10
mov edx, esi
cmovae ecx, dword [esp + 0x60]
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x403950
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
push 0x41a618
push esi
call edi
add esp, 8
test eax, eax
je 0x4039ba
push eax
lea ecx, [esp + 0x1e8]
call fcn.00404f60
push 0x41a618
push 0
call edi
add esp, 8
test eax, eax
je 0x4039ba
push eax
lea ecx, [esp + 0x1d0]
call fcn.00404f60
push 0x41a618
push 0
call edi
add esp, 8
test eax, eax
je 0x4039ba
push eax
lea ecx, [esp + 0x1b8]
call fcn.00404f60
push esi
call fcn.00415b4c
add esp, 4
lea eax, [esp + 0x1e4]
mov ecx, 0x427738
push 0xffffffffffffffff
push 0
push eax
call fcn.00405720
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1d4]
mov ecx, 0x427750
push eax
call fcn.00405720
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1bc]
mov ecx, 0x427768
push eax
call fcn.00405720
push 0
lea eax, [esp + 0xc4]
mov dword [esp + 0xc4], 1
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0xcc], 0
push eax
mov dword [esp + 0xd4], 0
mov dword [esp + 0xd8], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push str.Display_dialog
push 0x41a650
call fcn.004027d0
mov eax, dword [esp + 0x1c]
add esp, 8
mov dword [0x427670], eax
call fcn.00402990
lea ecx, [esp + 0xa8]
mov dword [0x427674], eax
call fcn.00402a10
cmp dword [esp + 0xb8], 4
jbe 0x403ac2
push str.version
mov ecx, 0x427780
call fcn.00404e20
lea edx, [esp + 0xa8]
lea ecx, [esp + 0xf0]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x403aab
mov eax, dword [eax]
push eax
mov ecx, 0x427780
call fcn.00404e70
lea ecx, [esp + 0xf0]
call fcn.00404ec0
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6c
push dword [0x427674]
call esi
push 0x6a
push dword [0x427674]
mov dword [0x427640], eax
call esi
push 5
push 0x3ea
push dword [0x427674]
mov dword [0x42766c], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x403b28
push eax
push dword [0x427674]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403b28
push 0
push 0x4069a0
push 0
push eax
push dword [0x427670]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
test eax, eax
jg 0x403b2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
lea ecx, [esp + 0xa8]
call fcn.00404fe0
lea ecx, [esp + 0x1b4]
call fcn.00404fe0
lea ecx, [esp + 0x1cc]
call fcn.00404fe0
lea ecx, [esp + 0x1e4]
call fcn.00404fe0
lea ecx, [esp + 0x60]
call fcn.00404fe0
lea ecx, [esp + 0x78]
call fcn.00404fe0
lea ecx, [esp + 0x48]
call fcn.00404fe0
jmp 0x40435c
cmp dword [0x427730], 0
jbe 0x40435c
push str.install_replace
push 0x41a650
call fcn.004027d0
add esp, 8
mov ecx, ebx
call fcn.00412ae0
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push 4
push eax
call fcn.00411200
call fcn.00412b50
mov eax, esp
mov ecx, ebx
push 0x11
push eax
call fcn.00411200
call fcn.00412b50
add esp, 0x18
call fcn.00414570
call fcn.00414320
call fcn.004145c0
cmp byte [esp + 0x11], 0
jne 0x403bf8
xor ecx, ecx
call fcn.004029d0
jmp 0x40435c
mov ecx, str._s1
call fcn.004029d0
jmp 0x40435c
push str.Do_auto_install_and_activate
push 0x41a650
call fcn.004027d0
add esp, 8
lea eax, [esp + 0x48]
mov ecx, ebx
push str._version.txt
push 6
push eax
call fcn.00411200
mov edx, eax
lea ecx, [esp + 0xf4]
call fcn.004063e0
mov eax, dword [esp + 0x60]
add esp, 4
cmp eax, 0x10
jb 0x403c51
inc eax
push eax
push dword [esp + 0x4c]
call fcn.00405b90
sub esp, 0x18
mov dword [esp + 0x3c], 0
mov ecx, esp
mov dword [esp + 0x38], 0
lea eax, [esp + 0x108]
mov dword [esp + 0x34], 0
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00405720
lea eax, [esp + 0x34]
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x40]
call fcn.00402b00
add esp, 0x1c
lea ecx, [esp + 0xa8]
mov edx, 0x427720
push str._version.txt
call fcn.00406430
sub esp, 0x14
mov dword [esp + 0x2c], 0
mov ecx, esp
mov dword [esp + 0x40], 0
lea eax, [esp + 0xc0]
mov dword [esp + 0x44], 0
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00405720
lea eax, [esp + 0x44]
push eax
lea edx, [esp + 0x44]
lea ecx, [esp + 0x30]
call fcn.00402b00
mov eax, dword [esp + 0x40]
add esp, 0x1c
mov esi, dword [esp + 0x2c]
cdq
mov ecx, eax
mov eax, dword [esp + 0x14]
xor ecx, edx
sub ecx, edx
cdq
push esi
push dword [esp + 0x2c]
xor eax, edx
mov dword [esp + 0x2c], ecx
sub eax, edx
push eax
push dword [esp + 0x28]
mov dword [esp + 0x24], eax
push dword [esp + 0x30]
push ecx
push str.Old_Version:__d._d._d__New_Version:__d._d._d
push 0x41a650
call fcn.004027d0
mov eax, dword [esp + 0x44]
add esp, 0x20
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jg 0x404158
jne 0x404141
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jg 0x404158
jne 0x404141
mov eax, dword [esp + 0x1c]
cmp esi, eax
jg 0x404158
jne 0x404141
push 0xf0001
push 0
push 0
mov byte [esp + 0x34], 1
mov byte [esp + 0x2c], 1
mov byte [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x404123
push 0xa
lea eax, [esp + 0x7c]
mov ecx, ebx
push eax
call fcn.00411200
cmp dword [esp + 0x88], 0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x403e81
cmp dword [esp + 0x8c], 0x10
lea eax, [esp + 0x78]
cmovae eax, dword [esp + 0x78]
push eax
push str.Open_service:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
lea edx, [esp + 0x78]
lea ecx, [esp + 0x48]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x403e11
mov eax, dword [eax]
push 0xa0000000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x48]
mov dword [esp + 0x2c], eax
call fcn.00404ec0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x403e38
push eax
call esi
jmp 0x403e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x8c], 0x10
lea ecx, [esp + 0x78]
mov esi, eax
cmovae ecx, dword [esp + 0x78]
push esi
push ecx
push str.Cannot_open_service___s___error_code:__d
push 0x41a650
call fcn.00402740
mov eax, dword [esp + 0x38]
xor ecx, ecx
add esp, 0x10
movzx eax, al
cmp esi, 0x424
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmove eax, ecx
mov dword [esp + 0x28], eax
push 4
lea eax, [esp + 0xc4]
mov ecx, ebx
push eax
call fcn.00411200
cmp dword [esp + 0xd0], 0
je 0x403f52
cmp dword [esp + 0xd4], 0x10
lea eax, [esp + 0xc0]
cmovae eax, dword [esp + 0xc0]
push eax
push str.Open_service:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
lea edx, [esp + 0xc0]
lea ecx, [esp + 0x48]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x403ee2
mov eax, dword [eax]
push 0xa0000000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x48]
mov dword [esp + 0x2c], eax
call fcn.00404ec0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x403f09
push eax
call esi
jmp 0x403f52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0xd4], 0x10
lea ecx, [esp + 0xc0]
mov esi, eax
cmovae ecx, dword [esp + 0xc0]
push esi
push ecx
push str.Cannot_open_service___s___error_code:__d
push 0x41a650
call fcn.00402740
mov eax, dword [esp + 0x30]
xor ecx, ecx
add esp, 0x10
movzx eax, al
cmp esi, 0x424
cmove eax, ecx
mov dword [esp + 0x20], eax
push 0x11
lea eax, [esp + 0x64]
mov ecx, ebx
push eax
call fcn.00411200
cmp dword [esp + 0x70], 0
je 0x404008
cmp dword [esp + 0x74], 0x10
lea eax, [esp + 0x60]
cmovae eax, dword [esp + 0x60]
push eax
push str.Open_service:__s
push 0x41a650
call fcn.004027d0
add esp, 0xc
lea edx, [esp + 0x60]
lea ecx, [esp + 0x48]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x403fa1
mov eax, dword [eax]
push 0xa0000000
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x48]
mov esi, eax
call fcn.00404ec0
test esi, esi
je 0x403fc8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x40400e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x74], 0x10
lea ecx, [esp + 0x60]
mov esi, eax
cmovae ecx, dword [esp + 0x60]
push esi
push ecx
push str.Cannot_open_service___s___error_code:__d
push 0x41a650
call fcn.00402740
mov eax, dword [esp + 0x2c]
xor ecx, ecx
add esp, 0x10
movzx eax, al
cmp esi, 0x424
cmove eax, ecx
mov dword [esp + 0x1c], eax
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
cmp byte [esp + 0x28], 0
je 0x40402a
cmp byte [esp + 0x20], 0
je 0x40402a
cmp byte [esp + 0x1c], 0
jne 0x404100
cmp dword [0x427730], 0
jbe 0x404100
mov ecx, ebx
call fcn.00412ac0
mov ecx, ebx
call fcn.00412ae0
mov ecx, ebx
call fcn.00412aa0
call fcn.00414570
call fcn.00414320
call fcn.004145c0
push 0x400
call fcn.00415dff
add esp, 4
mov esi, eax
push 0x400
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x90]
cmp dword [esp + 0xa4], 0x10
lea eax, [esp + 0x30]
cmovae ecx, dword [esp + 0x90]
cmp dword [esp + 0x44], 0x10
push ecx
cmovae eax, dword [esp + 0x34]
push eax
xor eax, eax
cmp byte [esp + 0x19], al
setne al
push eax
push str._s_d__k_s__p_s
push esi
call fcn.00402530
add esp, 0x14
lea ecx, [esp + 0x48]
push esi
call fcn.00405120
push esi
call fcn.00415b4c
add esp, 4
lea edx, [esp + 0x48]
lea ecx, [esp + 0x168]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x4040e4
mov eax, dword [eax]
mov ecx, eax
call fcn.004029d0
lea ecx, [esp + 0x168]
call fcn.00404ec0
lea ecx, [esp + 0x48]
call fcn.00404fe0
lea ecx, [esp + 0x60]
call fcn.00404fe0
lea ecx, [esp + 0xc0]
call fcn.00404fe0
lea ecx, [esp + 0x78]
call fcn.00404fe0
jmp 0x40430a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_open_OpenSCManager_error_code__d
push 0x41a650
call fcn.00402740
add esp, 0xc
jmp 0x40430a
push str.Do_not_auto_install.__Application_has_installed_already_
push 0x41a650
call fcn.004027d0
add esp, 8
jmp 0x40430a
cmp dword [esp + 0x134], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x120]
cmovae eax, dword [esp + 0x120]
push ecx
push eax
call edi
add esp, 8
test eax, eax
je 0x4041aa
cmp dword [esp + 0x11c], 0x10
lea ecx, [esp + 0x168]
lea eax, [esp + 0x108]
cmovae eax, dword [esp + 0x108]
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4041f7
cmp dword [0x427730], 0
jbe 0x4041f7
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push 4
push eax
call fcn.00411200
call fcn.00412b50
add esp, 0x18
mov ecx, ebx
call fcn.00412ae0
sub esp, 0x18
mov ecx, ebx
mov eax, esp
push 0x11
push eax
call fcn.00411200
call fcn.00412b50
add esp, 0x18
call fcn.00414570
call fcn.00414320
call fcn.004145c0
push 0x400
call fcn.00415dff
add esp, 4
mov esi, eax
push 0x400
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x90]
cmp dword [esp + 0xa4], 0x10
lea eax, [esp + 0x30]
cmovae ecx, dword [esp + 0x90]
cmp dword [esp + 0x44], 0x10
push ecx
cmovae eax, dword [esp + 0x34]
push eax
xor eax, eax
cmp byte [esp + 0x19], al
setne al
push eax
push str._s_d__k_s__p_s
push esi
call fcn.00402530
add esp, 0x14
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
cmp byte [esi], 0
jne 0x404273
xor ecx, ecx
jmp 0x404281
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404278
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x50]
call fcn.00405620
push esi
call fcn.00415b4c
add esp, 4
lea edx, [esp + 0x48]
lea ecx, [esp + 0x78]
call fcn.0040c1f0
cmp dword [eax + 0x14], 8
jb 0x4042aa
mov eax, dword [eax]
push 0
push 0
push eax
push str.main_installer.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x427730], 0
jbe 0x4042df
cmp dword [0x427734], 0x10
mov ecx, 0x427720
cmovae ecx, dword [0x427720]
call fcn.0040d380
mov eax, dword [esp + 0x8c]
cmp eax, 8
jb 0x4042f6
inc eax
push eax
push dword [esp + 0x7c]
call fcn.00405b30
mov eax, dword [esp + 0x5c]
cmp eax, 0x10
jb 0x40430a
inc eax
push eax
push dword [esp + 0x4c]
call fcn.00405b90
mov eax, dword [esp + 0xbc]
cmp eax, 0x10
jb 0x404324
inc eax
push eax
push dword [esp + 0xac]
call fcn.00405b90
mov eax, dword [esp + 0x104]
mov dword [esp + 0xbc], 0xf
mov dword [esp + 0xb8], 0
mov byte [esp + 0xa8], 0
cmp eax, 0x10
jb 0x40435c
inc eax
push eax
push dword [esp + 0xf4]
call fcn.00405b90
test ebx, ebx
je 0x404375
mov ecx, ebx
call fcn.00410f40
push 0x88
push ebx
call fcn.00415df1
add esp, 8
call fcn.004068c0
mov ecx, dword [0x427710]
test ecx, ecx
je 0x404395
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [0x427710], 0
mov eax, dword [esp + 0x11c]
cmp eax, 0x10
jb 0x4043af
inc eax
push eax
push dword [esp + 0x10c]
call fcn.00405b90
mov eax, dword [esp + 0x134]
mov dword [esp + 0x11c], 0xf
mov dword [esp + 0x118], 0
mov byte [esp + 0x108], 0
cmp eax, 0x10
jb 0x4043e7
inc eax
push eax
push dword [esp + 0x124]
call fcn.00405b90
mov eax, dword [esp + 0x14c]
mov dword [esp + 0x134], 0xf
mov dword [esp + 0x130], 0
mov byte [esp + 0x120], 0
cmp eax, 0x10
jb 0x40441f
inc eax
push eax
push dword [esp + 0x13c]
call fcn.00405b90
mov eax, dword [esp + 0x164]
mov dword [esp + 0x14c], 0xf
mov dword [esp + 0x148], 0
mov byte [esp + 0x138], 0
cmp eax, 0x10
jb 0x404457
inc eax
push eax
push dword [esp + 0x154]
call fcn.00405b90
mov eax, dword [esp + 0x44]
mov dword [esp + 0x164], 0xf
mov dword [esp + 0x160], 0
mov byte [esp + 0x150], 0
cmp eax, 0x10
jb 0x404489
inc eax
push eax
push dword [esp + 0x34]
call fcn.00405b90
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
cmp eax, 0x10
jb 0x4044b8
inc eax
push eax
push dword [esp + 0x94]
call fcn.00405b90
mov eax, dword [esp + 0xec]
mov dword [esp + 0xa4], 0xf
mov dword [esp + 0xa0], 0
mov byte [esp + 0x90], 0
cmp eax, 0x10
jb 0x4044f0
inc eax
push eax
push dword [esp + 0xdc]
call fcn.00405b90
mov ecx, dword [esp + 0x1b0]
mov dword [esp + 0xec], 0xf
mov dword [esp + 0xe8], 0
mov byte [esp + 0xd8], 0
cmp ecx, 0x10
jb 0x404528
inc ecx
push ecx
push dword [esp + 0x1a0]
call fcn.00405b90
mov ecx, dword [esp + 0x1fc]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00415b3b
mov esp, ebp
pop ebp
ret 0x10