Function at 0x415740
Capabilities:
Accept command line arguments
Create process on windows
Enumerate processes
Get installed programs
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44bf90
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x46b0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0
call fcn.004345f9
push 2
push 0
call fcn.004345f9
add esp, 0x10
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x770]
mov dword [ebp - 0x770], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0x770]
cmp ecx, 1
jle 0x416d4e
push ecx
push eax
call fcn.0040b8e0
add esp, 8
test eax, eax
jne 0x416d4e
push str.LibReportParam2.dll
call fcn.0040c310
add esp, 4
test eax, eax
jne 0x4157f2
push str.LibReportParam2.dll
call fcn.0040c310
add esp, 4
test eax, eax
je 0x416d4e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 9
push str.SOFTWARE_
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
mov byte [ebp - 0x540], 0
call fcn.0040e120
push 8
push 0x44f014
lea ecx, [ebp - 0x540]
call fcn.0040de10
push 9
push str.Subscribe
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x49c], 0xf
mov byte [ebp - 0x4b0], 0
call fcn.0040e120
cmp dword [ebp - 0x52c], 0x10
lea ecx, [ebp - 0x714]
push ecx
push 0x20019
lea eax, [ebp - 0x540]
mov dword [ebp - 0x714], 0x80000001
cmovae eax, dword [ebp - 0x540]
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4158ad
mov dword [ebp - 0x754], 1
jmp 0x415927
cmp dword [ebp - 0x49c], 0x10
lea ecx, [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x740]
mov dword [ebp - 0x740], 0
push ecx
lea ecx, [ebp - 0x754]
mov dword [ebp - 0x730], 4
push ecx
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x754], 4
cmovae eax, dword [ebp - 0x4b0]
push 0
push eax
push dword [ebp - 0x714]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x714]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x740]
test esi, esi
mov eax, 1
cmovne edi, eax
mov dword [ebp - 0x754], edi
lea ecx, [ebp - 0x4b0]
call fcn.00409620
xor al, al
mov byte [ebp - 0x45c], 0x47
mov byte [ebp - 0x453], al
mov cl, 0x14
xor al, byte [ebp - 0x45c]
mov ch, 0x29
xor cl, byte [ebp - 0x45c]
mov dl, 0x28
mov byte [ebp - 0x45b], al
mov dh, 0x37
mov byte [ebp - 0x45a], cl
mov ah, 0xe
mov cl, byte [ebp - 0x45c]
mov byte [ebp - 0x70f], 0x32
xor dl, cl
mov al, byte [ebp - 0x70f]
xor ch, cl
xor al, cl
mov byte [ebp - 0x70e], 0x33
xor dh, cl
mov byte [ebp - 0x455], al
mov al, byte [ebp - 0x70e]
xor ah, cl
xor al, cl
mov byte [ebp - 0x457], ch
lea ecx, [ebp - 0x45b]
mov byte [ebp - 0x459], dl
mov byte [ebp - 0x456], dh
lea edx, [ecx + 1]
mov byte [ebp - 0x458], ah
mov byte [ebp - 0x454], al
mov byte [ebp - 0x453], 0
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x49c], 0xf
mov byte [ebp - 0x4b0], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4159e0
sub ecx, edx
lea eax, [ebp - 0x45b]
push ecx
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0040e120
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x4f8]
push eax
call fcn.0040aff0
add esp, 8
lea ecx, [ebp - 0x4b0]
call fcn.00409620
mov esi, dword [ebp - 0x4e8]
test esi, esi
jne 0x415a3f
push 5
push str.20001
lea ecx, [ebp - 0x4f8]
call fcn.0040e120
mov esi, dword [ebp - 0x4e8]
add esi, 0xffffffff
mov edi, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0x4f8]
js 0x415a79
cmp edi, 0x10
lea eax, [ebp - 0x4f8]
cmovae eax, ecx
cmp byte [eax + esi], 0x30
jl 0x415a79
cmp edi, 0x10
lea eax, [ebp - 0x4f8]
cmovae eax, ecx
cmp byte [eax + esi], 0x39
jg 0x415a79
sub esi, 1
jns 0x415a50
push 0
lea ecx, [ebp - 0x778]
mov dword [ebp - 4], 0
mov byte [ebp - 0x780], 0
call fcn.00408f20
mov eax, dword [ebp - 0x4e8]
inc esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 0xf
mov byte [ebp - 0x588], 0
cmp eax, esi
jb 0x416d86
sub eax, esi
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp edi, 0x10
lea eax, [ebp - 0x4f8]
cmovae eax, dword [ebp - 0x4f8]
push ecx
add eax, esi
lea ecx, [ebp - 0x588]
push eax
call fcn.0040e120
xorps xmm0, xmm0
push 0x18
movq qword [ebp - 0x748], xmm0
call fcn.00418c22
add esp, 4
mov edi, eax
mov ecx, edi
push 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push 0x44f038
mov byte [edi], 0
call fcn.0040e120
push 0x44f034
lea ecx, [ebp - 0x780]
call fcn.00402ed0
mov esi, eax
mov eax, dword [ebp - 0x744]
mov cl, byte [esi]
mov byte [esi], 3
mov edx, dword [esi + 0xc]
mov byte [ebp - 0x750], cl
mov ecx, dword [esi + 8]
mov dword [ebp - 0x748], ecx
lea ecx, [ebp - 0x750]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x744], edx
call fcn.004094e0
xorps xmm0, xmm0
push 0x18
movq qword [ebp - 0x748], xmm0
call fcn.00418c22
add esp, 4
mov edi, eax
lea eax, [ebp - 0x588]
mov ecx, edi
push eax
call fcn.00408500
push str.Chnid
lea ecx, [ebp - 0x780]
call fcn.00402ed0
mov esi, eax
mov eax, dword [ebp - 0x454]
mov cl, byte [esi]
mov byte [esi], 3
mov edx, dword [esi + 0xc]
mov byte [ebp - 0x750], cl
mov ecx, dword [esi + 8]
mov dword [ebp - 0x748], ecx
lea ecx, [ebp - 0x750]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x744], edx
call fcn.004094e0
push 0x40
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.00430e20
push 0x3f
lea eax, [ebp - 0x50]
push eax
push str.getIEVersion
call fcn.0040af30
xorps xmm0, xmm0
push 0x18
movq qword [ebp - 0x748], xmm0
call fcn.00418c22
mov edi, eax
lea ecx, [ebp - 0x50]
add esp, 0x1c
lea edx, [ecx + 1]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415c21
sub ecx, edx
lea eax, [ebp - 0x50]
push ecx
push eax
mov ecx, edi
call fcn.0040e120
push 0x44f054
lea ecx, [ebp - 0x780]
call fcn.00402ed0
mov esi, eax
mov eax, dword [ebp - 0x744]
mov cl, byte [esi]
mov byte [esi], 3
mov edx, dword [esi + 0xc]
mov byte [ebp - 0x750], cl
mov ecx, dword [esi + 8]
mov dword [ebp - 0x748], ecx
lea ecx, [ebp - 0x750]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x744], edx
call fcn.004094e0
push 1
push 0x44f038
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x49c], 0xf
mov byte [ebp - 0x4b0], 0
call fcn.0040e120
push 1
push 0x44ee40
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x514], 0xf
mov byte [ebp - 0x528], 0
call fcn.0040e120
push 1
push 0x44ee40
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4cc], 0xf
mov byte [ebp - 0x4e0], 0
call fcn.0040e120
push 0xe
push str.DisplayVersion
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 0xf
mov byte [ebp - 0x4c8], 0
call fcn.0040e120
push 8
push 0x44f014
lea ecx, [ebp - 0x494]
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 0xf
mov byte [ebp - 0x494], 0
call fcn.0040e120
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x5e0]
call fcn.00402a00
lea ecx, [ebp - 0x558]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx]
call eax
cmp dword [ebp - 0x480], 0x10
lea ecx, [ebp - 0x494]
push dword [ebp - 0x484]
cmovae ecx, dword [ebp - 0x494]
push ecx
mov ecx, eax
call fcn.0040de10
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x478], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x468], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x570]
push 0x80000002
push eax
call fcn.0040c430
mov edx, dword [ebp - 0x464]
add esp, 0x10
cmp edx, 0x10
jb 0x415e36
mov ecx, dword [ebp - 0x478]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x415e2c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d8b
push edx
push ecx
call fcn.00418c52
add esp, 8
mov edx, dword [ebp - 0x544]
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0xf
mov byte [ebp - 0x478], 0
cmp edx, 0x10
jb 0x415e8b
mov ecx, dword [ebp - 0x558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x415e81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d90
push edx
push ecx
call fcn.00418c52
add esp, 8
lea ecx, [ebp - 0x494]
call fcn.00409620
lea ecx, [ebp - 0x4c8]
call fcn.00409620
push 0xffffffffffffffff
push 0x44e7c4
lea ecx, [ebp - 0x570]
call fcn.00413840
mov esi, eax
cmp esi, 0xffffffff
je 0x415f71
mov ecx, dword [ebp - 0x560]
lea eax, [ebp - 0x478]
sub ecx, esi
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [ebp - 0x570]
call fcn.00415100
mov edi, eax
lea eax, [ebp - 0x4e0]
cmp eax, edi
je 0x415f19
mov ecx, eax
call fcn.00409620
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x4e0], xmm0
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
movq qword [ebp - 0x4d0], xmm0
mov byte [edi], 0
lea ecx, [ebp - 0x478]
call fcn.00409620
mov eax, dword [ebp - 0x560]
lea ecx, [ebp - 0x570]
sub eax, esi
push eax
push 0x44e7c4
call fcn.00413840
cmp eax, 0xffffffff
je 0x415f71
sub esi, eax
lea ecx, [ebp - 0x570]
dec esi
inc eax
push esi
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.00415100
push eax
lea ecx, [ebp - 0x528]
call fcn.00409f10
lea ecx, [ebp - 0x478]
call fcn.00409620
push 1
push 0x44e7c4
lea ecx, [ebp - 0x4b0]
call fcn.0040de10
cmp dword [ebp - 0x514], 0x10
lea eax, [ebp - 0x528]
push dword [ebp - 0x518]
cmovae eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x4b0]
push eax
call fcn.0040de10
push 1
push 0x44e7c4
lea ecx, [ebp - 0x4b0]
call fcn.0040de10
cmp dword [ebp - 0x4cc], 0x10
lea eax, [ebp - 0x4e0]
push dword [ebp - 0x4d0]
cmovae eax, dword [ebp - 0x4e0]
lea ecx, [ebp - 0x4b0]
push eax
call fcn.0040de10
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x728]
call fcn.00402980
push 0x44f068
lea ecx, [ebp - 0x780]
call fcn.00402ed0
mov cl, byte [ebp - 0x728]
mov esi, eax
mov eax, dword [ebp - 0x720]
mov dl, byte [esi]
mov byte [esi], cl
mov ecx, dword [esi + 8]
mov byte [ebp - 0x728], dl
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x720], ecx
lea ecx, [ebp - 0x728]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x71c], edx
call fcn.004094e0
push 0x400
lea eax, [ebp - 0x450]
push 0
push eax
call fcn.00430e20
push 0x3ff
lea eax, [ebp - 0x450]
push eax
push str.getUpdaterFlag
call fcn.0040af30
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x500], 0
add esp, 0x18
mov dword [ebp - 0x4fc], 0xf
mov byte [ebp - 0x510], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416094
sub ecx, edx
lea eax, [ebp - 0x450]
push ecx
push eax
lea ecx, [ebp - 0x510]
call fcn.0040e120
mov ecx, dword [ebp - 0x500]
test ecx, ecx
jne 0x416130
mov byte [ebp - 0x728], cl
push ecx
lea ecx, [ebp - 0x720]
mov dword [ebp - 4], 1
call fcn.00408f20
push str.Cver
lea ecx, [ebp - 0x780]
mov dword [ebp - 4], 0xffffffff
call fcn.00402ed0
mov cl, byte [ebp - 0x728]
mov esi, eax
mov eax, dword [ebp - 0x720]
mov dl, byte [esi]
mov byte [esi], cl
mov ecx, dword [esi + 8]
mov byte [ebp - 0x728], dl
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x720], ecx
lea ecx, [ebp - 0x728]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x71c], edx
call fcn.004094e0
jmp 0x4162b7
cmp dword [ebp - 0x4fc], 0x10
lea eax, [ebp - 0x510]
cmovae eax, dword [ebp - 0x510]
add eax, ecx
cmp dword [ebp - 0x4fc], 0x10
lea ecx, [ebp - 0x510]
cmovae ecx, dword [ebp - 0x510]
push eax
push ecx
lea ecx, [ebp - 0x734]
call fcn.00402ac0
push 0
lea ecx, [ebp - 0x720]
mov dword [ebp - 4], 2
mov byte [ebp - 0x728], 0
call fcn.00408f20
lea eax, [ebp - 0x728]
mov dword [ebp - 4], 0xffffffff
push eax
push 1
push 1
sub esp, 0x28
mov eax, esp
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x730]
test ecx, ecx
je 0x4161b4
lock inc dword [ecx + 4]
mov ecx, dword [ebp - 0x730]
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x458]
mov dword [ebp - 0x454], ecx
lea ecx, [ebp - 0x684]
push eax
call fcn.004086e0
mov ecx, eax
call fcn.00412b50
lea ecx, [ebp - 0x654]
call fcn.004099a0
mov ecx, dword [ebp - 0x660]
test ecx, ecx
je 0x416212
mov edx, dword [ecx]
lea eax, [ebp - 0x684]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x660], 0
mov esi, dword [ebp - 0x454]
or edi, 0xffffffff
test esi, esi
je 0x41623e
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x41623e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x41623e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push str.Cver
lea ecx, [ebp - 0x780]
call fcn.00402ed0
mov cl, byte [ebp - 0x728]
mov esi, eax
mov dl, byte [esi]
mov byte [esi], cl
mov eax, dword [ebp - 0x720]
mov byte [ebp - 0x728], dl
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x71c]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x720], ecx
lea ecx, [ebp - 0x728]
mov dword [ebp - 0x71c], edx
call fcn.004094e0
mov esi, dword [ebp - 0x730]
test esi, esi
je 0x4162b7
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4162b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4162b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x780]
call fcn.0040f690
push eax
lea eax, [ebp - 0x494]
push eax
call fcn.0040f2d0
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.0040e3b0
add esp, 0x10
lea ecx, [ebp - 0x494]
call fcn.00409620
cmp dword [ebp - 0x464], 0x10
lea eax, [ebp - 0x478]
cmovae eax, dword [ebp - 0x478]
push eax
push 0x44ef30
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea ecx, [ebp - 0x478]
call fcn.00409620
lea ecx, [ebp - 0x4c8]
call fcn.00409620
mov byte [ebp - 0x45c], 0x3e
mov cl, 0x5f
xor cl, byte [ebp - 0x45c]
mov al, 0x4a
xor al, byte [ebp - 0x45c]
mov ch, 0x52
mov byte [ebp - 0x45b], al
mov dl, 0x4b
mov byte [ebp - 0x45a], cl
mov dh, 0x4e
mov cl, byte [ebp - 0x45c]
mov ah, 0x56
mov byte [ebp - 0x70e], 0x10
xor dl, cl
mov al, byte [ebp - 0x70e]
xor ch, cl
xor al, cl
mov byte [ebp - 0x70f], 0x5b
mov byte [ebp - 0x455], al
xor dh, cl
mov al, byte [ebp - 0x70f]
xor ah, cl
xor al, cl
mov byte [ebp - 0x729], 0x46
mov byte [ebp - 0x454], al
mov al, byte [ebp - 0x729]
xor al, cl
mov byte [ebp - 0x70d], 0x5b
mov byte [ebp - 0x453], al
mov al, byte [ebp - 0x70d]
xor al, cl
mov byte [ebp - 0x457], ch
lea ecx, [ebp - 0x45b]
mov byte [ebp - 0x451], 0
mov byte [ebp - 0x459], dl
mov byte [ebp - 0x456], dh
lea edx, [ecx + 1]
mov byte [ebp - 0x458], ah
mov byte [ebp - 0x452], al
mov byte [ebp - 0x451], 0
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0xf
mov byte [ebp - 0x478], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416406
sub ecx, edx
lea eax, [ebp - 0x45b]
push ecx
push eax
lea ecx, [ebp - 0x478]
call fcn.0040e120
push 1
push 1
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x828]
call fcn.00408130
lea ecx, [ebp - 0x478]
call fcn.00409620
lea eax, [ebp - 0x828]
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x828]
mov dword [ebp - 0x484], 0
push eax
mov dword [ebp - 0x480], 0xf
mov byte [ebp - 0x494], 0
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0xf
mov byte [ebp - 0x478], 0
call fcn.00402ca0
mov esi, dword [ebp - 0x47c]
add esp, 8
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
mov eax, 0
mov byte [ebp - 0x730], al
push dword [ebp - 0x730]
cmovne esi, eax
mov dword [ebp - 0x724], eax
sub esp, 0x1c
mov dword [ebp - 0x720], eax
mov ecx, esp
mov dword [ebp - 0x71c], eax
mov dword [ebp - 0x47c], esi
mov dword [ecx], eax
lea eax, [ebp - 0x494]
push eax
add ecx, 4
call fcn.00408500
sub esp, 0x1c
lea eax, [ebp - 0x478]
mov ecx, esp
push eax
mov dword [ecx], esi
add ecx, 4
call fcn.00408500
lea ecx, [ebp - 0x724]
call fcn.00404940
lea ecx, [ebp - 0x47c]
call fcn.004097e0
lea ecx, [ebp - 0x498]
call fcn.004097e0
xor eax, eax
xor esi, esi
cmp dword [ebp - 0x754], 1
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x714], esi
mov dword [ebp - 0x768], esi
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x75c], eax
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x758], eax
jne 0x416779
mov edi, dword [ebp - 0x724]
cmp edi, dword [ebp - 0x720]
je 0x416779
mov edx, 0x7fffffff
nop dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x718], edi
jb 0x4165c3
mov ecx, dword [edi]
mov dword [ebp - 0x718], ecx
cmp eax, 0x10
jae 0x4165de
movups xmm0, xmmword [ecx]
mov dword [ebp - 0x480], 0xf
movups xmmword [ebp - 0x494], xmm0
jmp 0x41662a
mov esi, eax
lea ecx, [ebp - 0x494]
or esi, 0xf
cmp esi, 0x7fffffff
cmova esi, edx
lea eax, [esi + 1]
push eax
call fcn.0040da90
mov ecx, dword [ebp - 0x730]
inc ecx
mov dword [ebp - 0x494], eax
push ecx
push dword [ebp - 0x718]
push eax
call fcn.00430320
mov eax, dword [ebp - 0x730]
add esp, 0xc
mov dword [ebp - 0x480], esi
mov esi, dword [ebp - 0x714]
push 0
mov dword [ebp - 0x484], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.0040b300
push 0x40
lea eax, [ebp - 0x5e0]
push 0
push eax
call fcn.00430e20
add esp, 0x14
mov dword [ebp - 0x5e4], 0x44
cmp dword [ebp - 0x4b4], 0x10
lea ecx, [ebp - 0x470]
lea eax, [ebp - 0x4c8]
cmovae eax, dword [ebp - 0x4c8]
push ecx
lea ecx, [ebp - 0x5e4]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea ecx, [ebp - 0x4c8]
setne byte [ebp - 0x70d]
call fcn.00409620
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x494]
push eax
cmp dword [ebp - 0x764], esi
je 0x4166e0
mov ecx, esi
call fcn.00408500
add esi, 0x18
mov dword [ebp - 0x768], esi
jmp 0x4166f2
push esi
lea ecx, [ebp - 0x76c]
call fcn.00403df0
mov esi, dword [ebp - 0x768]
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x714], esi
mov dword [ebp - 0x730], ecx
cmp dword [ebp - 0x740], eax
je 0x41671f
mov dword [eax], ecx
add eax, 4
mov dword [ebp - 0x75c], eax
jmp 0x41673e
lea ecx, [ebp - 0x730]
push ecx
push eax
lea ecx, [ebp - 0x760]
call fcn.00403bb0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x740], eax
cmp byte [ebp - 0x70d], 0
lea ecx, [ebp - 0x494]
jne 0x416768
call fcn.00409620
add edi, 0x18
mov edx, 0x7fffffff
cmp edi, dword [ebp - 0x720]
jne 0x416590
jmp 0x41676d
call fcn.00409620
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x718], eax
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, dword [ebp - 0x718]
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x454], esi
push 0
lea ecx, [ebp - 0x748]
mov dword [ebp - 4], 3
mov byte [ebp - 0x750], 0
call fcn.00408f20
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x714], edi
test esi, esi
jle 0x416a5d
lea eax, [ebp - 0x70d]
xorps xmm0, xmm0
push 1
push eax
movq qword [ebp - 0x548], xmm0
call fcn.0040da30
add esp, 8
mov esi, eax
mov ecx, esi
push dword [ebp - 0x718]
call fcn.00408500
push str.name
push edi
lea ecx, [ebp - 0x750]
call fcn.00409f50
mov ecx, eax
call fcn.00402ed0
mov cl, byte [eax]
mov byte [eax], 3
mov edx, dword [eax + 0xc]
mov byte [ebp - 0x550], cl
mov ecx, dword [eax + 8]
mov dword [eax + 8], esi
mov esi, dword [ebp - 0x454]
mov dword [ebp - 0x548], ecx
lea ecx, [ebp - 0x550]
mov dword [eax + 0xc], esi
mov dword [ebp - 0x544], edx
call fcn.004094e0
mov eax, dword [ebp - 0x760]
lea ecx, [ebp - 0x750]
push str.code
push dword [ebp - 0x714]
xorps xmm0, xmm0
mov eax, dword [eax + edi*4]
cdq
movq qword [ebp - 0x4b8], xmm0
mov esi, eax
mov edi, edx
call fcn.00409f50
mov ecx, eax
call fcn.00402ed0
mov cl, byte [eax]
mov byte [eax], 5
mov edx, dword [eax + 0xc]
mov byte [ebp - 0x4c0], cl
mov ecx, dword [eax + 8]
mov dword [ebp - 0x4b8], ecx
lea ecx, [ebp - 0x4c0]
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov dword [ebp - 0x4b4], edx
call fcn.004094e0
mov eax, dword [ebp - 0x718]
mov edi, eax
cmp dword [eax + 0x14], 0x10
jb 0x4168be
mov edi, dword [eax]
push 0
push 2
mov dword [ebp - 0x730], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x70c], 0x128
lea eax, [ebp - 0x70c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4169d6
lea eax, [ebp - 0x70c]
mov dword [ebp - 0x70c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x41696a
nop dword [eax]
mov eax, edi
lea ecx, [ebp - 0x6e8]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x416938
test dl, dl
je 0x416934
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x416938
add ecx, 2
add eax, 2
test dl, dl
jne 0x416918
xor eax, eax
jmp 0x41693d
sbb eax, eax
or eax, 1
test eax, eax
je 0x41695e
lea eax, [ebp - 0x70c]
mov dword [ebp - 0x70c], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x416910
jmp 0x41696a
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x730], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x730], 0
je 0x4169d6
mov edi, dword [ebp - 0x714]
lea ecx, [ebp - 0x750]
push str.exist
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x484], xmm0
call fcn.00409f50
mov ecx, eax
call fcn.00402ed0
mov cl, byte [eax]
mov byte [eax], 5
mov edx, dword [eax + 0xc]
mov byte [ebp - 0x48c], cl
mov ecx, dword [eax + 8]
mov dword [ebp - 0x484], ecx
lea ecx, [ebp - 0x48c]
mov dword [eax + 8], 1
mov dword [eax + 0xc], 0
mov dword [ebp - 0x480], edx
jmp 0x416a3e
mov edi, dword [ebp - 0x714]
lea ecx, [ebp - 0x750]
xorps xmm0, xmm0
push str.exist
push edi
movq qword [ebp - 0x468], xmm0
movlpd qword [ebp - 0x734], xmm0
call fcn.00409f50
mov ecx, eax
call fcn.00402ed0
mov esi, eax
mov eax, dword [ebp - 0x734]
mov cl, byte [esi]
mov byte [esi], 5
mov edx, dword [esi + 0xc]
mov byte [ebp - 0x470], cl
mov ecx, dword [esi + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x468], ecx
lea ecx, [ebp - 0x470]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x464], edx
call fcn.004094e0
add dword [ebp - 0x718], 0x18
inc edi
mov dword [ebp - 0x714], edi
cmp edi, dword [ebp - 0x454]
jl 0x4167d3
push 0
lea ecx, [ebp - 0x734]
mov dword [ebp - 4], 4
mov byte [ebp - 0x73c], 0
call fcn.00408f20
lea eax, [ebp - 0x70d]
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
push 1
push eax
movq qword [ebp - 0x458], xmm0
call fcn.0040da30
add esp, 8
mov edi, eax
mov ecx, edi
push 6
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push str.taurus
mov byte [edi], 0
call fcn.0040e120
push str.type
lea ecx, [ebp - 0x73c]
call fcn.00402ed0
mov esi, eax
mov eax, dword [ebp - 0x454]
mov cl, byte [esi]
mov byte [esi], 3
mov edx, dword [esi + 0xc]
mov byte [ebp - 0x460], cl
mov ecx, dword [esi + 8]
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x460]
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [ebp - 0x454], edx
call fcn.004094e0
xorps xmm0, xmm0
lea ecx, [ebp - 0x73c]
push str.subscribe
movq qword [ebp - 0x468], xmm0
call fcn.00402ed0
mov esi, dword [ebp - 0x754]
mov cl, byte [eax]
mov byte [eax], 6
mov edx, dword [eax + 0xc]
mov byte [ebp - 0x470], cl
mov ecx, dword [eax + 8]
mov dword [ebp - 0x468], ecx
lea ecx, [ebp - 0x470]
mov dword [eax + 8], esi
mov dword [eax + 0xc], 0
mov dword [ebp - 0x464], edx
call fcn.004094e0
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x460]
call fcn.00408300
push str.result
lea ecx, [ebp - 0x73c]
call fcn.00402ed0
mov cl, byte [ebp - 0x460]
mov esi, eax
mov eax, dword [ebp - 0x458]
mov dl, byte [esi]
mov byte [esi], cl
mov ecx, dword [esi + 8]
mov byte [ebp - 0x460], dl
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x458], ecx
lea ecx, [ebp - 0x460]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x454], edx
call fcn.004094e0
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x73c]
call fcn.0040f690
mov edi, eax
cmp dword [edi + 0x14], 0x10
jb 0x416bdc
mov edi, dword [edi]
push str.LibReportParam2.dll
call fcn.0040c310
mov esi, eax
add esp, 4
test esi, esi
jne 0x416c02
push str.LibReportParam2.dll
call fcn.0040c310
mov esi, eax
add esp, 4
test esi, esi
je 0x416c1b
push str.PostUpdaterRequest
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x416d6d
call fcn.0040b540
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x5a0]
call fcn.00409620
push str.LibReportParam2.dll
call fcn.0040c310
mov esi, eax
add esp, 4
test esi, esi
jne 0x416c52
push str.LibReportParam2.dll
call fcn.0040c310
mov esi, eax
add esp, 4
test esi, esi
je 0x416c6c
push str.ReleaseUpdaterRequest
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416c67
call eax
push esi
call edi
call fcn.0040b540
push 0
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], 5
mov byte [ebp - 0x470], 0
call fcn.00408f20
lea ecx, [ebp - 0x470]
call fcn.004094e0
lea ecx, [ebp - 0x73c]
call fcn.004094e0
lea ecx, [ebp - 0x750]
call fcn.004094e0
mov ecx, dword [ebp - 0x760]
test ecx, ecx
je 0x416cca
mov eax, dword [ebp - 0x740]
sub eax, ecx
sar eax, 2
push eax
push ecx
lea ecx, [ebp - 0x760]
call fcn.0040f3a0
lea ecx, [ebp - 0x76c]
call fcn.0040d790
lea ecx, [ebp - 0x724]
call fcn.0040d790
lea ecx, [ebp - 0x828]
call fcn.0040a340
lea ecx, [ebp - 0x510]
call fcn.00409620
lea ecx, [ebp - 0x570]
call fcn.00409620
lea ecx, [ebp - 0x4e0]
call fcn.00409620
lea ecx, [ebp - 0x528]
call fcn.00409620
lea ecx, [ebp - 0x4b0]
call fcn.00409620
lea ecx, [ebp - 0x588]
call fcn.00409620
lea ecx, [ebp - 0x780]
call fcn.004094e0
lea ecx, [ebp - 0x4f8]
call fcn.00409620
lea ecx, [ebp - 0x540]
call fcn.00409620
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419373
mov esp, ebp
pop ebp
ret 0x10
push edi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 4
push esi
call edi
call fcn.0040b540
jmp 0x416c21
call fcn.0040d940
call fcn.00434109
call fcn.00434109
int3