Function at 0x41f280
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Move file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4d7bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov edi, dword [esp + 0xb4]
mov ebx, dword [esp + 0xac]
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x3c], 0
mov eax, dword [edi + 0x2c]
cmp eax, 5
jne 0x41f46a
call fcn.00426eb0
mov eax, dword [esp + 0xb0]
push eax
lea ecx, [esp + 0x34]
call fcn.004755e0
lea ecx, [edi + 0xc]
push ecx
lea esi, [esp + 0x34]
mov dword [esp + 0xa4], 0
call fcn.00410550
add esp, 4
push 0xffffffffffffffff
push str._1__1__1__1
lea ecx, [esp + 0x40]
call fcn.004748c0
mov byte [esp + 0xa0], 1
mov edx, dword [ebp + 0x228]
push edx
push ecx
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.004755e0
mov edx, dword [ebx]
mov edx, dword [edx + 0x6c]
mov eax, esi
push eax
add edi, 8
push edi
mov ecx, ebx
call edx
mov esi, eax
test esi, esi
jge 0x41f42f
push 0xffffffffffffffff
push 0x51ef3c
lea ecx, [esp + 0x3c]
call fcn.004748c0
mov ebx, eax
push 0xffffffffffffffff
push 0x51ef40
lea ecx, [esp + 0x44]
mov byte [esp + 0xa8], 2
call fcn.004748c0
push edi
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0xac], 3
call fcn.004740c0
push ebx
push eax
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0xac], 4
call fcn.004740c0
lea ecx, [esp + 0x40]
mov byte [esp + 0xa0], 6
call fcn.004732d0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 7
call fcn.004732d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xa0], 8
call fcn.004732d0
push 0
lea edx, [esp + 0x48]
push edx
push 0x75
lea eax, [esp + 0x3c]
push eax
push ebp
mov ecx, esi
call fcn.00427c80
mov ebp, dword [ebp + 0x220]
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], 1
call fcn.004732d0
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 0
call fcn.004732d0
lea ecx, [esp + 0x30]
mov dword [esp + 0xa0], 0xffffffff
call fcn.004732d0
mov eax, ebp
jmp 0x420803
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
call fcn.00426eb0
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 0
call fcn.004732d0
lea ecx, [esp + 0x30]
mov dword [esp + 0xa0], 0xffffffff
call fcn.004732d0
mov eax, esi
jmp 0x420803
cmp eax, 9
je 0x41f947
cmp eax, 0xa
je 0x41f947
lea ecx, [esp + 0x2c]
call fcn.00474bb0
mov edx, dword [esp + 0xb0]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0xa4], 0x3c
call fcn.004755e0
lea eax, [edi + 0xc]
mov byte [esp + 0xa0], 0x3d
push eax
lea esi, [esp + 0x24]
mov dword [esp + 0x44], eax
call fcn.00410550
lea eax, [edi + 8]
add esp, 4
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], eax
call fcn.004755e0
mov byte [esp + 0xa0], 0x3e
mov eax, dword [esp + 0x40]
push eax
lea esi, [esp + 0x20]
call fcn.00410550
xor esi, esi
add esp, 4
mov dword [esp + 0x38], esi
mov dword [esp + 0x44], esi
call fcn.00426eb0
cmp dword [ebp + 0x218], esi
jne 0x41f662
mov edx, dword [ebx]
mov edx, dword [edx + 0x34]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call edx
mov eax, dword [edi + 0x2c]
cmp eax, 6
jne 0x41f528
mov eax, dword [ebx]
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebx
call edx
jmp 0x41f565
cmp eax, 7
mov eax, dword [ebx]
jne 0x41f554
mov ecx, dword [ebp + 0x228]
mov eax, dword [eax + 0x1c]
push 0
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, ebx
call eax
mov edx, dword [ebx]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call edx
jmp 0x41f565
mov eax, dword [eax + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, ebx
call eax
mov esi, eax
test esi, esi
jge 0x41f7bb
sar eax, 0x10
and eax, 0x1fff
cmp eax, 7
movzx ecx, si
je 0x41f588
cmp eax, 8
jne 0x41f616
cmp ecx, 0x21
je 0x41f597
cmp ecx, 0x20
je 0x41f597
cmp ecx, 5
jne 0x41f616
cmp dword [ebx + 8], 0
jne 0x41f616
cmp dword [esp + 0x44], 0
jne 0x41f616
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebp
call fcn.004267b0
mov esi, eax
test esi, esi
jne 0x41f5c3
mov dword [esp + 0x44], 1
jmp 0x41f650
cmp esi, 1
jne 0x41f616
mov eax, dword [edi + 0x2c]
cmp eax, 6
je 0x41f5e9
cmp eax, 7
je 0x41f5e9
mov edx, dword [ebx]
mov eax, dword [edx + 0x30]
mov ecx, ebx
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x24]
jmp 0x41f5fb
mov eax, dword [ebx]
mov edx, dword [eax + 0x30]
mov ecx, ebx
call edx
push 0x55056c
lea ecx, [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0x7c]
push ecx
mov ecx, eax
call edx
mov esi, eax
mov eax, 1
mov dword [esp + 0x38], eax
mov dword [ebp + 0x1dc], eax
call fcn.00426eb0
cmp dword [ebp + 0x218], 0
jne 0x41f6a2
test esi, esi
jge 0x41f7bb
cmp dword [ebp + 0x194], 0
jne 0x41f6c8
push 1
mov ecx, ebp
call fcn.00426660
call fcn.00426eb0
cmp dword [ebp + 0x218], 0
jne 0x41f6b5
call fcn.00426eb0
cmp dword [ebp + 0x218], 0
je 0x41f502
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0x3d
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 0x3c
call fcn.004732d0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.004732d0
mov eax, 0x80004004
jmp 0x420803
push 0
push 0x73
lea eax, [esp + 0x28]
push eax
push ebp
xor ecx, ecx
call fcn.004278e0
jmp 0x41f662
push 0
push 0x73
lea ecx, [esp + 0x28]
push ecx
push ebp
xor ecx, ecx
call fcn.004278e0
jmp 0x41f662
push 0xffffffffffffffff
push 0x51ef3c
lea ecx, [esp + 0x40]
call fcn.004748c0
mov edi, eax
push 0xffffffffffffffff
push 0x51ef40
lea ecx, [esp + 0x44]
mov byte [esp + 0xa8], 0x3f
call fcn.004748c0
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0xac], 0x40
call fcn.004740c0
push edi
push eax
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0xac], 0x41
call fcn.004740c0
lea ecx, [esp + 0x40]
mov byte [esp + 0xa0], 0x43
call fcn.004732d0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 0x44
call fcn.004732d0
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 0x45
call fcn.004732d0
push 0
lea edx, [esp + 0x48]
push edx
push 0x77
lea eax, [esp + 0x2c]
push eax
push ebp
mov ecx, esi
call fcn.00427c80
mov ebp, dword [ebp + 0x220]
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], 0x3e
call fcn.004732d0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0x3d
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 0x3c
call fcn.004732d0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.004732d0
mov eax, ebp
jmp 0x420803
call fcn.00426eb0
mov eax, dword [edi + 0x2c]
cmp eax, 2
jne 0x41f8ab
mov ecx, dword [esp + 0x40]
push 0
call fcn.00473350
cmp ax, 0x5f
jne 0x41f811
push 0x63
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.00415a10
mov byte [esp + 0xa0], 0x46
mov eax, dword [eax]
mov ecx, dword [esp + 0x34]
push eax
mov dword [esp + 0x40], 1
call fcn.00410820
test eax, eax
mov byte [esp + 0x1b], 0
je 0x41f816
mov byte [esp + 0x1b], 1
mov dword [esp + 0xa0], 0x3e
test byte [esp + 0x3c], 1
je 0x41f831
lea ecx, [esp + 0x28]
call fcn.004732d0
cmp byte [esp + 0x1b], 0
je 0x41f93d
mov eax, dword [ebp + 0x228]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
push 1
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call edx
mov esi, eax
test esi, esi
je 0x41f93d
push 0
push 0x78
lea eax, [esp + 0x24]
push eax
push ebp
mov ecx, esi
call fcn.004278e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0x3d
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 0x3c
call fcn.004732d0
lea ecx, [esp + 0x2c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.004732d0
mov eax, esi
jmp 0x420803
cmp eax, 3
jne 0x41f912
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push 0xffffffffffffffff
push 0x51cd44
call fcn.004748c0
push 0
mov byte [esp + 0xa8], 0x47
mov ecx, dword [ebp + 0x228]
push 1
push ecx
push ecx
add edi, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push edi
call fcn.004755e0
mov eax, dword [ebx]
add eax, 0x20
mov eax, dword [eax]
lea edx, [esp + 0x30]
push edx
mov ecx, ebx
mov byte [esp + 0xb8], 0x3e
call eax
mov esi, eax
test esi, esi
je 0x41f93d
push 0
push 0x65
lea ecx, [esp + 0x24]
push ecx
jmp 0x41f866
cmp eax, 8
jne 0x41f93d
cmp dword [esp + 0x38], 0
jne 0x41f93d
lea edx, [esp + 0x1c]
push edx
lea ecx, [ebp + 0x1c4]
call fcn.00475be0
add edi, 0x1c
push edi
lea ecx, [ebp + 0x1d0]
call fcn.00475be0
call fcn.00426eb0
jmp 0x41f86e
call fcn.00426eb0
lea esi, [esp + 0x50]
call fcn.00418d30
mov dword [esp + 0xa0], 9
mov eax, dword [ebp + 8]
mov dword [esp + 0x48], eax
mov eax, dword [0x5546c0]
test eax, eax
je 0x41f979
lea ecx, [esp + 0x48]
push ecx
push 2
call eax
lea edx, [edi + 0xc]
push edx
lea ecx, [esp + 0x24]
call fcn.004755e0
lea esi, [edi + 0x20]
mov byte [esp + 0xa0], 0xa
mov eax, dword [esi]
test eax, eax
je 0x41fad8
cmp word [eax], 0
je 0x41fad8
mov eax, dword [edi + 0x24]
test eax, eax
je 0x41fad8
cmp word [eax], 0
je 0x41fad8
lea ecx, [esp + 0x38]
call fcn.00474bb0
push 0
push 2
push ecx
mov byte [esp + 0xac], 0xb
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [esp + 0x58], esp
push eax
call fcn.004755e0
lea ecx, [esp + 0x44]
push ecx
push ecx
mov byte [esp + 0xb4], 0xc
lea edx, [edi + 8]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call fcn.004755e0
mov byte [esp + 0xb4], 0xb
call fcn.00419380
test eax, eax
jne 0x41fac7
push esi
lea ecx, [esp + 0x34]
call fcn.004755e0
push 8
mov byte [esp + 0xa4], 0xd
mov eax, dword [esp + 0x34]
push 0x51ec6c
push eax
call fcn.00478500
add esp, 0xc
test eax, eax
jne 0x41fa6e
push 8
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x38]
call fcn.00401040
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xa4], 0xe
call fcn.00474c20
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], 0xd
call fcn.004732d0
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.004755e0
push ecx
mov byte [esp + 0xa8], 0xf
lea eax, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.004755e0
mov byte [esp + 0xa8], 0xd
call fcn.00423f20
test eax, eax
jl 0x41fab6
lea eax, [edi + 0x24]
push eax
lea ecx, [esp + 0x24]
call fcn.00474c20
lea ecx, [esp + 0x30]
mov byte [esp + 0xa0], 0xb
call fcn.004732d0
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 0xa
call fcn.004732d0
mov ecx, dword [esp + 0xb0]
push ecx
lea ecx, [esp + 0x20]
call fcn.004755e0
mov byte [esp + 0xa0], 0x10
call fcn.00426eb0
lea edx, [esp + 0x20]
push edx
lea esi, [esp + 0x20]
call fcn.00410550
add esp, 4
cmp dword [ebp + 0x218], 0
je 0x41fb52
push 0
push 0x73
mov eax, esi
push eax
push ebp
xor ecx, ecx
call fcn.004278e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0xa
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 9
call fcn.004732d0
sub dword [0x554674], 1
mov eax, 0x80004004
jmp 0x420803
push 4
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x24]
call fcn.004742d0
mov byte [esp + 0xa0], 0x11
mov edx, dword [eax]
push 0x51ef44
push edx
call fcn.00477290
add esp, 8
test eax, eax
lea ecx, [esp + 0x44]
sete byte [esp + 0x1b]
mov byte [esp + 0xa0], 0x10
call fcn.004732d0
cmp byte [esp + 0x1b], 0
je 0x41fe42
xor esi, esi
cmp dword [str.3964575C_D828_4587_AED1_E538EAAFC083], esi
je 0x41fe42
mov eax, 0x54f95c
mov eax, dword [eax]
push eax
mov eax, dword [edi + 8]
push eax
call fcn.00477290
add esp, 8
test eax, eax
je 0x41fbdc
add esi, 1
cmp dword [esi*4 + 0x54f95c], 0
lea eax, [esi*4 + 0x54f95c]
jne 0x41fbb0
jmp 0x41fe42
lea ecx, [esp + 0x30]
call fcn.00474bb0
push ecx
mov byte [esp + 0xa4], 0x12
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
lea edi, [esp + 0x38]
call fcn.004755e0
call fcn.004191f0
test eax, eax
jge 0x41fc5e
push 0
push 0x76
lea ecx, [esp + 0x24]
push ecx
push ebp
mov ecx, eax
call fcn.004278e0
mov ecx, edi
mov byte [esp + 0xa0], 0x10
call fcn.004732d0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0xa
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 9
call fcn.004732d0
sub dword [0x554674], 1
mov eax, 0x80004005
jmp 0x420803
lea ecx, [esp + 0x30]
call fcn.00410800
test eax, eax
jne 0x41fe31
mov edx, dword [esp + 0xb0]
push edx
lea ecx, [esp + 0x2c]
call fcn.004755e0
lea eax, [esp + 0x30]
push eax
lea esi, [esp + 0x2c]
mov byte [esp + 0xa4], 0x13
call fcn.00410550
add esp, 4
push 0x51ef44
mov ecx, esi
call fcn.00473fc0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.00477290
add esp, 8
test eax, eax
je 0x41fe20
mov eax, dword [ebx]
mov edx, dword [eax + 0x58]
mov ecx, esi
push ecx
mov ecx, ebx
call edx
test eax, eax
je 0x41fdf1
mov eax, dword [ebx]
mov edx, dword [eax + 0x2c]
mov ecx, esi
push ecx
mov ecx, ebx
call edx
mov edi, eax
test edi, edi
jge 0x41fdf1
push 0xffffffffffffffff
push 0x51ef3c
lea ecx, [esp + 0x40]
call fcn.004748c0
mov esi, eax
push 0xffffffffffffffff
push 0x51ef40
lea ecx, [esp + 0x44]
mov byte [esp + 0xa8], 0x14
call fcn.004748c0
lea ecx, [esp + 0x28]
push ecx
push eax
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0xac], 0x15
call fcn.004740c0
push esi
push eax
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0xac], 0x16
call fcn.004740c0
lea ecx, [esp + 0x40]
mov byte [esp + 0xa0], 0x18
call fcn.004732d0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 0x19
call fcn.004732d0
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 0x1a
call fcn.004732d0
push 0
lea ecx, [esp + 0x48]
push ecx
push 0x77
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, edi
call fcn.00427c80
mov ebp, dword [ebp + 0x220]
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], 0x13
call fcn.004732d0
lea ecx, [esp + 0x28]
mov byte [esp + 0xa0], 0x12
call fcn.004732d0
lea ecx, [esp + 0x30]
mov byte [esp + 0xa0], 0x10
call fcn.004732d0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0xa
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 9
call fcn.004732d0
sub dword [0x554674], 1
mov eax, ebp
jmp 0x420803
mov eax, dword [ebx]
mov eax, dword [eax + 4]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
call eax
mov edx, dword [ebx]
mov edx, dword [edx + 0x2c]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
call fcn.00474c20
lea ecx, [esp + 0x28]
mov byte [esp + 0xa0], 0x12
call fcn.004732d0
lea ecx, [esp + 0x30]
mov byte [esp + 0xa0], 0x10
call fcn.004732d0
call fcn.00426eb0
cmp dword [ebp + 0x218], 0
je 0x41fe5e
push 0
push 0x73
lea ecx, [esp + 0x24]
push ecx
jmp 0x41fb17
lea ecx, [esp + 0x2c]
call fcn.00474bb0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 0x1b
call fcn.00474bb0
push 0xffffffffffffffff
push 0x51d04c
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], 0x1c
call fcn.004748c0
push 4
lea edx, [esp + 0x48]
mov byte [esp + 0xa4], 0x1d
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 0
call fcn.004742d0
mov byte [esp + 0xa0], 0x1e
mov eax, dword [eax]
push str..msp
push eax
call fcn.00477290
add esp, 8
test eax, eax
lea ecx, [esp + 0x44]
sete bl
mov byte [esp + 0xa0], 0x1d
call fcn.004732d0
test bl, bl
je 0x41ffbf
mov edx, dword [ebp + 0x14]
xor ecx, ecx
lea esi, [esp + 0x40]
call fcn.004155a0
push str.msiexec.exe
push eax
lea ecx, [esp + 0x4c]
mov bl, 0x1f
push ecx
mov byte [esp + 0xac], bl
call fcn.00474150
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4], 0x20
call fcn.00474c20
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], bl
call fcn.004732d0
mov ecx, esi
mov byte [esp + 0xa0], 0x1d
call fcn.004732d0
mov edi, dword [esp + 0xb4]
lea esi, [edi + 0x1c]
mov ecx, esi
call fcn.00410800
mov edx, dword [esp + 0x1c]
test eax, eax
lea eax, [esp + 0x24]
je 0x41ff6c
push edx
push str._update___s_
push eax
call fcn.00473270
add esp, 0xc
jmp 0x41ff7e
mov ecx, dword [esi]
push ecx
push edx
push str._update___s___s
push eax
call fcn.00473270
add esp, 0x10
push 2
push ecx
lea edx, [ebp + 0xc]
mov ecx, esp
mov dword [esp + 0x54], esp
push edx
call fcn.004755e0
lea eax, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0xb0], 0x21
add edi, 8
mov ecx, esp
mov dword [esp + 0x54], esp
push edi
call fcn.004755e0
mov byte [esp + 0xb0], 0x1d
call fcn.004197b0
jmp 0x420116
push 4
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x28]
call fcn.004742d0
mov byte [esp + 0xa0], 0x22
mov edx, dword [eax]
push 0x51ef44
push edx
call fcn.00477290
add esp, 8
test eax, eax
lea ecx, [esp + 0x44]
sete bl
mov byte [esp + 0xa0], 0x1d
call fcn.004732d0
test bl, bl
je 0x420257
mov edx, dword [ebp + 0x14]
xor ecx, ecx
lea esi, [esp + 0x40]
call fcn.004155a0
push str.msiexec.exe
push eax
lea eax, [esp + 0x4c]
mov bl, 0x23
push eax
mov byte [esp + 0xac], bl
call fcn.00474150
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4], 0x24
call fcn.00474c20
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], bl
call fcn.004732d0
mov ecx, esi
mov byte [esp + 0xa0], 0x1d
call fcn.004732d0
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
lea edi, [esp + 0x38]
call fcn.004755e0
call fcn.004195d0
push 2
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
mov dword [esp + 0x50], 0
lea edi, [esp + 0x50]
call fcn.004755e0
mov ecx, dword [esp + 0xbc]
push ecx
lea edx, [ecx + 8]
mov byte [esp + 0xac], 0x25
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.004755e0
mov byte [esp + 0xac], 0x1d
call fcn.00418ec0
test eax, eax
jne 0x420238
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x44]
push eax
push ecx
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call fcn.004755e0
mov esi, dword [esp + 0xc0]
push ebp
mov ecx, esi
call fcn.00420820
mov ecx, dword [esp + 0x1c]
test eax, eax
mov eax, dword [esi + 0x1c]
push eax
lea edx, [esp + 0x28]
push ecx
jne 0x42022e
push str._i___s___s
push edx
call fcn.00473270
add esp, 0x10
cmp dword [esp + 0x30], 0
je 0x420136
call fcn.0042f480
test eax, eax
je 0x420136
push 0xffffffffffffffff
push str.runas
lea ecx, [esp + 0x3c]
call fcn.00473ec0
mov ecx, dword [esp + 0xb4]
cmp dword [ecx + 0x2c], 9
jne 0x420630
mov edx, dword [esp + 0x2c]
push edx
lea ecx, [esp + 0x48]
call fcn.00410140
mov byte [esp + 0xa0], 0x28
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
call fcn.00410140
mov byte [esp + 0xa0], 0x29
mov esi, dword [ebp + 0x14]
push 0
lea edi, [esp + 0x50]
call fcn.00415c10
mov byte [esp + 0xa0], 0x2a
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x40]
call fcn.00410140
mov ecx, edi
mov byte [esp + 0xa0], 0x2c
call fcn.004732d0
xor edi, edi
cmp dword [esp + 0x30], edi
mov dword [esp + 0x38], edi
je 0x4202f5
push 0x3c
lea ecx, [esp + 0x60]
push edi
push ecx
call fcn.004b0770
mov ecx, dword [esp + 0x4c]
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x7c], ecx
add esp, 0xc
mov dword [esp + 0x64], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x5c]
push ecx
mov dword [esp + 0x60], 0x3c
mov dword [esp + 0x64], 0x440
mov dword [esp + 0x78], edx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x7c], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4202c8
xor esi, esi
mov eax, dword [esp + 0x94]
test eax, eax
je 0x420353
mov edi, eax
jmp 0x420353
push str._fvamus___s___s
jmp 0x42010d
mov eax, dword [esp + 0xb4]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push str._i___s___s
lea eax, [esp + 0x30]
push eax
jmp 0x42010e
mov esi, dword [ebp + 0x14]
push 0
lea edi, [esp + 0x44]
call fcn.00415c10
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x4c]
mov bl, 0x26
push edx
mov byte [esp + 0xac], bl
call fcn.004740c0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xa4], 0x27
call fcn.00474c20
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], bl
call fcn.004732d0
mov ecx, edi
mov byte [esp + 0xa0], 0x1d
call fcn.004732d0
mov eax, dword [esp + 0xb4]
add eax, 0x1c
push eax
lea ecx, [esp + 0x28]
call fcn.00474c20
jmp 0x420136
mov eax, dword [esp + 0x7c]
cmp eax, 0x20
mov esi, 0x80004005
jae 0x420218
test eax, eax
jne 0x4202ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
or esi, 0x80070000
jmp 0x420353
or eax, 0x80070000
jmp 0x420351
lea edx, [esp + 0x38]
push edx
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00410050
push ecx
mov byte [esp + 0xac], 0x2d
lea edx, [esp + 0x4c]
mov ecx, esp
mov dword [esp + 0x60], esp
push edx
call fcn.00410050
push ecx
mov byte [esp + 0xb0], 0x2e
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x68], esp
push eax
call fcn.00410050
mov byte [esp + 0xb0], 0x2c
call fcn.0041eb20
mov edi, dword [esp + 0x48]
add esp, 0x10
mov esi, eax
test esi, esi
jl 0x4205e9
test edi, edi
je 0x42044b
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea ecx, [esp + 0x28]
push ecx
push edi
mov dword [esp + 0x30], 0
call esi
test eax, eax
mov ebx, 1
je 0x4203af
cmp dword [esp + 0x28], 0x103
jne 0x4203af
call fcn.00426eb0
cmp dword [ebp + 0x218], ebx
je 0x4203a7
lea edx, [esp + 0x28]
push edx
push edi
call esi
test eax, eax
jne 0x420382
jmp 0x4203af
mov dword [esp + 0x28], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
xor edi, edi
test eax, eax
je 0x42044b
cmp eax, 0x669
je 0x420438
cmp eax, 0xbc2
je 0x420426
cmp eax, 0x666
jne 0x4203ea
push eax
push eax
push str._mp_distribute___ERROR__MSIEXEC_cannot_continue._Check_Reinstall_or_NOT._dwExitCode__d__0x_X__r_n
call fcn.00477660
add esp, 0xc
jmp 0x42044b
cmp eax, 0x642
jne 0x420402
push eax
push eax
push str._mp_distribute___ERROR__MSIEXEC_returns_User_Cancelled_installation._Check_Admin._dwExitCode__d__0x_X__r_n
call fcn.00477660
add esp, 0xc
jmp 0x42044b
cmp eax, 0x643
jne 0x420415
push str._mp_distribute___ERROR__ERROR_INSTALL_FAILURE_r_n
call fcn.00477660
jmp 0x420448
push eax
push eax
push str._mp_distribute___ERROR__MSIEXEC_returns_error._dwExitCode__d__0x_X__r_n
call fcn.00477660
add esp, 0xc
jmp 0x42044b
push str._mp_distribute__MSIEXEC_OK._reboot_required._r_n
call fcn.00477660
mov dword [ebp + 0x1dc], ebx
jmp 0x420448
push str._mp_distribute__MSIEXEC_OK._REBOOT_INITIATED._r_n
call fcn.00477660
mov dword [ebp + 0x218], ebx
add esp, 4
lea ecx, [esp + 0x38]
call fcn.00474bb0
lea eax, [esp + 0x30]
push eax
push 2
push ecx
mov byte [esp + 0xac], 0x2f
xor ebx, ebx
cmp dword [esp + 0x3c], ebx
lea edx, [ebp + 0xc]
mov ecx, esp
mov dword [esp + 0x64], esp
push edx
mov dword [esp + 0x40], ebx
je 0x4204c7
call fcn.004755e0
mov ecx, dword [esp + 0xc0]
lea eax, [esp + 0x44]
push eax
push ecx
lea edx, [ecx + 8]
mov byte [esp + 0xb4], 0x30
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
call fcn.004755e0
mov byte [esp + 0xb4], 0x2f
call fcn.00419380
mov esi, eax
cmp esi, ebx
jne 0x4205d3
cmp dword [esp + 0x30], ebx
je 0x42051a
push str._mp_distribute__bNeedAdmin__TRUE._but_read_version_like_normal_user_r_n
jmp 0x420512
call fcn.004755e0
mov ecx, dword [esp + 0xc0]
lea eax, [esp + 0x44]
push eax
push ecx
lea edx, [ecx + 8]
mov byte [esp + 0xb4], 0x31
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
call fcn.004755e0
mov byte [esp + 0xb4], 0x2f
call fcn.00419380
mov esi, eax
cmp esi, ebx
jne 0x4205d3
cmp dword [esp + 0x30], ebx
jne 0x42051a
push str._mp_distribute__bNeedAdmin__false._but_read_version_like_bNeedAdmin_r_n
call fcn.00477660
add esp, 4
mov eax, dword [esp + 0xb4]
add eax, 0x10
push eax
lea ecx, [esp + 0x34]
call fcn.004755e0
mov bl, 0x32
push 8
mov byte [esp + 0xa4], bl
mov ecx, dword [esp + 0x34]
push 0x51ec6c
push ecx
call fcn.00478500
add esp, 0xc
test eax, eax
jne 0x420581
push 8
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x38]
call fcn.00401040
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xa4], 0x33
call fcn.00474c20
lea ecx, [esp + 0x28]
mov byte [esp + 0xa0], bl
call fcn.004732d0
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.004755e0
push ecx
mov byte [esp + 0xa8], 0x34
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x5c], esp
push edx
call fcn.004755e0
mov byte [esp + 0xa8], bl
call fcn.00423f20
test eax, eax
jge 0x4205c0
mov esi, 0x80004005
lea ecx, [esp + 0x30]
mov byte [esp + 0xa0], 0x2f
call fcn.004732d0
jmp 0x4205d8
mov esi, 0x80004005
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 0x2c
call fcn.004732d0
test edi, edi
je 0x4205f4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jl 0x42060b
mov ecx, dword [esp + 0xac]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
lea edx, [esp + 0x1c]
push edx
call eax
lea ecx, [esp + 0x3c]
call fcn.00410230
lea ecx, [esp + 0x40]
call fcn.00410230
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], 0x1d
call fcn.00410230
jmp 0x420660
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [ebp + 0x1c4]
call fcn.00475be0
lea edx, [esp + 0x24]
push edx
lea ecx, [ebp + 0x1d0]
call fcn.00475be0
mov eax, dword [esp + 0x1c]
push 4
xor esi, esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.00426eb0
cmp dword [ebp + 0x218], 0
je 0x4206b7
push 0
push 0x73
lea ecx, [esp + 0x24]
push ecx
push ebp
xor ecx, ecx
call fcn.004278e0
lea ecx, [esp + 0x34]
mov byte [esp + 0xa0], 0x1c
call fcn.004732d0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 0x1b
call fcn.004732d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa0], 0x10
call fcn.004732d0
jmp 0x41fb1f
test esi, esi
jge 0x4207a0
push 0xffffffffffffffff
push 0x51ef3c
lea ecx, [esp + 0x44]
call fcn.004748c0
mov edi, eax
push 0xffffffffffffffff
push 0x51ef40
lea ecx, [esp + 0x48]
mov byte [esp + 0xa8], 0x35
call fcn.004748c0
lea edx, [esp + 0x1c]
push edx
push eax
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0xac], 0x36
call fcn.004740c0
push edi
push eax
lea ecx, [esp + 0x4c]
push ecx
mov byte [esp + 0xac], 0x37
call fcn.004740c0
lea ecx, [esp + 0x4c]
mov byte [esp + 0xa0], 0x39
call fcn.004732d0
lea ecx, [esp + 0x40]
mov byte [esp + 0xa0], 0x3a
call fcn.004732d0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 0x3b
call fcn.004732d0
push 0
lea edx, [esp + 0x48]
push edx
push 0x77
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.00427c80
mov ebp, dword [ebp + 0x220]
lea ecx, [esp + 0x44]
mov byte [esp + 0xa0], 0x1d
call fcn.004732d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xa0], 0x1c
call fcn.004732d0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 0x1b
call fcn.004732d0
lea ecx, [esp + 0x2c]
jmp 0x41fdb4
call fcn.00426eb0
lea ecx, [esp + 0x34]
mov byte [esp + 0xa0], 0x1c
call fcn.004732d0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa0], 0x1b
call fcn.004732d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa0], 0x10
call fcn.004732d0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 0xa
call fcn.004732d0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa0], 9
call fcn.004732d0
sub dword [0x554674], 1
xor eax, eax
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0x10