Function at 0x4080a0
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Get installed programs
Query or enumerate registry value
Query service status

Disassembly:
push ebp
lea ebp, [esp - 0x4d0]
sub esp, 0x4d0
push 0xffffffffffffffff
push 0x4c8459
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4e7744]
xor eax, ebp
mov dword [ebp + 0x4cc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x50], 7
mov word [ebp + 0x3c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
push str.SOFTWARESynologyCloudStationBackup
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408d72
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xcc]
mov dword [ebp - 0x18], 0x400
push eax
push 0
push 0
push str.installer
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x40815f
push str.Failed_to_open_Cloud_Station_Backup_installer_type_reg_key_n
call fcn.0040b3d0
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408d72
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea ecx, [ebp + 0xcc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408173
sub ecx, edx
lea eax, [ebp + 0xcc]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x3c]
call fcn.00409f70
cmp dword [ebp + 0x50], 8
lea esi, [ebp + 0x3c]
cmovae esi, dword [ebp + 0x3c]
cmp dword [ebp + 0x4c], 4
jne 0x408486
mov ecx, str.nsis
mov edx, 4
sub esi, ecx
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x408486
add ecx, 2
sub edx, 1
jne 0x4081b3
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSynology_Cloud_Station_Backup
lea ecx, [ebp + 0x54]
call fcn.00401ac0
xor eax, eax
mov dword [ebp + 0xb4], 0
mov dword [ebp + 0xc4], 0
mov dword [ebp + 0xc8], 7
mov word [ebp + 0xb4], ax
cmp dword [ebp + 0x68], 8
lea ecx, [ebp - 0x10]
push ecx
push 0x20119
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 2
cmovae eax, dword [ebp + 0x54]
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x80000002
call eax
test eax, eax
jne 0x40825d
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x400
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
push 0
push str.UninstallString
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4082a0
push str.Failed_to_open_Cloud_Station_Backup_NSIS_UninstallString_reg_key_n
call fcn.0040b3d0
add esp, 4
push dword [ebp - 0x10]
call ebx
mov edx, dword [ebp + 0xc8]
cmp edx, 8
jb 0x40845c
mov ecx, dword [ebp + 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408452
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
jmp 0x408452
push dword [ebp - 0x10]
call ebx
lea eax, [ebp + 0xcc]
push eax
lea ecx, [ebp + 0xb4]
call fcn.00402700
lea eax, [ebp + 0xcc]
push eax
push 0
push dword [0x4e85f0]
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4082e6
push str.Failed_to_get_user_temp_folder_n
call fcn.0040b3d0
add esp, 4
jmp 0x40825d
lea eax, [ebp + 0xcc]
push eax
lea ecx, [ebp + 0x84]
call fcn.00401ac0
push str.AppDataLocalTempuninstaller.exe
lea ecx, [ebp + 0x84]
mov byte [ebp - 4], 3
call fcn.00402880
cmp dword [ebp + 0x98], 8
lea ecx, [ebp + 0x84]
push 0
cmovae ecx, dword [ebp + 0x84]
lea eax, [ebp + 0xb4]
cmp dword [ebp + 0xc8], 8
push ecx
cmovae eax, dword [ebp + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40835f
push str.Failed_to_copy_uninstaller_to_temp_folder_n
call fcn.0040b3d0
add esp, 4
lea ecx, [ebp + 0x84]
call fcn.004022d0
jmp 0x40825d
cmp dword [ebp + 0x98], 8
lea eax, [ebp + 0x84]
mov dword [ebp + 0x24], 0
cmovae eax, dword [ebp + 0x84]
mov dword [ebp + 0x10], eax
lea eax, [ebp]
push eax
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x40
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], str.open
mov dword [ebp + 0x14], 0x4ca270
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x98], 8
lea eax, [ebp + 0x84]
cmovae eax, dword [ebp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 0x84]
call fcn.004022d0
mov edx, dword [ebp + 0xc8]
cmp edx, 8
jb 0x40845c
mov ecx, dword [ebp + 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408452
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push edx
push ecx
call fcn.004aa4d8
add esp, 8
xor eax, eax
mov dword [ebp + 0xc4], 0
lea ecx, [ebp + 0x54]
mov dword [ebp + 0xc8], 7
mov word [ebp + 0xb4], ax
call fcn.004022d0
jmp 0x408d3c
lea eax, [ebp + 0x3c]
push 0x4ca278
push eax
call fcn.004013a0
add esp, 8
test al, al
je 0x408d2f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp + 0x54]
call fcn.00401ac0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.00401ba0
xor eax, eax
mov dword [ebp + 0x9c], 0
mov dword [ebp + 0xac], 0
mov dword [ebp + 0xb0], 7
mov word [ebp + 0x9c], ax
cmp dword [ebp + 0x68], 8
lea ecx, [ebp - 0x10]
push ecx
push 0x20119
lea eax, [ebp + 0x54]
mov byte [ebp - 4], 6
cmovae eax, dword [ebp + 0x54]
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x80000002
call eax
test eax, eax
jne 0x408c8e
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x10]
call fcn.00404eb0
add esp, 8
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x2c]
mov eax, 0x7ffffffe
mov dword [ebp - 0x14], ecx
mov esi, dword [ecx]
cmp esi, ecx
je 0x408a66
jmp 0x408540
cmp dword [esi + 0x1c], 8
lea edi, [esi + 8]
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x24], ecx
jb 0x408551
mov edi, dword [edi]
cmp ecx, 8
jae 0x40858c
mov eax, dword [edi]
mov ebx, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0xb4], eax
mov eax, dword [edi + 4]
mov dword [ebp + 0xb8], eax
mov eax, dword [edi + 8]
mov dword [ebp + 0xbc], eax
mov eax, dword [edi + 0xc]
mov edi, dword [ebp - 0x24]
mov dword [ebp + 0xc0], eax
mov dword [ebp + 0xc4], ecx
jmp 0x4085d0
mov ebx, ecx
lea ecx, [ebp + 0xb4]
or ebx, 7
cmp ebx, 0x7ffffffe
cmova ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.00409b60
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0xb4], eax
lea ecx, [ecx*2 + 2]
push ecx
push edi
push eax
call fcn.004ac060
mov edi, dword [ebp - 0x24]
add esp, 0xc
mov dword [ebp + 0xc4], edi
mov dword [ebp + 0xc8], ebx
mov ecx, dword [ebp + 0x64]
mov eax, 0x7ffffffe
sub eax, ecx
mov byte [ebp - 4], 7
cmp eax, 1
jb 0x408d9a
cmp dword [ebp + 0x68], 8
lea eax, [ebp + 0x54]
push 1
cmovae eax, dword [ebp + 0x54]
push 0x4c996c
push ecx
push eax
lea eax, [ebp + 0x54]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp + 0x24]
call fcn.00401b00
cmp ebx, 8
mov byte [ebp - 4], 8
lea eax, [ebp + 0xb4]
cmovae eax, dword [ebp - 0x1c]
lea ecx, [ebp + 0x24]
push edi
push eax
call fcn.00409d10
mov edx, eax
mov ecx, dword [edx]
mov dword [ebp + 0x84], ecx
mov ecx, dword [edx + 4]
mov dword [ebp + 0x88], ecx
mov ecx, dword [edx + 8]
mov dword [ebp + 0x8c], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp + 0x90], ecx
mov ecx, dword [edx + 0x10]
mov dword [ebp + 0x94], ecx
lea ecx, [ebp - 0x10]
mov eax, dword [edx + 0x14]
mov dword [ebp + 0x98], eax
xor eax, eax
push ecx
mov word [edx], ax
lea eax, [ebp + 0x84]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
cmp dword [ebp + 0x98], 8
push 0x20119
cmovae eax, dword [ebp + 0x84]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp + 0x98]
test eax, eax
setne bl
cmp edx, 8
jb 0x4086e5
mov ecx, dword [ebp + 0x84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4086db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push edx
push ecx
call fcn.004aa4d8
add esp, 8
mov edx, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp + 0x94], 0
mov dword [ebp + 0x98], 7
mov word [ebp + 0x84], ax
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x408740
mov ecx, dword [ebp + 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408736
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push edx
push ecx
call fcn.004aa4d8
add esp, 8
test bl, bl
jne 0x4088b2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x400
push eax
lea eax, [ebp + 0xcc]
push eax
push 0
push 0
push str.DisplayName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
je 0x40877e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4088b2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp + 0x6c], 0
lea ecx, [ebp + 0xcc]
mov dword [ebp + 0x7c], 0
mov dword [ebp + 0x80], 7
lea edx, [ecx + 2]
mov word [ebp + 0x6c], ax
jmp 0x4087b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4087b0
sub ecx, edx
lea eax, [ebp + 0xcc]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x6c]
call fcn.00409f70
mov eax, dword [ebp + 0x80]
lea edi, [ebp + 0x6c]
mov ebx, dword [ebp + 0x6c]
cmp eax, 8
mov byte [ebp - 4], 9
cmovae edi, ebx
cmp dword [ebp + 0x7c], 0x1d
jne 0x40887a
mov ecx, str.Synology_Cloud_Station_Backup
mov edx, 0x1d
sub edi, ecx
jmp 0x408800
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x408874
add ecx, 2
sub edx, 1
jne 0x408800
cmp dword [ebp + 0xc8], 8
lea edx, [ebp + 0xb4]
mov ecx, dword [ebp + 0xb0]
cmovae edx, dword [ebp + 0xb4]
mov eax, dword [ebp + 0xc4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
cmp eax, ecx
ja 0x40890d
lea esi, [eax + eax]
mov dword [ebp + 0xac], eax
cmp ecx, 8
lea edi, [ebp + 0x9c]
push esi
cmovae edi, dword [ebp + 0x9c]
push edx
push edi
call fcn.004ac060
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp + 0x9c]
jmp 0x4089c6
mov eax, dword [ebp + 0x80]
mov byte [ebp - 4], 7
cmp eax, 8
jb 0x4088b2
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4088a8
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push ecx
push ebx
call fcn.004aa4d8
add esp, 8
mov edx, dword [ebp + 0xc8]
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x4088f6
mov ecx, dword [ebp + 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4088ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push edx
push ecx
call fcn.004aa4d8
add esp, 8
mov eax, dword [esi]
mov esi, eax
cmp eax, dword [ebp - 0x14]
je 0x408a66
mov eax, 0x7ffffffe
jmp 0x408540
cmp eax, 0x7ffffffe
ja 0x408d9a
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x40892c
mov esi, 0x7ffffffe
jmp 0x40894a
mov edx, ecx
mov eax, 0x7ffffffe
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x408942
mov esi, 0x7ffffffe
jmp 0x40894a
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp + 0x9c]
call fcn.00409b60
mov edi, eax
mov dword [ebp + 0xb0], esi
mov eax, dword [ebp + 0xc4]
mov dword [ebp + 0xac], eax
lea esi, [eax + eax]
push esi
push dword [ebp - 0x14]
push edi
call fcn.004ac060
xor eax, eax
add esp, 0xc
mov word [esi + edi], ax
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x4089c0
mov ecx, dword [ebp + 0x9c]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4089b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push edx
push ecx
call fcn.004aa4d8
add esp, 8
mov dword [ebp + 0x9c], edi
cmp dword [ebp + 0xb0], 8
lea eax, [ebp + 0x9c]
cmovae eax, edi
push eax
push str.Cloud_Station_Backup_product_code_found:__s_n
call fcn.0040b3d0
mov eax, dword [ebp + 0x80]
add esp, 8
mov byte [ebp - 4], 7
cmp eax, 8
jb 0x408a22
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x408a18
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push ecx
push ebx
call fcn.004aa4d8
add esp, 8
mov eax, dword [ebp + 0xc8]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x408a66
mov ecx, dword [ebp + 0xb4]
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408a5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d95
push edx
push ecx
call fcn.004aa4d8
add esp, 8
lea eax, [ebp + 0x9c]
push 0x4c94bc
push eax
call fcn.004013a0
add esp, 8
test al, al
je 0x408a90
push str.Failed_to_find_product_code_of_Cloud_Station_Bakcup_n
call fcn.0040b3d0
add esp, 4
jmp 0x408c8e
mov ecx, dword [ebp + 0xac]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 2
jb 0x408d9f
cmp dword [ebp + 0xb0], 8
lea eax, [ebp + 0x9c]
push ecx
cmovae eax, dword [ebp + 0x9c]
lea ecx, [ebp + 0x24]
push eax
push 2
push 0x4ca41c
lea eax, [ebp + 0x9c]
push eax
push dword [ebp - 0x14]
call fcn.00401b00
push str.__quiet
lea eax, [ebp + 0x24]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.00401400
add esp, 0xc
lea ecx, [ebp + 0x24]
call fcn.004022d0
cmp dword [ebp + 0x80], 8
lea eax, [ebp + 0x6c]
cmovae eax, dword [ebp + 0x6c]
push eax
push str.Uninstall_command:__s_n
call fcn.0040b3d0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
xor esi, esi
lea ebx, [ebx]
lea eax, [ebp + 0x6c]
push eax
call fcn.00408db0
add esp, 4
cmp eax, 0x652
jne 0x408c3a
inc esi
push esi
push str.Msiexec_Mutex_is_set_so_uninstall_cannot_be_done__retry__d_n
call fcn.0040b3d0
add esp, 8
push 0x3e8
call ebx
cmp esi, 0x1e
jl 0x408b20
xor ebx, ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x408c10
push 0xc
push str.msiserver
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x408bf1
lea eax, [ebp - 0x14]
push eax
push 0x24
lea eax, [ebp + 0x18]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x408bcf
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov eax, dword [ebp + 0x20]
shr eax, 2
and al, 1
je 0x408c24
inc ebx
push ebx
push str.Msiexec_is_running_so_uninstall_cannot_be_done__retry__d_n
call fcn.0040b3d0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x1e
jl 0x408b54
jmp 0x408c3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryServiceStatusEx_failed___d__n
call fcn.0040b3d0
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
jmp 0x408c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenServiceW_failed___d__n
call fcn.0040b3d0
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push esi
call edi
jmp 0x408c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManagerW_failed___d__n
call fcn.0040b3d0
add esp, 8
push str.Msiexec_is_available__running_uninstaller..._n
call fcn.0040b3d0
lea eax, [ebp + 0x6c]
push eax
call fcn.00408db0
add esp, 8
mov edx, dword [ebp + 0x80]
cmp edx, 8
jb 0x408c77
mov ecx, dword [ebp + 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408c6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408da4
push edx
push ecx
call fcn.004aa4d8
add esp, 8
xor eax, eax
mov dword [ebp + 0x7c], 0
mov dword [ebp + 0x80], 7
mov word [ebp + 0x6c], ax
mov edx, dword [ebp + 0xb0]
cmp edx, 8
jb 0x408cce
mov ecx, dword [ebp + 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408cc4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408da4
push edx
push ecx
call fcn.004aa4d8
add esp, 8
xor eax, eax
mov dword [ebp + 0xac], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp + 0xb0], 7
mov word [ebp + 0x9c], ax
call fcn.004023c0
mov edx, dword [ebp + 0x68]
cmp edx, 8
jb 0x408d3c
mov ecx, dword [ebp + 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408d23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408da4
push edx
push ecx
call fcn.004aa4d8
add esp, 8
jmp 0x408d3c
push str.Failed_to_recognize_Cloud_Station_Backup_installer_type_n
call fcn.0040b3d0
add esp, 4
mov eax, dword [ebp + 0x50]
cmp eax, 8
jb 0x408d72
mov edx, dword [ebp + 0x3c]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x408d68
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408da9
push ecx
push edx
call fcn.004aa4d8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4cc]
xor ecx, ebp
call fcn.004aa4f4
lea esp, [ebp + 0x4d0]
pop ebp
ret
call fcn.004aeecf
call fcn.00409af0
call fcn.00409af0
call fcn.004aeecf
call fcn.004aeecf
int3