Function at 0x4915ba
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path

Disassembly:
push 0x78c
mov eax, 0x4e61f2
call fcn.004b5417
mov ebx, dword [ebp + 0x10]
push 0xffffffffffffffff
mov dword [ebp - 0x72c], ebx
call sub.IMM32.dll_ImmDisableIME
mov esi, 0x104
push esi
push 0x57
push 0x536618
call fcn.0048321a
add esp, 0xc
call fcn.0046affe
xor edi, edi
inc edi
test eax, eax
je 0x491609
push esi
push edi
push 0x536614
call fcn.0048321a
add esp, 0xc
push ebx
call fcn.00481125
pop ecx
test eax, eax
je 0x49161f
push 0xb
pop eax
call fcn.004b549a
ret 0x10
call fcn.0043a60d
test al, al
jne 0x49162f
push edi
call fcn.0044f175
pop ecx
lea ecx, [ebp - 0x718]
call fcn.0040c7d0
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004b47e0
add esp, 0xc
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov dword [ebp - 0x6f8], eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x53fda0
test eax, eax
je 0x492119
push ebx
call fcn.004b5eec
pop ecx
mov edi, eax
mov dword [ebp - 0x748], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [ebp - 0x748]
lea eax, [ebp - 0x718]
push edi
push 0x504788
push eax
call fcn.0040e3f0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x14
push dword [ebp - 0x718]
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x718]
call fcn.00428d50
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x4fb5c0
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
push 0x1f8
push str.FILE
call fcn.00493b26
add esp, 0xc
test al, al
jne 0x491812
lea ecx, [ebp - 0x718]
call fcn.00428e60
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004b47e0
add esp, 0xc
push 1
push 0x23
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x491765
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.0040d610
push 0x67
jmp 0x491616
push ebx
call fcn.004b5eec
pop ecx
mov dword [ebp - 0x70c], eax
mov dword [ebp - 0x708], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [ebp - 0x708]
lea eax, [ebp - 0x718]
push dword [ebp - 0x70c]
push 0x504788
push eax
call fcn.0040e3f0
add esp, 0x14
push dword [ebp - 0x718]
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x718]
call fcn.00428d50
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x4fb5c0
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
push 0x1f8
push str.FILE
call fcn.00493b26
add esp, 0xc
test al, al
jne 0x49181e
push 0x67
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.0040d610
mov eax, esi
jmp 0x491617
push dword [ebp - 0x718]
call fcn.0048d351
pop ecx
lea eax, [ebp - 0x218]
push eax
call fcn.0046a4c9
lea eax, [ebp - 0x744]
push eax
push dword [ebp - 0x72c]
mov dword [ebp - 0x744], ebx
call fcn.0048bcb7
add esp, 0xc
test eax, eax
je 0x491851
mov esi, dword [ebp - 0x744]
jmp 0x4917fc
mov ecx, 0x53f3f0
call fcn.0046d468
mov ecx, esi
call fcn.0049111c
test al, al
jne 0x49186a
push 0x65
jmp 0x4917fb
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call fcn.00484bb5
mov byte [ebp - 4], 1
push dword [eax]
lea ecx, [ebp - 0x250]
call fcn.0042b420
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x710]
call fcn.0040d610
lea eax, [ebp - 0x250]
push eax
call fcn.0048b3f7
pop ecx
call fcn.0048bc17
lea ecx, [ebp - 0x76c]
call fcn.0048e0fd
mov byte [ebp - 4], 4
push 0x3a
push dword [ebp - 0x72c]
lea ecx, [ebp - 0x76c]
call fcn.0048df9e
cmp al, 1
jne 0x491f15
cmp dword [ebp - 0x750], ebx
je 0x491f15
lea ecx, [ebp - 0x6fc]
call fcn.0040c7d0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x6fc]
push eax
push 0x504784
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x4919dd
mov byte [0x53fe3d], al
mov eax, dword [ebp - 0x6fc]
cmp dword [eax - 0xc], ebx
je 0x4919dd
cmp byte [0x53fe3c], bl
jne 0x4919dd
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call edi
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x6fc]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea ecx, [ebp - 0x6fc]
call fcn.0046f6d0
cmp ax, 0x5c
jne 0x49197f
mov eax, dword [ebp - 0x6fc]
mov eax, dword [eax - 0xc]
push 1
dec eax
push eax
lea ecx, [ebp - 0x6fc]
call fcn.00443860
push dword [ebp - 0x6fc]
call edi
mov dword [ebp - 0x704], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.Total_Security
push dword [ebp - 0x704]
call edi
test eax, eax
je 0x4919c8
push str.Total
push dword [ebp - 0x704]
call edi
test eax, eax
je 0x4919c8
push 0x501004
push dword [ebp - 0x704]
call edi
test eax, eax
je 0x4919c8
push 0x504764
lea ecx, [ebp - 0x6fc]
call fcn.00444b0f
push 1
lea ecx, [ebp - 0x6fc]
call fcn.0040c8a0
push eax
mov ecx, esi
call fcn.0048b477
lea ecx, [ebp - 0x720]
call fcn.0040c7d0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x720]
push eax
push 0x504760
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491a1a
mov eax, dword [ebp - 0x720]
cmp dword [eax - 0xc], ebx
je 0x491a1a
push eax
mov ecx, esi
call fcn.0048b496
lea ecx, [ebp - 0x738]
call fcn.0040c7d0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x738]
push eax
push 0x504758
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491a52
lea eax, [ebp - 0x738]
push eax
mov ecx, esi
call fcn.0048b4af
lea ecx, [ebp - 0x700]
call fcn.0040c7d0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x700]
push eax
push str.pmode
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491b3a
mov eax, dword [ebp - 0x700]
cmp dword [eax - 0xc], ebx
je 0x491b3a
lea ecx, [ebp - 0x700]
call fcn.0040c8a0
push eax
call fcn.004bc3a2
pop ecx
lea ecx, [ebp - 0x704]
mov edi, eax
call fcn.0040c7d0
mov byte [ebp - 4], 9
cmp edi, 0xfe
jne 0x491b0f
lea eax, [ebp - 0x704]
push eax
push str.regmode
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491b1f
mov eax, dword [ebp - 0x704]
cmp dword [eax - 0xc], ebx
je 0x491b1f
push eax
push 0x1f7
push str.FILE
call fcn.004758fa
add esp, 0xc
test al, al
je 0x491b1f
push dword [ebp - 0x704]
mov ecx, 0x53fe30
call fcn.00428d10
mov dword [0x53fe40], edi
jmp 0x491b2b
lea eax, [edi - 1]
cmp eax, 1
ja 0x491b1f
mov dword [0x53fe40], edi
jmp 0x491b2b
mov ecx, esi
call fcn.0046f2e9
mov dword [0x53fe40], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x704]
call fcn.0040d610
lea ecx, [ebp - 0x710]
call fcn.0040c7d0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x710]
push eax
push str.show
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491b69
mov byte [0x53fe3e], al
lea ecx, [ebp - 0x734]
call fcn.0040c7d0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x734]
push eax
push str.post
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491bc5
push str.wait
lea ecx, [ebp - 0x734]
mov byte [0x53fe51], al
call fcn.0043f457
test eax, eax
jne 0x491bc5
call fcn.0043b042
mov byte [0x53fe52], 1
cmp dword [0x53fedc], ebx
je 0x491bc5
call fcn.00481c48
lea ecx, [ebp - 0x71c]
call fcn.0040c7d0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x71c]
push eax
push 0x50472c
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491bf4
mov byte [0x53fe53], al
lea ecx, [ebp - 0x724]
call fcn.0040c7d0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x724]
push eax
push str.autodeploy
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491c23
mov byte [0x53fe54], al
lea ecx, [ebp - 0x740]
call fcn.0040c7d0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x740]
push eax
push str.campaign
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491c5e
lea eax, [ebp - 0x740]
push eax
mov ecx, 0x53fe34
call fcn.004453ce
lea ecx, [ebp - 0x730]
call fcn.0040c7d0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x730]
push eax
push str.syncid0_0
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491c94
mov dword [0x53fe6c], 1
jmp 0x491ce6
lea eax, [ebp - 0x730]
push eax
push str.syncid0_1
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491cbb
mov dword [0x53fe6c], 2
jmp 0x491ce6
lea eax, [ebp - 0x730]
push eax
push str.syncid0_2
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
mov dword [0x53fe6c], 3
cmp al, 1
je 0x491ce6
mov dword [0x53fe6c], ebx
lea ecx, [ebp - 0x728]
call fcn.0040c7d0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x728]
push eax
push str.promo
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491e26
mov eax, dword [ebp - 0x728]
push dword [eax - 0xc]
lea ecx, [ebp - 0x798]
call fcn.00456201
mov byte [ebp - 4], 0x11
push dword [ebp - 0x728]
lea ecx, [ebp - 0x704]
call fcn.004611c9
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x788]
sub ecx, dword [ebp - 0x78c]
mov edi, dword [eax]
push ecx
push ebx
lea ecx, [ebp - 0x798]
call fcn.0043c95b
push eax
push edi
call fcn.00460ae8
add esp, 0xc
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x704]
call fcn.0044209e
push ebx
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 0xf
call fcn.0040d1d0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x774]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040c520
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x74c], ecx
push ebx
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x748], eax
call fcn.0043c95b
mov edi, eax
add edi, dword [ebp - 0x708]
push ebx
lea ecx, [ebp - 0x798]
call fcn.0043c95b
push dword [ebp - 0x6f8]
lea ecx, [ebp - 0x234]
push edi
push eax
push dword [ebp - 0x748]
push dword [ebp - 0x74c]
call fcn.0045497d
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
call fcn.0048f915
mov byte [ebp - 4], 0x11
push ebx
push 1
lea ecx, [ebp - 0x234]
call fcn.0040d2f0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x798]
call fcn.00444c5d
lea ecx, [ebp - 0x73c]
call fcn.0040c7d0
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x73c]
push eax
push str.clientid
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x491e61
lea eax, [ebp - 0x73c]
push eax
mov ecx, 0x53fea0
call fcn.004453ce
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x73c]
call fcn.0040d610
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x728]
call fcn.0040d610
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x730]
call fcn.0040d610
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x740]
call fcn.0040d610
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x724]
call fcn.0040d610
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x71c]
call fcn.0040d610
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x734]
call fcn.0040d610
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x710]
call fcn.0040d610
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x700]
call fcn.0040d610
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x738]
call fcn.0040d610
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x720]
call fcn.0040d610
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6fc]
call fcn.0040d610
xor edi, edi
inc edi
cmp byte [0x53fe3d], bl
jne 0x4920f0
lea ecx, [ebp - 0x70c]
call fcn.00484479
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x70c]
call fcn.0048fba6
test al, al
je 0x491f62
push dword [ebp - 0x70c]
mov ecx, esi
call fcn.0048b496
lea eax, [ebp - 0x708]
push eax
mov ecx, esi
call fcn.0048b4af
jmp 0x4920e1
lea ecx, [ebp - 0x778]
call fcn.004844a7
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x778]
call fcn.00491088
test al, al
je 0x491fbd
lea eax, [ebp - 0x778]
push eax
mov ecx, 0x53fe9c
mov dword [0x53fe98], edi
call fcn.004453ce
push dword [ebp - 0x774]
mov ecx, esi
call fcn.0048b496
lea eax, [ebp - 0x770]
push eax
mov ecx, esi
call fcn.0048b4af
mov dword [0x53fe6c], edi
jmp 0x4920d2
lea ecx, [ebp - 0x700]
call fcn.0040c7d0
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x700]
push eax
push str.h2_hash
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x492018
lea eax, [ebp - 0x700]
push eax
mov ecx, 0x53fe9c
mov dword [0x53fe98], edi
call fcn.004453ce
mov dword [0x53fe6c], edi
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x700]
call fcn.0040d610
jmp 0x4920d2
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x700]
call fcn.0040d610
lea ecx, [ebp - 0x714]
call fcn.00484479
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x714]
call fcn.0048fc3a
test al, al
je 0x49206f
push dword [ebp - 0x714]
mov ecx, esi
mov dword [0x53fe98], 2
call fcn.0048b496
lea eax, [ebp - 0x710]
push eax
mov ecx, 0x53fe9c
call fcn.00446840
jmp 0x4920c3
lea ecx, [ebp - 0x700]
call fcn.0040c7d0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x700]
push eax
push str.h3_hash
lea ecx, [ebp - 0x76c]
call fcn.0048bb9b
cmp al, 1
jne 0x4920b4
lea eax, [ebp - 0x700]
push eax
mov ecx, 0x53fe9c
mov dword [0x53fe98], 2
call fcn.004453ce
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x700]
call fcn.0040d610
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x714]
call fcn.0044277f
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x778]
call fcn.004845d4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70c]
call fcn.0044277f
mov ecx, esi
call fcn.004909fd
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x76c]
call fcn.0048e11e
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp - 0x250]
call fcn.0040d590
xor edi, edi
inc edi
push 0x504678
call fcn.0043b83c
cmp eax, ebx
jne 0x492191
cmp byte [0x53fe3d], bl
jne 0x49218a
push 0x4fdbac
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call fcn.0047d67a
mov edi, eax
mov byte [ebp - 4], 0x1a
push str.ERROR_CNNOGDIPLUS
lea eax, [ebp - 0x708]
push eax
mov ecx, esi
call fcn.0047d67a
mov byte [ebp - 4], 0x1b
mov edi, dword [edi]
mov eax, dword [eax]
push ebx
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x708]
call fcn.0040d610
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x710]
call fcn.0040d610
push 0x66
jmp 0x4917fb
call fcn.0048ba12
call fcn.0048b923
push str.LocalQ360SafeI18NInstaller
call fcn.0046a34a
pop ecx
mov dword [ebp - 0x724], eax
cmp eax, ebx
jne 0x4921d9
cmp byte [0x53fe3d], bl
jne 0x4921d2
push ebx
push ebx
push 0x503208
call fcn.00463ca5
add esp, 0xc
cmp eax, ebx
je 0x4921d2
push eax
call fcn.0046a0c5
pop ecx
push 0x69
jmp 0x4917fb
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00481a9d
mov byte [ebp - 0x6f1], bl
cmp al, 1
jne 0x492204
cmp dword [ebp - 0x6f8], edi
jne 0x492204
mov byte [ebp - 0x6f1], al
call fcn.0046dc26
test al, al
je 0x4922d7
cmp byte [ebp - 0x6f1], bl
jne 0x4922d7
push dword [ebp - 0x724]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x53fe3d], bl
jne 0x4922d0
push str.UAC_ELEVATION_FAILED_MESSAGE
lea eax, [ebp - 0x71c]
push eax
mov ecx, esi
call fcn.0047d67a
mov edi, eax
mov byte [ebp - 4], 0x1c
push str.UAC_MESSAGE
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call fcn.0047d67a
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 0x1d
push str.UAC_TITLE
lea eax, [ebp - 0x708]
push eax
mov ecx, esi
call fcn.0047d67a
mov byte [ebp - 4], 0x1e
push edi
push dword [ebp - 0x6f8]
push eax
call fcn.0046dd93
add esp, 0xc
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x708]
call fcn.0040d610
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x710]
call fcn.0040d610
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x71c]
call fcn.0040d610
push 1
push dword [ebp - 0x72c]
push 0xffffffffffffffff
call fcn.0046de42
add esp, 0xc
push 0x6a
jmp 0x4917fb
call fcn.0048d467
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00481014
pop ecx
push ebx
push dword [ebp + 8]
mov ecx, 0x53fee4
push ebx
call fcn.00481bbd
call fcn.0048d99a
mov dword [ebp - 0x6fc], ebx
call fcn.00411bd0
call fcn.00411d40
mov eax, dword [0x53fb38]
cmp dword [eax - 0xc], ebx
jne 0x492372
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
call fcn.00484b80
mov byte [ebp - 4], 0x1f
push eax
mov ecx, 0x53fb38
call fcn.004453ce
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
call fcn.0048cba9
mov byte [ebp - 4], 0x20
push eax
mov ecx, 0x53fb3c
call fcn.004453ce
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
call fcn.0048b875
mov dword [0x53fed8], eax
cmp byte [0x53fe3d], bl
jne 0x4925ca
cmp byte [0x53fe3c], bl
jne 0x49248b
push 0x53fe7c
call fcn.00485204
pop ecx
test al, al
jne 0x4923b5
or dword [0x53fe64], 0xffffffff
mov dword [0x53fe58], ebx
jmp 0x492485
mov eax, dword [0x53fe6c]
cmp eax, ebx
jne 0x4923ca
push ebx
call fcn.0048fe16
pop ecx
jmp 0x49248b
cmp eax, edi
je 0x4923a3
cmp eax, 2
jne 0x49242e
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
mov dword [0x53fe58], edi
mov dword [0x53fe64], ebx
call fcn.00484bb5
mov byte [ebp - 4], 0x21
push 0x4fdb64
mov ecx, eax
call fcn.0043f457
neg eax
sbb al, al
inc al
mov byte [ebp - 0x6f1], al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
cmp byte [ebp - 0x6f1], bl
je 0x492425
mov dword [0x53fe64], edi
mov byte [0x53fe68], 1
jmp 0x49248b
cmp eax, 3
jne 0x49248b
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
mov dword [0x53fe58], edi
mov dword [0x53fe64], ebx
call fcn.00484bb5
mov byte [ebp - 4], 0x22
push 0x4fdb64
mov ecx, eax
call fcn.0043f457
neg eax
sbb al, al
inc al
mov byte [ebp - 0x6f1], al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
cmp byte [ebp - 0x6f1], bl
je 0x492485
mov dword [0x53fe64], edi
mov byte [0x53fe68], bl
lea ecx, [ebp - 0x780]
call fcn.004814d8
mov byte [ebp - 4], 0x23
push str.font
lea eax, [ebp - 0x708]
push eax
mov ecx, esi
mov byte [0x53fe3e], 1
call fcn.0047d67a
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
call fcn.0048caaa
mov byte [ebp - 4], 0x25
push dword [eax]
call fcn.00469dee
mov ecx, eax
call fcn.004684bc
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x708]
call fcn.0040d610
push str.IDCANCEL
lea eax, [ebp - 0x71c]
push eax
mov ecx, esi
call fcn.0047d67a
mov edi, eax
mov byte [ebp - 4], 0x26
push str.IDOK
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call fcn.0047d67a
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 0x27
push 0x4fdbac
lea eax, [ebp - 0x708]
push eax
mov ecx, esi
call fcn.0047d67a
mov byte [ebp - 4], 0x28
mov edx, dword [eax]
mov edi, dword [edi]
mov ecx, dword [ebp - 0x6f8]
mov ecx, dword [ecx]
mov eax, 0x50ea8c
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push ecx
push edx
call fcn.0048e215
add esp, 0x24
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x708]
call fcn.0040d610
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x710]
call fcn.0040d610
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x71c]
call fcn.0040d610
call fcn.0048dc12
call fcn.00497311
push dword [ebp + 0x14]
push dword [ebp - 0x72c]
lea eax, [ebp - 0x6fc]
push eax
call fcn.004914ed
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], bl
push dword [ebp - 0x770]
call sub.gdiplus.dll_GdiplusShutdown
jmp 0x492762
mov ecx, esi
call fcn.0049009b
test al, al
je 0x4925db
mov dword [0x536610], edi
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call fcn.0046fad7
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x710]
cmp dword [eax - 0xc], ebx
jne 0x492623
lea eax, [ebp - 0x6f8]
push eax
call fcn.0047ce4b
pop ecx
mov byte [ebp - 4], 0x2a
mov eax, dword [eax]
push ebx
push eax
mov ecx, esi
call fcn.0048b477
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
cmp byte [0x53fe3c], bl
je 0x49268a
call fcn.0043a60d
test al, al
jne 0x492645
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00481090
pop ecx
test eax, eax
jne 0x4926a1
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
call fcn.0046fad7
mov byte [ebp - 4], 0x2b
push dword [eax]
call fcn.0043ee36
neg al
sbb al, al
inc al
pop ecx
mov byte [ebp - 0x6f1], al
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
cmp byte [ebp - 0x6f1], bl
je 0x4926a1
push 0x72
pop edi
jmp 0x492754
push 0x53fe7c
call fcn.00484aaa
pop ecx
cmp eax, 2
jne 0x4926a1
mov byte [0x53fe3e], 1
lea ecx, [ebp - 0x6f0]
call fcn.0049d41a
mov byte [ebp - 4], 0x2c
mov edi, dword [ebp - 0x66c]
cmp edi, ebx
jne 0x492712
lea eax, [ebp - 0x6f0]
push eax
call fcn.004a490c
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x492712
call fcn.00497311
push str.Install1992
mov ecx, 0x53ff20
call fcn.00444b0f
lea ecx, [ebp - 0x6f0]
call fcn.0049e62f
cmp al, 1
jne 0x4926fb
push ebx
push ebx
call fcn.004a1c69
pop ecx
pop ecx
jmp 0x492712
mov edi, dword [ebp - 0x66c]
mov dword [ebp - 0x6fc], edi
cmp edi, ebx
jne 0x492712
or dword [ebp - 0x6fc], 0xffffffff
call fcn.0048ef1e
cmp edi, ebx
je 0x492722
push edi
call fcn.004a091f
pop ecx
cmp dword [ebp - 0x6ec], ebx
je 0x49273a
push ebx
push ebx
push 0x12
push dword [ebp - 0x6ec]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x6f0]
call fcn.00493c44
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x6f0]
call fcn.00499725
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x710]
call fcn.0040d610
cmp edi, ebx
jne 0x4928aa
cmp byte [0x53fe3c], bl
jne 0x4928aa
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
call fcn.00484be7
mov byte [ebp - 4], 0x2d
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
setne byte [ebp - 0x6f1]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
cmp byte [ebp - 0x6f1], bl
je 0x4927bb
push dword [ebp - 0x6fc]
call fcn.0048efc6
pop ecx
jmp 0x492856
lea eax, [ebp - 0x6f8]
push eax
mov ecx, esi
call fcn.00484b80
mov byte [ebp - 4], 0x2e
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
setne byte [ebp - 0x6f1]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x6f8]
call fcn.0040d610
cmp byte [ebp - 0x6f1], bl
je 0x492856
lea eax, [ebp - 0x71c]
push eax
mov ecx, esi
call fcn.00484b80
mov byte [ebp - 4], 0x2f
push 3
lea eax, [ebp - 0x710]
push eax
lea ecx, [ebp - 0x71c]
call fcn.0046a66c
mov byte [ebp - 4], 0x30
push 0x504574
lea ecx, [ebp - 0x710]
call fcn.0043f457
test eax, eax
jne 0x492839
push dword [ebp - 0x6fc]
call fcn.0048efc6
pop ecx
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x710]
call fcn.0040d610
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x71c]
call fcn.0040d610
lea eax, [ebp - 0x720]
push eax
call fcn.0048f0e5
pop ecx
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x720]
cmp dword [eax - 0xc], ebx
je 0x49289c
push 1
push ebx
push ebx
push eax
mov esi, str.open
push esi
push ebx
call fcn.0046a56a
add esp, 0x18
test al, al
jne 0x49289c
push 1
push ebx
push ebx
push dword [ebp - 0x720]
push esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x720]
call fcn.0040d610
call fcn.0049e71f
call fcn.00411d60
call fcn.00411cf0
call fcn.00481b11
push dword [ebp - 0x724]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x53fe3d], bl
jne 0x4928ec
push 0xffffffffffffffff
call fcn.0048dc12
mov ecx, eax
call fcn.004816ff
call fcn.0048dc12
mov ecx, eax
call fcn.00493c44
cmp dword [0x53fecc], 1
jne 0x492902
push ebx
push 2
push 1
call fcn.0049e745
add esp, 0xc
mov ecx, 0x53fee4
call fcn.00484f82
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, edi
jmp 0x4917fc