Function at 0x413370
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x100
mov edi, ecx
mov eax, dword [0x5c1040]
xor eax, ebp
mov dword [esp + 0xf8], eax
xor esi, esi
dec esi
lea ebx, [esp + 0xec]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov ecx, ebx
call fcn.004bc9a0
push ebx
push 3
call fcn.004452f0
add esp, 8
mov ecx, edi
call fcn.00413860
test al, al
jne 0x4134bb
push 0x18
call fcn.004f190e
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x4131a0
push 0x4160d0
call fcn.004bc7c0
mov dword [ebx + 0x10], 0x418200
mov dword [esp + 0xe4], ebx
lea eax, [edi + 4]
push ebx
push eax
call fcn.00417530
add esp, 8
lea esi, [esp + 0x10]
push esi
call fcn.004b0580
add esp, 4
mov ebx, dword [esi]
mov esi, dword [esi + 4]
mov eax, ebx
or eax, esi
je 0x4135fc
mov eax, ebx
add eax, 1
mov edx, esi
adc edx, 0x80000000
mov ecx, SysReAllocString
cmp eax, 2
sbb edx, 0
jb 0x4134a7
xor eax, eax
add ebx, 0xb779c000
adc esi, 0xffd6a169
cmovo esi, ecx
cmovo ebx, eax
mov eax, ebx
add eax, 1
mov edx, SysReAllocString
adc edx, esi
cmp eax, 2
sbb edx, 0
mov edx, 0
jb 0x413600
mov eax, 0xf4240
push 0
push eax
push esi
push ebx
call fcn.00516b90
mov dword [esp + 8], eax
mov ecx, edx
mov eax, dword [esp + 8]
mov edx, 0xf4240
mul edx
mov dword [esp + 0xc], eax
imul eax, ecx, 0xf4240
add eax, edx
mov edx, dword [esp + 8]
cmp ebx, dword [esp + 0xc]
sbb esi, eax
setl al
movzx eax, al
sub edx, eax
sbb ecx, 0
jmp 0x413600
lea eax, [ecx - 1]
test esi, esi
cmovns ecx, eax
sar esi, 0x1f
not esi
mov edx, esi
jmp 0x413600
mov eax, dword [edi + 0x24]
mov dword [esp + 8], eax
lea ebx, [esp + 0x40]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov ecx, ebx
call fcn.0043ca20
mov eax, dword [esp + 8]
cmp byte [eax + 1], 1
mov eax, reloc.OLEAUT32.dll_SysReAllocString
sbb eax, 0
mov ecx, ebx
push 0x20019
push 0x59ae5e
push eax
call fcn.0043caf0
mov cl, 1
test eax, eax
jne 0x41350d
lea ecx, [esp + 0x40]
push 0x59aeba
call fcn.0043cba0
mov ecx, eax
mov byte [esp + 8], cl
lea ecx, [esp + 0x40]
call fcn.0043cb60
push 0x18
call fcn.004f190e
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x4131a0
push 0x4160d0
call fcn.004bc7c0
mov dword [ebx + 0x10], 0x418200
mov dword [esp + 0xe8], ebx
lea esi, [edi + 4]
push ebx
push esi
call fcn.00417530
add esp, 8
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x28]
mov al, byte [eax + 1]
mov byte [ecx + 1], al
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x28]
mov al, byte [eax]
mov byte [ecx], al
mov eax, dword [edi + 0x24]
mov ebx, dword [edi + 0x28]
cmp ebx, eax
je 0x413595
lea edx, [eax + 8]
lea ecx, [ebx + 8]
cmp byte [ebx + 0x13], 0
movzx ebx, byte [eax + 0x13]
js 0x413848
test bl, bl
jns 0x4135ec
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0043b0e0
mov ecx, edi
call fcn.00413970
mov ecx, edi
call fcn.00414340
test al, al
je 0x4136c0
lea eax, [edi + 0x20]
lea ecx, [edi + 0x10]
push eax
push ecx
push esi
push dword [edi + 0x24]
push 0
lea esi, [esp + 0x54]
push esi
call fcn.00416530
add esp, 0x18
mov bl, byte [esp + 0x40]
mov ecx, esi
call fcn.004164e0
test bl, bl
je 0x4136c0
mov ecx, edi
call fcn.00414430
mov ecx, edi
call fcn.00414510
jmp 0x413694
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
movq xmm0, qword [edx]
movq qword [ecx], xmm0
jmp 0x413595
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x40]
push ecx
push edx
push eax
call fcn.0043f210
add esp, 0xc
mov esi, edi
mov eax, dword [edi + 0x28]
lea edi, [eax + 8]
cmp byte [eax + 0x13], 0
jns 0x413627
push dword [edi]
call fcn.004f193e
add esp, 4
mov eax, dword [esp + 0x48]
mov dword [edi + 8], eax
movq xmm0, qword [esp + 0x40]
movq qword [edi], xmm0
push 0x47
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.004bb7d0
add esp, 8
mov byte [esp + 8], 1
test eax, eax
jle 0x4136bc
lea ebx, [esp + 0x40]
mov ecx, ebx
push 0xffffffffffffffff
push 0xcf
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044fd30
lea eax, [esp + 0x48]
push 0x1c
push str.AppId_for_new_installation:
push eax
call fcn.00499a00
add esp, 0xc
mov edi, esi
mov ecx, dword [esi + 0x28]
add ecx, 8
push ecx
push eax
call fcn.0044a4c0
add esp, 8
mov ecx, ebx
call fcn.00450200
lea ebx, [edi + 4]
mov ecx, edi
push ebx
lea eax, [esp + 0xf0]
push eax
call fcn.004149e0
test al, al
jne 0x4136f3
add edi, 0x10
mov ecx, edi
call fcn.00430be0
mov esi, 6
jmp 0x4136cf
mov edi, esi
jmp 0x413694
add edi, 0x10
mov ecx, edi
call fcn.00430be0
mov esi, 4
lea ecx, [esp + 0xec]
call fcn.004bcaf0
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.004f1eb0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [esp + 8]
mov ecx, edi
push eax
call fcn.00414e90
test al, al
jne 0x413715
add edi, 0x10
mov ecx, edi
call fcn.00430be0
mov esi, 7
jmp 0x4136cf
mov ecx, edi
call fcn.004154e0
test al, al
jne 0x413731
add edi, 0x10
mov ecx, edi
call fcn.00430be0
mov esi, 8
jmp 0x4136cf
mov dword [esp + 8], edi
lea edi, [esp + 0x10]
xor eax, eax
dec eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x20], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x40]
mov ecx, ebx
push 0x17
push 0x59b06c
push esi
call fcn.004bd830
mov ecx, edi
push esi
call fcn.00453b60
mov ecx, esi
call fcn.004bcaf0
mov esi, str.installfolder
push esi
call fcn.0050d550
add esp, 4
mov ecx, edi
push ebx
push eax
push esi
call fcn.00454b30
mov ecx, edi
push 0xd
push str.run_assistant
call fcn.00454740
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x28]
cmp byte [eax + 1], 0
mov eax, 0x59b09c
mov ebx, 0x59ad7d
cmove ebx, eax
mov eax, str.allusers
push eax
mov esi, str.allusers
call fcn.0050d550
add esp, 4
mov ecx, edi
push 1
push ebx
push eax
push esi
call fcn.00454e30
lea esi, [esp + 0x40]
mov ecx, esi
call fcn.004451f0
push esi
push edi
call fcn.0043ffb0
add esp, 8
mov ecx, esi
call fcn.00445240
push 0x47
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.004bb7d0
add esp, 8
test eax, eax
jle 0x41382f
lea edi, [esp + 0x40]
mov ecx, edi
push 0xffffffffffffffff
push 0xe9
push str.....operadesktopwindows_assistantinstaller_assistant_installer.cc
call fcn.0044fd30
lea eax, [esp + 0x48]
push 0x1b
push str.Finalizing_the_installation
push eax
call fcn.00499a00
add esp, 0xc
mov ecx, edi
call fcn.00450200
mov ecx, dword [esp + 8]
call fcn.004155c0
lea ecx, [esp + 0x10]
call fcn.00453fa0
xor esi, esi
jmp 0x4136cf
test bl, bl
jns 0x413852
mov ebx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push ebx
push edx
call fcn.0043b010
jmp 0x413595