Function at 0x409390
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports
Self delete

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46ab69
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x484060]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [esp + 0x34]
push eax
call fcn.0040227e
xor edi, edi
mov dword [esp + 0xa8], edi
mov dword [esp + 0x38], 1
push 0xfffffffffffffffe
pop eax
cmp dword [esi + 0x5a8], edi
je 0x409412
or dword [esp + 0x2c], 0xffffffff
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x34]
lea eax, [esi + 0x5ac]
push eax
mov dword [esp + 0x44], edi
call fcn.004376a1
mov eax, dword [esp + 0x2c]
add eax, 2
cmp eax, 0x4b
ja case.default.0x40941e
jmp dword [eax*4 + 0x40b130]
cmp dword [esi + 0x5a8], edi
jne 0x409f5d
mov esi, dword [ebp + 8]
push str.StartInstall_v
add esi, 0x5ac
xor edi, edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
inc edi
cmp dword [esi + 0x5a8], eax
jne 0x409ff3
mov esi, dword [ebp + 8]
push str.DoExit_v
add esi, 0x5ac
call fcn.0040bd5d
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [esi + 0x5a8], eax
jne 0x40a010
mov esi, dword [ebp + 8]
push str.DoExit_i
push 2
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a02c
mov esi, dword [ebp + 8]
push str.DoSelectFolder_ss
push 3
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a0eb
mov esi, dword [ebp + 8]
push str.SetInstallPath_s
push 4
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a14d
mov esi, dword [ebp + 8]
push str.GetInstallPath_v
push 5
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a19c
mov esi, dword [ebp + 8]
push str.RemoveEndBS_s
push 6
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a1b8
mov esi, dword [ebp + 8]
push str.SetName_s
push 7
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a1e5
mov esi, dword [ebp + 8]
push str.GetAppVersion_v
push 8
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a20c
mov esi, dword [ebp + 8]
push str.GetBetaVersion_v
push 9
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a223
mov esi, dword [ebp + 8]
push str.GetTargetMachine_v
push 0xa
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a22b
mov esi, dword [ebp + 8]
push str.GetUninstDispName_v
push 0xb
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a233
mov esi, dword [ebp + 8]
push str.DigPath_s
push 0xc
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a261
mov esi, dword [ebp + 8]
push str.LoadRTF_is
push 0xd
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a2b3
mov esi, dword [ebp + 8]
push str.SetLanguage_s
push 0xe
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a2e3
mov esi, dword [ebp + 8]
push str.SetTitle_s
push 0xf
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a323
mov esi, dword [ebp + 8]
push str.GetLanguageAsLocal_v
push 0x10
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a33c
mov esi, dword [ebp + 8]
push str.GetLanguage_v
push 0x11
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a385
mov esi, dword [ebp + 8]
push str.Is64BitOS_v
push 0x12
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a39e
mov esi, dword [ebp + 8]
push str.GetPlatform_v
push 0x13
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a3e5
mov esi, dword [ebp + 8]
push str.LANG_s
push 0x14
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a42b
mov esi, dword [ebp + 8]
push str.GetRegStr_s
push 0x15
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a4a1
mov esi, dword [ebp + 8]
push str.GetRegStr64_s
push 0x16
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a50f
mov esi, dword [ebp + 8]
push str.GetRegInt_s
push 0x17
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a557
mov esi, dword [ebp + 8]
push str.GetRegInt64_s
push 0x18
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a571
mov esi, dword [ebp + 8]
push str.SetRegStr_ss
push 0x19
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a5ff
mov esi, dword [ebp + 8]
push str.SetRegStr64_ss
push 0x1a
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a674
mov esi, dword [ebp + 8]
push str.SetRegInt_si
push 0x1b
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a6b7
mov esi, dword [ebp + 8]
push str.SetRegInt64_si
push 0x1c
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a6d4
mov esi, dword [ebp + 8]
push str.MessageBox_s
push 0x1d
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a70b
mov esi, dword [ebp + 8]
push str.MessageBox_i
push 0x1e
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a765
mov esi, dword [ebp + 8]
push str.MessageBox_si
push 0x1f
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a7b7
mov esi, dword [ebp + 8]
push str.CreateShortcut_ssss
push 0x20
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a86b
mov esi, dword [ebp + 8]
push str.ExecWait_ss
push 0x21
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a86b
mov esi, dword [ebp + 8]
push str.Sleep_i
push 0x22
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a897
mov esi, dword [ebp + 8]
push str.TouchURL_ss
push 0x23
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a8c5
mov esi, dword [ebp + 8]
push str.ShellExecute_s
push 0x24
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a91e
mov esi, dword [ebp + 8]
push str.RunNonElevated_ss
push 0x25
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a9bf
mov esi, dword [ebp + 8]
push str.GetPackingDate_s
push 0x26
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aa01
mov esi, dword [ebp + 8]
push str.GetIniStr_sss
push 0x27
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aa57
mov esi, dword [ebp + 8]
push str.CloseApp_ss
push 0x28
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aa91
mov esi, dword [ebp + 8]
push str.CloseApp_s
push 0x29
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aaa9
mov esi, dword [ebp + 8]
push str.WaitAppExit_si
push 0x2a
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aae4
mov esi, dword [ebp + 8]
push str.DeleteFile_s
push 0x2b
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40abdf
mov esi, dword [ebp + 8]
push 0x470ff4
push 0x2c
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac06
mov esi, dword [ebp + 8]
push str.RemoveDirectory_s
push 0x2d
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac39
mov esi, dword [ebp + 8]
push str.DeleteFolderRec_s
push 0x2e
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac63
mov esi, dword [ebp + 8]
push str.RegDeleteKey_s
push 0x2f
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac89
mov esi, dword [ebp + 8]
push str.RegDeleteKey64_s
push 0x30
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac90
mov esi, dword [ebp + 8]
push str.GetAccountType_v
push 0x31
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac9a
mov esi, dword [ebp + 8]
push str.IsXPOrLess_v
push 0x32
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40acc4
mov esi, dword [ebp + 8]
push str.IsVistaOrLess_v
push 0x33
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40acd3
mov esi, dword [ebp + 8]
push str.IsWin11OrLater_v
push 0x34
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ace2
mov esi, dword [ebp + 8]
push str.GetTime_v
push 0x35
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40acf2
mov esi, dword [ebp + 8]
push str.HideWindow_v
push 0x36
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad02
mov esi, dword [ebp + 8]
push str.GetCommandLine_v
push 0x37
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad43
mov esi, dword [ebp + 8]
push str.GetCommandLine_i
push 0x38
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad89
mov esi, dword [ebp + 8]
push str.GetParam_i
push 0x39
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40adcf
mov esi, dword [ebp + 8]
push str.IsCommandLineAuto_v
push 0x3a
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40addb
mov esi, dword [ebp + 8]
push str.IsCommandLineSilent_v
push 0x3b
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ade7
mov esi, dword [ebp + 8]
push str.IsFile_s
push 0x3c
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ae17
mov esi, dword [ebp + 8]
push str.CheckVersionAsync_ssssss
push 0x3d
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aed7
mov esi, dword [ebp + 8]
push str.FindWindow_s
push 0x3e
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aef8
mov esi, dword [ebp + 8]
push str.FindProcess_s
push 0x3f
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40af18
mov esi, dword [ebp + 8]
push str.CopyFile_ss
push 0x40
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40af7e
mov esi, dword [ebp + 8]
push str.ShowMainWindow_i
push 0x41
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40af96
mov esi, dword [ebp + 8]
push str.SetFocusByID_i
push 0x42
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40afc3
mov esi, dword [ebp + 8]
push str.GetControlText_i
push 0x43
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b009
mov esi, dword [ebp + 8]
push str.SetControlEnable_ii
push 0x44
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b034
mov esi, dword [ebp + 8]
push str.IsValidEmail_s
push 0x45
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b04c
mov esi, dword [ebp + 8]
push str.IsValidBandizipEntProductKey_s
push 0x46
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b064
mov esi, dword [ebp + 8]
push str.IsShiftPressing_v
push 0x47
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b096
mov esi, dword [ebp + 8]
push str.MutexExist_s
push 0x48
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b0e0
mov esi, dword [ebp + 8]
push str.PinToTaskbar_s
push 0x49
add esi, 0x5ac
pop edi
call fcn.0040bd5d
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi + 0x5a8], 1
cmp dword [esp + 0x38], edi
jne 0x4093e5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
call fcn.004017c3
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x4f8]
cmp dword [eax - 0xc], edi
jne 0x409f7e
push edi
push 0x46f164
push str.call_SetName___first
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x409f37
mov eax, dword [esi + 0x504]
cmp dword [eax - 0xc], edi
jne 0x409faf
push edi
push 0x46f164
push str.call_SetInstallPath___first
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, esi
jmp 0x409f45
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
call fcn.00402be6
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
test eax, eax
je 0x409fee
push 0
push 0x800a
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
inc esi
jmp 0x409f9f
mov dword [esi + 0x4bc], edi
mov dword [esi + 0x4b8], eax
push eax
push eax
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, edi
jmp 0x409f9f
xor edi, edi
inc edi
mov dword [esi + 0x4bc], edi
mov dword [esi + 0x4b8], eax
mov ecx, dword [ebx]
mov ecx, dword [ecx + 8]
mov dword [esi + 0x4d0], ecx
jmp 0x409fff
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.004407e4
mov byte [esp + 0xa8], 1
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 2
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x2c], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xac], 3
mov ebx, dword [esp + 0x20]
push ecx
add ebx, 0xfffffff0
mov eax, ebx
mov dword [esp + 0x2c], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x28]
push eax
push dword [ebp + 8]
mov byte [esp + 0xb8], 2
call fcn.0040bb0c
mov byte [esp + 0xa8], 4
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.004408ce
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, esi
call fcn.004017c3
mov eax, ebx
call fcn.004017c3
jmp 0x409fee
push dword [ebx]
lea esi, [esp + 0x54]
call fcn.004407e4
mov edi, dword [ebp + 8]
add edi, 0x504
mov byte [esp + 0xa8], 5
call fcn.00401470
mov byte [esp + 0xa8], 0
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [edi]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
call fcn.00402be6
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
jmp 0x409fee
mov eax, dword [esi + 0x504]
sub eax, 0x10
call fcn.004015e7
add eax, 0x10
mov dword [esp + 0x20], eax
lea edi, [esp + 0x20]
mov byte [esp + 0xa8], 6
call fcn.0040341e
mov esi, dword [esp + 0x20]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.004408ce
mov eax, esi
jmp 0x40a0e1
push dword [ebx]
lea esi, [esp + 0x24]
call fcn.004407e4
mov ecx, esi
mov byte [esp + 0xa8], 7
call fcn.004034c6
jmp 0x40a173
push dword [ebx]
lea esi, [esp + 0x4c]
call fcn.004407e4
mov edi, dword [ebp + 8]
add edi, 0x4f8
mov byte [esp + 0xa8], 8
call fcn.00401470
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
jmp 0x40a0e1
mov eax, dword [esi + 0x518]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.004408ce
jmp 0x409fee
mov esi, dword [esi + 0x51c]
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], esi
jmp 0x409fee
mov eax, dword [esi + 0x524]
jmp 0x40a1eb
mov eax, dword [esi + 0x528]
jmp 0x40a1eb
push dword [ebx]
lea esi, [esp + 0x24]
call fcn.004407e4
push ecx
mov byte [esp + 0xac], 9
mov edi, esp
mov dword [esp + 0x18], esp
call fcn.004036f4
call fcn.0040284b
mov eax, dword [esp + 0x24]
pop ecx
jmp 0x40a1dd
mov eax, dword [ebx]
mov eax, dword [eax + 8]
push dword [ebx + 4]
lea esi, [esp + 0x24]
mov dword [esp + 0x18], eax
call fcn.004407e4
push ecx
mov byte [esp + 0xac], 0xa
mov edi, esp
mov dword [esp + 0x20], esp
call fcn.004036f4
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0040b260
mov esi, dword [esp + 0x20]
test eax, eax
jne 0x40a2ab
push esi
push str.LoadRTF__s__FALSE
call fcn.004025b1
pop ecx
pop ecx
lea eax, [esi - 0x10]
jmp 0x40a0e1
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.004407e4
mov edi, dword [ebp + 8]
lea esi, [edi + 0x608]
call fcn.0040dd4f
push 0
push 0x801a
push 0x111
push dword [edi + 4]
jmp 0x409fe8
push dword [ebx]
lea esi, [esp + 0x6c]
call fcn.004407e4
mov edi, dword [ebp + 8]
add edi, 0x500
mov byte [esp + 0xa8], 0xb
call fcn.00401470
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
call fcn.004017c3
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x409fee
mov eax, dword [ebp + 8]
push ecx
add eax, 0x608
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.0040de5c
jmp 0x40a1ff
lea ecx, [esi + 0x608]
lea edx, [esp + 0x38]
call fcn.0040de22
lea eax, [esp + 0x38]
mov byte [esp + 0xa8], 0xc
call fcn.004051a4
mov eax, dword [esp + 0x38]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.004408ce
mov eax, dword [esp + 0x38]
jmp 0x40a1dd
call fcn.004032d4
cmp byte [esi + 0x530], 0
je 0x40a13c
xor eax, eax
jmp 0x40a13c
cmp byte [esi + 0x530], 0
je 0x40a3b5
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push 0x46ee54
jmp 0x40a3ca
cmp byte [esi + 0x531], 0
je 0x40a3d5
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.ARM64
push eax
call fcn.0040227e
jmp 0x40a1ff
call fcn.00403327
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
push ecx
jmp 0x40a3cb
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0xd
mov esi, dword [esp + 0x14]
push esi
push ecx
call fcn.00436a89
pop ecx
mov ecx, str.INSTALLER
mov edx, eax
call fcn.004371b8
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
push ecx
call fcn.0040227e
mov edi, dword [ebp + 0x10]
call fcn.004408ce
jmp 0x40a2ab
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0xe
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
xor ebx, ebx
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x38]
push eax
mov ecx, ebx
call fcn.00411255
mov byte [esp + 0xb0], 0xf
mov eax, dword [esp + 0x3c]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.004408ce
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
call fcn.004017c3
jmp 0x40a195
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x10
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov ebx, 0x100
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
call fcn.00411255
mov byte [esp + 0xb0], 0x11
mov eax, dword [esp + 0x2c]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.004408ce
mov eax, dword [esp + 0x24]
jmp 0x40a494
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x12
xor ebx, ebx
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.0041135a
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
jmp 0x40a195
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x13
mov ebx, 0x100
jmp 0x40a524
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.004407e4
mov byte [esp + 0xa8], 0x14
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x15
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x2c], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xac], 0x16
mov edi, dword [esp + 0x20]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x2c], esp
mov ebx, esp
call fcn.004015e7
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xb0], 0x15
xor ecx, ecx
call fcn.00411446
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
mov eax, esi
call fcn.004017c3
mov eax, edi
jmp 0x40a0e1
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.004407e4
mov byte [esp + 0xa8], 0x17
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x18
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x2c], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xac], 0x19
mov edi, dword [esp + 0x20]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x2c], esp
mov ebx, esp
call fcn.004015e7
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xb0], 0x18
mov ecx, 0x100
jmp 0x40a5de
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x1a
mov eax, dword [ebx + 4]
xor ebx, ebx
mov eax, dword [eax + 8]
mov esi, dword [esp + 0x14]
push eax
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.0041155e
pop ecx
jmp 0x40a545
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x1b
mov eax, dword [ebx + 4]
mov ebx, 0x100
jmp 0x40a68c
cmp dword [esi + 0x4c4], 0
je 0x409fee
push dword [ebx]
lea esi, [esp + 0x44]
call fcn.004407e4
mov ecx, dword [ebp + 8]
push 0
push dword [ecx + 0x500]
push dword [eax]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x40]
jmp 0x40a1dd
mov eax, dword [0x4872ec]
mov ecx, 0x4872ec
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0xa8], 0x1c
mov eax, dword [ebx]
push dword [eax + 8]
lea eax, [esp + 0x28]
push 0x4715ac
push eax
call fcn.00402550
mov edi, dword [esp + 0x30]
add esp, 0xc
cmp dword [esi + 0x4c4], 0
je 0x40a75d
push 0
push dword [esi + 0x500]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [edi - 0x10]
jmp 0x40a0e1
xor edi, edi
inc edi
cmp dword [esi + 0x4c4], 0
je 0x40a7a6
push dword [ebx]
lea esi, [esp + 0x7c]
call fcn.004407e4
mov ecx, dword [ebp + 8]
mov esi, dword [ebx + 4]
push dword [esi + 8]
mov edx, dword [ecx + 0x500]
mov eax, dword [eax]
push edx
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], edi
jmp 0x409fee
push dword [ebx + 0xc]
lea esi, [esp + 0x84]
call fcn.004407e4
mov edi, eax
mov byte [esp + 0xa8], 0x1d
push dword [ebx + 8]
lea esi, [esp + 0x64]
call fcn.004407e4
mov dword [esp + 0x14], eax
mov byte [esp + 0xa8], 0x1e
push dword [ebx + 4]
lea esi, [esp + 0x74]
call fcn.004407e4
mov dword [esp + 0x1c], eax
mov byte [esp + 0xa8], 0x1f
push dword [ebx]
lea esi, [esp + 0x5c]
call fcn.004407e4
mov byte [esp + 0xa8], 0x20
mov edi, dword [edi]
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
mov eax, dword [eax]
push edi
push ecx
push edx
push eax
call fcn.004038f8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x68]
add esp, 0x10
add eax, 0xfffffff0
mov dword [ecx], 2
call fcn.004017c3
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [esp + 0x80]
jmp 0x40a1dd
push dword [esi + 4]
push dword [ebp + 0x10]
mov eax, dword [esp + 0x38]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
call fcn.00401377
add esp, 0x10
jmp 0x409fee
push dword [ebx + 4]
lea esi, [esp + 0x48]
call fcn.004407e4
push dword [eax]
push str.TouchURL:__s
call fcn.004025b1
mov eax, dword [esp + 0x4c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [ebp + 8]
push dword [eax + 4]
jmp 0x40a86e
push dword [ebx]
lea esi, [esp + 0x50]
call fcn.004407e4
mov eax, dword [eax]
push 5
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
call fcn.004017c3
cmp esi, 0x20
jle 0x409fee
push dword [ebx]
lea esi, [esp + 0x58]
call fcn.004407e4
push dword [eax]
push str.__rShellExecute__s_failed
call fcn.004025b1
mov eax, dword [esp + 0x5c]
pop ecx
pop ecx
jmp 0x40a1dd
push dword [ebx]
lea esi, [esp + 0x38]
call fcn.004407e4
mov byte [esp + 0xa8], 0x21
push dword [ebx + 4]
lea esi, [esp + 0x28]
call fcn.004407e4
mov byte [esp + 0xa8], 0x22
mov esi, dword [esp + 0x24]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xac], 0x23
mov edi, dword [esp + 0x38]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x24], esp
mov ebx, esp
call fcn.004015e7
push dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xb4], 0x22
call fcn.0040b7b1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
test eax, eax
jne 0x40a5f1
push dword [esp + 0x24]
push dword [esp + 0x38]
push str.__rRunNonElevated__s___s_failed
call fcn.004025b1
add esp, 0xc
jmp 0x40a5f1
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x24
mov esi, dword [esp + 0x14]
push ecx
mov dword [esp + 0x20], esp
mov ebx, esp
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
mov ecx, dword [ebp + 8]
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.0040b3fe
jmp 0x40a18d
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
push dword [ebx + 8]
call fcn.004407e4
push ecx
mov byte [esp + 0xb4], 0x25
mov esi, esp
mov dword [esp + 0x28], esp
push dword [ebx + 4]
call fcn.004407e4
push ecx
mov byte [esp + 0xb8], 0x26
mov esi, esp
mov dword [esp + 0x38], esp
push dword [ebx]
call fcn.004407e4
push edi
mov byte [esp + 0xbc], 0
call fcn.0040b49a
jmp 0x40a1ff
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx + 4]
call fcn.004407e4
push ecx
mov byte [esp + 0xb0], 0x27
mov esi, esp
mov dword [esp + 0x24], esp
push dword [ebx]
call fcn.004407e4
push dword [ebp + 8]
mov byte [esp + 0xb4], 0
call fcn.0040b548
jmp 0x40a13c
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.004407e4
call fcn.0040b5d2
jmp 0x40a13c
push dword [ebx]
lea esi, [esp + 0x30]
call fcn.004407e4
mov eax, dword [ebx + 4]
mov esi, dword [eax + 8]
jmp 0x40aad7
push 0
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40aadb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 0x64
test esi, esi
jg 0x40aabc
mov eax, dword [esp + 0x2c]
jmp 0x40a1dd
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.004407e4
lea esi, [esp + 0x40]
call fcn.00403717
mov byte [esp + 0xac], 0x28
xor ecx, ecx
mov dword [esp], 0x470fec
call fcn.00405155
test eax, eax
jge 0x40ab40
push 0x470ff0
xor ecx, ecx
call fcn.00405155
test eax, eax
jge 0x40ab40
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
jmp 0x40abd6
xor eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], 0xa
push eax
mov byte [esp + 0xac], 0x29
mov eax, dword [esp + 0x40]
push ecx
add eax, 0xfffffff0
lea ebx, [esp + 0x8c]
mov dword [esp + 0x1c], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
call fcn.004044b6
mov esi, dword [esp + 0x8c]
pop ecx
xor edi, edi
pop ecx
inc edi
jmp 0x40abba
mov eax, esi
push dword [eax + 8]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, eax
test esi, esi
jne 0x40abab
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x84]
mov dword [eax], 2
mov dword [eax + 8], edi
call fcn.004366f6
mov eax, dword [esp + 0x3c]
jmp 0x40a1dd
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
push dword [ebx]
call fcn.004407e4
mov esi, edi
call fcn.00403717
pop ecx
call fcn.0040b634
jmp 0x40a13c
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.004407e4
lea esi, [esp + 0x60]
call fcn.00403717
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
call fcn.004017c3
jmp 0x40a212
push 1
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x20], esp
push dword [ebx]
call fcn.004407e4
mov esi, edi
call fcn.00403717
pop ecx
call 0x403ef4
pop ecx
jmp 0x40a13b
push 0
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x20], esp
push dword [ebx]
call fcn.004407e4
mov esi, edi
call fcn.00403717
pop ecx
call fcn.0040406e
jmp 0x40ac5d
push 0x100
jmp 0x40ac65
call fcn.0040ed06
jmp 0x40a3da
call fcn.004042ab
xor ecx, ecx
cmp eax, 7
setl cl
cmp byte [esi + 0x534], 0
je 0x40acb3
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], ecx
jmp 0x409fee
call fcn.004042ab
xor ecx, ecx
cmp eax, 0xa
setl cl
jmp 0x40acb3
call fcn.004042ab
xor ecx, ecx
cmp eax, 0x12
setge cl
jmp 0x40acb3
push 0
call fcn.0044a126
mov dword [esp + 0x1c], edx
jmp 0x40a13b
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x409fee
mov edi, dword [ebp + 8]
add edi, 0x530
lea esi, [esp + 0x64]
mov eax, edi
call fcn.00407880
push dword [eax]
push str.GetCommandLine____s
call fcn.004025b1
mov eax, dword [esp + 0x6c]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004017c3
push ecx
mov esi, esp
mov eax, edi
mov dword [esp + 0x18], esp
call fcn.00407880
jmp 0x40a1ff
mov eax, dword [ebx]
mov ebx, dword [eax + 8]
lea eax, [esp + 0x28]
push eax
lea ecx, [esi + 0x530]
call fcn.00401b52
mov byte [esp + 0xa8], 0x2a
mov eax, dword [esp + 0x28]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.004408ce
mov eax, dword [esp + 0x28]
jmp 0x40a1dd
mov eax, dword [ebx]
mov ebx, dword [eax + 8]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x530]
call fcn.00401bae
mov byte [esp + 0xa8], 0x2b
mov eax, dword [esp + 0x1c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.004408ce
mov eax, dword [esp + 0x1c]
jmp 0x40a1dd
movzx eax, byte [esi + 0x533]
jmp 0x40a13c
movzx eax, byte [esi + 0x532]
jmp 0x40a13c
push dword [ebx]
lea esi, [esp + 0x70]
call fcn.004407e4
mov byte [esp + 0xa8], 0x2c
push dword [eax]
call fcn.0041ba17
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [ecx], 2
jmp 0x40a1dd
push dword [ebx + 0xc]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x2d
mov edi, dword [esp + 0x14]
push edi
push str.CheckVersionAsync__s__
call fcn.004025b1
pop ecx
mov esi, esp
mov dword [esp + 0x20], esp
push dword [ebx + 0x14]
call fcn.004407e4
push ecx
mov byte [esp + 0xb0], 0x2e
mov esi, esp
mov dword [esp + 0x30], esp
push dword [ebx + 0x10]
call fcn.004407e4
push ecx
add edi, 0xfffffff0
mov byte [esp + 0xb4], 0x2f
mov eax, edi
mov dword [esp + 0x30], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [esp + 0xb8], 0x30
mov esi, esp
mov dword [esp + 0x44], esp
push dword [ebx + 8]
call fcn.004407e4
push ecx
mov byte [esp + 0xbc], 0x31
mov esi, esp
mov dword [esp + 0x34], esp
push dword [ebx + 4]
call fcn.004407e4
push ecx
mov byte [esp + 0xc0], 0x32
mov esi, esp
mov dword [esp + 0x44], esp
push dword [ebx]
call fcn.004407e4
mov ecx, dword [ebp + 8]
mov byte [esp + 0xc0], 0x2d
call fcn.0040b882
jmp 0x40a5f8
push dword [ebx]
lea esi, [esp + 0x78]
call fcn.004407e4
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov eax, dword [esp + 0x74]
jmp 0x40ac2c
push dword [ebx]
lea esi, [esp + 0x80]
call fcn.004407e4
mov edi, dword [eax]
call fcn.00404cf9
mov esi, eax
mov eax, dword [esp + 0x7c]
jmp 0x40ac2c
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.004407e4
mov byte [esp + 0xa8], 0x33
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.004407e4
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
push esi
push edi
test ebx, ebx
jne 0x40af58
push str.__rCopyFile__s___s_failed
jmp 0x40af5d
push str.CopyFile__s___s__success
call fcn.004025b1
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], ebx
add esp, 0xc
lea eax, [esi - 0x10]
call fcn.004017c3
jmp 0x40a75d
mov eax, dword [ebx]
mov eax, dword [eax + 8]
mov dword [esi + 0x4c4], eax
neg eax
sbb eax, eax
and eax, 5
push eax
jmp 0x40acf4
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
mov esi, dword [ecx + 8]
add eax, 0x28
push eax
mov dword [esp + 0x18], eax
call fcn.00422266
test eax, eax
je 0x409fee
mov edi, eax
mov eax, dword [esp + 0x14]
call fcn.004227fa
jmp 0x409fee
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
mov esi, dword [eax + 8]
add ecx, 0x28
push ecx
lea edi, [esp + 0x18]
call fcn.0042275c
mov byte [esp + 0xa8], 0x34
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.004408ce
mov eax, dword [esp + 0x14]
jmp 0x40a1dd
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
mov esi, dword [eax + 8]
add ecx, 0x28
push ecx
call fcn.00422266
test eax, eax
je 0x409fee
mov ecx, dword [ebx + 4]
push dword [ecx + 8]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x78]
jmp 0x409fee
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.004407e4
call fcn.00404847
jmp 0x40a13b
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.004407e4
call fcn.004048a1
jmp 0x40a13b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
cwde
mov edi, 0x10000
test edi, eax
jne 0x40acb0
push 0xa1
call esi
cwde
test edi, eax
jne 0x40acb0
xor ecx, ecx
jmp 0x40acb3
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov edi, dword [esp + 0x14]
push edi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
je 0x40b0c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b0c4
inc esi
test ebx, ebx
je 0x40b0cf
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], esi
jmp 0x40a75d
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.004407e4
mov byte [esp + 0xa8], 0x35
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov esi, eax
test esi, esi
je 0x40b11c
push esi
call fcn.00441a2d
pop ecx
push esi
mov bl, al
call dword [sym.imp.SHELL32.dll_ILFree]
test bl, bl
jne 0x40a75d
push edi
push str.PinCurrentAppToTaskbarImpl__s_
call fcn.004025b1
pop ecx
pop ecx
jmp 0x40a75d