Function at 0x446950
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bdbb
mov eax, dword fs:[0]
push eax
sub esp, 0x9f4
mov eax, dword [0x4ab13c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [ebp - 0xc4]
push ebx
push eax
call fcn.00449c30
add esp, 8
cmp dword [ebp - 0xac], 8
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 4], ebx
jae 0x4469ab
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x930]
call fcn.004484f0
lea ecx, [ebp - 0x1c]
xor eax, eax
push ecx
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 1
mov word [ebp - 0x1c], bx
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], ax
call fcn.00448100
movzx edi, word [ebp - 0x18]
push ebx
mov esi, 7
push 0x4991b8
lea ecx, [ebp - 0x954]
mov dword [ebp - 0x93c], esi
mov dword [ebp - 0x940], ebx
mov word [ebp - 0x950], bx
call fcn.00402438
lea edx, [ebp - 0x954]
push edx
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 2
call fcn.00449740
add esp, 8
cmp dword [ebp - 0x93c], 8
mov byte [ebp - 4], 4
jb 0x446a37
mov ecx, dword [ebp - 0x950]
push ecx
call fcn.00451909
add esp, 4
push 1
push 3
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x93c], esi
mov dword [ebp - 0x940], ebx
mov word [ebp - 0x950], bx
call fcn.00442040
push edi
push 0x4935a8
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x9f8]
push eax
mov byte [ebp - 4], 5
call fcn.00441440
add esp, 8
push eax
call fcn.004416d0
add esp, 8
mov ecx, eax
call fcn.00441bb0
lea ecx, [ebp - 0x970]
push ecx
lea ecx, [ebp - 0xa00]
call fcn.0043b560
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 6
call fcn.00402157
cmp dword [ebp - 0x958], 8
mov byte [ebp - 4], 5
jb 0x446ac4
mov edx, dword [ebp - 0x96c]
push edx
call fcn.00451909
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.____strDesExeFilePath:_n
call esi
mov eax, dword [ebp - 0x6c]
mov edi, 8
cmp dword [ebp - 0x58], edi
jae 0x446ae1
lea eax, [ebp - 0x6c]
push eax
call esi
lea eax, [ebp - 0x70]
push eax
call fcn.00449120
add esp, 4
test al, al
jne 0x446b61
lea ecx, [ebp - 0x9ac]
mov byte [ebp - 4], 4
call fcn.00437360
lea ecx, [ebp - 0x9ac]
push ecx
mov dword [ebp - 0x9ac], 0x491650
call fcn.0047623c
add esp, 4
cmp dword [ebp - 0x58], edi
jb 0x446b2d
mov edx, dword [ebp - 0x6c]
push edx
call fcn.00451909
add esp, 4
lea ecx, [ebp - 0x930]
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x6c], bx
mov byte [ebp - 4], bl
call fcn.00448170
cmp dword [ebp - 0xac], edi
jb 0x44702b
mov eax, dword [ebp - 0xc0]
push eax
jmp 0x447023
push str._n_____n
call esi
push str.win7_setting_32.exe
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.00412680
add esp, 0xc
push 0x16
push str.handle0_install_bho0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], bx
call fcn.00402438
cmp dword [ebp - 0x20], edi
mov ecx, dword [ebp - 0x34]
jae 0x446ba9
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x50]
jae 0x446bb4
lea eax, [ebp - 0x50]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push ebx
push ecx
push eax
push str.open
push ebx
call edi
cmp eax, 0x20
jge 0x446be3
push str._n____ShellExecute_failed:_n
call esi
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x446bde
lea eax, [ebp - 0x50]
push eax
call esi
jmp 0x446bee
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x20], 8
jb 0x446c00
mov eax, dword [ebp - 0x34]
push eax
call fcn.00451909
add esp, 4
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], bx
mov byte [ebp - 4], 5
jb 0x446c24
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.00451909
add esp, 4
lea edx, [ebp - 0x8c]
push edx
call fcn.0043a730
add esp, 4
push str._n____strCurRegFileName:_n
mov byte [ebp - 4], 8
call esi
cmp dword [ebp - 0x74], 8
mov eax, dword [ebp - 0x88]
jae 0x446c50
lea eax, [ebp - 0x88]
push eax
call esi
cmp dword [ebp - 0x78], ebx
je 0x446ca6
cmp dword [ebp - 0x74], 8
jb 0x446def
mov eax, dword [ebp - 0x88]
cmp eax, ebx
je 0x446ca6
cmp word [eax], bx
je 0x446ca6
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x446ca6
test al, 0x10
jne 0x446ca6
push 0x493d10
call esi
cmp dword [ebp - 0x74], 8
mov eax, dword [ebp - 0x88]
jae 0x446c9a
lea eax, [ebp - 0x88]
push ebx
push ebx
push str.__UnregServer
push eax
push ebx
push ebx
call edi
push str.DownloadProxyPS.dll
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0xe0]
push ecx
call fcn.00412680
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0x970]
push str._u__s__
push eax
mov byte [ebp - 4], 9
call fcn.00439bf0
push 0x493760
push eax
lea ecx, [ebp - 0xa8]
push ecx
mov byte [ebp - 4], 0xa
call fcn.00412680
add esp, 0x24
cmp dword [ebp - 0x958], 8
mov byte [ebp - 4], 0xc
jb 0x446d0c
mov edx, dword [ebp - 0x96c]
push edx
call fcn.00451909
add esp, 4
cmp dword [ebp - 0x90], 8
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x958], 7
mov dword [ebp - 0x95c], ebx
mov word [ebp - 0x96c], bx
jae 0x446d38
lea eax, [ebp - 0xa4]
push ebx
push ebx
push eax
push str.regsvr32.exe
push ebx
push ebx
call edi
cmp eax, 0x20
jge 0x446d68
push str._n____ShellExecute_regsvr32.exe_failed:_n
call esi
cmp dword [ebp - 0x90], 8
mov eax, dword [ebp - 0xa4]
jae 0x446d65
lea eax, [ebp - 0xa4]
push eax
call esi
call fcn.00436450
push str._n_____n
call esi
push str.win7_setting_32.exe
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.00412680
add esp, 0xc
push 0x16
push str.handle0_install_bho0
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], bx
call fcn.00402438
cmp dword [ebp - 0x20], 8
mov ecx, dword [ebp - 0x34]
jae 0x446db6
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x446dc2
lea eax, [ebp - 0x50]
push ebx
push ebx
push ecx
push eax
push str.open
push ebx
call edi
cmp eax, 0x20
jge 0x446dfa
push str._n____ShellExecute_failed:_n
call esi
mov eax, dword [ebp - 0x50]
mov edi, 8
cmp dword [ebp - 0x3c], edi
jae 0x446dea
lea eax, [ebp - 0x50]
push eax
call esi
jmp 0x446dff
lea eax, [ebp - 0x88]
jmp 0x446c6c
mov edi, 8
cmp dword [ebp - 0x20], edi
jb 0x446e10
mov edx, dword [ebp - 0x34]
push edx
call fcn.00451909
add esp, 4
cmp dword [ebp - 0x3c], edi
mov esi, 7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], bx
jb 0x446e30
mov eax, dword [ebp - 0x50]
push eax
call fcn.00451909
add esp, 4
mov dword [ebp - 0x934], ebx
jmp 0x446e40
cmp dword [ebp - 0x934], 5
jge 0x446f4e
mov byte [ebp - 4], 0xe
call dword [0x4ac514]
cmp dword [ebp - 0x58], edi
mov dword [ebp - 0x938], eax
jb 0x446e6d
mov edi, dword [ebp - 0x6c]
cmp edi, ebx
jne 0x446e70
xor eax, eax
jmp 0x446ea3
lea edi, [ebp - 0x6c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x446e85
xor eax, eax
jmp 0x446ea3
lea esi, [eax + eax]
mov eax, esi
call fcn.0045bdd0
mov ecx, dword [ebp - 0x938]
mov dword [ebp - 0x10], esp
mov eax, esp
push ecx
push esi
push edi
push eax
call fcn.004113b0
mov esi, 0xf
mov ecx, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x446eb6
sub ecx, edi
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00402288
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._n____strDesExeFilePathA_n
mov byte [ebp - 4], 0xf
call edi
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x446ee8
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x54]
call fcn.0043ce30
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0x10
call fcn.00444a90
add esp, 4
cmp eax, ebx
jne 0x446f16
push str._n____uninstall_remove_all_failed_n
call edi
mov edi, 0x10
cmp dword [ebp - 0x3c], edi
jb 0x446f2c
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.00451909
add esp, 4
cmp dword [ebp - 0x20], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x50], bl
jb 0x446f46
mov edx, dword [ebp - 0x34]
push edx
call fcn.00451909
add esp, 4
mov edi, 8
lea esi, [edi - 1]
cmp dword [ebp - 0x90], edi
jb 0x446f65
mov eax, dword [ebp - 0xa4]
push eax
call fcn.00451909
add esp, 4
cmp dword [ebp - 0xc8], edi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x94], ebx
mov word [ebp - 0xa4], bx
jb 0x446f8f
mov ecx, dword [ebp - 0xdc]
push ecx
call fcn.00451909
add esp, 4
cmp dword [ebp - 0x74], edi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xcc], ebx
mov word [ebp - 0xdc], bx
jb 0x446fb6
mov edx, dword [ebp - 0x88]
push edx
call fcn.00451909
add esp, 4
lea ecx, [ebp - 0x9ac]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], ebx
mov word [ebp - 0x88], bx
mov byte [ebp - 4], 4
call fcn.00437360
lea eax, [ebp - 0x9ac]
push eax
mov dword [ebp - 0x9ac], 0x491650
call fcn.0047623c
add esp, 4
cmp dword [ebp - 0x58], edi
jb 0x446ffc
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00451909
add esp, 4
lea ecx, [ebp - 0x930]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x6c], bx
mov byte [ebp - 4], bl
call fcn.00448170
cmp dword [ebp - 0xac], edi
jb 0x44702b
mov edx, dword [ebp - 0xc0]
push edx
call fcn.00451909
add esp, 4
lea esp, [ebp - 0xa10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045b0da
mov esp, ebp
pop ebp
ret