Function at 0x456930
Capabilities:
Check if file exists
Create directory
Create process on windows
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daf2f
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x50b0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x300], esi
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x4579cf
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x28c], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x270], 0
call fcn.00479a60
push 0
push 0xa
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0045aa30
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x17c], eax
je 0x456a1e
lea ecx, [ebp - 0x2f4]
call fcn.0047b3b0
mov dword [ebp - 0x220], 1
mov ecx, 0x4ed664
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x456a0e
test dx, dx
je 0x456a0a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x456a0e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4569e8
xor eax, eax
jmp 0x456a13
sbb eax, eax
or eax, 1
mov byte [ebp - 0x2e5], 1
test eax, eax
jne 0x456a25
mov byte [ebp - 0x2e5], 0
test byte [ebp - 0x220], 1
je 0x456a4c
mov edx, dword [ebp - 0x2f4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x456a4c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
movzx eax, byte [ebp - 0x2e5]
xorps xmm0, xmm0
mov dword [ebp - 0x2f4], eax
xor eax, eax
movups xmmword [ebp - 0x26c], xmm0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], ax
movups xmmword [ebp - 0x254], xmm0
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
push ecx
lea ecx, [esi + 4]
mov byte [ebp - 4], 4
call fcn.0045c400
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x224], 1
je 0x456af3
cmp dword [ebp + 8], 0
je 0x456af3
mov ecx, esi
call fcn.0045b410
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x224], ecx
test eax, eax
je 0x456af3
push str._update__shell_is_install_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x456c71
lea eax, [esi + 0x124]
mov ecx, eax
mov dword [ebp - 0x21c], eax
call fcn.00461d80
xorps xmm0, xmm0
mov dword [ebp - 0x278], 0
xor eax, eax
mov dword [ebp - 0x274], 7
movups xmmword [ebp - 0x288], xmm0
mov word [ebp - 0x288], ax
mov byte [ebp - 4], 5
call fcn.00485ff0
mov eax, dword [0x5208d0]
push 0x208
mov dword [ebp - 0x304], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a8730
add esp, 0xc
lea ecx, [esi + 0x124]
cmp dword [esi + 0x138], 7
jbe 0x456b6c
mov ecx, dword [esi + 0x124]
push ecx
lea eax, [ebp - 0x218]
push 0x4f1270
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, str.XDZipShellExt.dll
cmp dword [ebp - 0x304], 0
mov eax, str.XDZipShellExt64.dll
cmove eax, ecx
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0042af70
mov ecx, dword [ebp - 0x274]
cmp ecx, 7
jbe 0x456bf6
mov edx, dword [ebp - 0x288]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456bec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579d9
push ecx
push edx
call fcn.004a6653
add esp, 8
movups xmm1, xmmword [ebp - 0x23c]
lea ecx, [ebp - 0x288]
movq xmm0, qword [ebp - 0x22c]
movq qword [ebp - 0x278], xmm0
cmp dword [ebp - 0x274], 7
movd eax, xmm1
movups xmmword [ebp - 0x288], xmm1
cmova ecx, eax
call fcn.00485890
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x274]
cmp ecx, 7
jbe 0x456c7d
mov edx, dword [ebp - 0x288]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456c67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579d9
push ecx
push edx
call fcn.004a6653
add esp, 8
lea eax, [esi + 0x124]
mov dword [ebp - 0x21c], eax
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x14], 7
jbe 0x456c96
mov eax, dword [eax]
push ecx
push 1
push eax
call fcn.0045c6f0
lea eax, [ebp - 0x220]
mov ecx, esi
push eax
call fcn.0045b130
mov dword [ebp - 0x2ec], eax
test eax, eax
js 0x45786a
cmp dword [ebp + 0x28], 0
je 0x456cc6
call fcn.0045aaa0
push 1
push 0x1e
mov ecx, esi
call fcn.0045aa30
mov eax, dword [esi + 0xb0]
mov ecx, dword [esi + 0xac]
sub eax, ecx
sar eax, 6
mov dword [ebp - 0x304], 0
test eax, eax
je 0x456dfb
xor eax, eax
mov dword [ebp - 0x21c], eax
nop dword [eax]
add eax, ecx
mov dword [ebp - 0x2ec], eax
add eax, 4
mov dword [ebp - 0x2f8], eax
mov ecx, eax
cmp dword [eax + 0x14], 7
jbe 0x456d1b
mov ecx, dword [eax]
lea eax, [esi + 0x10c]
push 0x4f29b0
push ecx
mov dword [ebp - 0x220], eax
call fcn.004bcdb3
add esp, 8
test eax, eax
jne 0x456d49
mov eax, dword [ebp - 0x220]
cmp dword [eax + 0x14], 7
jbe 0x456da5
mov eax, dword [eax]
jmp 0x456da5
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a8730
mov eax, dword [ebp - 0x220]
add esp, 0xc
cmp dword [eax + 0x14], 7
jbe 0x456d6d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004bd337
mov eax, dword [ebp - 0x2f8]
add esp, 0xc
cmp dword [eax + 0x14], 7
jbe 0x456d90
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push dword [esi + 0x17c]
push eax
mov eax, dword [ebp - 0x2ec]
push dword [eax]
call fcn.00465dc0
mov dword [ebp - 0x2ec], eax
test eax, eax
js 0x45786a
mov eax, dword [esi + 0xb0]
mov edx, dword [ebp - 0x304]
mov ecx, dword [esi + 0xac]
inc edx
add dword [ebp - 0x21c], 0x40
sub eax, ecx
sar eax, 6
mov dword [ebp - 0x304], edx
cmp edx, eax
jae 0x456dfb
mov eax, dword [ebp - 0x21c]
jmp 0x456d00
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x2ec], 0
push eax
call fcn.0045a9a0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x23c]
cmp dword [ebp - 0x228], 7
cmova eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x456e4d
cmp dword [ebp - 0x228], 7
lea ecx, [ebp - 0x23c]
cmova ecx, dword [ebp - 0x23c]
call fcn.00485890
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x456e91
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456e87
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579de
push ecx
push edx
call fcn.004a6653
add esp, 8
push 3
push 0x32
mov ecx, esi
call fcn.0045aa30
cmp dword [esi + 0x138], 7
lea eax, [esi + 0x124]
jbe 0x456ead
mov eax, dword [eax]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str._tools64
lea edx, [esi + 0x10c]
lea ecx, [ebp - 0x23c]
call fcn.0045be00
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x2f8], eax
add esp, 4
cmp ecx, eax
je 0x456f6c
mov ecx, dword [ebp - 0x258]
cmp ecx, 7
jbe 0x456f2b
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456f1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579e3
push ecx
push edx
call fcn.004a6653
mov eax, dword [ebp - 0x2f8]
add esp, 8
mov dword [ebp - 0x25c], 0
xor ecx, ecx
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], cx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x26c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x25c], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x456fac
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456fa2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579e3
push ecx
push edx
call fcn.004a6653
add esp, 8
push str._tools
lea edx, [esi + 0x10c]
lea ecx, [ebp - 0x23c]
call fcn.0045be00
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x2f8], eax
add esp, 4
cmp ecx, eax
je 0x457060
mov ecx, dword [ebp - 0x240]
cmp ecx, 7
jbe 0x45701f
mov edx, dword [ebp - 0x254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45700f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579e8
push ecx
push edx
call fcn.004a6653
mov eax, dword [ebp - 0x2f8]
add esp, 8
mov dword [ebp - 0x244], 0
xor ecx, ecx
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], cx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x254], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x244], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x4570a0
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x457096
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4579e8
push ecx
push edx
call fcn.004a6653
add esp, 8
call fcn.00485ff0
cmp dword [0x5208d0], 0
push ecx
push 0
je 0x4570fc
cmp dword [ebp - 0x240], 7
lea eax, [ebp - 0x254]
cmova eax, dword [ebp - 0x254]
push eax
call fcn.0045c6f0
cmp dword [ebp - 0x240], 7
lea ecx, [ebp - 0x254]
lea eax, [ebp - 0x26c]
cmova ecx, dword [ebp - 0x254]
cmp dword [ebp - 0x258], 7
push ecx
cmova eax, dword [ebp - 0x26c]
push eax
call fcn.0045d1f0
jmp 0x457116
cmp dword [ebp - 0x258], 7
lea eax, [ebp - 0x26c]
cmova eax, dword [ebp - 0x26c]
push eax
call fcn.0045c6f0
cmp dword [esi + 0x138], 7
lea eax, [esi + 0x124]
jbe 0x457127
mov eax, dword [eax]
lea ecx, [esi + 0x10c]
cmp dword [ecx + 0x14], 7
lea edx, [ecx + 0x14]
mov dword [ebp - 0x2f8], edx
jbe 0x45713e
mov ecx, dword [ecx]
push eax
push ecx
call fcn.0045d1f0
mov ecx, dword [ebp - 0x2f8]
lea eax, [esi + 0x10c]
cmp dword [ecx], 7
jbe 0x457158
mov eax, dword [eax]
push ecx
push 0
push eax
call fcn.0045c6f0
push 2
push 0x3c
mov ecx, esi
call fcn.0045aa30
cmp dword [ebp + 0x18], 0
je 0x4571b7
cmp dword [ebp + 0xc], 0
jne 0x4571b7
push ecx
mov esi, esp
mov dword [ebp - 0x2f0], esi
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00409760
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp - 0x300]
mov ecx, esi
push 0
call fcn.00459fc0
mov dword [ebp - 0x2ec], eax
test eax, eax
js 0x45786a
jmp 0x45731b
call fcn.00462fc0
cmp dword [ebp + 0x3c], 0
jne 0x4571cc
cmp dword [ebp + 0xc], 0
je 0x45731b
lea eax, [ebp - 0x118]
push eax
lea ecx, [esi + 4]
call fcn.0045dd20
cmp dword [ebp - 0x8c], 7
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x220], 0
cmova eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2f0], eax
mov eax, dword [0x5208b8]
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x45721d
lock inc dword [eax + 4]
mov eax, dword [0x5208b8]
mov dword [ebp - 0x21c], eax
mov ecx, dword [0x5208b4]
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x308], eax
mov byte [ebp - 4], 8
lea edx, [ebp - 0x2f8]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x34]
call eax
lea ecx, [ebp - 0x220]
push ecx
push 0xf003f
push 0
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x2f8]
or ecx, 0xffffffff
mov dword [ebp - 0x304], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x457280
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x4572ad
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x4572ad
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x21c]
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x4572ad
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x304], 0
jne 0x4572f4
mov edx, dword [ebp - 0x2f0]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x2f0], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4572c7
sub ecx, dword [ebp - 0x2f0]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 4
call fcn.00457a20
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2ec], eax
cmp dword [ebp + 0x38], 0
je 0x457326
call fcn.00463200
push 4
push 0x41
mov ecx, esi
call fcn.0045aa30
cmp dword [ebp + 0x1c], 0
je 0x457349
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x457349
push eax
mov ecx, esi
call fcn.004581e0
push 5
push 0x46
mov ecx, esi
call fcn.0045aa30
cmp dword [ebp + 0x20], 0
je 0x457367
cmp dword [ebp + 0xc], 0
jne 0x457367
mov ecx, esi
call fcn.0045a7e0
push 8
push 0x46
mov ecx, esi
call fcn.0045aa30
cmp dword [ebp + 0x34], 0
je 0x4574c3
lea ecx, [ebp - 0x2e4]
call fcn.004564a0
mov eax, ecx
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push eax
mov ecx, esi
call fcn.00459500
mov byte [ebp - 4], 0xa
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x4579ed
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0xb
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x4579f7
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x220]
mov esi, dword [ebp - 0x224]
lea edx, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.00465270
add esp, 4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0045afa0
push ecx
mov ecx, esp
push str._cfatrue
call fcn.00409d80
mov ecx, dword [ebp - 0x300]
call fcn.00459c50
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45745a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45747c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x457498
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 4
call fcn.0042b090
lea ecx, [ebp - 0x2c8]
call fcn.0042b090
lea ecx, [ebp - 0x2e0]
call fcn.0042b090
mov esi, dword [ebp - 0x300]
push 6
push 0x50
mov ecx, esi
call fcn.0045aa30
cmp dword [ebp + 0x24], 0
je 0x4574db
mov ecx, esi
call fcn.00457ab0
cmp dword [ebp - 0x2f4], 0
je 0x4575eb
call fcn.0040a050
mov ecx, eax
test ecx, ecx
je 0x457a01
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x224]
push dword [ebp - 0x2f4]
push 0x4ee618
push eax
call fcn.004248c0
lea eax, [ebp - 0x30c]
push eax
call fcn.00478e70
mov byte [ebp - 4], 0xe
mov eax, dword [eax]
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.0047f0b0
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2f8]
mov eax, dword [ebp - 0x2f0]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 0xf0]
call edx
push dword [esi]
mov esi, dword [ebp - 0x224]
push esi
push str.Cover
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp - 0x2f8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45759c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
or eax, 0xffffffff
mov edx, dword [ebp - 0x2f4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4575be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x30c]
call fcn.00414a20
mov byte [ebp - 4], 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4575e5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x300]
push 9
push 0x5f
mov ecx, esi
call fcn.0045aa30
cmp dword [ebp + 0x2c], 0
je 0x45786a
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x21c], 0
push eax
call fcn.00478e70
add esp, 4
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x2f0]
mov ecx, dword [eax]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
call eax
mov byte [ebp - 4], 0x11
lea edx, [esi + 0x124]
push dword [eax]
lea ecx, [ebp - 0x23c]
call fcn.00460440
add esp, 4
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 7
jbe 0x457653
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00409d80
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x228]
cmp ecx, 7
jbe 0x4576a3
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x457699
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457a0b
push ecx
push edx
call fcn.004a6653
add esp, 8
xor eax, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
mov byte [ebp - 4], 0x15
or eax, 0xffffffff
mov edx, dword [ebp - 0x2f0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4576e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x30c]
mov byte [ebp - 4], 0x16
call fcn.00414a20
cmp dword [ebp + 0xc], 0
je 0x4577e9
mov esi, dword [0x5208b8]
test esi, esi
je 0x45770f
lock inc dword [esi + 4]
mov esi, dword [0x5208b8]
mov ecx, dword [0x5208b4]
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x2f8], esi
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x2f4]
mov eax, dword [ecx]
push edx
call dword [eax + 0x98]
mov byte [ebp - 4], 0x19
test esi, esi
je 0x45775d
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x45775d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x45775d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x2f8], esp
mov dword [ebp - 0x224], esi
mov eax, dword [ebp - 0x2f4]
add eax, 0xfffffff0
push eax
call fcn.00409760
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 0x1a
cmp dword [0x520938], 0
jne 0x4577ab
push 4
call fcn.004a6623
mov dword [ebp - 0x2f8], eax
add esp, 4
mov dword [0x520938], eax
mov dword [eax], vtable.CAutoRunManager.0
mov byte [ebp - 4], 0x19
call fcn.00491140
mov byte [ebp - 4], 0x16
mov esi, eax
mov edx, dword [ebp - 0x2f4]
or ecx, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4577d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x4577e9
push str._update__task_is_run
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x457826
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x457826
push ecx
mov esi, esp
mov dword [ebp - 0x2f8], esi
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
push eax
call fcn.00409760
add esp, 4
add eax, 0x10
mov ecx, 1
mov dword [esi], eax
call fcn.0047b6f0
add esp, 4
push 1
push 0
push str._restart
push dword [ebp - 0x21c]
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 4
or eax, 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x457864
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x300]
push 0x4ed664
push 0x4ebc94
push str.install
call fcn.0047cac0
add esp, 0xc
mov ecx, esi
push 0xa
push 0x64
call fcn.0045aa30
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x240]
cmp ecx, 7
jbe 0x4578d0
mov edx, dword [ebp - 0x254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4578c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457a10
push ecx
push edx
call fcn.004a6653
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
cmp ecx, 7
jbe 0x457931
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x457927
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x457a10
push ecx
push edx
call fcn.004a6653
add esp, 8
xor eax, eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x270]
or esi, 0xffffffff
mov word [ebp - 0x26c], ax
add edx, 0xfffffff0
mov dword [ebp - 0x25c], 0
mov eax, esi
mov dword [ebp - 0x258], 7
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x457972
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45798d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4579ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a69a0
mov esp, ebp
pop ebp
ret 0x38
push 0x80004005
call fcn.00409e30
call fcn.004abd0f
call fcn.004abd0f
call fcn.004abd0f
call fcn.004abd0f
push 0x80004005
call fcn.00409e30
push 0x80004005
call fcn.00409e30
push 0x80004005
call fcn.00409e30
call fcn.004abd0f
call fcn.004abd0f
int3