Function at 0x409e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4439d8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x4513a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [ebp + 0x40]
push eax
call fcn.0040a240
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x34]
call fcn.004022c0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x409ecc
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.0040a2d0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.0040a2d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.0040a2d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.0040a2d0
jmp 0x40a132
mov ecx, dword [ebp - 0x34]
call fcn.004025a0
mov ecx, dword [ebp - 0x34]
call fcn.00402690
mov ecx, dword [ebp + 0x78]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp + 0x5c]
push edx
call fcn.0040a240
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [ebp + 0x40]
push edx
call fcn.0040a240
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp + 0x24]
push edx
call fcn.0040a240
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
call fcn.00406220
mov ecx, dword [ebp - 0x34]
call fcn.00402c30
mov eax, dword [ebp + 0x7c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [ebp + 8]
push edx
call fcn.0040a240
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x34]
call fcn.004028e0
mov eax, dword [ebp - 0x34]
add eax, 0x118
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x114
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.00404840
mov ecx, dword [ebp - 0x34]
call fcn.00405a70
mov ecx, dword [ebp - 0x34]
call fcn.00404b80
mov edx, dword [ebp - 0x34]
add edx, 0x118
push edx
mov eax, dword [ebp - 0x34]
add eax, 0x114
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00404840
mov ecx, dword [ebp - 0x34]
call fcn.00404e60
mov ecx, dword [ebp - 0x34]
call fcn.00405050
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
mov edx, dword [ebp - 0x34]
push edx
call fcn.0040a240
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 6
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp + 8]
push edx
call fcn.0040a240
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
call fcn.00402b00
mov ecx, dword [ebp - 0x34]
call fcn.00403aa0
mov ecx, dword [ebp - 0x34]
call fcn.00403fc0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x124], 0
je 0x40a031
push str.use_svchost_rename_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x34]
call fcn.00407c80
mov ecx, dword [ebp - 0x34]
call fcn.00408850
jmp 0x40a044
push str.use_normal_rename_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x34]
call fcn.00408c20
mov ecx, dword [ebp - 0x34]
call fcn.00405620
mov ecx, dword [ebp - 0x34]
call fcn.00409c00
mov ecx, dword [ebp - 0x34]
call fcn.00406610
mov ecx, dword [ebp - 0x34]
call fcn.004067a0
mov ecx, dword [ebp - 0x34]
call fcn.004046f0
mov ecx, dword [ebp - 0x34]
call fcn.00406a80
mov ecx, dword [ebp - 0x34]
call fcn.00406ba0
mov ecx, dword [ebp - 0x34]
call fcn.00406ca0
mov ecx, dword [ebp - 0x34]
call fcn.004071d0
mov ecx, dword [ebp - 0x34]
call fcn.00406ec0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
lea edx, [ebp + 8]
push edx
call fcn.0040a240
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x34]
call fcn.00402c00
mov ecx, dword [ebp - 0x34]
call fcn.004025d0
mov ecx, dword [ebp - 0x34]
call fcn.00402720
mov ecx, dword [ebp - 0x34]
call fcn.00406fc0
mov ecx, dword [ebp - 0x34]
call fcn.004070c0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x124], 0
jne 0x40a0e4
mov ecx, dword [ebp - 0x34]
call fcn.00408c20
push str.Install_over_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x34]
call fcn.00406370
mov ecx, dword [ebp - 0x34]
call fcn.00409d90
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.0040a2d0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.0040a2d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.0040a2d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.0040a2d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x78