Function at 0x408050
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524d4e
mov eax, dword fs:[0]
push eax
sub esp, 0xb6c
mov eax, dword [0x570454]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x478], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor edi, edi
mov byte [esi + 0xb8], 0
call fcn.0040b1c0
test al, al
jne 0x4080aa
call fcn.0040b240
test eax, eax
jne 0x4080bc
call fcn.0040b240
test eax, eax
jne 0x4080f7
call fcn.0040b2e0
test eax, eax
jne 0x4080f7
lea eax, [ebp - 0x5d0]
push eax
call fcn.0040c190
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 4], edi
call fcn.00414645
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
cmp eax, 6
je 0x4080f2
call fcn.0040c230
jmp 0x40a0c0
call fcn.0040c230
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408111
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 4], 1
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408144
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x440], esi
mov byte [ebp - 4], 2
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408174
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x458], eax
mov byte [ebp - 4], 3
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4081a4
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x45c], eax
mov byte [ebp - 4], 4
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4081d4
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x470], eax
mov byte [ebp - 4], 5
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408204
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x46c], eax
mov byte [ebp - 4], 6
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408234
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x468], eax
mov byte [ebp - 4], 7
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408264
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x464], eax
mov byte [ebp - 4], 8
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408294
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x444], eax
mov byte [ebp - 4], 9
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4082c4
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x448], eax
mov byte [ebp - 4], 0xa
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4082f4
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x450], eax
mov byte [ebp - 4], 0xb
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408324
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 0xc
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408354
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x474], eax
mov byte [ebp - 4], 0xd
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x408384
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x47c], eax
mov byte [ebp - 4], 0xe
call fcn.00415761
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4083b4
push 0x80004005
call fcn.00401330
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x460], eax
mov byte [ebp - 4], 0xf
push 0x12c
mov dword [ebp - 0x430], edi
call fcn.0041a156
cmp eax, edi
je 0x4083f5
push 0x12c
push eax
lea ecx, [ebp - 0x43c]
call fcn.004063e0
mov ebx, dword [ebp - 0x43c]
push 0xc8
call fcn.0041a156
cmp eax, edi
je 0x40841a
push 0xc8
push eax
lea ecx, [ebp - 0x440]
call fcn.004063e0
mov esi, dword [ebp - 0x440]
push 0x136
call fcn.0041a156
cmp eax, edi
je 0x408439
push 0x136
push eax
lea ecx, [ebp - 0x444]
call fcn.004063e0
push 0x140
call fcn.0041a156
cmp eax, edi
je 0x408458
push 0x140
push eax
lea ecx, [ebp - 0x448]
call fcn.004063e0
push 0x5512c8
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp - 0x42c]
push edx
call fcn.0040c0a0
add esp, 0xc
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
mov edi, dword [ebp - 0x458]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x4084e0
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x4084ca
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4084ca
push eax
call fcn.004041f0
mov esi, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x4084b9
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [ebp - 0x458], esi
mov esi, dword [ebp - 0x440]
jmp 0x4084da
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x458]
call fcn.00404140
mov ebx, dword [ebp - 0x43c]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408506
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx - 0xc]
test edi, edi
jns 0x408517
push 0x80070057
call fcn.00401330
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edi
or eax, ecx
jge 0x40853a
push edi
lea ecx, [ebp - 0x43c]
call fcn.00401290
mov ebx, dword [ebp - 0x43c]
lea ecx, [edi + 1]
push ecx
push ebx
call fcn.005015c5
add esp, 8
cmp edi, dword [ebx - 8]
jg 0x40850d
push str.ExamShieldVersion.txt
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x42c]
xor edx, edx
mov dword [ebx - 0xc], edi
push ecx
mov word [ebx + edi*2], dx
call fcn.0040c0a0
add esp, 0xc
mov byte [ebp - 4], 0x11
mov ecx, dword [eax]
mov edi, dword [ebp - 0x45c]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x4085dd
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x4085c7
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4085c7
push eax
call fcn.004041f0
mov esi, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x4085b6
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [ebp - 0x45c], esi
mov esi, dword [ebp - 0x440]
jmp 0x4085d7
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x45c]
call fcn.00404140
mov ebx, dword [ebp - 0x43c]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408603
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esi - 0xc], 0
jle 0x4086bb
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x42c]
push str._id
push edx
call fcn.00404060
add esp, 0xc
mov byte [ebp - 4], 0x12
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x458]
call fcn.0040bfe0
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408664
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x42c]
push str._id
push edx
call fcn.00404060
add esp, 0xc
mov byte [ebp - 4], 0x13
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x45c]
call fcn.0040bfe0
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4086bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esi - 0xc]
test edi, edi
jns 0x4086cc
push 0x80070057
call fcn.00401330
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4086ef
push edi
lea ecx, [ebp - 0x440]
call fcn.00401290
mov esi, dword [ebp - 0x440]
lea ecx, [edi + 1]
push ecx
push esi
call fcn.0050140b
add esp, 8
cmp edi, dword [esi - 8]
jg 0x40850d
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
mov ecx, str.COMPATIBILITYCHECK
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40873b
test dx, dx
je 0x408737
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40873b
add eax, 4
add ecx, 4
test dx, dx
jne 0x408715
xor eax, eax
jmp 0x408740
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x408756
mov eax, dword [ebp - 0x478]
mov byte [eax + 0xb8], 1
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408777
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x450]
call fcn.00404140
push 0xc
push str.Exam_Shield
lea ecx, [ebp - 0x450]
call fcn.0040bfe0
mov edi, dword [ebp - 0x450]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408a13
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408a13
push eax
push 0x10
push str.Unable_to_create_directory
call fcn.00414bad
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408805
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x47c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40882b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x474]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408851
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x454]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408877
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408897
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x444]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408909
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40892f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408955
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40897b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4089a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4089c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4089e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a0c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40a0c0
push 0x105
lea ecx, [ebp - 0x428]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x428]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408a30
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x428]
push edx
lea ecx, [ebp - 0x464]
call fcn.00404140
push 0x5513a4
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call fcn.0040c0a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x14
call fcn.00404260
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408aa3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.ExamShieldSetup.exe
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x42c]
push edx
call fcn.0040c0a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x15
call fcn.00404260
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408af4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.ExamShieldParams.dat
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x42c]
push edx
call fcn.0040c0a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0x16
call fcn.00404260
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x478]
cmp byte [ecx + 0xb8], 0
jne 0x408df5
lea ecx, [ebp - 0x4a4]
call fcn.0041cc06
push 0
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0x47c]
push 0x5001
push esi
lea ecx, [ebp - 0x4a4]
call fcn.0041cade
test eax, eax
jne 0x408dc7
push eax
push 0x10
push str.Unable_to_create_file
call fcn.00414bad
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0xf
call fcn.0041cee5
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408bca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408bea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x474]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x454]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c36
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x450]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c82
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x444]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408ca8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408cce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408cf4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408db2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
jmp 0x4089f1
mov ecx, dword [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x4a4]
call fcn.0041cce1
lea ecx, [ebp - 0x4a4]
call fcn.0041cea7
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0xf
call fcn.0041cee5
jmp 0x408dfb
mov esi, dword [ebp - 0x47c]
lea edx, [ebp - 0x460]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x438], esp
push str.ExamShield
lea edi, [ebp - 0x430]
call fcn.00406620
mov ebx, dword [ebp - 0x478]
push ebx
mov ecx, edi
call fcn.0040a210
test al, al
je 0x40957d
push 0x5518bc
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x488]
push ecx
call fcn.0040c0a0
push str.ExamShield.exe
push eax
lea edx, [ebp - 0x478]
push edx
mov byte [ebp - 4], 0x18
call fcn.0040c0a0
add esp, 0x18
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x488]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408e88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5518c0
lea ecx, [ebp - 0x42c]
call fcn.00406620
mov byte [ebp - 4], 0x1b
cmp byte [ebx + 0xb8], 0
je 0x408eb5
push str._COMPATIBILITYCHECK
lea ecx, [ebp - 0x42c]
call fcn.0040bec0
mov ecx, dword [ebp - 0x444]
cmp dword [ecx - 0xc], 0
jle 0x408f68
push str.__COLLABORATIONCLIENT
lea ebx, [ebp - 0x430]
call fcn.0040bb10
mov edx, ebx
push edx
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x42c]
push eax
call fcn.0040be00
add esp, 8
mov bl, 0x1d
mov byte [ebp - 4], bl
mov eax, dword [eax]
test eax, eax
je 0x408f00
mov eax, dword [eax]
jmp 0x408f02
xor eax, eax
lea ecx, [ebp - 0x444]
push ecx
push eax
lea edx, [ebp - 0x44c]
push edx
call fcn.00404060
add esp, 0xc
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x1e
call fcn.00404260
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x44c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408f4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x438]
call fcn.0040bdb0
lea edi, [ebp - 0x430]
mov byte [ebp - 4], 0x1b
call fcn.0040bdb0
mov ecx, dword [ebp - 0x448]
cmp dword [ecx - 0xc], 0
jle 0x40901b
push str.__OPERATINGSYSTEM
lea ebx, [ebp - 0x430]
call fcn.0040bb10
mov edx, ebx
push edx
lea eax, [ebp - 0x44c]
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x42c]
push eax
call fcn.0040be00
add esp, 8
mov bl, 0x20
mov byte [ebp - 4], bl
mov eax, dword [eax]
test eax, eax
je 0x408fb3
mov eax, dword [eax]
jmp 0x408fb5
xor eax, eax
lea ecx, [ebp - 0x448]
push ecx
push eax
lea edx, [ebp - 0x438]
push edx
call fcn.00404060
add esp, 0xc
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0x21
call fcn.00404260
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x438]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409001
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x44c]
call fcn.0040bdb0
lea edi, [ebp - 0x430]
mov byte [ebp - 4], 0x1b
call fcn.0040bdb0
push ecx
lea edx, [ebp - 0x478]
mov dword [ebp - 0x438], esp
mov ecx, esp
push edx
call fcn.00403fd0
call fcn.0040a0e0
test al, al
jne 0x4092be
push 0
push 0x10
push str.An_unexpected_error_has_occured___n_Please_contact_support.
call fcn.00414bad
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409071
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x478]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409097
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4090bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4090dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x474]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409103
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x454]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409129
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x450]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40914f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409175
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x444]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40919b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40920d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409233
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409259
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40927f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408db2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
jmp 0x4089f1
mov ecx, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x478]
push 5
push 0
push ecx
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, dword [ebp - 0x468]
mov edi, dword [ebp - 0x464]
push 0
push 0
push 0
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [ebp - 4], 0x1a
mov eax, dword [ebp - 0x42c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409322
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x478]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409348
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40936e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40938e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x474]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4093b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x454]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4093da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x450]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409400
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409426
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x444]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40944c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40946c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40948c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4094b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4094d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4094fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409524
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40954a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409573
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x40a0c2
lea ecx, [ebp - 0xb78]
push ecx
call fcn.004015c0
lea edx, [ebp - 0x458]
push edx
lea ecx, [ebp - 0xad8]
mov byte [ebp - 4], 0x24
call fcn.00404260
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0xad4]
call fcn.00404260
xor eax, eax
push str.ExamShield_Setup
lea ecx, [ebp - 0x760]
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xaa8], eax
call fcn.0040bec0
cmp byte [ebx + 0xb8], 0
je 0x4095ef
push str.ExamShield__Compatibility_Check__Setup
lea ecx, [ebp - 0x760]
mov byte [ebp - 0x5d8], 1
call fcn.0040bec0
lea ecx, [ebp - 0xb78]
call fcn.00414645
cmp eax, 1
je 0x40983a
lea ecx, [ebp - 0xb78]
push ecx
mov byte [ebp - 4], 0xf
call fcn.00401800
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409639
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409659
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x474]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40967f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x454]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x450]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x444]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409717
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40973d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409763
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409789
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4097af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4097d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4097fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408db2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
jmp 0x4089f1
push 0x5518c0
lea ecx, [ebp - 0x434]
call fcn.00406620
mov byte [ebp - 4], 0x25
cmp byte [ebx + 0xb8], 0
je 0x409aed
push str._COMPATIBILITYCHECK
lea ecx, [ebp - 0x434]
call fcn.0040bec0
cmp dword [ebp - 0x430], 0
je 0x4099ad
mov ecx, dword [ebp - 0x444]
cmp dword [ecx - 0xc], 0
jle 0x409910
push str.__COLLABORATIONCLIENT
lea ebx, [ebp - 0x430]
call fcn.0040bb10
mov edx, ebx
push edx
lea eax, [ebp - 0x44c]
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x434]
push eax
call fcn.0040be00
add esp, 8
mov byte [ebp - 4], 0x27
mov eax, dword [eax]
test eax, eax
je 0x4098c2
mov eax, dword [eax]
jmp 0x4098c4
xor eax, eax
lea ecx, [ebp - 0x444]
push ecx
push eax
lea edx, [ebp - 0x438]
push edx
call fcn.00404060
add esp, 0xc
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x28
call fcn.00404260
lea ecx, [ebp - 0x438]
call fcn.00401170
lea edi, [ebp - 0x44c]
call fcn.0040bdb0
lea edi, [ebp - 0x430]
mov byte [ebp - 4], 0x25
call fcn.0040bdb0
mov eax, dword [ebp - 0x448]
cmp dword [eax - 0xc], 0
jle 0x409aed
push str.__OPERATINGSYSTEM
lea ebx, [ebp - 0x430]
call fcn.0040bb10
mov ecx, ebx
push ecx
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x434]
push edx
call fcn.0040be00
add esp, 8
mov byte [ebp - 4], 0x2a
mov eax, dword [eax]
test eax, eax
je 0x40995a
mov eax, dword [eax]
jmp 0x40995c
xor eax, eax
lea ecx, [ebp - 0x448]
push ecx
push eax
lea edx, [ebp - 0x438]
push edx
call fcn.00404060
add esp, 0xc
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x2b
call fcn.00404260
lea ecx, [ebp - 0x438]
call fcn.00401170
lea edi, [ebp - 0x44c]
call fcn.0040bdb0
lea edi, [ebp - 0x430]
mov byte [ebp - 4], 0x25
call fcn.0040bdb0
jmp 0x409aed
mov eax, dword [ebp - 0x444]
cmp dword [eax - 0xc], 0
jle 0x409a45
push str.__COLLABORATIONCLIENT
lea ebx, [ebp - 0x430]
call fcn.0040bb10
mov ecx, ebx
push ecx
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x434]
push edx
call fcn.0040be00
add esp, 8
mov byte [ebp - 4], 0x2d
mov eax, dword [eax]
test eax, eax
je 0x4099f7
mov eax, dword [eax]
jmp 0x4099f9
xor eax, eax
lea ecx, [ebp - 0x444]
push ecx
push eax
lea edx, [ebp - 0x438]
push edx
call fcn.00404060
add esp, 0xc
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x2e
call fcn.00404260
lea ecx, [ebp - 0x438]
call fcn.00401170
lea edi, [ebp - 0x44c]
call fcn.0040bdb0
lea edi, [ebp - 0x430]
mov byte [ebp - 4], 0x25
call fcn.0040bdb0
mov eax, dword [ebp - 0x448]
cmp dword [eax - 0xc], 0
jle 0x409add
push str.__OPERATINGSYSTEM
lea ebx, [ebp - 0x430]
call fcn.0040bb10
mov ecx, ebx
push ecx
lea edx, [ebp - 0x44c]
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x434]
push edx
call fcn.0040be00
add esp, 8
mov byte [ebp - 4], 0x30
mov eax, dword [eax]
test eax, eax
je 0x409a8f
mov eax, dword [eax]
jmp 0x409a91
xor eax, eax
lea ecx, [ebp - 0x448]
push ecx
push eax
lea edx, [ebp - 0x438]
push edx
call fcn.00404060
add esp, 0xc
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x31
call fcn.00404260
lea ecx, [ebp - 0x438]
call fcn.00401170
lea edi, [ebp - 0x44c]
call fcn.0040bdb0
lea edi, [ebp - 0x430]
mov byte [ebp - 4], 0x25
call fcn.0040bdb0
mov ecx, str._UNINSTALL
lea ebx, [ebp - 0x434]
call fcn.0040b520
mov ecx, str._LAUNCHEXAMSHIELD
lea ebx, [ebp - 0x434]
call fcn.0040b520
push ecx
lea eax, [ebp - 0x454]
mov dword [ebp - 0x438], esp
mov ecx, esp
push eax
call fcn.00403fd0
call fcn.0040a0e0
test al, al
jne 0x409d7a
push 0
push 0x10
push str.An_unexpected_error_has_occured___n_Please_contact_support.
call fcn.00414bad
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x434]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xb78]
push ecx
mov byte [ebp - 4], 0xf
call fcn.00401800
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x460]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409b89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409ba9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x474]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bcf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x454]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bf5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x450]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x444]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x464]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c8d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x468]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409cb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x46c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409cd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x470]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409cff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x45c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409d25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x458]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409d4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a0b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40a0b5
push 0x5518c0
lea ecx, [ebp - 0x484]
call fcn.00406620
push 0x5518c0
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0x32
call fcn.00406620
mov ebx, 0x33
push 0x5515b0
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], bl
call fcn.0040bec0
push 0x5515b4
lea ecx, [ebp - 0x480]
call fcn.0040bec0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x484]
push edx
lea eax, [ebp - 0x44c]
push eax
call fcn.0040b6d0
lea ecx, [ebp - 0x480]
push ecx
push eax
lea edx, [ebp - 0x438]
push edx
mov byte [ebp - 4], 0x34
call fcn.0040b6d0
add esp, 0x18
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 0x35
call fcn.00404260
lea ecx, [ebp - 0x438]
call fcn.00401170
lea ecx, [ebp - 0x44c]
call fcn.00401170
mov byte [ebp - 4], 0x36
call fcn.0040b1c0
test al, al
jne 0x409e37
call fcn.0040b240
test eax, eax
jne 0x409e49
call fcn.0040b240
test eax, eax
jne 0x409e62
call fcn.0040b2e0
test eax, eax
jne 0x409e62
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x454]
push 5
push 0
push eax
push ecx
push 0x5515b8
jmp 0x409e79
mov edx, dword [ebp - 0x434]
mov eax, dword [ebp - 0x454]
push 5
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x5518bc
lea ecx, [ebp - 0x460]
push ecx
lea edx, [ebp - 0x438]
push edx
call fcn.0040c0a0
add esp, 0xc
push str.ExamShield.exe
push eax
lea eax, [ebp - 0x44c]
push eax
mov byte [ebp - 4], 0x37
call fcn.0040c0a0
add esp, 0xc
lea ecx, [ebp - 0x438]
call fcn.00401170
mov ecx, dword [ebp - 0x468]
mov edx, dword [ebp - 0x464]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x44c]
call fcn.00401170
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], ebx
call fcn.00401170
lea ecx, [ebp - 0x484]
call fcn.00401170
lea ecx, [ebp - 0x434]
call fcn.00401170
lea eax, [ebp - 0xb78]
push eax
mov byte [ebp - 4], 0xf
call fcn.00401800
lea ecx, [ebp - 0x460]
call fcn.00401170
lea ecx, [ebp - 0x47c]
call fcn.00401170
lea ecx, [ebp - 0x474]
call fcn.00401170
lea ecx, [ebp - 0x454]
call fcn.00401170
lea ecx, [ebp - 0x450]
call fcn.00401170
lea ecx, [ebp - 0x448]
call fcn.00401170
lea ecx, [ebp - 0x444]
call fcn.00401170
lea ecx, [ebp - 0x464]
call fcn.00401170
lea ecx, [ebp - 0x468]
call fcn.00401170
lea ecx, [ebp - 0x46c]
call fcn.00401170
lea ecx, [ebp - 0x470]
call fcn.00401170
lea ecx, [ebp - 0x45c]
call fcn.00401170
lea ecx, [ebp - 0x458]
call fcn.00401170
lea ecx, [ebp - 0x440]
call fcn.00401170
lea ecx, [ebp - 0x43c]
call fcn.00401170
mov eax, 1
jmp 0x40a0c2
lea ecx, [ebp - 0x43c]
call fcn.00401170
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00500836
mov esp, ebp
pop ebp
ret