Function at 0x42dc31
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Check mutex on windows
Copy file
Create directory
Create process on windows
Create thread
Delete file
Execute shellcode via indirect call
Get common file path
Get disk size
Get process heap force flags
Move file
Query or enumerate registry value
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe3c
push ebx
push esi
xor ebx, ebx
xor eax, eax
push edi
inc ebx
mov dword [esp + 0x20], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp + 8]
xor edi, edi
push edi
mov dword [0x4ad194], eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [esp + 0x88], 8
lea eax, [esp + 0x88]
mov dword [esp + 0xb0], esi
push eax
mov dword [esp + 0x90], 0xffff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov eax, dword [0x4ad688]
mov dword [0x4ad224], edi
mov edi, dword [0x4ad684]
jmp 0x42dcb3
mov ecx, dword [edi]
test ecx, ecx
je 0x42dcb0
push ebx
call dword [ecx + 0x1c]
mov eax, dword [0x4ad688]
add edi, 4
cmp edi, eax
jb 0x42dca1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
mov dword [0x4ad228], eax
push 0xc
mov dword [0x4ad22c], edi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x42dce3
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x42dce5
mov eax, edi
mov dword [0x4ad22c], eax
lea ecx, [esp + 0x600]
neg eax
mov dword [esp + 0xc0], 0x4950c0
sbb eax, eax
not eax
and dword [0x4ad230], eax
lea eax, [esp + 0xc0]
push eax
mov dword [esp + 0xe8], eax
call fcn.0043ba54
lea ecx, [esp + 0xc0]
call fcn.0043ba36
push 0x104
lea eax, [esp + 0x62c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x628]
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0043b8e8
mov edi, 0x4ad284
push eax
mov ecx, edi
call fcn.0043c5cb
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push str.ConfigConfig.ini
mov edx, edi
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
push eax
mov ecx, 0x4ad468
call fcn.0043c5cb
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
xor eax, eax
push eax
push 0x80
push ebx
push eax
push ebx
push 0x40000000
push dword [0x4ad468]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42dde7
xor eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 2
push 0x488338
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042cf07
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42de1e
push 0x40
push 0x4880b0
call sym.Dismx86.exe_DismMultiLanguage
push eax
push str.Dism__
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
jmp 0x42deb4
mov edi, dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [esp + 0x17]
push eax
xor eax, eax
push eax
push ebx
push 0x11
call edi
test eax, eax
jne 0x42de56
lea eax, [esp + 0x17]
push eax
xor eax, eax
push eax
push ebx
push 0x12
call edi
test eax, eax
jne 0x42de56
mov byte [esp + 0x17], bl
mov dword [0x4ad198], 4
jmp 0x42de5c
xor eax, eax
mov byte [esp + 0x17], al
push str.Configx86CbsHost.Dll
mov edx, 0x4ad284
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
mov ecx, dword [eax]
call fcn.00482abc
mov ecx, dword [esp + 0x10]
mov dword [0x4ad1c8], eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
cmp dword [0x4ad1c8], 0
jne 0x42deba
push 0x10
push 0x48f30c
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x492030
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 3
pop ebx
jmp 0x42f701
call fcn.0044ccde
test eax, eax
je 0x42deec
push 0x40
push 0x4880b0
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x4991a0
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ebx, ebx
inc ebx
jmp 0x42f701
push 0x4991ec
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42df55
push 0x42f8a3
call edi
xor eax, eax
mov dword [esp + 0x30], 0x4c2c033
mov byte [esp + 0x34], al
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x42df55
push 5
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x14]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.Dismx86.exe
push dword [esp + 0x40]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x42df92
xor ebx, ebx
push ebx
push 0x4880b0
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x499208
call sym.Dismx86.exe_DismMultiLanguage
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, 0x80004005
jmp 0x42f701
xor eax, eax
push eax
push eax
push 3
push eax
push 5
push 0xa0000000
lea eax, [esp + 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
mov dword [esp + 0x10], eax
push ecx
push ecx
push ecx
push eax
call dword [sym.imp.ntdll.dll_LdrVerifyImageMatchesChecksum]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0043bb32
test edi, edi
je 0x42dfd3
mov dword [0], ebx
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xa4], eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0xb8]
push eax
push 0xffffffffffffffff
call dword [0x487634]
mov eax, dword [esp + 0xa4]
mov ecx, 0x14c
cmp ax, cx
je 0x42e114
movzx eax, ax
cmp eax, 0x8664
je 0x42e052
cmp eax, 0xaa64
je 0x42e04b
xor ebx, ebx
push ebx
push 0x4880b0
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x499244
call sym.Dismx86.exe_DismMultiLanguage
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, 0x80004001
jmp 0x42f701
mov edi, str.DismARM64.exe
jmp 0x42e057
mov edi, str.Dismx64.exe
xor eax, eax
mov dword [esp + 0xc0], 0x44
push 0x40
push eax
lea eax, [esp + 0xcc]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [esp + 0xf0], bx
mov edx, 0x4ad284
mov dword [esp + 0xec], ebx
lea ecx, [esp + 0x10]
push edi
call fcn.0043baed
pop ecx
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esp + 0xc4]
push ecx
xor ecx, ecx
push ecx
push ecx
push 0x4000410
push ecx
push ecx
push ecx
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test edi, edi
je 0x42e0e9
push dword [esp + 0x98]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x94]
call edi
jmp 0x42e10b
xor eax, eax
push eax
push 0x4880b0
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x499270
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esp + 0x10], ebx
jmp 0x42f701
lea eax, [esp + 0x7f]
push eax
xor eax, eax
push eax
push ebx
push 0x13
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x20]
call fcn.0043bbe8
cmp byte [esp + 0x17], 0
mov edi, 0x4992b8
jne 0x42e167
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.0043c99e
push 0x4992c8
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x20]
call fcn.0043ca2b
xor eax, eax
mov edi, eax
mov word [esp + 0x830], ax
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edi
test eax, eax
je 0x42e1ec
xor edx, edx
cmp word [eax], dx
je 0x42e1ec
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
je 0x42e1ec
push str._ScratchDir
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x42e1ec
dec dword [esp + 0x40]
cmp dword [edi + 4], eax
je 0x42e1e4
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x42e1e4
push dword [edi + 4]
lea eax, [esp + 0x834]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
add edi, 8
dec dword [esp + 0x40]
mov dword [esp + 0xc], edi
jmp 0x42e21b
push 0x57
pop ebx
jmp 0x42f6f5
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x834]
push eax
xor eax, eax
push eax
push 2
push str.TEMP
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
lea eax, [esp + 0x60]
push eax
push ecx
push ecx
lea eax, [esp + 0x83c]
mov dword [esp + 0x6c], ecx
push eax
mov dword [esp + 0x74], ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push str.ConfigDism.log
mov edx, 0x4ad284
lea ecx, [esp + 0x84]
call fcn.0043baed
pop ecx
xor eax, eax
push eax
push 0x2000080
push 2
push eax
push 7
push 0x40000000
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x64], ebx
ja 0x42e343
jb 0x42e293
cmp dword [esp + 0x60], 0x40000000
jae 0x42e343
push dword [0x4ad284]
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x42e317
cmp esi, 0xffffffff
je 0x42e317
xor ecx, ecx
lea eax, [esp + 0x60]
push eax
push ecx
push ecx
push dword [0x4ad284]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [esp + 0x64], ebx
jb 0x42e317
ja 0x42e2d7
cmp dword [esp + 0x60], 0x40000000
jb 0x42e317
mov eax, dword [0x4ad284]
mov esi, dword [sym.imp.msvcrt.dll_memcpy]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
lea eax, [esp + 0x838]
push eax
call esi
mov eax, dword [0x4ad284]
lea ecx, [esp + 0x83c]
add esp, 0xc
mov eax, dword [eax - 0xc]
push 0x18
push str.ConfigTemp
lea eax, [ecx + eax*2]
push eax
call esi
add esp, 0xc
jmp 0x42e343
mov esi, 0x4992b8
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.0043c99e
push 0x4993e8
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x20]
call fcn.0043ca2b
mov eax, dword fs:[0x18]
xor esi, esi
xor edx, edx
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shld esi, ecx, 0x10
shl ecx, 0x10
or esi, edx
or ecx, dword [eax + 0xa8]
movzx eax, word [eax + 0xac]
shld esi, ecx, 0x10
cdq
shl ecx, 0x10
or esi, edx
or ecx, eax
shld esi, ecx, 0x10
shl ecx, 0x10
cmp esi, 0xa0000
jb 0x42e418
ja 0x42e399
xor eax, eax
cmp ecx, eax
jb 0x42e418
jmp 0x42e39b
xor eax, eax
add ecx, 0xc5990000
adc esi, 0xfff5ffff
cmp esi, eax
ja 0x42e3e3
jb 0x42e3b5
cmp ecx, 0xdffff
ja 0x42e3e3
mov esi, 0x4992b8
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.0043c99e
push str.S_MRHr_gW
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x20]
call fcn.0043ca2b
jmp 0x42e3e8
mov esi, 0x4992b8
call fcn.00415703
test al, al
jne 0x42e418
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.0043c99e
push 0x4994c8
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x20]
call fcn.0043ca2b
xor ecx, ecx
lea eax, [esp + 0xc40]
mov esi, 0x104
mov dword [esp + 0xa8], ecx
push esi
push eax
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42e480
cmp eax, esi
jae 0x42e480
push 0x492da0
lea eax, [esp + 0xc44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x42e480
xor eax, eax
lea edx, [esp + 0xa8]
push eax
lea ecx, [esp + 0xc44]
call fcn.0044d9a9
pop ecx
push str.Configx86wimgapi.dll
mov edx, 0x4ad284
lea ecx, [esp + 0x1c]
call fcn.0043baed
mov esi, dword [esp + 0x1c]
lea edx, [esp + 0x8c]
pop ecx
xor eax, eax
mov ecx, esi
push eax
call fcn.0044d9a9
mov eax, dword [esp + 0xb0]
pop ecx
cmp eax, dword [esp + 0x8c]
jb 0x42e4e3
ja 0x42e4cc
mov eax, dword [esp + 0xa8]
cmp eax, dword [esp + 0x88]
jb 0x42e4e3
mov ecx, 0x492da0
call fcn.00482abc
mov dword [0x4ad184], eax
test eax, eax
jne 0x42e535
mov ecx, esi
jmp 0x42e4f8
mov ecx, esi
call fcn.00482abc
mov dword [0x4ad184], eax
test eax, eax
jne 0x42e535
mov ecx, 0x492da0
call fcn.00482abc
mov dword [0x4ad184], eax
test eax, eax
jne 0x42e535
push 0x4992b8
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push 0x4992b8
lea ecx, [esp + 0x24]
call fcn.0043c99e
push 0x499540
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x20]
call fcn.0043ca2b
lea ecx, [esi - 0x10]
call fcn.0043d912
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], 0
je 0x42e58e
lea eax, [esp + 0x1c]
push eax
push 0x499570
call sym.Dismx86.exe_DismMultiLanguage
mov edx, eax
lea ecx, [esp + 0x88]
call fcn.00431d43
pop ecx
push 0x30
push 0x4880b0
mov esi, eax
call sym.Dismx86.exe_DismMultiLanguage
push eax
push dword [esi]
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x84]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov edx, dword [esp + 0x80]
lea eax, [esp + 0x830]
push eax
call fcn.00412d38
mov dword [esp + 0x18], eax
test eax, eax
jne 0x42f6a8
push 0x491bbc
mov edx, 0x4ad284
lea ecx, [esp + 0x14]
call fcn.0043baed
pop ecx
mov edx, 0x4ad338
mov ecx, dword [eax]
call fcn.0042cce3
mov ecx, dword [esp + 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test esi, esi
jne 0x42e5f7
mov esi, 0x4ad338
mov ecx, esi
call fcn.00409a03
test al, al
jne 0x42e5f7
mov ecx, esi
call fcn.00439aeb
test edi, edi
je 0x42f359
cmp dword [edi], 0
je 0x42f359
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
xor eax, eax
push str._Update
push dword [edi]
mov dword [esp + 0x18], eax
call esi
push str._Crash
test eax, eax
jne 0x42e80d
push dword [edi + 4]
call esi
neg eax
sbb eax, eax
inc eax
mov dword [0x4ac118], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
xor eax, eax
push eax
push 0x400
call edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x42e6b5
xor edx, edx
lea ecx, [esp + 0x128]
push edx
push 0x18
push ecx
push edx
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, eax
test esi, esi
je 0x42e683
lea ecx, [esp + 0x18]
call fcn.00439864
mov ebx, esi
jmp 0x42f6df
push dword [esp + 0x13c]
xor eax, eax
push eax
push 0x100000
call edi
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00439864
push 0xffffffffffffffff
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x18]
call fcn.00439864
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x4ad284
lea ecx, [esp + 0x28]
push str.ConfigPluginsFrogPlugins_Pcn7FMvReAsVWfCQBfRJCw
mov edx, edi
call fcn.0043baed
mov edx, edi
mov dword [esp], str.ConfigPlugins4d420a2e_ea11_450a_b8a0_ab8ca7772043
lea ecx, [esp + 0x60]
mov esi, dword [eax]
call fcn.0043baed
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edx, edx
pop ecx
push edx
push esi
push dword [eax]
call edi
mov ecx, dword [esp + 0x5c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push str.ConfigPluginsFrogPlugins_Pcn7FMvReAsVWfCQBfRJCw
mov edx, 0x4ad284
lea ecx, [esp + 0x50]
call fcn.0043baed
mov edx, 0x4ad284
mov dword [esp], str.ConfigPluginsFogPlugins_Pcn7FMvReAsVWfCQBfRJCw
lea ecx, [esp + 0x54]
mov esi, dword [eax]
call fcn.0043baed
pop ecx
xor ecx, ecx
push ecx
push esi
push dword [eax]
call edi
mov ecx, dword [esp + 0x50]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x4c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push str.ConfigPluginsNCleaner_RGlzbVBsdWdATTItVXRpbA
mov edx, 0x4ad284
lea ecx, [esp + 0x4c]
call fcn.0043baed
pop ecx
mov edx, ebx
mov ecx, dword [eax]
call fcn.0044d00c
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0043d912
push ecx
mov ecx, dword [0x4ad284]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0043cad2
add eax, 0x10
mov dword [esi], eax
call fcn.0042d49b
cmp dword [0x4ac118], 0
pop ecx
jne 0x42e7fd
call fcn.00405ad1
test eax, eax
je 0x42e7fd
push 3
lea ecx, [esp + 0x62c]
call fcn.00403200
mov dword [esp + 0x69c], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [esp + 0x62c], 0
jne 0x42e7de
mov dword [esp + 0x62c], eax
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0x634]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
lea ecx, [esp + 0x628]
call fcn.00405c84
lea ecx, [esp + 0x18]
call fcn.00439864
xor eax, eax
jmp 0x42f360
push dword [edi]
call esi
test eax, eax
jne 0x42f14e
cmp dword [esp + 0x40], 4
je 0x42e828
or ebx, 0xffffffff
jmp 0x42f6df
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor eax, eax
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x42e84d
call fcn.0044cc8a
jmp 0x42f6dd
xor ecx, ecx
lea eax, [esp + 0x1b0]
push ecx
push 0x18
push eax
push ecx
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jne 0x42f6dd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x1c4]
xor eax, eax
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x42e843
push 0xa
xor eax, eax
push eax
push dword [edi + 8]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x5c], eax
push 0x434
push eax
lea eax, [esp + 0x1d0]
push eax
call sub.msvcrt.dll_memset
or dword [esp + 0x1fc], 0xffffffff
lea ecx, [esp + 0x1d4]
or dword [esp + 0x200], 0xffffffff
add esp, 0xc
or dword [esp + 0x1f8], 0xffffffff
call fcn.00471cb5
mov ecx, dword [0x4ad194]
lea edx, [esp + 0x1d8]
xor eax, eax
push eax
call fcn.0044d947
pop ecx
xor eax, eax
lea edx, [esp + 0x1e0]
push eax
mov ecx, 0x491a2c
call fcn.0044d9a9
pop ecx
push 0x10
xor eax, eax
push eax
push dword [edi + 4]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x70], eax
xor ecx, ecx
push ecx
push 4
lea ecx, [esp + 0x64]
push ecx
push eax
push esi
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jne 0x42e97b
push eax
push 0x50
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x68]
push esi
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x140]
cdq
mov dword [esp + 0x1f0], eax
mov dword [esp + 0x1f4], edx
mov dword [esp + 0x1f8], ecx
jmp 0x42e989
mov edx, dword [esp + 0x1f4]
mov eax, dword [esp + 0x1f0]
and eax, edx
cmp eax, 0xffffffff
je 0x42e9de
push 0x200
lea eax, [esp + 0x200]
push eax
push dword [esp + 0x1f8]
push esi
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
push 0x1c
lea eax, [esp + 0xc4]
push eax
push dword [esp + 0x1f8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42e9de
mov eax, dword [esp + 0xc4]
sub dword [esp + 0x1f0], eax
push 0
pop eax
sbb dword [esp + 0x1f4], eax
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x2c]
call fcn.0043bbe8
mov ecx, dword [0x4ad468]
lea eax, [esp + 0x28]
push eax
push str.LastCrashTime
mov edx, 0x488134
call fcn.0044e2fd
xor eax, eax
push eax
call dword [sym.imp.msvcrt.dll__time64]
add esp, 0xc
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x38]
mov dword [esp + 0xbc], edx
lea ecx, [esp + 0xb8]
push 0x491b80
push eax
call fcn.0043ab89
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x40]
call fcn.0043c99e
push dword [esp + 0x1f0]
lea eax, [esp + 0x3c]
push 0x499774
push eax
call fcn.0043c2a4
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x134]
add esp, 0xc
mov edx, dword [ecx - 0xc]
push 0x10
push eax
push 0x8003
add edx, edx
call fcn.0044c2f1
add esp, 0xc
lea edx, [esp + 0x128]
lea ecx, [esp + 0x20]
push 0x10
call fcn.0044b142
pop ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.0043c5cb
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push dword [esp + 0x28]
lea ecx, [esp + 0x3c]
call fcn.00432a00
test eax, eax
je 0x42f131
push dword [0x4ad468]
push dword [esp + 0x3c]
push str.LastCrashTime
push 0x488134
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp word [esp + 0x1fc], 0
je 0x42eb46
lea eax, [esp + 0x1fc]
push eax
push str._GLOBALROOT
lea ecx, [esp + 0x5c]
call fcn.0043c2b8
mov edx, eax
lea ecx, [esp + 0x94]
call fcn.0043baed
pop ecx
xor ecx, ecx
lea edx, [esp + 0x1e8]
push ecx
mov ecx, dword [eax]
call fcn.0044d9a9
pop ecx
mov ecx, dword [esp + 0x90]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x54]
lea ecx, [ecx - 0x10]
call fcn.0043d912
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x42eb60
lea ecx, [esp + 0x1c8]
mov dword [eax], ecx
xor ecx, ecx
jmp 0x42eb64
xor ecx, ecx
mov eax, ecx
push ecx
push ecx
push eax
push 0x433815
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esp + 0x84], eax
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x28]
call fcn.0043bbe8
mov edx, str.UpdateInfo_Report
mov ecx, 0x4ad338
call fcn.0043b82e
mov dword [esp + 0x54], eax
test eax, eax
je 0x42ed7b
push ebx
push 9
push str.MinReport
mov ecx, eax
call fcn.0043b7cc
test eax, eax
je 0x42ebf2
mov eax, dword [eax + 4]
test eax, eax
jne 0x42ebc7
mov eax, 0x4934ec
push 0x10
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.msvcrt.dll__wcstoui64]
add esp, 0xc
cmp edx, dword [esp + 0x1dc]
ja 0x42ed7b
jb 0x42ebf2
cmp eax, dword [esp + 0x1d8]
ja 0x42ed7b
mov ecx, str.dbghelp.dll
call fcn.00482abc
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x90], eax
test eax, eax
je 0x42ed7b
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
add eax, 8
lea ecx, [esp + 0x24]
push eax
call fcn.0043c8e4
xor eax, eax
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push edx
push eax
lea eax, [esp + 0x2c]
push str.Dism__I64x_
push eax
call fcn.0043c2a4
mov esi, dword [esp + 0x34]
add esp, 0x10
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Dismx86.dmp
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
call fcn.0043baed
mov edi, dword [esp + 0x40]
xor eax, eax
pop ecx
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x42ed59
mov ecx, dword [esp + 0x54]
push ebx
push 8
push str.DumpType
call fcn.0043b7cc
test eax, eax
je 0x42ecc4
mov eax, dword [eax + 4]
test eax, eax
jne 0x42ecb3
mov eax, 0x4934ec
push 0x10
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
jmp 0x42ecc9
mov eax, 0x401
mov ebx, dword [esp + 0x18]
xor ecx, ecx
push ecx
push ecx
lea ecx, [esp + 0x74]
push ecx
push eax
push dword [esp + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push ebx
call dword [esp + 0xac]
push dword [esp + 0x20]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x42ed56
push 0x49981c
lea edx, [esp + 0x28]
lea ecx, [esp + 0x5c]
call fcn.0043baed
mov edx, 0x4ad284
mov dword [esp], str.ConfigDism.tmp.log
lea ecx, [esp + 0x34]
call fcn.0043baed
mov edi, dword [esp + 0x5c]
xor eax, eax
mov esi, dword [esp + 0x34]
pop ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi - 0x10]
call fcn.0043d912
lea ecx, [edi - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x3c]
lea ecx, [ecx - 0x10]
jmp 0x42ed6e
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, esi
call fcn.0044d00c
lea ecx, [esp + 0x24]
call fcn.0043c7e8
lea ecx, [edi - 0x10]
call fcn.0043d912
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0xc]
push 2
xor ecx, ecx
lea eax, [esp + 0x4c]
push ecx
push ecx
push eax
push 0xffffffffffffffff
push 0x10
push ecx
push dword [edi + 0xc]
mov dword [esp + 0x68], ecx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x42edbb
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x24]
xor eax, eax
cmp dword [edi - 0xc], eax
je 0x42f10e
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x10]
call fcn.0043bbe8
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
mov esi, str.Dism_Crash_when_UTC_Time
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043c99e
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0xa0]
push eax
movzx eax, word [esp + 0xa2]
push eax
movzx eax, word [esp + 0xa4]
push eax
movzx eax, word [esp + 0xa6]
push eax
movzx eax, word [esp + 0xa6]
push eax
movzx eax, word [esp + 0xa8]
push eax
lea eax, [esp + 0x24]
push str._hu__.2hu__.2hu__.2hu:_.2hu:_.2hu
push eax
call fcn.0043c2a4
mov esi, 0x4902c4
push esi
call ebx
add esp, 0x24
lea ecx, [esp + 0xc]
push eax
push esi
call fcn.0043c99e
mov esi, 0x4998b4
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043c99e
movzx eax, byte [esp + 0x1d7]
push eax
movzx eax, byte [esp + 0x1da]
push eax
movzx eax, byte [esp + 0x1dd]
push eax
movzx eax, byte [esp + 0x1e0]
push eax
movzx eax, byte [esp + 0x1e3]
push eax
movzx eax, byte [esp + 0x1e6]
push eax
movzx eax, byte [esp + 0x1e9]
push eax
movzx eax, byte [esp + 0x1ec]
push eax
movzx eax, word [esp + 0x1ee]
push eax
movzx eax, word [esp + 0x1f0]
push eax
push dword [esp + 0x1f0]
lea eax, [esp + 0x38]
push str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
push eax
call fcn.0043c2a4
add esp, 0x34
mov esi, 0x4902c4
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043c99e
mov esi, str.Crash_Module:
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043c99e
cmp word [esp + 0x1fc], 0
je 0x42ef72
lea eax, [esp + 0x1fc]
push eax
call ebx
pop ecx
push eax
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x14]
call fcn.0043c99e
movzx eax, word [esp + 0x1e8]
push eax
movzx eax, word [esp + 0x1ee]
push eax
movzx eax, word [esp + 0x1f4]
push eax
movzx eax, word [esp + 0x1fa]
push eax
lea eax, [esp + 0x1c]
push str.____hu._hu._hu._hu__
push eax
call fcn.0043c2a4
add esp, 0x18
jmp 0x42ef86
mov esi, str.null
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043c99e
mov esi, 0x4902c4
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043c99e
movzx eax, word [esp + 0x1d8]
push eax
movzx eax, word [esp + 0x1de]
push eax
movzx eax, word [esp + 0x1e4]
push eax
movzx eax, word [esp + 0x1ea]
push eax
lea eax, [esp + 0x1c]
push str.Dism_Version:__hu._hu._hu._hu_r_n
push eax
call fcn.0043c2a4
movzx eax, word [esp + 0x1f8]
push eax
movzx eax, word [esp + 0x1fe]
push eax
movzx eax, word [esp + 0x204]
push eax
movzx eax, word [esp + 0x20a]
push eax
lea eax, [esp + 0x34]
push str.OS_Version:__hu._hu._hu._hu_r_n
push eax
call fcn.0043c2a4
push dword [esp + 0x220]
lea eax, [esp + 0x40]
push str.ExceptionOffset:_0x_.8X_r_n
push eax
call fcn.0043c2a4
add esp, 0x3c
lea eax, [esp + 0xc]
push dword [esp + 0x1f8]
push str.ExceptionCode:_0x_.8X_r_n
push eax
call fcn.0043c2a4
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x30]
add esp, 0xc
dec eax
push eax
call fcn.0043d882
push 0x4939bc
lea edx, [esp + 0x28]
lea ecx, [esp + 0x54]
call fcn.0043baed
mov esi, dword [esp + 0x54]
mov edx, esi
pop ecx
lea ecx, [esp + 0x2c]
call fcn.0044b00f
push ecx
mov edx, edi
mov ecx, esp
mov ebx, eax
call fcn.0044b00f
mov ecx, dword [ebx]
call fcn.00410c89
pop ecx
mov ecx, dword [esp + 0x2c]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.0043d912
test ebx, ebx
jne 0x42f0ee
push str.Dism_Crash_Auto_Report_
lea ecx, [esp + 0x50]
call fcn.0043c2b8
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [esp + 0x50]
call fcn.0043ca2b
push dword [esp + 0x1f0]
lea eax, [esp + 0x50]
push 0x499774
push eax
call fcn.0043c2a4
mov edx, dword [esp + 0x18]
add esp, 0xc
push esi
mov esi, dword [esp + 0x50]
mov ecx, esi
call fcn.0042d77d
pop ecx
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi - 0x10]
call fcn.0043d912
mov esi, dword [esp + 0x50]
xor ebx, ebx
mov ecx, edi
lea edx, [ebx + 1]
call fcn.0044d00c
lea ecx, [esi - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov esi, dword [esp + 0x84]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [edi - 0x10]
call fcn.0043d912
test esi, esi
je 0x42f131
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0043d912
jmp 0x42e820
push str._All
push dword [edi]
xor ebx, ebx
mov dword [0x4ac118], ebx
call esi
mov esi, str._Image
test eax, eax
je 0x42f1e7
mov ecx, dword [edi]
mov edx, esi
push 6
call fcn.0042d699
pop ecx
test al, al
jne 0x42f1e7
push 0x492e20
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42f1a7
push 0x40
push 0x488134
push 0x499d58
call sym.Dismx86.exe_DismMultiLanguage
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42f6df
push edi
lea ecx, [esp + 0x144]
call fcn.0040e8c9
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [esp + 0x144], ebx
jne 0x42f1ca
mov dword [esp + 0x144], eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
mov ecx, dword [esp + 0x1a8]
jmp 0x42f3a4
push 6
push esi
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x42f23d
mov esi, dword [edi]
cmp word [esi + 0xc], bx
jne 0x42f20c
push 0x40
push 0x488134
push str._Image:_path_to_image__t_
jmp 0x42f195
add esi, 0xe
cmp word [esi], 0x22
jne 0x42f226
add esi, 2
mov ecx, esi
call fcn.0044ccce
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00412ea0
mov dword [esp + 0x18], eax
test eax, eax
jne 0x42f6aa
mov ecx, dword [edi + 4]
mov edx, str._Plugin
push 7
call fcn.0042d699
pop ecx
test al, al
je 0x42f348
mov eax, dword [edi + 4]
cmp word [eax + 0xe], bx
jne 0x42f26f
push 0x40
push 0x488134
push str._Plugin:_Plugin_ID__t_
jmp 0x42f195
push 0x499ca8
add eax, 0x10
lea ecx, [esp + 0x5c]
push eax
push str.ConfigPlugins_
mov edx, 0x4ad284
call fcn.0043baed
pop ecx
mov edx, eax
lea ecx, [esp + 0x38]
call fcn.0043baed
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.0043baed
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x2c]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043d912
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.0043d912
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0043d912
test esi, esi
jne 0x42f2ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
test eax, eax
je 0x42f6dd
jmp 0x42f6aa
push str.DismCreateInstance2
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x42f30b
mov eax, 0x80004002
mov dword [esp + 0x18], eax
jmp 0x42f6aa
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
push ecx
push 0x49a300
push dword [esp + 0x18]
call eax
mov dword [esp + 0x18], eax
test eax, eax
jne 0x42f6aa
mov ecx, dword [esp + 0x28]
lea eax, [edi + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x42f6d9
push 0x40
push 0x488134
push 0x499ce8
jmp 0x42f195
xor eax, eax
mov dword [0x4ac118], eax
push str.GlobalDism_B8BECCD6_BA05_443C_B649_012B3E5C21E6
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42f3b1
mov ebx, 0x420
lea ecx, [esp + 0x2c]
mov edx, ebx
call fcn.0043c2ea
push 0x30
push 0x488134
push dword [eax]
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
jmp 0x42f6df
mov edx, str.Data_UserAgreement
mov ecx, 0x4ad470
call fcn.0043b82e
mov ecx, eax
test ecx, ecx
je 0x42f550
xor eax, eax
mov byte [esp + 0x6c], 0xff
lea edi, [esp + 0x6d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ecx + 4]
test eax, eax
je 0x42f3e7
mov edx, dword [ecx + 0xc]
jmp 0x42f3f0
xor ecx, ecx
mov eax, 0x4934ec
mov edx, ecx
push 0x10
lea ecx, [esp + 0x70]
add edx, edx
push ecx
push 0x8003
mov ecx, eax
call fcn.0044c2f1
xor eax, eax
lea edi, [esp + 0xa0]
stosd dword es:[edi], eax
lea ecx, [esp + 0xa0]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00471cb5
mov eax, dword [esp + 0x94]
xor dword [esp + 0x6c], eax
mov eax, dword [esp + 0x98]
xor dword [esp + 0x70], eax
mov eax, dword [esp + 0x9c]
xor dword [esp + 0x74], eax
mov eax, dword [esp + 0xa0]
xor dword [esp + 0x78], eax
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x40]
call fcn.0043bbe8
mov ecx, dword [0x4ad468]
lea eax, [esp + 0x3c]
push eax
mov edi, str.UserAgreement
mov edx, 0x488134
push edi
call fcn.0044e2fd
mov esi, dword [esp + 0x44]
mov edx, esi
pop ecx
lea ecx, [esp + 0x70]
call fcn.0043b683
pop ecx
test al, al
jne 0x42f548
xor eax, eax
push eax
push ecx
push 0x499fb0
call sym.Dismx86.exe_DismMultiLanguage
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [esp + 0xcc]
call fcn.00404d5a
lea ecx, [esp + 0x140]
call fcn.0040eec6
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0xc4]
call fcn.00431558
xor eax, eax
lea ecx, [esp + 0xc0]
push eax
call fcn.004315ab
cmp eax, ebx
je 0x42f511
cmp dword [esp + 0x154], 0
je 0x42f4f8
push dword [esp + 0x154]
call fcn.00483481
lea ecx, [esp + 0xc0]
call fcn.00431611
lea ecx, [esi - 0x10]
call fcn.0043d912
jmp 0x42f690
push ecx
mov ecx, dword [0x4ad468]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.0044e356
add esp, 0xc
cmp dword [esp + 0x154], 0
je 0x42f53c
push dword [esp + 0x154]
call fcn.00483481
lea ecx, [esp + 0xc0]
call fcn.00431611
lea ecx, [esi - 0x10]
call fcn.0043d912
call sym.Dismx86.exe_BcdIsWinPEBoot
test eax, eax
je 0x42f562
xor eax, eax
mov dword [0x4ac13c], eax
jmp 0x42f5af
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x24]
call fcn.0043bbe8
mov ecx, dword [0x4ad468]
lea eax, [esp + 0x20]
push eax
push str.Mode
mov edx, 0x488134
call fcn.0044e2fd
mov esi, dword [esp + 0x28]
pop ecx
pop ecx
push 0x490458
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
neg eax
lea ecx, [esi - 0x10]
sbb eax, eax
and dword [0x4ac13c], eax
call fcn.0043d912
call fcn.0042d06e
push str.ConfigTemp
mov edx, 0x4ad284
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x30]
call fcn.0043baed
pop ecx
mov edx, ebx
mov ecx, dword [eax]
call fcn.0044d00c
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
xor ecx, ecx
lea eax, [esp + 0x44]
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
mov esi, 0x80000002
mov dword [esp + 0x70], ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x42f67e
push 0x103
lea ecx, [esp + 0xa3c]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x42f67e
push 0x26
push str.bf1a281b_ad7b_4476_ac95_f47682990ce7
lea eax, [esp + 0xa40]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x42f67e
lea eax, [esp + 0xa38]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
test eax, eax
je 0x42f67e
push eax
lea eax, [esp + 0xa3c]
push eax
lea eax, [esp + 0x38]
push 0x495d6c
push eax
call fcn.0044af44
add esp, 0x10
push dword [eax]
push str.kb__
push ebx
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [esp + 0x30]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov eax, dword [esp + 0x44]
dec eax
mov dword [esp + 0x44], eax
cmp eax, 0xffffffff
jne 0x42f604
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x20]
jmp 0x42f6df
xor ebx, ebx
mov edx, eax
lea ecx, [esp + 0x54]
call fcn.0043c2ea
push 0x10
push 0x48f30c
mov esi, eax
call sym.Dismx86.exe_DismMultiLanguage
push eax
push dword [esi]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x54]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov eax, dword [esp + 0x18]
mov ebx, eax
mov ecx, dword [esp + 0x80]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov esi, dword [esp + 0xb0]
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x600]
call fcn.0043ba19
test esi, esi
js 0x42f717
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10