Function at 0x4027c0
Capabilities:
Accept command line arguments
Create process on windows
Extract resource via kernel32 functions
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x328
mov eax, dword [0x42f040]
xor eax, esp
mov dword [esp + 0x324], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x2a8]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0x24], eax
call fcn.00413930
call fcn.0040cb70
mov edi, eax
push 0x64
mov ecx, dword [edi]
mov esi, dword [ecx + 0x10]
call fcn.0041bee5
cmp dword [esp + 0x2c8], 0xf
lea ecx, [esp + 0x2b4]
cmova ecx, dword [esp + 0x2b4]
sub esp, 8
push ecx
mov ecx, eax
call fcn.0040ae10
push eax
mov ecx, edi
call esi
call fcn.004065d0
push 0x268
call fcn.0041bee5
add esp, 4
mov esi, eax
push 0x268
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov ecx, esi
call fcn.00411210
mov ecx, eax
mov dword [0x42fbf8], eax
call fcn.004148b0
lea eax, [esp + 0x20]
mov byte [0x42fbd0], 0
push eax
mov dword [0x42fbf4], 0
mov dword [0x42fbd4], 0
mov dword [0x42fbc4], 0
mov dword [0x42fbe8], 0
mov dword [0x42fbd8], 0
mov dword [0x42fbc0], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push dword [esp + 0x20]
push str.process_session_id__d
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
cmp dword [esp + 0x20], 0
jne 0x40296e
call fcn.0040aa80
mov esi, eax
push esi
push str.Received_session_id__d
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
cmp esi, 0xffffffff
je 0x40295c
mov ecx, esi
call fcn.0040c5a0
mov esi, eax
test esi, esi
je 0x40296e
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov ecx, esi
call fcn.0040c7e0
add esp, 0xc
test al, al
je 0x40294b
push str.self_re_launch:_success____
push str.antivirus_detector
call fcn.00401ed0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.self_re_launch:_fail____
push str.antivirus_detector
call fcn.00401ed0
jmp 0x40296b
push str.possible_launch_from_msi.
push str.antivirus_detector
call fcn.00401ea0
add esp, 8
push 0
xorps xmm0, xmm0
mov byte [esp + 0xf], 0
push 0x421760
lea ecx, [esp + 0x118]
mov byte [esp + 0x28], 0
movaps xmmword [esp + 0x118], xmm0
mov dword [esp + 0x128], 0
mov dword [esp + 0x12c], 0
call fcn.00402000
push 0
push 0x421760
mov ecx, 0x42f0b4
call fcn.00405d60
mov edi, dword [esp + 0x24]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4029c4
sub edi, ecx
sar edi, 1
lea esi, [edi + 1]
push esi
call fcn.0041c17b
add esp, 4
mov dword [esp + 0x18], eax
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [esp + 0x24]
add esp, 0xc
push edi
push dword [esp + 0x28]
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
add esp, 0xc
xor edi, edi
push 0x421874
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov esi, eax
add esp, 8
test esi, esi
je 0x402b29
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test edi, edi
jne 0x402a6c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push str.token0:__s
push str.antivirus_detector
call fcn.00401ed0
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a50
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x118]
call fcn.00405d60
jmp 0x402b09
cmp edi, 1
jne 0x402aa7
push esi
push str.token1:__s
push str.antivirus_detector
call fcn.00401ed0
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a90
sub ecx, edx
push ecx
push esi
mov ecx, 0x42f0b4
call fcn.00405d60
jmp 0x402b09
cmp edi, 2
jne 0x402ad3
push esi
call eax
add esp, 4
mov esi, eax
push esi
push str.token2:__d
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
cmp esi, 1
jne 0x402b09
mov byte [esp + 0xb], 1
jmp 0x402b09
cmp edi, 3
jne 0x402b09
push esi
call eax
add esp, 4
mov esi, eax
push esi
push str.token3:__d
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp esi, 1
movzx eax, al
mov ecx, 1
cmove eax, ecx
mov dword [esp + 0x20], eax
push 0x421874
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov esi, eax
add esp, 8
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
inc edi
test esi, esi
jne 0x402a22
push dword [esp + 0x18]
call fcn.0041bee0
add esp, 4
mov dword [esp + 0x80], 0
xorps xmm0, xmm0
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x70]
movaps xmmword [esp + 0x70], xmm0
push 0
push 0x421760
call fcn.00402000
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x2c]
call fcn.00405c70
sub esp, 8
lea ecx, [esp + 0x30]
call fcn.00405a10
test eax, eax
jle 0x402bc3
lea ecx, [eax + 1]
cmp dword [esp + 0x38], ecx
jb 0x404ae8
cmp dword [esp + 0x3c], 0xf
lea eax, [esp + 0x28]
mov dword [esp + 0x38], ecx
cmova eax, dword [esp + 0x28]
mov byte [eax + ecx], 0
lea eax, [esp + 0x28]
cmp dword [esp + 0x3c], 0xf
lea ecx, [esp + 0x70]
push dword [esp + 0x38]
cmova eax, dword [esp + 0x2c]
push eax
call fcn.00405d60
mov ecx, dword [esp + 0x3c]
mov eax, ecx
mov edi, dword [esp + 0x38]
sub eax, edi
push 0xb
push str.license.txt
cmp eax, 0xb
jb 0x402c01
cmp ecx, 0xf
lea esi, [esp + 0x30]
lea eax, [edi + 0xb]
cmova esi, dword [esp + 0x30]
mov dword [esp + 0x40], eax
lea eax, [esi + edi]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + edi + 0xb], 0
jmp 0x402c10
push dword [esp + 0x14]
lea ecx, [esp + 0x34]
push 0xb
call fcn.004061f0
mov edx, dword [esp + 0x84]
mov eax, edx
mov ecx, dword [esp + 0x80]
sub eax, ecx
push 7
push str.log.csv
cmp eax, 7
jb 0x402c55
cmp edx, 0xf
lea esi, [esp + 0x78]
lea eax, [ecx + 7]
cmova esi, dword [esp + 0x78]
add esi, ecx
mov dword [esp + 0x88], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 7], 0
jmp 0x402c64
push dword [esp + 0x14]
lea ecx, [esp + 0x7c]
push 7
call fcn.004061f0
cmp dword [esp + 0x3c], 0xf
lea ecx, [esp + 0x130]
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea eax, [esp + 0x28]
cmova eax, dword [esp + 0x28]
push ecx
push eax
mov byte [esp + 0x1b], 0
call edi
add esp, 8
test eax, eax
jne 0x402cca
cmp dword [esp + 0x3c], 0xf
lea ecx, [esp + 0x130]
lea eax, [esp + 0x28]
cmova eax, dword [esp + 0x28]
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x402f61
cmp dword [esp + 0x144], eax
jle 0x402f61
mov byte [esp + 0x13], 1
jmp 0x402f61
push 0
push 0x421760
lea ecx, [esp + 0x78]
call fcn.00405d60
cmp byte [esp + 0x20], 0
je 0x402f61
push 0x2b
xorps xmm0, xmm0
mov dword [esp + 0xa4], 0
push str.SOFTWAREPoliciesWindows_ProvisioningPath
lea ecx, [esp + 0x98]
movaps xmmword [esp + 0x98], xmm0
mov dword [esp + 0xac], 0
call fcn.004020e0
cmp dword [esp + 0xa4], 7
lea ecx, [esp + 0x1c]
push ecx
push 0x201
lea eax, [esp + 0x98]
mov dword [esp + 0x24], 0
cmova eax, dword [esp + 0x98]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push str.open_reg:__d
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x402ee0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0
push ecx
push 0
push 0x421918
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x18]
push str.len_lic_path:__d
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x402e25
inc eax
push eax
call fcn.0041c17b
mov ecx, dword [esp + 0x1c]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x28]
push eax
push 0
push 0x421918
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402df5
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x30]
call fcn.00405d60
push esi
push str.License_path:__s
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
push esi
call fcn.0041bee0
add esp, 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
lea eax, [esp + 0x28]
push eax
push 0
push str.Status
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x24]
push str.len_status_path:__d
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x30]
add esp, 0xc
test eax, eax
je 0x402ed6
inc eax
push eax
call fcn.0041c17b
mov ecx, dword [esp + 0x28]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push esi
lea eax, [esp + 0x28]
push eax
push 0
push str.Status
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402ea6
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x78]
call fcn.00405d60
push esi
push str.Status_path:__s
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
push esi
call fcn.0041bee0
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x3c], 0xf
lea ecx, [esp + 0x130]
lea eax, [esp + 0x28]
cmova eax, dword [esp + 0x28]
push ecx
push eax
call edi
xor ecx, ecx
test eax, eax
sete cl
push ecx
push str.License_file_exists:__d
push str.antivirus_detector
call fcn.00401ed0
mov ecx, dword [esp + 0xb8]
add esp, 0x14
mov byte [esp + 0x13], 1
mov byte [esp + 0xb], 1
cmp ecx, 7
jbe 0x402f61
mov edx, dword [esp + 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402f57
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402f57
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
push 0x268
mov byte [esp + 0x16], 0
call fcn.0041bee5
add esp, 4
mov esi, eax
push 0x268
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov ecx, esi
call fcn.00411210
mov esi, eax
mov ecx, esi
call fcn.00413af0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 2
push eax
lea eax, [esp + 0x44]
mov ecx, esi
push eax
call fcn.00416480
mov eax, dword [esp + 0x48]
cmp byte [eax + 0xd], 0
jne 0x402fdd
cmp dword [eax + 0x10], 2
jg 0x402fdd
cmp eax, dword [esi]
je 0x402fdd
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.00415fb0
push eax
lea ecx, [esp + 0x184]
call fcn.00405c70
jmp 0x403011
push 0
xorps xmm0, xmm0
mov dword [esp + 0x194], 0
push 0x421760
lea ecx, [esp + 0x188]
movaps xmmword [esp + 0x188], xmm0
mov dword [esp + 0x19c], 0
call fcn.00402000
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 3
push eax
lea eax, [esp + 0x44]
mov ecx, esi
push eax
call fcn.00416480
mov eax, dword [esp + 0x48]
cmp byte [eax + 0xd], 0
jne 0x403059
cmp dword [eax + 0x10], 3
jg 0x403059
cmp eax, dword [esi]
je 0x403059
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.00415fb0
push eax
lea ecx, [esp + 0x164]
call fcn.00405c70
jmp 0x40308d
push 0
xorps xmm0, xmm0
mov dword [esp + 0x174], 0
push 0x421760
lea ecx, [esp + 0x168]
movaps xmmword [esp + 0x168], xmm0
mov dword [esp + 0x17c], 0
call fcn.00402000
cmp dword [esp + 0x194], 0xf
lea ecx, [esp + 0x130]
lea eax, [esp + 0x180]
cmova eax, dword [esp + 0x180]
push ecx
push eax
call edi
add esp, 8
test eax, eax
je 0x4030df
cmp dword [esp + 0x174], 0xf
lea ecx, [esp + 0x130]
lea eax, [esp + 0x160]
cmova eax, dword [esp + 0x160]
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4030e4
mov byte [esp + 0x12], 1
mov ecx, esi
call fcn.00412cc0
push 0x268
push esi
call fcn.0041c16d
push str.create_stealth_manager
push str.antivirus_detector
call fcn.00401ed0
push 0x268
call fcn.0041bee5
add esp, 0x14
mov esi, eax
push 0x268
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov ecx, esi
call fcn.00411210
mov edi, eax
push str.load_name_map
push str.antivirus_detector
mov dword [esp + 0x14], edi
call fcn.00401ed0
add esp, 8
mov ecx, edi
call fcn.004148b0
push str.get_filename
push str.antivirus_detector
call fcn.00401ed0
add esp, 8
mov dword [esp + 0x20], 2
lea eax, [esp + 0x20]
mov ecx, edi
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00416480
mov eax, dword [esp + 0x48]
cmp byte [eax + 0xd], 0
jne 0x4031a4
cmp dword [eax + 0x10], 2
jg 0x4031a4
cmp eax, dword [edi]
je 0x4031a4
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.00415fb0
push eax
lea ecx, [esp + 0xd4]
call fcn.00405c70
jmp 0x4031d8
push 0
xorps xmm0, xmm0
mov dword [esp + 0xe4], 0
push 0x421760
lea ecx, [esp + 0xd8]
movaps xmmword [esp + 0xd8], xmm0
mov dword [esp + 0xec], 0
call fcn.00402000
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 3
push eax
lea eax, [esp + 0x44]
mov ecx, edi
push eax
call fcn.00416480
mov eax, dword [esp + 0x48]
cmp byte [eax + 0xd], 0
jne 0x403220
cmp dword [eax + 0x10], 3
jg 0x403220
cmp eax, dword [edi]
je 0x403220
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.00415fb0
push eax
lea ecx, [esp + 0xb4]
call fcn.00405c70
jmp 0x403254
push 0
xorps xmm0, xmm0
mov dword [esp + 0xc4], 0
push 0x421760
lea ecx, [esp + 0xb8]
movaps xmmword [esp + 0xb8], xmm0
mov dword [esp + 0xcc], 0
call fcn.00402000
cmp byte [esp + 0x13], 0
jne 0x403c69
cmp dword [esp + 0x120], 3
jbe 0x403285
cmp dword [esp + 0x124], 0xf
lea ecx, [esp + 0x110]
cmova ecx, dword [esp + 0x110]
call fcn.0040e430
cmp dword [esp + 0xe4], 0xf
lea ecx, [esp + 0x2f8]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea eax, [esp + 0xd0]
cmova eax, dword [esp + 0xd0]
push ecx
push eax
call esi
add esp, 8
test eax, eax
je 0x403b0c
cmp dword [esp + 0xc4], 0xf
lea ecx, [esp + 0x2c8]
lea eax, [esp + 0xb0]
cmova eax, dword [esp + 0xb0]
push ecx
push eax
call esi
add esp, 8
test eax, eax
je 0x403b0c
cmp byte [esp + 0x12], 0
jne 0x403b0c
cmp byte [esp + 0xb], 0
je 0x403495
push str.install_silent_mode
push str.antivirus_detector
call fcn.00401ed0
push 0x40
call fcn.0041c17b
add esp, 0xc
mov esi, eax
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 1
push str._s_d
push esi
call fcn.00401b40
mov ecx, esi
mov dword [esp + 0x21c], 0
xorps xmm0, xmm0
mov dword [esp + 0x220], 0
add esp, 0xc
movaps xmmword [esp + 0x200], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403360
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x208]
call fcn.00402000
push esi
call fcn.0041bee0
add esp, 4
lea edx, [esp + 0x200]
lea ecx, [esp + 0x1c0]
call fcn.0040d160
cmp dword [eax + 0x14], 7
jbe 0x40339b
mov eax, dword [eax]
push 0
push 0
push eax
push str.main_installer.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x42f0c4], 0
jbe 0x4033d0
cmp dword [0x42f0c8], 0xf
mov ecx, 0x42f0b4
cmova ecx, dword [0x42f0b4]
call fcn.0040e6c0
mov ecx, dword [esp + 0x1d4]
cmp ecx, 7
jbe 0x403414
mov edx, dword [esp + 0x1c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40340a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40340a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x214]
xor eax, eax
mov dword [esp + 0x1d0], 0
mov dword [esp + 0x1d4], 7
mov word [esp + 0x1c0], ax
cmp ecx, 0xf
jbe 0x403472
mov edx, dword [esp + 0x200]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403468
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403468
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov dword [esp + 0x210], 0
mov dword [esp + 0x214], 0xf
mov byte [esp + 0x200], 0
jmp 0x40472d
push 0x42f0b4
lea ecx, [esp + 0xfc]
call fcn.00405c70
mov edx, dword [esp + 0x10c]
lea eax, [esp + 0xf8]
mov esi, dword [esp + 0xf8]
cmp edx, 0xf
mov ecx, dword [esp + 0x108]
cmova eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x4034f5
push 0x4218a8
lea ecx, [esp + 0xfc]
call fcn.00405b00
mov edx, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
mov esi, dword [esp + 0xf8]
mov eax, SysReAllocString
sub eax, ecx
cmp eax, 0xb
jb 0x404aed
push 0xb
push str.version.txt
cmp edx, 0xf
lea eax, [esp + 0x100]
push ecx
cmova eax, esi
push eax
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x1c0]
call fcn.004064c0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x64], 0
push 0x421760
lea ecx, [esp + 0x58]
movaps xmmword [esp + 0x58], xmm0
mov dword [esp + 0x6c], 0
call fcn.00402000
lea ecx, [esp + 0x1a8]
call fcn.00405ac0
mov ecx, eax
call fcn.0040e2e0
test al, al
je 0x4035f5
lea ecx, [esp + 0x1a8]
call fcn.00405ac0
mov ecx, eax
call fcn.0040e320
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x4035e6
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 0x24]
call edx
test eax, eax
je 0x4035e6
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x24]
call eax
lea esi, [eax + 1]
push esi
call fcn.0041c17b
add esp, 4
mov edi, eax
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x2c]
add esp, 0xc
mov ecx, dword [ecx]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edx, dword [ecx + 0x18]
mov ecx, esi
call edx
push edi
lea ecx, [esp + 0x54]
call fcn.00405ad0
push edi
call fcn.0041bee0
mov edi, dword [esp + 0x10]
add esp, 4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push 0x421760
lea ecx, [esp + 0x1ec]
call fcn.00401fc0
push 0x421760
lea ecx, [esp + 0x254]
call fcn.00401fc0
push 0x421760
lea ecx, [esp + 0x23c]
call fcn.00401fc0
sub esp, 0x18
mov ecx, esp
push 0x4217c0
call fcn.00401fc0
sub esp, 0x18
lea eax, [esp + 0x80]
mov ecx, esp
push eax
call fcn.00405c70
lea ecx, [esp + 0x160]
call fcn.0040d5c0
add esp, 0x30
lea ecx, [esp + 0x50]
push eax
call fcn.00405bf0
lea ecx, [esp + 0x130]
call fcn.00405ba0
sub esp, 0x18
lea eax, [esp + 0x68]
mov ecx, esp
push eax
call fcn.00405c70
lea ecx, [esp + 0x148]
call fcn.0040d450
add esp, 0x18
lea ecx, [esp + 0x50]
push eax
call fcn.00405bf0
lea ecx, [esp + 0x130]
call fcn.00405ba0
mov eax, dword [esp + 0x60]
inc eax
push eax
call fcn.0041c17b
mov ecx, dword [esp + 0x64]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.00405ac0
mov edx, esi
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x4036d0
push 0x421764
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
add esp, 8
test eax, eax
je 0x403740
push eax
lea ecx, [esp + 0x1ec]
call fcn.00405ad0
push 0x421764
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
add esp, 8
test eax, eax
je 0x403740
push eax
lea ecx, [esp + 0x254]
call fcn.00405ad0
push 0x421764
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
add esp, 8
test eax, eax
je 0x403740
push eax
lea ecx, [esp + 0x23c]
call fcn.00405ad0
push esi
call fcn.0041bee0
add esp, 4
lea eax, [esp + 0x1e8]
mov ecx, 0x42f0cc
push eax
call fcn.00405b70
lea eax, [esp + 0x250]
mov ecx, 0x42f0fc
push eax
call fcn.00405b70
lea eax, [esp + 0x238]
mov ecx, 0x42f144
push eax
call fcn.00405b70
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 1
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x4c], 0
push eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push str.Display_dialog
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x1c]
add esp, 8
mov dword [0x42fbb8], eax
call fcn.004021e0
lea ecx, [esp + 0x220]
mov dword [0x42fbbc], eax
call fcn.00402260
cmp dword [esp + 0x230], 4
jbe 0x40382c
push str.version
mov ecx, 0x42f174
call fcn.004057c0
lea edx, [esp + 0x220]
lea ecx, [esp + 0x130]
call fcn.0040d160
mov ecx, eax
call fcn.004057b0
push eax
mov ecx, 0x42f174
call fcn.00405830
lea ecx, [esp + 0x130]
call fcn.004058b0
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6c
push dword [0x42fbbc]
call esi
push 0x6a
push dword [0x42fbbc]
mov dword [0x42fbb0], eax
call esi
push 5
push 0x3ea
push dword [0x42fbbc]
mov dword [0x42fbb4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x403892
push eax
push dword [0x42fbbc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403892
push 0
push 0x406730
push 0
push eax
push dword [0x42fbb8]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
test eax, eax
jg 0x403898
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x24]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov ecx, dword [esp + 0x234]
cmp ecx, 0xf
jbe 0x4038de
mov edx, dword [esp + 0x220]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4038d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ad9
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x24c]
mov dword [esp + 0x230], 0
mov dword [esp + 0x234], 0xf
mov byte [esp + 0x220], 0
cmp ecx, 0xf
jbe 0x403938
mov edx, dword [esp + 0x238]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40392e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ad9
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x264]
mov dword [esp + 0x248], 0
mov dword [esp + 0x24c], 0xf
mov byte [esp + 0x238], 0
cmp ecx, 0xf
jbe 0x403992
mov edx, dword [esp + 0x250]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403988
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ad9
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x1fc]
mov dword [esp + 0x260], 0
mov dword [esp + 0x264], 0xf
mov byte [esp + 0x250], 0
cmp ecx, 0xf
jbe 0x4039ec
mov edx, dword [esp + 0x1e8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4039e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ad9
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x1f8], 0
mov dword [esp + 0x1fc], 0xf
mov byte [esp + 0x1e8], 0
cmp ecx, 0xf
jbe 0x403a40
mov edx, dword [esp + 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a36
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ad9
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x1bc]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x50], 0
cmp ecx, 0xf
jbe 0x403a8d
mov edx, dword [esp + 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ad9
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0x1b8], 0
mov dword [esp + 0x1bc], 0xf
mov byte [esp + 0x1a8], 0
cmp ecx, 0xf
jbe 0x403ae9
mov edx, dword [esp + 0xf8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403adf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403adf
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov dword [esp + 0x108], 0
mov dword [esp + 0x10c], 0xf
mov byte [esp + 0xf8], 0
jmp 0x40472d
cmp dword [0x42f0c4], 0
jbe 0x40472d
push str.install_replace
push str.antivirus_detector
call fcn.00401ed0
add esp, 8
mov dword [esp + 0x20], 0
call fcn.004159a0
mov ecx, edi
call fcn.00415640
sub esp, 0x18
mov ecx, edi
mov eax, esp
push 4
push eax
call fcn.00413a70
call fcn.00415be0
mov eax, esp
mov ecx, edi
push 0x11
push eax
call fcn.00413a70
call fcn.00415be0
add esp, 0x18
call fcn.004189a0
call fcn.00418660
call fcn.004181c0
push str.GlobalKNIT_NFS_EXIT_CD1DF70D_8191_4840_B884_76C2620B8ED3
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x403ba8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialize_network_exit_event___d_
push str.uninstall_util
call fcn.00401ea0
add esp, 0xc
jmp 0x403bc1
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call fcn.004157a0
test al, al
je 0x403bed
push 1
call fcn.004157a0
test al, al
je 0x403bed
push 2
call fcn.004157a0
test al, al
je 0x403bed
push 3
call fcn.004157a0
test al, al
jne 0x403c1c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.loop
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x28]
add esp, 8
inc eax
mov dword [esp + 0x20], eax
cmp eax, 5
jl 0x403b33
cmp byte [esp + 0xb], 0
push 0
push 0
jne 0x403c2b
push 0
jmp 0x403c30
push str._s1
push str.main_installer.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x42f0c4], 0
jbe 0x40472d
cmp dword [0x42f0c8], 0xf
mov ecx, 0x42f0b4
cmova ecx, dword [0x42f0b4]
call fcn.0040e6c0
jmp 0x40472d
push str.Do_auto_install_and_activate
push str.antivirus_detector
call fcn.00401ed0
add esp, 8
mov dword [esp + 0x20], 6
lea eax, [esp + 0x20]
mov ecx, edi
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00416480
mov eax, dword [esp + 0x48]
cmp byte [eax + 0xd], 0
jne 0x403cc0
cmp dword [eax + 0x10], 6
jg 0x403cc0
cmp eax, dword [edi]
je 0x403cc0
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.00415fb0
push eax
lea ecx, [esp + 0x54]
call fcn.00405c70
jmp 0x403ce8
push 0
xorps xmm0, xmm0
mov dword [esp + 0x64], 0
push 0x421760
lea ecx, [esp + 0x58]
movaps xmmword [esp + 0x58], xmm0
mov dword [esp + 0x6c], 0
call fcn.00402000
mov edx, dword [esp + 0x64]
mov eax, edx
mov ecx, dword [esp + 0x60]
sub eax, ecx
mov dword [esp + 0xc], ecx
push 0xc
push str._version.txt
cmp eax, 0xc
jb 0x403d32
cmp edx, 0xf
lea esi, [esp + 0x58]
lea eax, [ecx + 0xc]
cmova esi, dword [esp + 0x58]
mov dword [esp + 0x68], eax
lea eax, [esi + ecx]
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x18]
add esp, 0xc
mov byte [esi + eax + 0xc], 0
lea eax, [esp + 0x50]
jmp 0x403d41
push dword [esp + 0x14]
lea ecx, [esp + 0x5c]
push 0xc
call fcn.004061f0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c0], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [esp + 0x64]
movq qword [esp + 0x1d0], xmm0
cmp ecx, 0xf
jbe 0x403da3
mov edx, dword [esp + 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403d99
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403d99
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
sub esp, 0x18
mov dword [esp + 0x34], 0
lea eax, [esp + 0x1d8]
mov dword [esp + 0x30], 0
mov ecx, esp
mov dword [esp + 0x3c], 0
push eax
call fcn.00405c70
lea eax, [esp + 0x3c]
push eax
lea edx, [esp + 0x34]
lea ecx, [esp + 0x38]
call fcn.00402460
mov ecx, dword [0x42f0c4]
mov eax, SysReAllocString
sub eax, ecx
add esp, 0x1c
cmp eax, 0xc
jb 0x404af2
cmp dword [0x42f0c8], 0xf
mov eax, 0x42f0b4
push 0xc
cmova eax, dword [0x42f0b4]
push str._version.txt
push ecx
push eax
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x1c0]
call fcn.004064c0
sub esp, 0x18
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x1c0]
mov dword [esp + 0x24], 0
mov ecx, esp
mov dword [esp + 0x38], 0
push eax
call fcn.00405c70
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x30]
call fcn.00402460
mov eax, dword [esp + 0x38]
add esp, 0x1c
mov esi, dword [esp + 0xc]
cdq
mov ecx, eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x20]
xor ecx, edx
sub ecx, edx
cdq
push esi
xor eax, edx
mov dword [esp + 0x24], ecx
sub eax, edx
push eax
push dword [esp + 0x30]
mov dword [esp + 0x24], eax
push dword [esp + 0x28]
push ecx
push str.Old_Version:__d._d._d__New_Version:__d._d._d
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x3c]
add esp, 0x20
cmp dword [esp + 0x14], eax
jg 0x4043aa
jne 0x404393
mov eax, dword [esp + 0x18]
cmp esi, eax
jg 0x4043aa
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jne 0x404393
cmp ecx, edx
jg 0x4043aa
cmp esi, eax
jne 0x404393
cmp ecx, edx
jne 0x404393
push 5
xorps xmm0, xmm0
mov byte [esp + 0x28], 1
push ecx
lea ecx, [esp + 0x48]
mov byte [esp + 0x20], 1
mov byte [esp + 0x24], 1
mov byte [esp + 0x1a], 1
movlpd qword [esp + 0x48], xmm0
call fcn.0040fe30
mov ecx, dword [esp + 0x48]
add esp, 8
test ecx, ecx
je 0x403f5a
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.0041ad50
test al, al
jne 0x403f5a
mov esi, dword [esp + 0xc]
test esi, esi
je 0x403f4f
push esi
push str.watchdog_avilible_exist:__d
push str.antivirus_detector
call fcn.00401ea0
add esp, 0xc
cmp esi, 0x424
setne byte [esp + 0x12]
push 0xf0001
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x404340
push 0xa
lea eax, [esp + 0x29c]
mov ecx, edi
push eax
call fcn.00413a70
cmp dword [esp + 0x2a8], 0
je 0x404040
lea ecx, [esp + 0x298]
call fcn.00405ac0
push eax
push str.Open_service:__s
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
lea edx, [esp + 0x298]
lea ecx, [esp + 0x130]
push 0xa0000000
call fcn.0040d160
mov ecx, eax
call fcn.004057b0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x130]
mov dword [esp + 0xc], eax
call fcn.004058b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403ffe
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
jmp 0x404040
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0x298]
push esi
call fcn.00405ac0
push eax
push str.Cannot_open_service___s___error_code:__d
push str.antivirus_detector
call fcn.00401ea0
mov eax, dword [esp + 0x34]
xor ecx, ecx
add esp, 0x10
movzx eax, al
cmp esi, 0x424
mov esi, dword [esp + 0x20]
cmove eax, ecx
mov dword [esp + 0x24], eax
push 4
lea eax, [esp + 0x284]
mov ecx, edi
push eax
call fcn.00413a70
cmp dword [esp + 0x290], 0
je 0x404100
lea ecx, [esp + 0x280]
call fcn.00405ac0
push eax
push str.Open_service:__s
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
lea edx, [esp + 0x280]
lea ecx, [esp + 0x130]
push 0xa0000000
call fcn.0040d160
mov ecx, eax
call fcn.004057b0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x130]
mov esi, eax
call fcn.004058b0
test esi, esi
je 0x4040c2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x404106
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0x280]
push esi
call fcn.00405ac0
push eax
push str.Cannot_open_service___s___error_code:__d
push str.antivirus_detector
call fcn.00401ea0
mov eax, dword [esp + 0x28]
xor ecx, ecx
add esp, 0x10
movzx eax, al
cmp esi, 0x424
cmove eax, ecx
mov dword [esp + 0x18], eax
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x11
lea eax, [esp + 0x26c]
mov ecx, edi
push eax
call fcn.00413a70
cmp dword [esp + 0x278], 0
je 0x4041c9
lea ecx, [esp + 0x268]
call fcn.00405ac0
push eax
push str.Open_service:__s
push str.antivirus_detector
call fcn.00401ed0
add esp, 0xc
lea edx, [esp + 0x268]
lea ecx, [esp + 0x130]
push 0xa0000000
call fcn.0040d160
mov ecx, eax
call fcn.004057b0
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x130]
mov dword [esp + 0xc], eax
call fcn.004058b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40418b
push eax
call esi
jmp 0x4041c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [esp + 0x268]
push esi
call fcn.00405ac0
push eax
push str.Cannot_open_service___s___error_code:__d
push str.antivirus_detector
call fcn.00401ea0
mov eax, dword [esp + 0x2c]
xor ecx, ecx
add esp, 0x10
movzx eax, al
cmp esi, 0x424
cmove eax, ecx
mov dword [esp + 0x1c], eax
push dword [esp + 0x20]
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
cmp byte [esp + 0x24], 0
je 0x4041f4
cmp byte [esp + 0x18], 0
je 0x4041f4
cmp byte [esp + 0x1c], 0
je 0x4041f4
cmp byte [esp + 0x12], 0
jne 0x40431a
cmp dword [0x42f0c4], 0
jbe 0x40431a
xor esi, esi
call fcn.004159a0
mov ecx, edi
call fcn.00415640
mov ecx, edi
call fcn.004155b0
mov ecx, edi
call fcn.00415520
call fcn.004189a0
call fcn.00418660
call fcn.004181c0
call fcn.00418ab0
push 5
call fcn.004157a0
test al, al
je 0x40425d
push 1
call fcn.004157a0
test al, al
je 0x40425d
push 2
call fcn.004157a0
test al, al
je 0x40425d
push 3
call fcn.004157a0
test al, al
jne 0x404280
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.loop
push str.antivirus_detector
call fcn.00401ed0
inc esi
add esp, 8
cmp esi, 5
jl 0x404203
push 0x400
call fcn.0041c17b
add esp, 4
mov esi, eax
push 0x400
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.00405ac0
push eax
lea ecx, [esp + 0x2c]
call fcn.00405ac0
push eax
xor eax, eax
cmp byte [esp + 0x13], al
setne al
push eax
push str._s_d__k_s__p_s
push esi
call fcn.00401b40
add esp, 0x14
lea ecx, [esp + 0x130]
push esi
call fcn.00401fc0
push esi
call fcn.0041bee0
add esp, 4
lea edx, [esp + 0x130]
lea ecx, [esp + 0x1e8]
call fcn.0040d160
mov ecx, eax
call fcn.004057b0
mov ecx, eax
call fcn.00402220
lea ecx, [esp + 0x1e8]
call fcn.004058b0
lea ecx, [esp + 0x130]
call fcn.00405ba0
lea ecx, [esp + 0x268]
call fcn.00405ba0
lea ecx, [esp + 0x280]
call fcn.00405ba0
lea ecx, [esp + 0x298]
call fcn.00405ba0
jmp 0x404359
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_open_OpenSCManager_error_code__d
push str.antivirus_detector
call fcn.00401ea0
add esp, 0xc
mov esi, dword [esp + 0x44]
test esi, esi
je 0x4046b7
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x4046b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x4046b7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x4046b7
push str.Do_not_auto_install.__Application_has_installed_already_
push str.antivirus_detector
call fcn.00401ed0
add esp, 8
jmp 0x4046b7
cmp dword [esp + 0xe4], 0xf
lea ecx, [esp + 0x2c8]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea eax, [esp + 0xd0]
cmova eax, dword [esp + 0xd0]
push ecx
push eax
call esi
add esp, 8
test eax, eax
je 0x404406
cmp dword [esp + 0xc4], 0xf
lea ecx, [esp + 0x2c8]
lea eax, [esp + 0xb0]
cmova eax, dword [esp + 0xb0]
push ecx
push eax
call esi
add esp, 8
test eax, eax
jne 0x404509
cmp dword [0x42f0c4], 0
jbe 0x404509
mov dword [esp + 0xc], 0
nop dword [eax + eax]
call fcn.004159a0
mov ecx, edi
call fcn.00415640
sub esp, 0x18
mov ecx, edi
mov eax, esp
push 4
push eax
call fcn.00413a70
call fcn.00415be0
mov eax, esp
mov ecx, edi
push 0x11
push eax
call fcn.00413a70
call fcn.00415be0
add esp, 0x18
call fcn.004189a0
call fcn.00418660
call fcn.004181c0
push str.GlobalKNIT_NFS_EXIT_CD1DF70D_8191_4840_B884_76C2620B8ED3
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x404495
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialize_network_exit_event___d_
push str.uninstall_util
call fcn.00401ea0
add esp, 0xc
jmp 0x4044ae
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call fcn.004157a0
test al, al
je 0x4044da
push 1
call fcn.004157a0
test al, al
je 0x4044da
push 2
call fcn.004157a0
test al, al
je 0x4044da
push 3
call fcn.004157a0
test al, al
jne 0x404509
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.loop
push str.antivirus_detector
call fcn.00401ed0
mov eax, dword [esp + 0x14]
add esp, 8
inc eax
mov dword [esp + 0xc], eax
cmp eax, 5
jl 0x404420
push 0x400
call fcn.0041c17b
add esp, 4
mov esi, eax
push 0x400
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x70]
cmp dword [esp + 0x84], 0xf
lea eax, [esp + 0x28]
cmova ecx, dword [esp + 0x70]
cmp dword [esp + 0x3c], 0xf
push ecx
cmova eax, dword [esp + 0x2c]
push eax
xor eax, eax
cmp byte [esp + 0x13], al
setne al
push eax
push str._s_d__k_s__p_s
push esi
call fcn.00401b40
mov ecx, esi
mov dword [esp + 0xb4], 0
xorps xmm0, xmm0
mov dword [esp + 0xb8], 0
add esp, 0x14
movaps xmmword [esp + 0x90], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404587
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x98]
call fcn.00402000
push esi
call fcn.0041bee0
add esp, 4
lea edx, [esp + 0x90]
lea ecx, [esp + 0x130]
call fcn.0040d160
cmp dword [eax + 0x14], 7
jbe 0x4045c2
mov eax, dword [eax]
push 0
push 0
push eax
push str.main_installer.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x42f0c4], 0
jbe 0x4045f7
cmp dword [0x42f0c8], 0xf
mov ecx, 0x42f0b4
cmova ecx, dword [0x42f0b4]
call fcn.0040e6c0
mov ecx, dword [esp + 0x144]
cmp ecx, 7
jbe 0x40463b
mov edx, dword [esp + 0x130]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404631
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404631
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], 7
mov word [esp + 0x130], ax
cmp ecx, 0xf
jbe 0x404699
mov edx, dword [esp + 0x90]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40468f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40468f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
mov ecx, dword [esp + 0x1bc]
cmp ecx, 0xf
jbe 0x4046ef
mov edx, dword [esp + 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4046e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40471d
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x1d4]
cmp ecx, 0xf
jbe 0x40472d
mov edx, dword [esp + 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404723
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, edi
call fcn.00412cc0
push 0x268
push edi
call fcn.0041c16d
mov eax, dword [0x42fbfc]
add esp, 8
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x40475e
push eax
call esi
mov dword [0x42fbfc], 0
mov eax, dword [0x42fbcc]
test eax, eax
je 0x404774
push eax
call esi
mov dword [0x42fbcc], 0
mov eax, dword [0x42fbec]
test eax, eax
je 0x40478a
push eax
call esi
mov dword [0x42fbec], 0
mov eax, dword [0x42fbe4]
test eax, eax
je 0x4047a0
push eax
call esi
mov dword [0x42fbe4], 0
mov eax, dword [0x42fbf0]
test eax, eax
je 0x4047b6
push eax
call esi
mov dword [0x42fbf0], 0
mov eax, dword [0x42fc04]
test eax, eax
je 0x4047cc
push eax
call esi
mov dword [0x42fc04], 0
mov eax, dword [0x42fbdc]
test eax, eax
je 0x4047e2
push eax
call esi
mov dword [0x42fbdc], 0
mov eax, dword [0x42fbe0]
test eax, eax
je 0x4047f8
push eax
call esi
mov dword [0x42fbe0], 0
mov esi, dword [0x42fbf8]
test esi, esi
je 0x404817
mov ecx, esi
call fcn.00412cc0
push 0x268
push esi
call fcn.0041c16d
add esp, 8
mov ecx, dword [0x42fc08]
test ecx, ecx
je 0x404832
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [0x42fc08], 0
mov ecx, dword [esp + 0xc4]
cmp ecx, 0xf
jbe 0x40486e
mov edx, dword [esp + 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404864
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0xe4]
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 0xf
mov byte [esp + 0xb0], 0
cmp ecx, 0xf
jbe 0x4048c8
mov edx, dword [esp + 0xd0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4048be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x174]
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0xf
mov byte [esp + 0xd0], 0
cmp ecx, 0xf
jbe 0x404922
mov edx, dword [esp + 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404918
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x194]
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], 0xf
mov byte [esp + 0x160], 0
cmp ecx, 0xf
jbe 0x40497c
mov edx, dword [esp + 0x180]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404972
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x190], 0
mov dword [esp + 0x194], 0xf
mov byte [esp + 0x180], 0
cmp ecx, 0xf
jbe 0x4049d0
mov edx, dword [esp + 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4049c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0xf
mov byte [esp + 0x28], 0
cmp ecx, 0xf
jbe 0x404a1e
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404a14
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x124]
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0xf
mov byte [esp + 0x70], 0
cmp ecx, 0xf
jbe 0x404a71
mov edx, dword [esp + 0x110]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404a67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404abd
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x2c4]
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], 0xf
mov byte [esp + 0x110], 0
cmp ecx, 0xf
jbe 0x404acd
mov edx, dword [esp + 0x2b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404ac3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404ac3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c16d
add esp, 8
mov ecx, dword [esp + 0x32c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.0041bed2
mov esp, ebp
pop ebp
ret 0x10
call fcn.00405e90
call fcn.00401e90
call fcn.00401e90
int3