Function at 0x5113bd
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x619afb
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x6b9a04]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x6b9a04]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
mov dword [esp + 0x14], eax
xor eax, eax
cmp dword [ebp + 0x10], eax
push 0
sete al
mov dword [esp + 0x1c], eax
call fcn.004254c8
lea ebx, [esp + 0x118]
mov esi, eax
call fcn.0057290e
xor ebx, ebx
mov dword [esp + 0x270], ebx
cmp dword [esp + 0x124], ebx
jne 0x511471
push ebx
push 1
lea ecx, [esp + 0x118]
call fcn.004055c2
xor eax, eax
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.005c30b2
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0xc], ebx
je 0x511c53
push dword [ebp + 0x10]
push 5
call fcn.004254c8
lea ebx, [esp + 0x1a4]
mov esi, eax
call fcn.0057290e
lea eax, [esp + 0xd8]
mov byte [esp + 0x270], 1
call fcn.005486f7
push str.ppinstall5.dat
push eax
lea eax, [esp + 0x1c0]
push eax
mov byte [esp + 0x27c], 2
call fcn.00404922
add esp, 0xc
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0xe0]
mov byte [esp + 0x278], 4
call fcn.004055c2
lea eax, [esp + 0x1d4]
push ebx
push eax
call fcn.004254c8
mov ecx, eax
call fcn.0057298d
mov byte [esp + 0x270], 5
mov byte [esp + 0x244], 0x79
mov byte [esp + 0x245], 0x63
mov byte [esp + 0x246], 0x61
mov byte [esp + 0x247], 0x62
mov byte [esp + 0x248], 0x50
mov byte [esp + 0x249], 0x55
mov byte [esp + 0x24a], 0x34
mov byte [esp + 0x24b], 0x71
mov byte [esp + 0x24c], 0x4c
mov byte [esp + 0x24d], 0x6a
mov byte [esp + 0x24e], 0x76
mov byte [esp + 0x24f], 0x43
mov byte [esp + 0x250], 0x36
mov byte [esp + 0x251], 0x5a
mov byte [esp + 0x252], 0x41
mov byte [esp + 0x253], 0x51
mov byte [esp + 0x254], 0x31
mov byte [esp + 0x255], 0x31
mov byte [esp + 0x256], 0x4f
mov byte [esp + 0x257], 0x4d
mov byte [esp + 0x258], 0x67
mov byte [esp + 0x259], 0x44
mov byte [esp + 0x25a], 0x73
mov byte [esp + 0x25b], 0x4b
mov byte [esp + 0x25c], bl
mov byte [esp + 0x228], 0x4a
mov byte [esp + 0x229], 0x42
mov byte [esp + 0x22a], 0x30
mov byte [esp + 0x22b], 0x47
mov byte [esp + 0x22c], 0x62
mov byte [esp + 0x22d], 0x39
mov byte [esp + 0x22e], 0x6b
mov byte [esp + 0x22f], 0x62
mov byte [esp + 0x230], 0x78
mov byte [esp + 0x231], 0x58
mov byte [esp + 0x232], 0x32
mov byte [esp + 0x233], 0x34
mov byte [esp + 0x234], 0x30
mov byte [esp + 0x235], 0x49
mov byte [esp + 0x236], 0x74
mov byte [esp + 0x237], 0x77
mov byte [esp + 0x238], 0x33
mov byte [esp + 0x239], 0x6a
mov byte [esp + 0x23a], 0x6d
mov byte [esp + 0x23b], 0x4e
lea eax, [esp + 0x244]
push eax
lea ecx, [esp + 0xdc]
mov byte [esp + 0x240], 0x46
mov byte [esp + 0x241], 0x45
mov byte [esp + 0x242], 0x69
mov byte [esp + 0x243], 0x75
mov byte [esp + 0x244], bl
call fcn.0040518c
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0xdc]
lea edx, [esp + 0x1a0]
mov byte [esp + 0x274], 6
call fcn.005754cb
pop ecx
push ebx
push edi
lea ecx, [esp + 0xe0]
mov byte [esp + 0x278], 8
call fcn.004055c2
lea esi, [esp + 0x148]
lea ecx, [esp + 0xf4]
call fcn.0054aeb1
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x27c], 9
call fcn.0040529a
push ebx
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 8
call fcn.004055c2
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0xf8]
call fcn.0040518c
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0xf8]
lea edx, [esp + 0x1d8]
mov byte [esp + 0x274], 0xa
call fcn.005754cb
pop ecx
push ebx
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 0xc
call fcn.004055c2
lea esi, [esp + 0x164]
lea ecx, [esp + 0xd8]
call fcn.0054aeb1
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x27c], 0xd
call fcn.0040529a
push ebx
push edi
lea ecx, [esp + 0xe0]
mov byte [esp + 0x278], 0xc
call fcn.004055c2
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0xdc]
call fcn.0040518c
lea eax, [esp + 0x180]
mov byte [esp + 0x270], 0xe
push eax
lea ecx, [esp + 0xdc]
lea edx, [esp + 0x1bc]
call fcn.005754cb
pop ecx
push ebx
push edi
lea ecx, [esp + 0xe0]
mov byte [esp + 0x278], 0x10
call fcn.004055c2
lea esi, [esp + 0x180]
lea ecx, [esp + 0xf4]
call fcn.0054aeb1
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x27c], 0x11
call fcn.0040529a
push ebx
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 0x10
call fcn.004055c2
push str.PpHelper.exe
lea ecx, [esp + 0x1c]
call fcn.004050f0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x274], 0x12
call fcn.005455ba
pop ecx
cmp eax, ebx
jne 0x511908
push str.PpHelper.exe_could_not_be_found_and_is_required_to_perform_this_action
lea ecx, [esp + 0xdc]
call fcn.0040518c
mov byte [esp + 0x270], 0x13
cmp dword [esp + 0xf0], 0x10
mov eax, dword [esp + 0xdc]
jae 0x511882
lea eax, [esp + 0xdc]
mov ecx, dword [esp + 0x10]
push 0x10
push 0x6411dc
push eax
call fcn.0059c594
push ebx
push edi
lea ecx, [esp + 0xe0]
call fcn.004055c2
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.00405172
push ebx
push edi
lea ecx, [esp + 0x188]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x16c]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x150]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1dc]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1c0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1a4]
call fcn.004055c2
push ebx
push edi
jmp 0x51143d
push dword [esp + 0x18]
lea ecx, [esp + 0x210]
call fcn.0040518c
push 0x65ca08
lea ecx, [esp + 0x130]
mov byte [esp + 0x274], 0x14
call fcn.0040518c
lea eax, [esp + 0x148]
push eax
lea eax, [esp + 0xf8]
push 0x64f6e4
push eax
mov byte [esp + 0x27c], 0x15
call fcn.004049b4
add esp, 0xc
mov esi, 0x641644
push esi
push eax
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x27c], 0x16
call fcn.00404922
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x138]
mov byte [esp + 0x27c], 0x17
call fcn.00403e6f
push ebx
push edi
lea ecx, [esp + 0xe0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 0x15
call fcn.004055c2
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0xf8]
push 0x64f6e4
push eax
call fcn.004049b4
add esp, 0xc
push esi
push eax
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x27c], 0x18
call fcn.00404922
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x138]
mov byte [esp + 0x27c], 0x19
call fcn.00403e6f
push ebx
push edi
lea ecx, [esp + 0xe0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 0x15
call fcn.004055c2
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0xf8]
push 0x64f6e4
push eax
call fcn.004049b4
add esp, 0xc
push esi
push eax
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x27c], 0x1a
call fcn.00404922
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x138]
mov byte [esp + 0x27c], 0x1b
call fcn.00403e6f
push ebx
push edi
lea ecx, [esp + 0xe0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 0x15
call fcn.004055c2
push ebx
push 0x7530
sub esp, 0x1c
lea eax, [esp + 0x150]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.004051ae
sub esp, 0x1c
mov byte [esp + 0x2b0], 0x1c
lea eax, [esp + 0x24c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.004051ae
mov byte [esp + 0x2b0], 0x15
call fcn.005450bb
add esp, 0x40
cmp eax, ebx
je 0x511bcc
push str.PpHelper.exe_could_not_update_the_necessary_data
lea ecx, [esp + 0xdc]
call fcn.0040518c
mov byte [esp + 0x270], 0x1d
cmp dword [esp + 0xf0], 0x10
mov eax, dword [esp + 0xdc]
jae 0x511b1a
lea eax, [esp + 0xdc]
mov ecx, dword [esp + 0x10]
push 0x10
push 0x6411dc
push eax
call fcn.0059c594
push ebx
push edi
lea ecx, [esp + 0xe0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x134]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x214]
call fcn.004055c2
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.00405172
push ebx
push edi
lea ecx, [esp + 0x188]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x16c]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x150]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1dc]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1c0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1a4]
call fcn.004055c2
xor esi, esi
push ebx
push edi
lea ecx, [esp + 0x118]
call fcn.004055c2
mov eax, esi
jmp 0x51144b
push ebx
push edi
lea ecx, [esp + 0x134]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x214]
call fcn.004055c2
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.00405172
push ebx
push edi
lea ecx, [esp + 0x188]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x16c]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x150]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1dc]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1c0]
call fcn.004055c2
push ebx
push edi
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x278], bl
call fcn.004055c2
xor ebx, ebx
jmp 0x511c56
xor edi, edi
inc edi
lea esi, [esp + 0x110]
lea ecx, [esp + 0x1f0]
call fcn.0054aeb1
push 0xe26dc
sub esp, 0x1c
mov byte [esp + 0x290], 0x1e
lea eax, [esp + 0x210]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004051ae
lea eax, [esp + 0xf8]
push eax
push ecx
mov byte [esp + 0x298], 0x1f
call fcn.0040cb83
pop ecx
mov ecx, eax
mov byte [esp + 0x294], 0x1e
call fcn.0049b553
push ebx
push edi
lea ecx, [esp + 0xe0]
call fcn.004055c2
cmp dword [esp + 0x14], ebx
je 0x511fe8
lea eax, [esp + 0x1f0]
push eax
call fcn.004010df
call fcn.004e006b
cmp dword [esp + 0x14], ebx
je 0x511fe8
push dword [ebp + 0x10]
push edi
call fcn.004254c8
lea ebx, [esp + 0xe0]
mov esi, eax
call fcn.0057290e
xor esi, esi
mov byte [esp + 0x270], 0x20
cmp dword [esp + 0xec], esi
jne 0x511d22
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x118]
push eax
mov ecx, ebx
call fcn.0040529a
push dword [ebp + 0xc]
lea eax, [esp + 0xdc]
push eax
call fcn.004010df
push eax
call fcn.004dc608
push esi
push 1
lea ecx, [esp + 0xe0]
mov byte [esp + 0x278], 0x1e
call fcn.004055c2
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x511fe8
push dword [ebp + 0x10]
push 4
call fcn.004254c8
lea ebx, [esp + 0xe0]
mov esi, eax
call fcn.0057290e
xor edi, edi
mov byte [esp + 0x270], 0x21
cmp dword [esp + 0xec], edi
jne 0x511d98
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x118]
push eax
mov ecx, ebx
call fcn.0040529a
xor ebx, ebx
push edi
inc ebx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004010a2
push eax
call fcn.00433256
mov byte [esp + 0x270], 0x22
push dword [eax]
lea ecx, [esp + 0xf8]
call fcn.0040518c
mov byte [esp + 0x270], 0x24
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00405172
lea eax, [esp + 0xf4]
call fcn.00562090
mov esi, str.PluginDataSpellingPersonal
push esi
call fcn.005c3140
pop ecx
push eax
push esi
lea esi, [esp + 0xfc]
call fcn.00403f16
lea ecx, [esp + 0x30]
call fcn.005a17a3
mov byte [esp + 0x270], 0x25
cmp dword [esp + 0x10c], 0x10
mov eax, dword [esp + 0xf8]
jae 0x511e26
lea eax, [esp + 0xf8]
push edi
push eax
lea ecx, [esp + 0x38]
call fcn.005a1838
cmp eax, edi
je 0x511fb3
lea ecx, [esp + 0x30]
call fcn.005a1564
mov eax, dword [esp + 0x30]
push 0x10
lea ecx, [esp + 0x34]
call dword [eax + 0x38]
cmp eax, edi
je 0x511fb3
push str..dat
lea ecx, [esp + 0x50]
call fcn.0040518c
mov esi, eax
push 0x65ca38
lea ecx, [esp + 0x6c]
mov byte [esp + 0x274], 0x26
call fcn.0040518c
push eax
lea eax, [esp + 0xc0]
push str._spe
push eax
mov byte [esp + 0x27c], 0x27
call fcn.004049b4
add esp, 0xc
push 0x65ca34
push eax
lea eax, [esp + 0xa8]
push eax
mov byte [esp + 0x27c], 0x28
call fcn.00404922
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0x27c], 0x29
call fcn.00404969
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x100]
mov byte [esp + 0x27c], 0x2a
call fcn.00403e6f
push edi
push ebx
lea ecx, [esp + 0x8c]
call fcn.004055c2
push edi
push ebx
lea ecx, [esp + 0xa8]
call fcn.004055c2
push edi
push ebx
lea ecx, [esp + 0xc4]
call fcn.004055c2
push edi
push ebx
lea ecx, [esp + 0x70]
call fcn.004055c2
push edi
push ebx
lea ecx, [esp + 0x54]
mov byte [esp + 0x278], 0x25
call fcn.004055c2
lea ecx, [esp + 0x20]
call fcn.005a1e8a
mov byte [esp + 0x270], 0x2b
cmp dword [esp + 0x10c], 0x10
mov eax, dword [esp + 0xf8]
jae 0x511f5c
lea eax, [esp + 0xf8]
push edi
push 0x1001
push eax
lea ecx, [esp + 0x2c]
call fcn.005a229f
cmp eax, edi
je 0x511fa2
cmp dword [esp + 0xf0], 0x10
mov eax, dword [esp + 0xdc]
jae 0x511f88
lea eax, [esp + 0xdc]
push dword [esp + 0xec]
lea ecx, [esp + 0x24]
push eax
call fcn.005a1bc0
lea ecx, [esp + 0x20]
call fcn.005a1e24
lea ecx, [esp + 0x20]
mov byte [esp + 0x270], 0x25
call fcn.005a1f65
lea ecx, [esp + 0x30]
mov byte [esp + 0x270], 0x24
call fcn.005a17c9
push edi
push ebx
lea ecx, [esp + 0xfc]
call fcn.004055c2
push edi
push ebx
lea ecx, [esp + 0xe0]
mov byte [esp + 0x278], 0x1e
call fcn.004055c2
push dword [ebp + 0x10]
push 2
call fcn.004254c8
lea ebx, [esp + 0xfc]
mov esi, eax
call fcn.0057290e
xor edi, edi
mov byte [esp + 0x270], 0x2c
cmp dword [esp + 0x108], edi
jne 0x512025
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x118]
push eax
mov ecx, ebx
call fcn.0040529a
lea eax, [esp + 0xd8]
push 2
push eax
call fcn.004254c8
mov ecx, eax
call fcn.0057298d
lea esi, [esp + 0x20]
mov byte [esp + 0x270], 0x2d
call fcn.0051e087
push 0x10
mov byte [esp + 0x274], 0x2e
mov eax, dword [esp + 0xe0]
pop ebx
cmp dword [esp + 0xf0], ebx
jae 0x51206e
lea eax, [esp + 0xdc]
push 0x20006
push eax
push 0x80000001
lea esi, [esp + 0x2c]
call fcn.0051e0ea
cmp eax, edi
jne 0x5120b4
mov eax, dword [esp + 0xdc]
cmp dword [esp + 0xf0], ebx
jae 0x51209d
lea eax, [esp + 0xdc]
push str.REG_SZ
push eax
lea esi, [esp + 0x28]
call fcn.0051e14a
cmp eax, edi
je 0x51217c
lea esi, [esp + 0xf4]
lea ecx, [esp + 0x4c]
call fcn.0054aeb1
push 0xffffffffffffffff
push edi
push eax
mov ecx, esi
mov byte [esp + 0x27c], 0x2f
call fcn.0040529a
push edi
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x278], 0x2e
call fcn.004055c2
mov eax, dword [esp + 0xf8]
cmp dword [esp + 0x10c], ebx
jae 0x512102
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x18]
call fcn.004050f0
lea eax, [esp + 0x4c]
push 3
push eax
mov byte [esp + 0x278], 0x30
call fcn.004254c8
mov ecx, eax
call fcn.0057298d
mov byte [esp + 0x270], 0x31
cmp dword [eax + 0x18], ebx
jb 0x512139
mov eax, dword [eax + 4]
jmp 0x51213c
add eax, 4
push eax
lea ecx, [esp + 0x14]
call fcn.004050f0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.0051e3e8
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00405172
push edi
push 1
lea ecx, [esp + 0x54]
call fcn.004055c2
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00405172
lea ecx, [esp + 0x20]
call fcn.0051e0bd
push edi
push 1
lea ecx, [esp + 0xe0]
call fcn.004055c2
push edi
push 1
lea ecx, [esp + 0xfc]
mov byte [esp + 0x278], 0x1e
call fcn.004055c2
push dword [ebp + 0x10]
push 3
call fcn.004254c8
lea ebx, [esp + 0xe0]
mov esi, eax
call fcn.0057290e
xor esi, esi
mov byte [esp + 0x270], 0x32
cmp dword [esp + 0xec], esi
jne 0x5121e8
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x118]
push eax
mov ecx, ebx
call fcn.0040529a
sub esp, 0x1c
lea eax, [esp + 0xf4]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004051ae
push 0xf
mov byte [esp + 0x290], 0x33
call fcn.004010a2
mov edi, eax
mov byte [esp + 0x290], 0x32
call fcn.004322be
cmp dword [ebp + 0xc], esi
je 0x51222e
push esi
call fcn.004010a2
mov edi, eax
call fcn.004318be
push esi
push 1
lea ecx, [esp + 0xe0]
call fcn.004055c2
push esi
push 1
lea ecx, [esp + 0x1f8]
call fcn.004055c2
xor esi, esi
xor edi, edi
inc esi
xor ebx, ebx
inc edi
jmp 0x511bb7