Function at 0x41ae30
Capabilities:
Check if file exists
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47117b
mov eax, dword fs:[0]
push eax
sub esp, 0xf98
mov eax, dword [0x48e110]
xor eax, esp
mov dword [esp + 0xf90], eax
push ebx
push esi
push edi
mov eax, dword [0x48e110]
xor eax, esp
push eax
lea eax, [esp + 0xfa8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x68]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x41be2b
mov ecx, 0x479040
call fcn.0041ec30
mov ecx, 0x478020
call fcn.0041ec30
mov ecx, 0x47905c
call fcn.0041ec30
mov ecx, 0x479078
call fcn.0041ec30
mov ecx, str.bugreport.exe
call fcn.0041ec30
mov ecx, 0x478048
call fcn.0041ec30
mov ecx, 0x478064
call fcn.0041ec30
mov ecx, 0x4790b8
call fcn.0041ec30
mov ecx, 0x4790d4
call fcn.0041ec30
mov ecx, 0x4790ec
call fcn.0041ec30
mov ecx, 0x478844
call fcn.0041ec30
mov ecx, 0x479110
call fcn.0041ec30
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 1
push 0
lea ecx, [esp + 0x784]
push ecx
push 0
call ebx
push 1
push 0x10
lea edx, [esp + 0x98c]
push edx
push 0
call ebx
push 1
push 0x1a
lea eax, [esp + 0x374]
push eax
push 0
call ebx
test eax, eax
je 0x41af59
lea edi, [esp + 0x36c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41af41
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
push 1
push 0x19
lea ecx, [esp + 0xb94]
push ecx
push 0
call ebx
push 1
push 0x17
lea edx, [esp + 0xd9c]
push edx
push 0
call ebx
push 1
push 0x1a
lea eax, [esp + 0x16c]
push eax
push 0
call ebx
test eax, eax
je 0x41afb8
lea edi, [esp + 0x164]
add edi, 0xfffffffe
jmp 0x41afa0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41afa0
mov ecx, 0x1f
mov esi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
rep movsd dword es:[edi], dword [esi]
push 1
push 0x1a
lea ecx, [esp + 0x57c]
push ecx
push 0
call ebx
test eax, eax
je 0x41afee
lea edi, [esp + 0x574]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41afd6
mov ecx, 0x20
mov esi, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x780]
call fcn.00403080
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xb90]
mov dword [esp + 0xfb4], 0
call fcn.00403080
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x988]
mov byte [esp + 0xfb4], 1
call fcn.00403080
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0xd98]
mov byte [esp + 0xfb4], 2
call fcn.00403080
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x370]
mov byte [esp + 0xfb4], 3
call fcn.00403080
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x168]
mov byte [esp + 0xfb4], 4
call fcn.00403080
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x578]
mov byte [esp + 0xfb4], 5
call fcn.00403080
mov ebx, 6
mov byte [esp + 0xfb0], bl
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x4c]
mov edi, 0x114
push eax
mov dword [esp + 0x50], edi
call esi
cmp dword [esp + 0x50], ebx
jne 0x41b0c7
cmp dword [esp + 0x54], 1
je 0x41b0e7
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x50], edi
call esi
cmp dword [esp + 0x50], ebx
jne 0x41b5ee
cmp dword [esp + 0x54], 2
jne 0x41b5ee
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x34]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
mov byte [esp + 0xfb0], 7
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b120
mov edx, dword [esp + 0x14]
mov dword [edx + 0x74], 1
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ebx, 0x479150
call fcn.00402c10
add esp, 8
push 0
push 0
mov byte [esp + 0xfb8], 8
mov edx, dword [esp + 0x24]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push edx
push str.taskbarunpin
push 0
call esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ebx, 0x479190
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0xfb0], 9
call fcn.00402ab0
mov byte [esp + 0xfb0], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b1a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push ecx
push str.taskbarunpin
push 0
call esi
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x24]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0xfb0], 0xa
call fcn.00402ab0
mov byte [esp + 0xfb0], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b20d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push ecx
push str.taskbarunpin
push 0
call esi
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x24]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0xfb0], 0xb
call fcn.00402ab0
mov byte [esp + 0xfb0], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b271
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push ecx
push str.taskbarunpin
push 0
call esi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x1c]
mov byte [esp + 0xfb0], 0xc
call fcn.00402ab0
mov byte [esp + 0xfb0], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b2d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push ecx
push str.taskbarunpin
push 0
call esi
mov eax, dword [esp + 0x30]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov edi, esp
call fcn.004033b0
add eax, 0x10
mov dword [edi], eax
call fcn.004027e0
add esp, 4
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x50], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x50], 6
jne 0x41b59e
cmp dword [esp + 0x54], 1
jne 0x41b59e
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
mov byte [esp + 0xfb0], 0xd
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b36b
mov eax, dword [esp + 0x14]
mov dword [eax + 0x78], 1
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x28]
push edx
mov ebx, 0x479150
call fcn.00402c10
add esp, 8
push 0
push 0
push 0
mov byte [esp + 0xfbc], 0xe
mov eax, dword [esp + 0x30]
push eax
push str.startunpin
push 0
call esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, 0x479190
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x24]
mov byte [esp + 0xfb0], 0xf
call fcn.00402ab0
mov byte [esp + 0xfb0], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b3ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push ecx
push str.startunpin
push 0
call esi
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x24]
mov byte [esp + 0xfb0], 0x10
call fcn.00402ab0
mov byte [esp + 0xfb0], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b452
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push ecx
push str.startunpin
push 0
call esi
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x24]
mov byte [esp + 0xfb0], 0x11
call fcn.00402ab0
mov byte [esp + 0xfb0], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b4b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push ecx
push str.startunpin
push 0
call esi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x24]
mov byte [esp + 0xfb0], 0x12
call fcn.00402ab0
mov byte [esp + 0xfb0], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b51a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push ecx
push str.startunpin
push 0
call esi
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
call fcn.004033b0
add eax, 0x10
mov dword [esi], eax
call fcn.004027e0
mov byte [esp + 0xfb4], 0xd
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b576
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 8
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b59e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b5c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 6
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b5ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [esp + 0x14]
test eax, eax
je 0x41b647
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esi + 0x6c], 1
mov dword [esp + 0x14], esp
mov edi, esp
call fcn.004033b0
add eax, 0x10
mov dword [edi], eax
call fcn.004027e0
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x18]
mov byte [esp + 0xfb0], 0x14
call fcn.00402ab0
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b697
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b6cd
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esi + 0x6c], 1
mov dword [esp + 0x14], esp
mov edi, esp
call fcn.004033b0
add eax, 0x10
mov dword [edi], eax
call fcn.004027e0
add esp, 4
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x18]
mov byte [esp + 0xfb0], 0x15
call fcn.00402ab0
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b71d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b753
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esi + 0x6c], 1
mov dword [esp + 0x14], esp
mov edi, esp
call fcn.004033b0
add eax, 0x10
mov dword [edi], eax
call fcn.004027e0
add esp, 4
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x479138
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x18]
mov byte [esp + 0xfb0], 0x16
call fcn.00402ab0
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b7a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b7d9
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esi + 0x70], 1
mov dword [esp + 0x14], esp
mov edi, esp
call fcn.004033b0
add eax, 0x10
mov dword [edi], eax
call fcn.004027e0
add esp, 4
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, 0x4791d4
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x18]
mov byte [esp + 0xfb0], 0x17
call fcn.00402ab0
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b829
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push 0
push ecx
call fcn.004028a0
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x1c]
push eax
mov ebx, 0x4791e4
call fcn.00402c10
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0xfb0], 0x18
call fcn.00402ab0
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b885
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push 0
push ecx
call fcn.004028a0
mov eax, dword [esi + 0x68]
add esp, 8
sub eax, 0x10
call fcn.004033b0
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0xfb0], 0x19
cmp dword [esi + 0x64], 0
je 0x41b8ea
push str.BFVShellIcon_Ctrl_Window
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x41b8ea
push str.BFVDesktop_Notify_Message_String
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0
push 0x3e8
push 0
push 0
push 0x640065
push eax
push edi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push eax
mov ebx, str._bfvwebhelper.dll
call fcn.00402c10
add esp, 8
mov bl, 0x1a
mov byte [esp + 0xfb0], bl
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b9c6
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0xfb0], 0x1b
mov ecx, dword [esp + 0x28]
push ecx
push str.regsvr32__s__u___s_
lea edi, [esp + 0x1c]
call fcn.00413e20
mov edi, dword [esp + 0x1c]
add esp, 8
cmp dword [edi - 4], 1
jle 0x41b96e
mov edx, dword [edi - 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00403180
mov edi, dword [esp + 0x14]
push edi
mov eax, 0xbb8
call fcn.00401000
mov eax, dword [edi - 8]
add esp, 4
push eax
push edi
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41be51
cmp eax, dword [edi - 8]
jg 0x41be51
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
lea eax, [edi - 0x10]
mov byte [esp + 0xfb0], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b9c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00403680
test al, al
je 0x41bae0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str._bfvwebhelper64.dll
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x28]
mov byte [esp + 0xfb0], 0x1c
call fcn.00402ab0
mov byte [esp + 0xfb0], 0x1a
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ba23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41bae0
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0xfb0], 0x1d
mov ecx, dword [esp + 0x28]
push ecx
push str.regsvr32__s__u___s_
lea edi, [esp + 0x1c]
call fcn.00413e20
mov edi, dword [esp + 0x1c]
add esp, 8
cmp dword [edi - 4], 1
jle 0x41ba87
mov edx, dword [edi - 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00403180
mov edi, dword [esp + 0x14]
push edi
mov eax, 0xbb8
call fcn.00401000
mov eax, dword [edi - 8]
add esp, 4
push eax
push edi
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41be51
cmp eax, dword [edi - 8]
jg 0x41be51
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
lea eax, [edi - 0x10]
mov byte [esp + 0xfb0], 0x1a
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41bae0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.UGCFlash.dll
call fcn.00402c10
add esp, 8
lea edi, [esp + 0x28]
mov byte [esp + 0xfb0], 0x1e
call fcn.00402ab0
mov bl, 0x1a
mov byte [esp + 0xfb0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bb31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41bbed
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0xfb0], 0x1f
mov ecx, dword [esp + 0x28]
push ecx
push str.regsvr32__s__u___s_
lea edi, [esp + 0x1c]
call fcn.00413e20
mov edi, dword [esp + 0x1c]
add esp, 8
cmp dword [edi - 4], 1
jle 0x41bb95
mov edx, dword [edi - 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00403180
mov edi, dword [esp + 0x14]
push edi
mov eax, 0xbb8
call fcn.00401000
mov eax, dword [edi - 8]
add esp, 4
push eax
push edi
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41be51
cmp eax, dword [edi - 8]
jg 0x41be51
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
lea eax, [edi - 0x10]
mov byte [esp + 0xfb0], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41bbed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
call fcn.0041be60
mov eax, dword [esi + 0x68]
sub eax, 0x10
call fcn.004033b0
lea edi, [eax + 0x10]
mov dword [esp + 0x30], edi
mov byte [esp + 0xfb0], 0x20
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x41bc36
mov eax, 0x104
lea ecx, [esp + 0x30]
call fcn.00403240
mov edi, dword [esp + 0x30]
push str...BFVFrame
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.0045ae41
add esp, 8
test eax, eax
js 0x41be51
cmp eax, dword [edi - 8]
jg 0x41be51
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
mov ecx, edi
call fcn.0041e190
lea eax, [edi - 0x10]
mov byte [esp + 0xfb0], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41bc93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 0x19
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bcbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 0x13
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bce3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 6
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 5
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 4
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bdab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 1
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bdd3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xfb0], 0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bdfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xfb0], 0xffffffff
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41be26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0xfa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf90]
xor ecx, esp
call fcn.0045a10c
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401950
int3