Function at 0x412e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x340
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x338], eax
lea eax, [esp + 0x60]
mov dword [eax], 0
push eax
call fcn.0049c9f0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x5c]
mov dword [ecx], 0xffffffff
call fcn.00446710
lea edi, [esp + 0x1e8]
mov byte [edi + 0xb], 9
cmp edi, str.installer
ja 0x412e96
lea eax, [esp + 0x1f1]
cmp eax, str.installer
ja 0x4146cf
mov dword [esp + 0x1ec], 0x656c6c61
mov dword [esp + 0x1e8], 0x74736e69
mov word [esp + 0x1f0], 0x72
lea edx, [esp + 0xa0]
mov byte [edx + 0xb], 5
cmp edx, str.ptype
ja 0x412edb
lea eax, [esp + 0xa5]
cmp eax, str.ptype
ja 0x4146cf
mov dword [esp + 0xa0], 0x70797470
mov word [esp + 0xa4], 0x65
lea ecx, [esp + 0x5c]
push edi
push edx
call fcn.00447e70
cmp byte [esp + 0xab], 0
jns 0x412f14
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
cmp byte [esp + 0x1f3], 0
jns 0x412f2d
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
push edi
call fcn.00437dd0
add esp, 4
push 0x18
call fcn.004dfb05
add esp, 4
mov ebx, eax
mov ecx, eax
push 0x100000
push edi
call fcn.004540a0
mov dword [esp + 0xa0], ebx
push ebx
call fcn.00455130
add esp, 4
mov ecx, edi
call fcn.00493ef0
lea edi, [esp + 0x1e8]
mov ecx, edi
push 0xa7
push str.wWinMain
push 0
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x52113a
push str._______________________________________Start_install.
call fcn.004147c0
mov ecx, edi
call fcn.004553c0
lea eax, [esp + 0x60]
push eax
call fcn.0049aea0
add esp, 4
test al, al
je 0x413061
lea ecx, [esp + 0x1e8]
push 0xad
push str.wWinMain
push 0
call fcn.00455190
lea esi, [esp + 0x224]
mov ecx, esi
push 0x52118a
push str.Handled_non_install_cmd_line_option_by_win10_default_browser_helper__ret_code:
call fcn.004147c0
lea edi, [esp + 0xa0]
push dword [esp + 0x60]
push edi
call fcn.004dcbd0
add esp, 8
movzx eax, byte [edi + 0xb]
test al, al
jns 0x41300c
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov ecx, esi
push eax
push edi
call fcn.00478310
cmp byte [esp + 0xab], 0
jns 0x41302e
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x1e8]
call fcn.004553c0
mov esi, dword [esp + 0x60]
lea ecx, [esp + 0x5c]
call fcn.00446740
mov ecx, dword [esp + 0x338]
xor ecx, ebp
call fcn.004e0685
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
cmp esi, 4
ja case.default.0x41306a
jmp dword [esi*4 + 0x521734]
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xb3
push str.wWinMain
push 0
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x5211b4
push str.Exiting__because_of_insecure_environment.
call fcn.004147c0
mov ecx, esi
jmp 0x413035
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xbe
push str.wWinMain
push 0
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x52121f
push str.Exiting__DLL_files_found_in_working_directory
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
mov esi, 0xffffff38
jmp 0x41303e
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xbb
push str.wWinMain
push 0
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x5211f1
push str.Runned_in_secure_environment.
jmp 0x41313e
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xb6
push str.wWinMain
push 0
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x5211d3
push str.Cant_find_secure_environment.
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
call fcn.0049e500
mov esi, eax
push str.run_as_admin
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
mov dword [esp + 4], esi
mov esi, edi
cmp eax, 0xa
jbe 0x4131a2
mov edi, ebx
or edi, 7
inc edi
push edi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or edi, 0x80000000
mov dword [esp + 0x1f0], edi
mov dword [esp + 0x1ec], ebx
jmp 0x4131ac
lea eax, [esp + 0x1e8]
mov byte [eax + 0xb], bl
lea edi, [eax + ebx]
cmp eax, str.run_as_admin
ja 0x4131c2
cmp edi, str.run_as_admin
ja 0x4146cf
test ebx, ebx
je 0x4131d5
push ebx
push str.run_as_admin
push eax
call fcn.004e3510
add esp, 0xc
mov byte [edi], 0
mov ecx, dword [esp + 4]
push esi
call fcn.0049eb20
mov ebx, eax
cmp byte [esp + 0x1f3], 0
jns 0x4131fd
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
test bl, bl
je 0x413ddc
xor edi, edi
dec edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call fcn.0049e500
mov esi, eax
push str.setup_cmd_line
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
cmp eax, 0xa
mov dword [esp + 4], esi
jbe 0x41326a
mov esi, ebx
or esi, 7
inc esi
push esi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or esi, 0x80000000
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
jmp 0x413274
lea eax, [esp + 0x1e8]
mov byte [eax + 0xb], bl
lea esi, [eax + ebx]
cmp eax, str.setup_cmd_line
ja 0x41328a
cmp esi, str.setup_cmd_line
ja 0x4146cf
test ebx, ebx
je 0x41329d
push ebx
push str.setup_cmd_line
push eax
call fcn.004e3510
add esp, 0xc
mov byte [esi], 0
lea edx, [esp + 0x10]
mov ecx, dword [esp + 4]
lea eax, [esp + 0x1e8]
push eax
push edx
call fcn.0049ed60
cmp byte [esp + 0x1f3], 0
jns 0x4132cf
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
call fcn.0049e500
mov esi, eax
push str.parent_installer_process_id
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
cmp eax, 0xa
mov dword [esp + 4], esi
jbe 0x41333a
mov esi, ebx
or esi, 7
inc esi
push esi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or esi, 0x80000000
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
jmp 0x413348
mov byte [esp + 0x1f3], bl
lea eax, [esp + 0x1e8]
lea esi, [eax + ebx]
cmp eax, str.parent_installer_process_id
ja 0x41335e
cmp esi, str.parent_installer_process_id
ja 0x4146cf
test ebx, ebx
je 0x413371
push ebx
push str.parent_installer_process_id
push eax
call fcn.004e3510
add esp, 0xc
mov byte [esi], 0
lea ebx, [esp + 0x94]
mov ecx, dword [esp + 4]
lea eax, [esp + 0x1e8]
push eax
push ebx
call fcn.0049eca0
cmp byte [esp + 0x1f3], 0
jns 0x4133a6
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
xor eax, eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], eax
movzx eax, byte [esp + 0x9f]
test al, al
cmovs eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
cmovns ecx, ebx
test eax, eax
js 0x4146c8
je 0x4133e4
test ecx, ecx
je 0x4146c1
lea edx, [esp + 0x88]
push edx
push eax
push ecx
call fcn.00489c70
add esp, 0xc
test al, al
jne 0x413495
call fcn.0050fe40
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0xa0]
push eax
push esi
call fcn.0050e3e0
add esp, 8
lea ecx, [esp + 0x1e8]
push esi
push 0x59
push str.ExecuteAsAdmin
push 1
call fcn.00455540
lea edi, [esp + 0x224]
mov ecx, edi
push 0x52150c
push str.Suspicious_process_id
call fcn.004147c0
movzx eax, byte [esp + 0x9f]
test al, al
jns 0x413462
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
add eax, ebx
mov ecx, edi
push eax
push ebx
call fcn.004147c0
lea ecx, [esp + 0x1e8]
call fcn.00455590
cmp byte [esp + 0xab], 0
jns 0x413492
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
xor edi, edi
dec edi
mov eax, 0x100000
push dword [esp + 0x88]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 4], eax
xor eax, eax
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0x5f
push str.ExecuteAsAdmin
push eax
xor ebx, ebx
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x521525
push str.Start_installer_as_admin
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
lea ecx, [esp + 0x40]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx], xmm0
lea eax, [esp + 0x10]
push eax
call fcn.0049fa90
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push str.0c0f0f0d_6434_4cfd_a5e9_23e9ca4d94b6
push ebx
mov eax, 0x100000
push eax
call esi
mov ebx, eax
push str.fef32d6d_67e9_4654_b314_6c72098ff5d1
xor eax, eax
push eax
mov eax, 0x100000
push eax
call esi
lea ecx, [esp + 0x32c]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
mov eax, dword [esp + 4]
mov dword [ecx + 8], eax
push edi
xor eax, eax
push eax
push ecx
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x41363e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0x20]
push eax
push esi
call fcn.0050e3e0
add esp, 8
lea ecx, [esp + 0x1e8]
push esi
push 0x72
push str.ExecuteAsAdmin
push 1
call fcn.00455540
lea ebx, [esp + 0x224]
mov ecx, ebx
push 0x521562
push str.Installer_started_as_admin_has_been_unexpectedly_synced__wr
call fcn.004147c0
lea esi, [esp + 0xa0]
push edi
push esi
call fcn.004dcea0
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4135ba
mov eax, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov ecx, ebx
push eax
push esi
call fcn.00478310
cmp byte [esp + 0xab], 0
mov esi, 0xffffffff
jns 0x4135e1
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x1e8]
call fcn.00455590
cmp byte [esp + 0x2b], 0
jns 0x413600
push dword [esp + 0x20]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x40]
call fcn.0049fad0
cmp byte [esp + 0x9f], 0
jns 0x413622
push dword [esp + 0x94]
call fcn.004dfb35
add esp, 4
cmp byte [esp + 0x1b], 0
jns 0x41303e
push dword [esp + 0x10]
call fcn.004dfb35
add esp, 4
jmp 0x41303e
lea edi, [esp + 0x40]
push edi
call fcn.0041e250
add esp, 4
xor eax, eax
dec eax
lea esi, [esp + 0x78]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, edi
push esi
call fcn.0049f100
movzx eax, byte [esi + 0xb]
test al, al
jns 0x413672
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
test eax, eax
lea edi, [esp + 0x1e8]
js 0x4146c8
je 0x41368b
test esi, esi
je 0x4146c1
mov ecx, edi
push eax
push esi
call fcn.00493e00
push edi
call fcn.0047e270
add esp, 4
mov ebx, eax
mov ecx, edi
call fcn.00493ef0
test bl, bl
jne 0x413753
call fcn.0050fe40
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esp + 0xa0]
push eax
push esi
call fcn.0050e3e0
add esp, 8
lea edi, [esp + 0x1e8]
mov ecx, edi
push esi
push 0x7c
push str.ExecuteAsAdmin
push 1
call fcn.00455540
lea ebx, [esp + 0x1f0]
lea ecx, [esp + 0x224]
push 0x521573
push str.Browser_archive
call fcn.004147c0
lea eax, [esp + 0x78]
mov ecx, ebx
push eax
call fcn.00414700
lea ecx, [eax + 0x34]
push 0x521583
push str._does_not_exist
call fcn.004147c0
mov ecx, edi
call fcn.00455590
cmp byte [esi + 0xb], 0
jns 0x413739
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
xor esi, esi
dec esi
cmp byte [esp + 0x83], 0
jns 0x413600
push dword [esp + 0x78]
jmp 0x4135f8
xor eax, eax
dec eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
push str.progress_window
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
cmp eax, 0xa
jbe 0x4137ad
mov esi, ebx
or esi, 7
inc esi
push esi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or esi, 0x80000000
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
jmp 0x4137b6
mov byte [esp + 0x1f3], bl
mov eax, edi
lea esi, [eax + ebx]
cmp eax, str.progress_window
ja 0x4137cc
cmp esi, str.progress_window
ja 0x4146cf
test ebx, ebx
je 0x4137df
push ebx
push str.progress_window
push eax
call fcn.004e3510
add esp, 0xc
mov byte [esi], 0
lea ebx, [esp + 0x6c]
lea ecx, [esp + 0x40]
push edi
push ebx
call fcn.0049ed60
cmp byte [esp + 0x1f3], 0
jns 0x41380a
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
cmp byte [esp + 0x77], 0
jns 0x413815
mov ebx, dword [esp + 0x6c]
xor edi, edi
push 0xa
push edi
push ebx
call fcn.004f6311
add esp, 0xc
lea ebx, [esp + 0x64]
mov dword [ebx], method.std::__Cr::locale::facet.virtual_0
mov dword [ebx + 4], eax
push 0x140
push 0xff
lea esi, [esp + 0x1f0]
push esi
call fcn.004e3a90
add esp, 0xc
mov ecx, esi
push edi
push edi
push edi
push ebx
call fcn.0041f7b0
lea eax, [esp + 0x78]
mov ecx, esi
lea edx, [esp + 0x40]
push edx
push eax
call fcn.00428060
mov ebx, eax
lea ecx, [esp + 0xa0]
push 0x8c
push str.ExecuteAsAdmin
push edi
call fcn.00455190
lea edi, [esp + 0xdc]
mov ecx, edi
push 0x52159f
push str.RunModule_results:_success
call fcn.004147c0
movzx eax, bl
lea esi, [esp + 0x20]
mov ebx, eax
push eax
push esi
call fcn.004dcbd0
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4138ba
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ecx, edi
push eax
push esi
call fcn.00478310
cmp byte [esp + 0x2b], 0
jns 0x4138d6
push dword [esp + 0x20]
call fcn.004dfb35
add esp, 4
mov ecx, edi
push 0x5215ac
push str._error_code
call fcn.004147c0
lea esi, [esp + 0x20]
push dword [esp + 0x2a4]
push esi
call fcn.004dcbd0
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x41390b
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ecx, edi
push eax
push esi
call fcn.00478310
cmp byte [esp + 0x2b], 0
jns 0x413927
push dword [esp + 0x20]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0xa0]
call fcn.004553c0
lea ecx, [esp + 0x1e8]
call fcn.004201d0
lea ecx, [esp + 0x64]
call fcn.00411780
cmp byte [esp + 0x77], 0
mov esi, ebx
jns 0x41373b
push dword [esp + 0x6c]
call fcn.004dfb35
add esp, 4
jmp 0x41373b
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x413966
mov ebx, eax
cmp eax, esi
je 0x4142e6
lea eax, [ebx + 0x10]
lea edx, [ebx + 0x1c]
mov ecx, edi
push edx
push eax
call fcn.00447e70
mov ecx, dword [ebx + 4]
test ecx, ecx
jne 0x413966
mov eax, dword [ebx + 8]
cmp dword [eax], ebx
mov ebx, eax
jne 0x41398e
jmp 0x41396e
xor ebx, ebx
lea edi, [esp + 0xa0]
mov ecx, edi
push 0x12f
push str.wWinMain
push ebx
call fcn.00455190
lea ecx, [esp + 0xdc]
push 0x521338
push str.Installing_in_silent_mode.
call fcn.004147c0
mov ecx, edi
call fcn.004553c0
call fcn.0049e500
mov esi, eax
push 0x140
push 0xff
push edi
call fcn.004e3a90
add esp, 0xc
mov ecx, edi
push 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1f0]
push eax
push ebx
call fcn.0041f7b0
push str.make_browser_default_after_import
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146ea
mov ebx, eax
cmp eax, 0xa
jbe 0x413a44
mov edi, ebx
or edi, 7
inc edi
push edi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x10], eax
or edi, 0x80000000
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
jmp 0x413a4b
lea eax, [esp + 0x10]
mov byte [eax + 0xb], bl
lea edi, [eax + ebx]
cmp eax, str.make_browser_default_after_import
ja 0x413a61
cmp edi, str.make_browser_default_after_import
ja 0x4146cf
test ebx, ebx
je 0x413a74
push ebx
push str.make_browser_default_after_import
push eax
call fcn.004e3510
add esp, 0xc
mov byte [edi], 0
lea edi, [esp + 0x10]
mov ecx, esi
push edi
call fcn.0049eb20
movzx eax, al
lea ecx, [esp + 0xa0]
push eax
call fcn.00427f20
cmp byte [edi + 0xb], 0
jns 0x413aa5
push dword [esp + 0x10]
call fcn.004dfb35
add esp, 4
push str.send_statistics
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146ea
mov ebx, eax
cmp eax, 0xa
jbe 0x413ae7
mov edi, ebx
or edi, 7
inc edi
push edi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x10], eax
or edi, 0x80000000
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
jmp 0x413aee
lea eax, [esp + 0x10]
mov byte [eax + 0xb], bl
lea edi, [eax + ebx]
cmp eax, str.send_statistics
ja 0x413b04
cmp edi, str.send_statistics
ja 0x4146cf
test ebx, ebx
je 0x413b17
push ebx
push str.send_statistics
push eax
call fcn.004e3510
add esp, 0xc
mov byte [edi], 0
mov ecx, esi
lea eax, [esp + 0x10]
push eax
call fcn.0049eb20
mov ecx, eax
mov al, 1
test cl, cl
jne 0x413b3a
lea ecx, [esp + 0x1e8]
call fcn.00419a80
mov byte [esp + 0x111], al
cmp byte [esp + 0x1b], 0
jns 0x413b54
push dword [esp + 0x10]
call fcn.004dfb35
add esp, 4
push str.disableyapin
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146ea
mov ebx, eax
cmp eax, 0xa
jbe 0x413b96
mov edi, ebx
or edi, 7
inc edi
push edi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x10], eax
or edi, 0x80000000
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
jmp 0x413b9e
mov byte [esp + 0x1b], bl
lea eax, [esp + 0x10]
lea edi, [eax + ebx]
cmp eax, str.disableyapin
ja 0x413bb4
cmp edi, str.disableyapin
ja 0x4146cf
test ebx, ebx
je 0x413bc7
push ebx
push str.disableyapin
push eax
call fcn.004e3510
add esp, 0xc
mov byte [edi], 0
mov ecx, esi
lea eax, [esp + 0x10]
push eax
call fcn.0049eb20
xor al, 1
mov byte [esp + 0x112], al
cmp byte [esp + 0x1b], 0
jns 0x413bf2
push dword [esp + 0x10]
call fcn.004dfb35
add esp, 4
lea edi, [esp + 0xa0]
mov ecx, edi
call fcn.00420570
mov ebx, dword [edi + 0xbc]
mov ecx, edi
call fcn.004201d0
lea ecx, [esp + 0xa0]
push 0x13e
push str.wWinMain
push 0
call fcn.00455190
lea ecx, [esp + 0xdc]
push 0x521353
push str.Installer_exit_with_code:
call fcn.004147c0
lea esi, [esp + 0x10]
mov edi, ebx
push ebx
push esi
call fcn.004dcbd0
add esp, 8
movzx eax, byte [esi + 0xb]
test al, al
jns 0x413c5b
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xdc]
push eax
push esi
call fcn.00478310
cmp byte [esp + 0x1b], 0
jns 0x413c7c
push dword [esp + 0x10]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0xa0]
call fcn.004553c0
mov esi, edi
cmp byte [esp + 0x83], 0
jns 0x413ca0
push dword [esp + 0x78]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x1e8]
call fcn.004173a0
lea ecx, [esp + 0x20]
call fcn.0041cdc0
cmp byte [esp + 0x337], 0
jns 0x413cce
push dword [esp + 0x32c]
call fcn.004dfb35
add esp, 4
cmp byte [esp + 0x9f], 0
jns 0x413dc5
push dword [esp + 0x94]
call fcn.004dfb35
add esp, 4
jmp 0x413dc5
mov edi, str.wWinMain
xor ebx, ebx
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xe0
push edi
push ebx
call fcn.00455190
lea ecx, [esp + 0x224]
push 0x521278
push str.Another_installer_instance_is_already_running.
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
lea ecx, [esp + 0x1e8]
push 0xe1
push edi
push ebx
call fcn.00455190
lea esi, [esp + 0x224]
mov ecx, esi
push 0x521296
push str.Master_installer_process_id:
call fcn.004147c0
push dword [section.SHARED]
lea edi, [esp + 0xa4]
push edi
call fcn.004dcea0
add esp, 8
movzx eax, byte [esp + 0xab]
test al, al
jns 0x413d84
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov ecx, esi
push eax
push edi
call fcn.00478310
cmp byte [esp + 0xab], 0
jns 0x413da6
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x1e8]
call fcn.004553c0
push dword [section.SHARED]
call fcn.0043afa0
add esp, 4
mov esi, 0x258
lea ecx, [esp + 0x6c]
call fcn.004391a0
lea ecx, [esp + 0x40]
call fcn.0043ed50
jmp 0x41303e
pcmpeqd xmm0, xmm0
lea ecx, [esp + 0x40]
movdqu xmmword [ecx + 0xc], xmm0
movdqa xmmword [ecx], xmm0
call fcn.0043ecd0
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xdc
push str.wWinMain
push 0
call fcn.00455190
call fcn.004114c0
mov ecx, str.Full_installer_mode.
mov edx, str.Lite_installer_mode.
test al, al
cmovne edx, ecx
lea ecx, [esp + 0x224]
mov eax, 0x521234
mov edi, 0x521249
cmovne edi, eax
push edi
push edx
call fcn.004147c0
mov ecx, esi
call fcn.004553c0
xor eax, eax
dec eax
lea esi, [esp + 0x6c]
mov dword [esi + 4], eax
mov dword [esi], eax
mov ecx, esi
call fcn.00439170
mov ecx, esi
call fcn.004391d0
test al, al
je 0x413cf0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [section.SHARED], eax
lea ecx, [esp + 0x1e8]
push 0xe8
push str.wWinMain
push 0
call fcn.00455190
lea esi, [esp + 0x224]
mov ecx, esi
push 0x5212ad
push str.Installer_process_id:
call fcn.004147c0
lea edi, [esp + 0xa0]
push dword [section.SHARED]
push edi
call fcn.004dcea0
add esp, 8
movzx eax, byte [edi + 0xb]
test al, al
jns 0x413ecb
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov ecx, esi
push eax
push edi
call fcn.00478310
cmp byte [esp + 0xab], 0
jns 0x413eed
push dword [esp + 0xa0]
call fcn.004dfb35
add esp, 4
lea ecx, [esp + 0x1e8]
call fcn.004553c0
call fcn.0049e500
mov edi, eax
push str.silent
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
cmp eax, 0xa
jbe 0x413f4b
mov esi, ebx
or esi, 7
inc esi
push esi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or esi, 0x80000000
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
jmp 0x413f55
lea eax, [esp + 0x1e8]
mov byte [eax + 0xb], bl
lea esi, [eax + ebx]
cmp eax, str.silent
ja 0x413f6b
cmp esi, str.silent
ja 0x4146cf
test ebx, ebx
je 0x413f7e
push ebx
push str.silent
push eax
call fcn.004e3510
add esp, 0xc
mov byte [esi], 0
mov ecx, edi
lea eax, [esp + 0x1e8]
push eax
call fcn.0049eb20
mov byte [esp + 4], al
cmp byte [esp + 0x1f3], 0
jns 0x413fad
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
call fcn.0049e500
mov edi, eax
push str.system_level
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
cmp eax, 0xa
jbe 0x413fff
mov esi, ebx
or esi, 7
inc esi
push esi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or esi, 0x80000000
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
jmp 0x414009
lea eax, [esp + 0x1e8]
mov byte [eax + 0xb], bl
lea esi, [eax + ebx]
cmp eax, str.system_level
ja 0x41401f
cmp esi, str.system_level
ja 0x4146cf
test ebx, ebx
je 0x414032
push ebx
push str.system_level
push eax
call fcn.004e3510
add esp, 0xc
mov byte [esi], 0
mov ecx, edi
lea eax, [esp + 0x1e8]
push eax
call fcn.0049eb20
mov byte [esp + 0xb], al
cmp byte [esp + 0x1f3], 0
jns 0x414061
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
xor eax, eax
dec eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
call fcn.0049e500
mov edi, eax
push 0x5277f4
call fcn.004fb1c0
add esp, 4
cmp eax, 0x7ffffff8
jae 0x4146de
mov ebx, eax
cmp eax, 0xa
jbe 0x4140cb
mov esi, ebx
or esi, 7
inc esi
push esi
call fcn.004dfb05
add esp, 4
mov dword [esp + 0x1e8], eax
or esi, 0x80000000
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x1ec], ebx
jmp 0x4140d9
mov byte [esp + 0x1f3], bl
lea eax, [esp + 0x1e8]
lea esi, [eax + ebx]
cmp eax, 0x5277f4
ja 0x4140ef
cmp esi, 0x5277f4
ja 0x4146cf
test ebx, ebx
je 0x414102
push ebx
push 0x5277f4
push eax
call fcn.004e3510
add esp, 0xc
mov byte [esi], 0
lea edx, [esp + 0x94]
mov ecx, edi
lea eax, [esp + 0x1e8]
push eax
push edx
call fcn.0049eca0
cmp byte [esp + 0x1f3], 0
jns 0x414135
push dword [esp + 0x1e8]
call fcn.004dfb35
add esp, 4
lea ebx, [esp + 0x32c]
xor eax, eax
dec eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push ebx
call fcn.00437ea0
add esp, 4
xor eax, eax
lea esi, [esp + 0x1e8]
mov ecx, esi
push 0xf3
push str.wWinMain
push eax
call fcn.00455190
lea edi, [esp + 0x1f0]
lea ecx, [esp + 0x224]
push 0x5212c1
push str.Temporary_path_is:
call fcn.004147c0
mov ecx, edi
push ebx
call fcn.00414700
mov ecx, esi
call fcn.004553c0
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqu xmmword [edi + 0xc], xmm0
movdqa xmmword [edi], xmm0
mov ecx, edi
call fcn.0041cd90
mov ecx, edi
call fcn.0041cf10
push 0x140
push 0xff
push esi
call fcn.004e3a90
add esp, 0xc
mov ecx, esi
push ebx
call fcn.004172a0
mov ecx, esi
lea eax, [esp + 0x94]
push eax
call fcn.004179b0
xor eax, eax
mov dword [esp + 0x80], eax
pxor xmm0, xmm0
movq qword [esp + 0x78], xmm0
lea edx, [esp + 0xa0]
mov byte [edx + 0xb], 4
cmp edx, 0x5212c2
ja 0x414218
lea eax, [esp + 0xa4]
cmp eax, 0x5212c2
ja 0x4146cf
mov dword [esp + 0xa0], 0x676e616c
mov byte [esp + 0xa4], 0
lea edi, [esp + 0x78]
lea ecx, [esp + 0x20]
push edi
push edx
call fcn.0041d940
invalid