Function at 0x419eaf
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529aaa
mov eax, dword fs:[0]
push eax
mov eax, 0x21a0
call fcn.004e4780
mov eax, dword [0x57a734]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x108]
cmp ecx, dword [esi + 0x35c]
je 0x41a50f
cmp ecx, dword [esi + 0x358]
jne 0x419f18
push 0
push 0xf020
push 0x112
mov ecx, esi
call fcn.0044e801
jmp 0x41aa50
mov eax, dword [ecx]
lea edx, [ebp - 0x20dc]
push edx
call dword [eax + 4]
and dword [ebp - 4], 0
mov ecx, eax
push str.install_minbtn
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
jne 0x419f00
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.install_closebtn
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
jne 0x41a50f
mov ecx, dword [edi + 0x108]
cmp ecx, dword [esi + 0x360]
jne 0x419fa0
mov ecx, dword [esi + 0x368]
jmp 0x41aa29
mov eax, dword [ecx]
lea edx, [ebp - 0x20dc]
push edx
call dword [eax + 4]
push str.step_last
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x419fe8
mov ecx, esi
call fcn.0041f36c
mov ecx, dword [esi + 0x368]
push 0
jmp 0x41aa2b
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.install_btn
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x41a447
push ecx
push ecx
push str.void___thiscall_InstallUIMainWnd::OnClick_struct_DuiLib::tagTNotifyUI__
push 0x1da
push str........._srcCommoninstall_ui_mainwnd.cpp
push 0x80
lea ecx, [ebp - 0x21ac]
call fcn.004064ae
push str.default
push 1
push eax
mov dword [ebp - 4], 4
call fcn.00406541
add esp, 0xc
cmp byte [eax + 0x1c], 0
je 0x41a071
push str._Click_install_button
lea ecx, [eax + 0x20]
call fcn.004063d6
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x21ac]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067a0
lea ecx, [ebp - 0x2180]
call fcn.00409800
or dword [ebp - 4], 0xffffffff
mov edi, str.Download
push 0
push 0x56204c
push str.2.DownStart
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
sub esp, 0x18
mov ebx, 0x55ce80
mov ecx, esp
mov dword [ebp - 0x2168], esp
push ebx
call fcn.00409c00
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.CoreFuncStart
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.Downloading
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x2164], esp
push str.CoreFuncEvent
call fcn.00409c00
mov byte [ebp - 4], 0xa
call fcn.004319f3
or dword [ebp - 4], 0xffffffff
xor eax, eax
push eax
push eax
push eax
call fcn.004335e4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2164], esp
push ebx
call fcn.00409c00
sub esp, 0x18
mov dword [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.DownStart
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c00
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Downloading
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c00
mov byte [ebp - 4], 0xf
call fcn.004319f3
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
push ebx
push ebx
push 1
call fcn.004335e4
cmp byte [0x581068], bl
jne 0x41a2b0
lea ecx, [ebp - 0x2028]
call fcn.0042f003
push 0xa
push ebx
lea ecx, [ebp - 0x2040]
mov dword [ebp - 4], 0x10
push ecx
mov ecx, eax
call fcn.004099c9
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 0x10
jb 0x41a211
mov eax, dword [eax]
push ebx
push eax
push str.StartTimeDate
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.0040bfcb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push ebx
push 1
call fcn.0040bfcb
lea ecx, [ebp - 0x2028]
call fcn.0042f003
push 2
push 0xb
lea ecx, [ebp - 0x2040]
mov dword [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.004099c9
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 0x10
jb 0x41a275
mov eax, dword [eax]
push ebx
push eax
push str.StartTimeHour
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.0040bfcb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push ebx
push 1
call fcn.0040bfcb
mov byte [0x581068], 1
mov ecx, dword [esi + 0x470]
call fcn.0045255e
push 0x56204c
lea ecx, [ebp - 0x2028]
call fcn.00409c00
mov dword [ebp - 4], 0x14
mov eax, dword [esi + 0x4d0]
cmp eax, 0x13
ja case.0x41a2e1.0
jmp dword [eax*4 + 0x41aa6f]
mov edi, str.Japanese
jmp 0x41a375
mov edi, 0x55cef4
jmp 0x41a375
mov edi, str.Spanish
jmp 0x41a375
mov edi, str.German
jmp 0x41a375
mov edi, str.French
jmp 0x41a375
mov edi, str.Russian
jmp 0x41a375
mov edi, str.Portuguese
jmp 0x41a375
mov edi, str.Arabic
jmp 0x41a375
mov edi, str.Italiano
jmp 0x41a375
mov edi, str.ChineseTrad
jmp 0x41a375
mov edi, str.Korean
jmp 0x41a375
mov edi, str.Nederlands
jmp 0x41a375
mov edi, str.Indonesian
jmp 0x41a375
mov edi, str.Turkish
jmp 0x41a375
mov edi, str.Hindi
jmp 0x41a375
mov edi, str.Thai
jmp 0x41a375
mov edi, str.Malay
jmp 0x41a375
mov edi, str.Swedish
jmp 0x41a375
mov edi, str.Czech
jmp 0x41a375
mov edi, 0x55cee0
push edi
call fcn.00402c84
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2028]
call fcn.0040c4f2
cmp dword [ebp - 0x2014], 0x10
lea eax, [ebp - 0x2028]
push ebx
cmovae eax, dword [ebp - 0x2028]
mov edi, str.Other
push eax
push str.SetLanguage
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
mov ecx, dword [esi + 0x36c]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.0044803f
push eax
lea ecx, [ebp - 0x2040]
call fcn.0040996a
lea ecx, [ebp - 0x20dc]
mov byte [ebp - 4], 0x17
call fcn.0044d6c6
lea edx, [esi + 0x528]
lea ecx, [ebp - 0x2040]
call fcn.004273f5
test al, al
jne 0x41a41b
push ebx
push 0x56204c
push str.SetPath
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.004021c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push ebx
push 1
call fcn.0040bfcb
mov ecx, esi
call fcn.00420030
jmp 0x41aa50
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.finish_btn
mov ecx, eax
mov dword [ebp - 4], 0x18
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x41a48f
push 0
mov ecx, esi
call fcn.0044e425
jmp 0x41aa50
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.browser_btn
mov ecx, eax
mov dword [ebp - 4], 0x19
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x41a4d5
mov ecx, esi
call fcn.0041ac7a
jmp 0x41aa50
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.cancel_btn
mov ecx, eax
mov dword [ebp - 4], 0x1a
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x41a51b
mov ecx, esi
call fcn.00420352
jmp 0x41aa50
mov ecx, dword [edi + 0x108]
mov eax, dword [esi + 0x46c]
cmp ecx, eax
jne 0x41a54f
mov ecx, eax
call fcn.0045255e
mov ecx, dword [esi + 0x47c]
test al, al
mov eax, dword [ecx]
je 0x41a542
push 0
jmp 0x41a544
push 1
call dword [eax + 0xd8]
jmp 0x41aa50
mov eax, dword [ecx]
lea edx, [ebp - 0x20dc]
push edx
call dword [eax + 4]
push str.start_app
mov ecx, eax
mov dword [ebp - 4], 0x1b
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x41a9b4
mov ecx, dword [esi + 0x494]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41a712
mov ecx, dword [esi + 0x498]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41a712
mov ecx, dword [esi + 0x4a0]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41a712
push ecx
push ecx
push str.void___thiscall_InstallUIMainWnd::OnClick_struct_DuiLib::tagTNotifyUI__
push 0x250
push str........._srcCommoninstall_ui_mainwnd.cpp
push 0x80
lea ecx, [ebp - 0x21ac]
call fcn.004064ae
push str.default
push 1
push eax
mov dword [ebp - 4], 0x1c
call fcn.00406541
add esp, 0xc
cmp byte [eax + 0x1c], 0
je 0x41a614
push str._User_click_try_again_button_to_retry
lea ecx, [eax + 0x20]
call fcn.004063d6
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0x21ac]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067a0
lea ecx, [ebp - 0x2180]
call fcn.00409800
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
cmp byte [esi + 0x58c], bl
mov ecx, str.First
push ebx
mov eax, str.Retry
mov edi, str.Download
cmove eax, ecx
push eax
push str.8_1.ClickTryAgain
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2164], esp
push 0x55ce80
call fcn.00409c00
sub esp, 0x18
mov dword [ebp - 4], 0x1e
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.CoreFuncStart
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x20
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Downloading
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c00
mov byte [ebp - 4], 0x22
call fcn.004319f3
or dword [ebp - 4], 0xffffffff
push ebx
push ebx
push ebx
call fcn.004335e4
mov ecx, dword [esi + 0x370]
push ebx
mov byte [esi + 0x58c], 1
call fcn.0045433f
jmp 0x41a43b
push 0x55695c
lea ecx, [ebp - 0x2040]
call fcn.0040996a
lea eax, [ebp - 0x2040]
mov dword [ebp - 4], 0x23
push eax
mov ecx, esi
call fcn.0041adbf
mov eax, dword [esi + 0x560]
sub esp, 0x18
add eax, 0xe8
mov ecx, esp
push eax
call fcn.0040219e
call fcn.0042ee48
add esp, 0x18
test al, al
je 0x41a8cd
sub esp, 0x18
lea eax, [ebp - 0x2040]
mov ecx, esp
push eax
call fcn.0040219e
call fcn.0042ece6
add esp, 0x18
test al, al
je 0x41a781
and dword [esi + 0x584], 0
cmp dword [esi + 0x584], 0
mov edi, str.Download
sete al
movzx eax, al
push eax
push 0x56204c
push str.7.ProgramLaunch
push edi
call fcn.004319f3
mov ecx, eax
call fcn.00431a4f
sub esp, 0x18
mov ebx, 0x55ce80
mov ecx, esp
mov dword [ebp - 0x2164], esp
push ebx
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x24
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.CoreFuncStart
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x25
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Starting
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c00
mov byte [ebp - 4], 0x28
call fcn.004319f3
xor eax, eax
mov byte [ebp - 4], 0x23
push eax
push eax
push eax
call fcn.004335e4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2164], esp
push ebx
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x29
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.ProgramLaunch
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x2a
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x2b
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Starting
call fcn.00409c00
sub esp, 0x18
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c00
mov byte [ebp - 4], 0x2d
call fcn.004319f3
xor ebx, ebx
mov byte [ebp - 4], 0x23
push ebx
push ebx
push 1
call fcn.004335e4
mov ecx, esi
call fcn.0041eee7
jmp 0x41a9a1
xor ebx, ebx
mov dword [ebp - 0x2014], 7
xor eax, eax
mov dword [ebp - 0x2018], ebx
mov word [ebp - 0x2028], ax
push 0x55bd28
lea edx, [esi + 0x540]
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x2058]
call fcn.004271c7
pop ecx
push eax
lea ecx, [ebp - 0x2028]
call fcn.0040214d
push ebx
push 1
lea ecx, [ebp - 0x2058]
call fcn.004021c6
push 1
lea eax, [ebp - 0x2058]
mov ecx, esi
push eax
call fcn.0042303e
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2028]
mov byte [ebp - 4], 0x2f
call fcn.004263d8
push ebx
push 1
lea ecx, [ebp - 0x2058]
call fcn.004021c6
cmp dword [ebp - 0x2014], 8
lea eax, [ebp - 0x2028]
cmovae eax, dword [ebp - 0x2028]
push eax
lea eax, [ebp - 0x2010]
push str._select___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2010]
push 1
push ebx
push eax
push str.explorer.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push 1
lea ecx, [ebp - 0x2028]
call fcn.004021c6
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.004021c6
jmp 0x41aa50
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x2160]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.install_setting
mov ecx, eax
mov dword [ebp - 4], 0x30
call fcn.0044d78c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2160]
mov bl, al
call fcn.0044d6c6
test bl, bl
je 0x41aa50
cmp byte [0x58107c], 0
mov ecx, dword [esi + 0x474]
je 0x41aa35
call fcn.00452d09
cmp eax, 1
jne 0x41aa19
push eax
push ecx
mov ecx, esi
call fcn.0041ee8c
mov byte [0x58107c], 0
jmp 0x41aa50
push 0
push ecx
mov ecx, esi
call fcn.0041ee8c
mov ecx, dword [esi + 0x474]
push 1
mov eax, dword [ecx]
call dword [eax + 0x1bc]
jmp 0x41aa50
mov eax, dword [ecx]
push 1
call dword [eax + 0x1bc]
push 0
push ecx
mov ecx, esi
call fcn.0041ee8c
mov byte [0x58107c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e36f8
mov esp, ebp
pop ebp
ret 4