Function at 0x42c770
Capabilities:
Check os version
Create directory
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b022
mov eax, dword fs:[0]
push eax
sub esp, 0x758
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, 2
mov dword [ebp - 0x628], ebx
mov dword [ebp - 0x618], ecx
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x62c], eax
cmp esi, ebx
je 0x42e4e3
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esi + 4]
sub eax, 0x10
push eax
call fcn.00401a20
add eax, 0x10
mov dword [ebp - 0x644], eax
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x24]
sub eax, 0x10
push eax
call fcn.00401a20
add eax, 0x10
add esp, 8
mov dword [ebp - 0x630], eax
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x2c]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push 1
push 0x40e
push ecx
mov dword [ebp - 0x694], ebx
call edi
push 0x104
lea edx, [ebp - 0x420]
push ebx
push edx
call fcn.00542dc0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea ecx, [ebp - 0x218]
push ebx
push ecx
call fcn.00542dc0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push ebx
push str.foxfzip
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x42c8d7
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c8a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c8cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 2
jmp 0x42e4e3
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x624]
call fcn.00403d90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x648]
call fcn.00432070
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x624]
push ecx
lea edx, [ebp - 0x630]
push edx
lea ecx, [ebp - 0x648]
call fcn.004324a0
test eax, eax
jg 0x42ca4c
cmp dword [ebp + 0x10], ebx
jne 0x42c9db
push 0x30
lea eax, [ebp - 0x650]
push eax
mov ecx, 0x5fc290
call fcn.00407370
mov byte [ebp - 4], 8
mov eax, dword [eax]
cmp eax, ebx
je 0x42c963
add eax, 0xc
jmp 0x42c968
mov eax, 0x58df78
push eax
push 0x29e5
push ecx
mov ecx, esp
mov dword [ebp - 0x664], esp
push 0xffffffffffffffff
push str.FoxitUpdater_DLL
call fcn.00567cd2
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x64c]
push ecx
mov byte [ebp - 4], 8
call fcn.00571a50
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
cmp eax, ebx
je 0x42c9a9
add eax, 0xc
jmp 0x42c9ae
mov eax, 0x58df78
mov edx, dword [esi + 0x2c]
push eax
push edx
mov ecx, 0x5fc290
call fcn.00409a40
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x64c]
call fcn.00567cb8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x650]
call fcn.00567cb8
mov eax, dword [esi + 0x2c]
push ebx
push ebx
push 0x417
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x648]
call fcn.00432080
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x624]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ca21
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ca47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42c8a4
mov ecx, dword [esi + 0x2c]
push 0
push 2
push 0x40e
push ecx
call edi
lea ecx, [ebp - 0x6bc]
call fcn.0044f0e4
mov byte [ebp - 4], 0xe
mov dword [ebp - method.CTypedPtrArray_class_CPtrArray__struct__UpdaterInfo__.virtual_0], 0x592468
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x624]
lea edx, [ebp - 0x6bc]
push edx
push ecx
add eax, 0xfffffff0
mov ebx, esp
mov dword [ebp - 0x664], esp
push eax
mov dword [ebp - 0x6a4], ebx
call fcn.00401a20
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x618]
call fcn.00428db0
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp - 0x6b4]
mov dword [ebp - 0x64c], ebx
je 0x42caf8
cmp ebx, 1
jne 0x42caf8
mov eax, dword [ebp - 0x6b8]
mov eax, dword [eax]
cmp dword [eax + 0xc], 0
je 0x42caf1
mov ecx, dword [esi + 0x2c]
push 0
push 0
push 0x41e
push ecx
mov dword [esi + 0x70], ebx
call edi
jmp 0x42caf8
mov dword [esi + 0x70], 0
mov dword [ebp - 0x68c], 0
test ebx, ebx
jle 0x42e371
lea ebx, [ebx]
mov eax, dword [ebp - 0x68c]
test eax, eax
js 0x42e734
cmp eax, dword [ebp - 0x6b4]
jge 0x42e734
mov edx, dword [ebp - 0x6b8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x634], eax
test eax, eax
je 0x42e346
push 0x58df78
lea ecx, [ebp - 0x614]
call fcn.00403d90
mov byte [ebp - 4], 0x12
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp - 0x620]
jne 0x42cb73
cmp dword [esi + 0x44], 0
je 0x42cdc0
mov edi, dword [ebp - 0x634]
jmp 0x42cb83
mov edi, dword [ebp - 0x634]
cmp dword [edi + 8], 0
je 0x42cdc0
mov eax, dword [edi + 4]
push str.patch
push eax
call fcn.005430ac
add esp, 8
test eax, eax
je 0x42cdc0
mov eax, dword [edi + 4]
push str.updater
push eax
call fcn.005430ac
add esp, 8
test eax, eax
je 0x42cdc0
mov eax, dword [esi + 0x50]
cmp dword [eax - 0xc], 0
jl 0x42cbdb
push 0x590484
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42cbdb
sub eax, dword [esi + 0x50]
sar eax, 1
je 0x42cd98
cmp dword [esi + 0x78], 0
jne 0x42cd98
push str.__Dir
lea ecx, [ebp - 0x614]
call fcn.004039b0
push 0x58df78
lea ecx, [ebp - 0x61c]
call fcn.00403d90
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x61c]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
jge 0x42cc39
push 0x104
lea ecx, [ebp - 0x61c]
call fcn.004019c0
mov edx, dword [ebp - 0x61c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x61c]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.00542f68
add esp, 8
test eax, eax
js 0x42e501
mov ecx, dword [ebp - 0x61c]
cmp eax, dword [ecx - 8]
jg 0x42e501
mov dword [ecx - 0xc], eax
mov edx, dword [ebp - 0x61c]
xor ecx, ecx
mov word [edx + eax*2], cx
push 0x5c
lea ecx, [ebp - 0x61c]
call fcn.00405730
push eax
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x61c]
call fcn.00405910
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x61c]
call fcn.00403340
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6f8]
call fcn.00401f60
push 0x58f2e0
lea ecx, [ebp - 0x614]
call fcn.00406b90
cmp dword [esi + 0x44], 0
je 0x42cd63
push 0x5c
lea ecx, [ebp - 0x61c]
call fcn.00405730
inc eax
push eax
lea ecx, [ebp - 0x6dc]
push ecx
lea ecx, [ebp - 0x61c]
call fcn.00405910
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x61c]
call fcn.00403340
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6dc]
call fcn.00401f60
mov eax, dword [esi + 4]
cmp dword [eax - 0xc], 0
jl 0x42cd50
push str.Phantom
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42cd50
sub eax, dword [esi + 4]
sar eax, 1
cmp eax, 0xffffffff
je 0x42cd50
push 0x590bcc
lea ecx, [ebp - 0x61c]
call fcn.00406b90
jmp 0x42cd63
mov eax, dword [esi + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x61c]
call fcn.004066d0
mov eax, dword [ebp - 0x61c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 0x58f2e0
lea ecx, [ebp - 0x614]
call fcn.00406b90
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x61c]
call fcn.00401f60
push 0x58f2e4
lea ecx, [ebp - 0x614]
call fcn.00406b90
mov eax, dword [edi + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
jmp 0x42d119
push 8
push str.__Appid
lea ecx, [ebp - 0x614]
call fcn.00402a10
push 1
push 0x58f2e0
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 0xc
push 0x590bcc
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 1
push 0x58f2e0
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov eax, dword [esi + 0x50]
cmp dword [eax - 0xc], 0
jl 0x42ce2a
push 0x590484
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42ce2a
sub eax, dword [esi + 0x50]
sar eax, 1
je 0x42ce7c
cmp dword [esi + 0x78], 0
jne 0x42ce7c
push str.__Dir
lea ecx, [ebp - 0x614]
call fcn.00406b90
push 0x58f2e0
lea ecx, [ebp - 0x614]
call fcn.00406b90
mov edx, dword [ebp - 0x618]
mov eax, dword [edx + 0x84]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 0x58f2e0
lea ecx, [ebp - 0x614]
call fcn.00406b90
mov eax, dword [esi + 0x54]
push 0x590484
push eax
call fcn.005430ac
add esp, 8
test eax, eax
jne 0x42cebb
mov eax, dword [esi + 4]
push str.Reader_Updater_exe
push eax
call fcn.005430ac
add esp, 8
test eax, eax
jne 0x42cebb
cmp dword [esi + 0x58], eax
je 0x42cebb
push str.__InstallPhantom
lea ecx, [ebp - 0x614]
call fcn.0041ab90
push 0x58df78
lea ecx, [ebp - 0x66c]
call fcn.00403d90
mov byte [ebp - 4], 0x13
push 0x58df78
lea ecx, [ebp - 0x680]
call fcn.00403d90
mov byte [ebp - 4], 0x14
mov bx, word [0x5fbd60]
lea eax, [ebp - 0x6e4]
push eax
call fcn.0056d8d0
add esp, 4
mov byte [ebp - 4], 0x15
mov eax, dword [eax]
test eax, eax
je 0x42cf08
add eax, 0xc
jmp 0x42cf0d
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x63c]
call fcn.00403d90
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6e4]
call fcn.00567cb8
mov ecx, dword [ebp - 0x63c]
push str.lang_en_US
push ecx
call fcn.005430ac
add esp, 8
test eax, eax
jne 0x42cf55
push 0x592d88
lea ecx, [ebp - 0x614]
call fcn.00406b90
jmp 0x42d0a7
xor edi, edi
cmp word [edi + 0x5f1950], bx
jne 0x42cf8f
mov edx, dword [edi + 0x5f1954]
test edx, edx
jne 0x42cf6e
xor eax, eax
jmp 0x42cf82
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cf73
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x680]
call fcn.00402a10
add edi, 8
cmp edi, 0x90
jb 0x42cf57
mov eax, dword [ebp - 0x63c]
cmp dword [eax - 0xc], 0
jge 0x42cfab
or eax, 0xffffffff
jmp 0x42cfca
push 0x58ed90
push eax
call fcn.00542363
add esp, 8
test eax, eax
jne 0x42cfc2
or eax, 0xffffffff
jmp 0x42cfca
sub eax, dword [ebp - 0x63c]
sar eax, 1
add eax, 5
push eax
lea edx, [ebp - 0x6ec]
push edx
lea ecx, [ebp - 0x63c]
call fcn.004032d0
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x66c]
call fcn.00403340
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x6ec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d016
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x592d84
push 0x592d80
lea ecx, [ebp - 0x66c]
call fcn.00417c70
push str.__LangEXELANG__verysilent_TYPEupdater
lea ecx, [ebp - 0x654]
call fcn.00403d90
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x680]
mov ecx, 1
cmp dword [eax - 0xc], ecx
jg 0x42d05a
mov eax, dword [ebp - 0x66c]
cmp dword [eax - 0xc], ecx
jle 0x42d06b
push eax
push str.EXELANG
lea ecx, [ebp - 0x654]
call fcn.00417c70
mov eax, dword [ebp - 0x654]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d0a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d0cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x680]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d0f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x66c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d119
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x634]
mov eax, dword [esi + 4]
push str.updater
push eax
call fcn.005430ac
add esp, 8
test eax, eax
jne 0x42d167
push 3
lea ecx, [ebp - 0x704]
push ecx
mov ecx, esi
call fcn.00406570
mov byte [ebp - 4], 0x22
mov eax, dword [eax]
or dword [ebp - 0x628], 1
push 0x592d18
push eax
call fcn.005430ac
add esp, 8
test eax, eax
jne 0x42d167
mov bl, 1
jmp 0x42d169
xor bl, bl
mov dword [ebp - 4], 0x12
test byte [ebp - 0x628], 1
je 0x42d1a6
and dword [ebp - 0x628], 0xfffffffe
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x704]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d1a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42d70a
push 0x58df78
lea ecx, [ebp - 0x65c]
call fcn.00403d90
mov byte [ebp - 4], 0x24
push 0x58df78
lea ecx, [ebp - 0x660]
call fcn.00403d90
mov byte [ebp - 4], 0x25
mov esi, dword [ebp - 0x620]
mov eax, dword [esi + 0x4c]
push 0x5c
push eax
call fcn.00542f3a
add esp, 8
test eax, eax
jne 0x42d1f3
or eax, 0xffffffff
jmp 0x42d1f8
sub eax, dword [esi + 0x4c]
sar eax, 1
push eax
lea ecx, [ebp - 0x718]
push ecx
lea ecx, [esi + 0x4c]
call fcn.00405910
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x614]
call fcn.00401950
push 3
push 0x592d10
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov edx, dword [ebp - 0x634]
push edx
lea eax, [ebp - 0x714]
push 0x58f2e0
push eax
call fcn.00423aa0
mov byte [ebp - 4], 0x27
push 0x592d08
push eax
lea ecx, [ebp - 0x70c]
push ecx
call fcn.00406860
add esp, 0x18
mov byte [ebp - 4], 0x28
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x70c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d296
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x714]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d2bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 4
push str._qn
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 0xb
push str._norestart
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 0xd
push str.TYPEupdater
lea ecx, [ebp - 0x614]
call fcn.004066d0
push 0x10
push 0x592ca4
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov esi, dword [ebp - 0x618]
mov eax, dword [esi + 0x84]
sub eax, 0x10
push eax
call fcn.00401a20
lea edi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x638], edi
mov byte [ebp - 4], 0x2c
push 1
lea ecx, [ebp - 0x71c]
push ecx
lea ecx, [esi + 0x84]
call fcn.00406570
mov byte [ebp - 4], 0x2d
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jne 0x42d35d
test ecx, ecx
js 0x42e501
cmp word [eax], 0x5c
jne 0x42d35d
mov bl, cl
jmp 0x42d35f
xor bl, bl
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x71c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d385
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42d3dc
mov edi, dword [edi - 0xc]
dec edi
push edi
lea ecx, [ebp - 0x6c0]
push ecx
lea ecx, [ebp - 0x638]
call fcn.00405910
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x638]
call fcn.00403340
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x6c0]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d3d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x638]
push 0x5c
push edi
call fcn.00542f3a
add esp, 8
test eax, eax
jne 0x42d3f0
or eax, 0xffffffff
jmp 0x42d3f4
sub eax, edi
sar eax, 1
push eax
lea ecx, [ebp - 0x6c8]
push ecx
lea ecx, [ebp - 0x638]
call fcn.00405910
mov byte [ebp - 4], 0x31
push eax
lea ecx, [ebp - 0x638]
call fcn.00403340
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x6c8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d43d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x592ca0
lea ecx, [ebp - 0x6a8]
call fcn.00403900
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x638]
push ecx
lea edx, [ebp - 0x6d0]
push 0x58f2e0
push edx
call fcn.00423aa0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x6a8]
push ecx
push eax
lea edx, [ebp - 0x6fc]
push edx
call fcn.00408920
add esp, 0x18
mov byte [ebp - 4], 0x35
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x6fc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d4c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0x6d0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d4e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x6a8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d50c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x660]
push ecx
mov ecx, dword [ebp - 0x618]
lea edx, [ebp - 0x65c]
push edx
call fcn.00428bf0
push 0x58eb80
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x670]
push ecx
call fcn.00406860
add esp, 0xc
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x65c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x670]
call fcn.004066d0
push 0x58eb80
lea edx, [ebp - 0x624]
push edx
lea eax, [ebp - 0x674]
push eax
call fcn.00406860
add esp, 0xc
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x660]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x674]
call fcn.004066d0
mov ecx, dword [ebp - 0x65c]
mov esi, 1
cmp dword [ecx - 0xc], esi
jle 0x42d5cd
mov edx, dword [ebp - 0x670]
push 0
push edx
call fcn.005431b6
add esp, 8
cmp eax, 0xffffffff
je 0x42d5cd
push str._Transforms
lea ecx, [ebp - 0x614]
call fcn.00406b90
mov eax, dword [ebp - 0x670]
jmp 0x42d604
mov eax, dword [ebp - 0x660]
cmp dword [eax - 0xc], esi
jle 0x42d614
mov ecx, dword [ebp - 0x674]
push 0
push ecx
call fcn.005431b6
add esp, 8
cmp eax, 0xffffffff
je 0x42d614
push str._Transforms
lea ecx, [ebp - 0x614]
call fcn.00406b90
mov eax, dword [ebp - 0x674]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov ecx, dword [ebp - 0x634]
push 7
push str.msiexec
call fcn.00402a10
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x674]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d64c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x670]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d672
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x638]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d698
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x718]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d6be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x660]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d6e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x65c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d70a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x634]
push 3
lea ecx, [ebp - 0x6d8]
push ecx
mov ecx, esi
call fcn.00406570
mov byte [ebp - 4], 0x41
mov eax, dword [eax]
push 0x592c6c
push eax
call fcn.005430ac
add esp, 8
test eax, eax
sete bl
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x6d8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42d75f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42d823
lea ecx, [ebp - 0x614]
call fcn.00401950
push 8
push str._update
lea ecx, [ebp - 0x614]
call fcn.004066d0
push esi
lea ecx, [ebp - 0x6e0]
push 0x58f2e0
push ecx
call fcn.00423aa0
mov byte [ebp - 4], 0x43
push 0x592d08
push eax
lea edx, [ebp - 0x700]
push edx
call fcn.00406860
add esp, 0x18
mov byte [ebp - 4], 0x44
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d7eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x6e0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d811
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x23
push str.REINSTALLMODEaomus__norestart__qn
lea ecx, [ebp - 0x614]
call fcn.004066d0
mov eax, dword [esi + 4]
push str.updater
push eax
call fcn.005430ac
mov edi, dword [ebp - 0x620]
add esp, 8
test eax, eax
je 0x42d8ac
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
jl 0x42d863
push str.OCR_
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42d863
sub eax, dword [edi + 4]
sar eax, 1
cmp eax, 0xffffffff
jg 0x42d8ac
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
jl 0x42d888
push str.PDF_A
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42d888
sub eax, dword [edi + 4]
sar eax, 1
cmp eax, 0xffffffff
jg 0x42d8ac
mov eax, dword [esi + 4]
push str.patch
push eax
call fcn.005430ac
add esp, 8
test eax, eax
jne 0x42d8a2
cmp dword [ebp + 0x10], eax
je 0x42d8ac
cmp dword [edi + 0x78], 0
je 0x42df55
push 3
lea ecx, [ebp - 0x710]
push ecx
mov ecx, esi
call fcn.00406570
mov byte [ebp - 4], 0x47
mov eax, dword [eax]
or dword [ebp - 0x628], 2
push 0x592c6c
push eax
call fcn.005430ac
add esp, 8
test eax, eax
je 0x42d925
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
jl 0x42d900
push str.OCR_
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42d900
sub eax, dword [edi + 4]
sar eax, 1
cmp eax, 0xffffffff
jg 0x42d925
mov eax, dword [edi + 4]
cmp dword [eax - 0xc], 0
jl 0x42d931
push str.PDF_A
push eax
call fcn.00542363
add esp, 8
test eax, eax
je 0x42d931
sub eax, dword [edi + 4]
sar eax, 1
cmp eax, 0xffffffff
jle 0x42d931
mov edx, dword [ebp - 0x618]
cmp dword [edx + 0x18], 0
jne 0x42d93b
cmp dword [edi + 0x78], 0
jne 0x42d93b
xor bl, bl
jmp 0x42d93d
mov bl, 1
mov dword [ebp - 4], 0x12
test byte [ebp - 0x628], 2
je 0x42d97a
and dword [ebp - 0x628], 0xfffffffd
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x710]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42d97a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42dd0c
push ecx
mov dword [ebp - 0x62c], esp
mov ecx, esp
push 0xffffffffffffffff
push 0x58f3a0
call fcn.00568ba9
mov byte [ebp - 4], 0x49
push ecx
mov dword [ebp - 0x690], esp
mov ecx, esp
push 0xffffffffffffffff
push str.SoftwareFoxit_SoftwareFoxit_Reader_8.0pluginsUpdater
call fcn.00568ba9
mov byte [ebp - 4], 0x4a
push SysReAllocStringLen
lea ecx, [ebp - 0x6e8]
push ecx
mov byte [ebp - 4], 0x12
call fcn.004330a0
add esp, 0x10
mov byte [ebp - 4], 0x4b
mov eax, dword [eax]
test eax, eax
je 0x42d9db
add eax, 0xc
jmp 0x42d9e0
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00403d90
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x6e8]
call fcn.00567cb8
mov eax, dword [ebp - 0x6a0]
mov ecx, 0x590490
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42da2c
test dx, dx
je 0x42da28
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42da2c
add eax, 4
add ecx, 4
test dx, dx
jne 0x42da06
xor eax, eax
jmp 0x42da31
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42dc63
cmp dword [edi + 0x78], 0
jne 0x42dc63
mov ecx, dword [ebp - 0x618]
call fcn.00428a20
test eax, eax
je 0x42dcdd
mov esi, dword [sym.imp.USER32.dll_BringWindowToTop]
mov ebx, dword [ebp - 0x618]
mov eax, dword [ebx + 8]
test eax, eax
je 0x42da6c
push eax
call esi
lea edx, [ebp - 0x708]
push edx
mov ecx, 0x5fc290
call fcn.004074a0
mov byte [ebp - 4], 0x4e
mov eax, dword [eax]
test eax, eax
je 0x42da8c
add eax, 0xc
jmp 0x42da91
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x698]
call fcn.00403d90
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x708]
call fcn.00567cb8
lea eax, [ebp - 0x6f0]
push eax
mov ecx, 0x5fc290
call fcn.00407370
mov byte [ebp - 4], 0x51
mov eax, dword [eax]
test eax, eax
je 0x42dacc
add eax, 0xc
jmp 0x42dad1
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x688]
call fcn.00403d90
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x6f0]
call fcn.00567cb8
call fcn.00440a7e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42e50b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 0x55
push 0x2a3e
push ecx
mov ecx, esp
mov dword [ebp - 0x690], esp
push 0xffffffffffffffff
push str.FoxitUpdater_DLL
call fcn.00567cd2
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x6f4]
push ecx
mov byte [ebp - 4], 0x55
call fcn.00571a50
add esp, 0xc
mov byte [ebp - 4], 0x57
mov eax, dword [eax]
test eax, eax
je 0x42db56
add eax, 0xc
jmp 0x42db5b
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x67c]
call fcn.00403d90
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x6f4]
call fcn.00567cb8
mov edx, dword [ebp - 0x698]
mov eax, dword [ebp - 0x67c]
push edx
push eax
lea ecx, [ebp - 0x668]
push ecx
call fcn.004038b0
mov edx, dword [ebp - 0x688]
mov eax, dword [ebp - 0x668]
mov ecx, dword [edi + 0x2c]
add esp, 0xc
push 5
push edx
push eax
push ecx
mov ecx, 0x5fc290
call fcn.00409a40
cmp eax, 2
je 0x42e515
mov byte [ebp - 4], 0x55
mov eax, dword [ebp - 0x67c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42dbe0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x53
mov eax, dword [ebp - 0x668]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42dc06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0x688]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42dc2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42dc52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, ebx
call fcn.00428a20
test eax, eax
jne 0x42da62
jmp 0x42dcdd
xor esi, esi
cmp dword [edi + 0x78], esi
je 0x42dc6f
mov esi, 1
mov ecx, dword [ebp - 0x618]
call fcn.00428a20
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x42dcc2
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
test esi, esi
jne 0x42dcac
mov ecx, dword [ebp - 0x618]
mov edx, dword [ecx + 8]
push esi
push esi
push 0x41c
push edx
call edi
mov esi, 1
push 0x7d0
call ebx
mov ecx, dword [ebp - 0x618]
call fcn.00428a20
test eax, eax
jne 0x42dc90
mov eax, dword [ebp - 0x618]
mov ecx, dword [eax + 8]
push 0
push 0
push 0x41d
push ecx
call edi
mov edi, dword [ebp - 0x620]
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x6a0]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42df55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42df55
mov ecx, dword [ebp - 0x618]
call fcn.00428a20
test eax, eax
je 0x42df55
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, dword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, dword [ebp - 0x618]
mov eax, dword [ecx + 8]
mov esi, 5
test eax, eax
je 0x42dd57
push eax
call edi
test eax, eax
je 0x42dd52
mov edx, dword [ebp - 0x618]
mov eax, dword [edx + 8]
push eax
call ebx
jmp 0x42dd57
mov esi, 0x1005
lea ecx, [ebp - 0x6c4]
push ecx
mov ecx, 0x5fc290
call fcn.004074a0
mov byte [ebp - 4], 0x60
mov eax, dword [eax]
test eax, eax
je 0x42dd77
add eax, 0xc
jmp 0x42dd7c
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x684]
call fcn.00403d90
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x6c4]
call fcn.00567cb8
lea edx, [ebp - 0x6cc]
push edx
mov ecx, 0x5fc290
call fcn.00407370
mov byte [ebp - 4], 0x63
mov eax, dword [eax]
test eax, eax
je 0x42ddb7
add eax, 0xc
jmp 0x42ddbc
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x678]
call fcn.00403d90
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x6cc]
call fcn.00567cb8
call fcn.00440a7e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42e50b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x650], eax
mov byte [ebp - 4], 0x67
push 0x2a3e
push ecx
mov ecx, esp
mov dword [ebp - 0x690], esp
push 0xffffffffffffffff
push str.FoxitUpdater_DLL
call fcn.00567cd2
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x6d4]
push ecx
mov byte [ebp - 4], 0x67
call fcn.00571a50
add esp, 0xc
mov byte [ebp - 4], 0x69
mov eax, dword [eax]
test eax, eax
je 0x42de41
add eax, 0xc
jmp 0x42de46
mov eax, 0x58df78
push eax
lea ecx, [ebp - 0x69c]
call fcn.00403d90
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x6d4]
call fcn.00567cb8
mov edx, dword [ebp - 0x684]
mov eax, dword [ebp - 0x69c]
push edx
push eax
lea ecx, [ebp - 0x650]
push ecx
call fcn.004038b0
mov edx, dword [ebp - 0x678]
mov eax, dword [ebp - 0x620]
mov ecx, dword [eax + 0x2c]
add esp, 0xc
push esi
mov esi, dword [ebp - 0x650]
push edx
push esi
push ecx
mov ecx, 0x5fc290
call fcn.00409a40
cmp eax, 2
je 0x42e5e8
mov byte [ebp - 4], 0x67
mov eax, dword [ebp - 0x69c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42ded0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x65
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42def0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x62
mov eax, dword [ebp - 0x678]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42df16
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x684]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42df3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x618]
call fcn.00428a20
test eax, eax
jne 0x42dd2b
mov edi, dword [ebp - 0x620]
push 0x58df78
lea ecx, [ebp - 0x658]
call fcn.00403d90
mov byte [ebp - 4], 0x79
push 0x114
lea ecx, [ebp - 0x534]
push 0
push ecx
call fcn.00542dc0
add esp, 0xc
lea edx, [ebp - 0x534]
push edx
mov dword [ebp - 0x534], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [edi + 0x78], 0
jne 0x42dfb7
cmp dword [ebp - 0x530], 5
jbe 0x42dfb7
push 5
push str.runas
lea ecx, [ebp - 0x658]
call fcn.00402a10
mov esi, dword [ebp - 0x634]
push 3
lea eax, [ebp - 0x6a4]
push eax
mov ecx, esi
call fcn.00406570
mov byte [ebp - 4], 0x7a
mov eax, dword [eax]
push 0x592c6c
push eax
call fcn.005430ac
xor edi, edi
add esp, 8
cmp eax, edi
sete bl
mov byte [ebp - 4], 0x79
mov eax, dword [ebp - 0x6a4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e00e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x42e032
push 5
push str.runas
lea ecx, [ebp - 0x658]
call fcn.00402a10
push 7
push str.msiexec
mov ecx, esi
call fcn.00402a10
mov ecx, dword [ebp - 0x620]
cmp dword [ecx + 0x70], edi
je 0x42e04f
push 0xd
push str._fromrdupdate
lea ecx, [ebp - 0x614]
call fcn.00402a10
push 0x38
lea edx, [ebp - 0x760]
push edi
push edx
call fcn.00542dc0
mov eax, dword [ebp - 0x658]
mov ecx, dword [esi]
mov edx, dword [ebp - 0x614]
mov dword [ebp - 0x758], eax
add esp, 0xc
lea eax, [ebp - 0x764]
push eax
mov dword [ebp - 0x764], 0x3c
mov dword [ebp - 0x760], 0x40
mov dword [ebp - 0x75c], edi
mov dword [ebp - 0x754], ecx
mov dword [ebp - 0x750], edx
mov dword [ebp - 0x74c], edi
mov dword [ebp - 0x748], 5
mov dword [ebp - 0x744], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
je 0x42e2f0
mov ecx, dword [ebp - 0x72c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x72c]
lea edx, [ebp - 0x694]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x694]
cmp eax, edi
je 0x42e139
cmp eax, 8
je 0x42e12a
cmp eax, 0xbc2
je 0x42e10e
mov dword [ebp - 0x62c], 2
jmp 0x42e257
mov ecx, dword [ebp - 0x72c]
push ecx
mov dword [ebp - 0x62c], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e2fa
mov dword [ebp - 0x62c], 1
jmp 0x42e266
call fcn.0044dab2
mov eax, dword [eax + 4]
add eax, 0xb8
cmp eax, edi
je 0x42e24b
mov eax, dword [0x5fc3bc]
test eax, eax
jle 0x42e249
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
js 0x42e734
cmp edi, eax
jge 0x42e734
mov ecx, dword [0x5fc3b8]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x42e235
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42e235
push 0x58df78
lea ecx, [ebp - 0x640]
call fcn.00403d90
mov byte [ebp - 4], 0x7c
push 0x591420
lea ecx, [ebp - 0x640]
call fcn.004039b0
mov edx, dword [ebp - 0x620]
mov eax, dword [edx + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x640]
call fcn.004066d0
push 0x59141c
lea ecx, [ebp - 0x640]
call fcn.00406b90
mov eax, dword [ebp - 0x640]
lea edx, [ebp - 0x728]
push edx
push 0
mov dword [ebp - 0x728], 0
mov ecx, dword [eax - 0xc]
push 0x4a
lea ecx, [ecx + ecx + 2]
push esi
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x720], eax
call ebx
mov byte [ebp - 4], 0x79
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e235
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x5fc3bc]
inc edi
cmp edi, eax
jl 0x42e161
mov esi, dword [ebp - 0x634]
xor edi, edi
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x62c], edi
cmp eax, edi
je 0x42e2e1
cmp eax, 0xbc2
je 0x42e2e1
mov eax, dword [esi + 4]
push str.updater
push eax
call fcn.005430ac
add esp, 8
cmp eax, edi
jne 0x42e2e1
mov ecx, dword [0x5fc2d8]
push ecx
lea ecx, [ebp - 0x664]
call fcn.00403d90
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x610]
call fcn.00435360
mov byte [ebp - 4], 0x7f
push edi
lea ecx, [ebp - 0x610]
call fcn.00438400
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x610]
call fcn.00408160
mov byte [ebp - 4], 0x79
mov eax, dword [ebp - 0x664]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e2e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e2fa
mov dword [ebp - 0x62c], 2
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x658]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e320
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x614]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e346
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp eax, dword [ebp - 0x64c]
jl 0x42cb10
mov esi, dword [ebp - 0x620]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, dword [ebp - 0x64c]
mov ecx, dword [esi + 0x2c]
push 0
push 3
push 0x40e
push ecx
call edi
mov edx, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x618]
push edx
call fcn.004232b0
cmp dword [ebp + 0xc], 0
jne 0x42e3a5
mov eax, dword [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x2c]
push 0
push 4
push 0x40e
push ecx
call edi
xor edi, edi
test ebx, ebx
jle 0x42e44a
mov edi, edi
test edi, edi
js 0x42e734
cmp edi, dword [ebp - 0x6b4]
jge 0x42e734
mov edx, dword [ebp - 0x6b8]
mov esi, dword [edx + edi*4]
test esi, esi
je 0x42e441
mov dword [ebp - 0x690], esi
mov byte [ebp - 4], 0x83
lea eax, [esi + 4]
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 0x83
mov eax, dword [eax]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e416
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e438
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.0043f967
add esp, 4
inc edi
cmp edi, ebx
jl 0x42e3c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6bc]
call fcn.0044f0fb
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x648]
call fcn.00432080
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x624]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e48e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e4b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x644]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e4dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x62c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.00401090
push 0x80004005
call fcn.00401090
mov ecx, dword [ebp - 0x624]
push ecx
mov ecx, ebx
call fcn.004232b0
cmp dword [ebp + 0xc], 0
jne 0x42e536
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x67c]
call fcn.00401f60
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x668]
call fcn.00401f60
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x688]
call fcn.00401f60
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x698]
call fcn.00401f60
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x6a0]
call fcn.00401f60
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x614]
call fcn.00401f60
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6bc]
call fcn.0044f0fb
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x648]
call fcn.00432080
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x624]
call fcn.00401f60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x630]
call fcn.00401f60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x644]
call fcn.00401f60
mov eax, 2
jmp 0x42e4e3
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x618]
push eax
call fcn.004232b0
cmp dword [ebp + 0xc], 0
jne 0x42e60d
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x67
mov eax, dword [ebp - 0x69c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e633
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x65
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e653
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [ebp - 4], 0x62
mov eax, dword [ebp - 0x678]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e679
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x684]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e69f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x614]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e6c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6bc]
call fcn.0044f0fb
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x648]
call fcn.00432080
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x624]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e709
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42e72f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42c8a4
call fcn.0043fa85
int3