Function at 0x409881
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create process on windows
Get memory capacity
Get system information on windows
Move file
Query environment variable
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58c
mov eax, dword [0x45b480]
xor eax, esp
mov dword [esp + 0x588], eax
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x184]
push ebx
push esi
mov esi, 0x200
mov dword [esp + 0x28], eax
push edi
mov edx, esi
call fcn.004204b0
test eax, eax
jne 0x4098df
push str.DumpUper.exe
mov edx, esi
lea ecx, [esp + 0x194]
call fcn.00420550
test eax, eax
jne 0x4098df
lea ecx, [esp + 0x190]
call fcn.00406c40
call fcn.00402506
push eax
lea ecx, [esp + 0x14]
call fcn.00402331
lea edx, [esp + 0x10]
mov ecx, 0x400000
call fcn.004141aa
mov esi, dword [esp + 0x10]
mov edi, eax
test edi, edi
jne 0x40a9b8
mov ecx, esi
call fcn.00414335
mov edi, eax
test edi, edi
jne 0x40a9b8
lea ecx, [esi - 0x10]
call fcn.004025d7
call fcn.00413cd9
test eax, eax
je 0x409936
mov eax, 0x8007000a
jmp 0x40a9c2
xor eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x20], ebx
test eax, eax
je 0x409965
cmp word [eax], bx
je 0x409965
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x24], eax
jmp 0x409969
mov dword [esp + 0x24], ebx
push 0xffffffffffffffff
call dword [sym.imp.IMM32.dll_ImmDisableIME]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x409983
push 5
pop eax
jmp 0x40a9c2
mov esi, dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [esp + 0x33]
push eax
push ebx
push 1
push 0x11
call esi
lea eax, [esp + 0x33]
push eax
push ebx
push 1
push 0x12
call esi
call fcn.00402506
push eax
lea ecx, [esp + 0x1c]
call fcn.00402331
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
push ebx
push str.WuaRegistryWorkRoot
call edi
mov esi, eax
lea ecx, [esp + 0x18]
test esi, esi
jne 0x4099da
call fcn.00401f40
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
jmp 0x409a70
push esi
call fcn.00402070
push esi
push eax
push str.WuaRegistryWorkRoot
call edi
push ecx
lea ecx, [esp + 0x1c]
call fcn.00411d9f
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.msvcrt.dll__wcsnicmp]
push 4
push str.HKLM
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x409a2a
lea edi, [esi + 8]
movzx eax, word [edi]
cmp eax, 0x5c
jne 0x409a1e
lea edi, [esi + 0xa]
jmp 0x409a23
test ax, ax
jne 0x409a6d
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x409a55
push 4
push str.HKCU
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x409a6d
lea edi, [esi + 8]
movzx eax, word [edi]
cmp eax, 0x5c
jne 0x409a4b
lea edi, [esi + 0xa]
jmp 0x409a50
test ax, ax
jne 0x409a6d
mov eax, SysReAllocStringLen
mov ecx, edi
mov dword [reloc.OLEAUT32.dll_SysReAllocString], eax
call fcn.00401f04
push eax
push edi
mov ecx, 0x47e730
call fcn.00402120
lea ecx, [esi - 0x10]
call fcn.004025d7
lea eax, [esp + 0x17]
mov byte [esp + 0x17], bl
mov dword [esp + 0x12c], eax
lea ecx, [esp + 0x168]
lea eax, [esp + 0x128]
mov dword [esp + 0x128], 0x44e764
push eax
mov dword [esp + 0x150], eax
call fcn.00411b06
mov ecx, dword [esp + 0x14c]
test ecx, ecx
je 0x409aca
mov edx, dword [ecx]
lea eax, [esp + 0x128]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 7
xor eax, eax
lea edi, [esp + 0x40]
pop ecx
rep stosd dword es:[edi], eax
cmp dword [esp + 0x20], eax
je 0x40a69c
mov edi, dword [esp + 0x24]
cmp dword [edi], eax
je 0x40a69c
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push 0x44d3bc
push dword [edi]
call esi
test eax, eax
jne 0x409b99
push 3
push 0x44d3c4
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x40a9a3
call fcn.0040934a
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40a693
mov byte [esp + 0x17], 1
lea ecx, [esp + 0x28]
mov eax, dword [edi + 4]
add eax, 6
push eax
call fcn.00401e23
mov esi, dword [esp + 0x28]
cmp dword [esi - 0xc], 2
jl 0x409b80
cmp dword [esi - 0xc], ebx
jl 0x40a9d9
cmp word [esi], 0x22
jne 0x409b80
cmp dword [esi - 4], 1
jle 0x409b6f
push dword [esi - 0xc]
lea ecx, [esp + 0x2c]
call fcn.00401f75
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00411d9f
push ebx
push ebx
push ebx
mov edx, esi
call fcn.004077d5
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.004025d7
jmp 0x40a68b
push str._IsBusy
push dword [edi]
call esi
test eax, eax
jne 0x409bdd
call fcn.0040934a
mov ebx, eax
test ebx, ebx
jne 0x40a68b
mov esi, 0x47e688
mov byte [esp + 0x17], 1
mov ecx, esi
call fcn.004074ca
mov ebx, eax
test ebx, ebx
jne 0x40a68b
push ecx
mov ecx, esi
call fcn.00407753
jmp 0x40a62b
push str._specucheck
push dword [edi]
call esi
test eax, eax
jne 0x409c38
push ebx
push 4
lea eax, [esp + 0x18]
push eax
push 0xc9
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x409c16
test byte [esp + 0x10], 0x18
jne 0x40a68b
mov ebx, 0xa0010001
jmp 0x40a68b
cmp eax, 0xc0000003
je 0x409c2e
cmp eax, 0xc0000002
je 0x409c2e
mov ebx, 0x80004005
jmp 0x40a68b
mov ebx, 0xa0010002
jmp 0x40a68b
push str._Embedding3
push dword [edi]
call esi
test eax, eax
je 0x40a56c
push str._Embedding4
push dword [edi]
call esi
test eax, eax
je 0x40a56c
push str._Embedding5
push dword [edi]
call esi
test eax, eax
jne 0x409dcf
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], eax
cmp eax, 3
je 0x409c83
mov ebx, 0x80070057
jmp 0x40a68b
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 0xffffffffffffffff
call dword [0x44a650]
xor eax, eax
cmp ax, word [esp + 0x10]
je 0x409ca8
mov ebx, 0x800f0235
jmp 0x40a68b
push 0x3c
lea eax, [esp + 0x130]
mov dword [esp + 0x12c], 0x40
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [esp + 0x14c], ebx
ja 0x409cf6
jb 0x409cec
cmp dword [esp + 0x148], 0x10000000
jae 0x409cf6
mov ebx, 0x8007000e
jmp 0x40a68b
call fcn.0040934a
test eax, eax
jne 0x40a68d
mov byte [esp + 0x17], 1
push dword [edi + 0xc]
push 0x10
push ebx
push dword [edi + 8]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov ecx, 0x47e688
push eax
push dword [edi + 4]
call fcn.0040735f
test eax, eax
jne 0x40a68d
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x3c]
push ebx
push ebx
push ebx
push eax
call edi
test eax, eax
je 0x40a68f
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 0xffffffff
je 0x409dbc
cmp dword [esp + 0x40], 0x8123
jne 0x409d6c
push dword [esp + 0x48]
mov edx, dword [esp + 0x48]
call fcn.0040d848
jmp 0x409d9c
cmp dword [esp + 0x40], 0x8124
jne 0x409d85
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
call fcn.00402bbb
jmp 0x409d9c
cmp dword [esp + 0x40], 0x8125
jne 0x409da6
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
call fcn.00402c75
push dword [0x47e710]
call esi
jmp 0x409dbc
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x48]
push eax
call edi
test eax, eax
jne 0x409d4e
jmp 0x40a68f
push str._InitializeWinRE
push dword [edi]
call esi
test eax, eax
jne 0x409e34
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x44a650]
xor eax, eax
cmp ax, word [esp + 0x10]
jne 0x409e65
call fcn.00413d6a
cmp eax, 0x60001
jb 0x409e2a
cmp eax, 0x60002
je 0x409e2a
cmp dword [esp + 0x20], 1
jne 0x409e20
call fcn.004059a7
jmp 0x40a68d
mov ebx, 0x80004002
jmp 0x40a68f
mov ebx, 0x80004001
jmp 0x40a68f
push str._EnableRestore
push dword [edi]
call esi
test eax, eax
jne 0x409ece
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x44a650]
xor eax, eax
cmp ax, word [esp + 0x10]
je 0x409e6f
mov ebx, 0x800f0235
jmp 0x40a68f
call fcn.00413d6a
cmp eax, 0x60001
jb 0x409fc5
cmp eax, 0x60002
je 0x409fc5
cmp dword [esp + 0x20], 2
jne 0x409ea4
push 0x10
push ebx
push dword [edi + 4]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov ebx, eax
jmp 0x409eaf
cmp dword [esp + 0x20], 1
jne 0x40a017
mov ecx, ebx
call fcn.00405e98
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x40a693
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a693
push str._DisableRestore
push dword [edi]
call esi
test eax, eax
jne 0x409fd2
call fcn.00413d6a
cmp eax, 0x60001
jb 0x409fc5
cmp eax, 0x60002
je 0x409fc5
cmp dword [esp + 0x20], 2
jl 0x409f1a
push str._Force
push dword [edi + 4]
call esi
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x409fb5
call fcn.00402506
push eax
lea ecx, [esp + 0x14]
call fcn.00402331
lea edx, [esp + 0x10]
mov ecx, str._SystemDrive_360SysRt360PatchMgrResult.txt
call fcn.00414098
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x409fad
call fcn.00402506
push eax
lea ecx, [esp + 0x28]
call fcn.00402331
lea edx, [esp + 0x24]
mov ecx, 0x400000
call fcn.004141aa
test eax, eax
jne 0x409fa1
push ecx
lea ecx, [esp + 0x28]
call fcn.0040cb8b
cmp eax, 0xffffffff
je 0x409fa1
inc eax
lea ecx, [esp + 0x24]
push eax
call fcn.004020f5
mov esi, str.360PatchMgrResult.txt
mov ecx, esi
call fcn.00401f04
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.0040173d
mov esi, dword [esp + 0x24]
push 3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x409fa5
mov esi, dword [esp + 0x24]
lea ecx, [esi - 0x10]
call fcn.004025d7
lea ecx, [edi - 0x10]
call fcn.004025d7
mov ecx, ebx
call fcn.004066aa
mov dword [esp + 0x18], eax
jmp 0x40a693
mov dword [esp + 0x18], 0x80004001
jmp 0x40a693
push str._ProxyCall
push dword [edi]
call esi
test eax, eax
jne 0x40a2b1
mov eax, dword [esp + 0x20]
cmp eax, 2
jl 0x40a017
add edi, 4
dec eax
push str._EvaluateApplicability
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
push dword [edi]
call esi
test eax, eax
jne 0x40a16d
cmp dword [esp + 0x20], 4
je 0x40a024
cmp dword [esp + 0x20], 5
je 0x40a024
mov dword [esp + 0x18], 0x80070057
jmp 0x40a693
push dword [edi + 4]
lea ecx, [esp + 0x14]
call fcn.00401e23
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
call fcn.00414098
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.00420630
test eax, eax
jne 0x40a056
mov esi, 0x80070241
jmp 0x40a160
mov ecx, edi
call fcn.00413bc1
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
je 0x40a150
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push dword [eax + 8]
call fcn.0040cb1c
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
mov dword [esp + 0x10], eax
call fcn.004025d7
cmp dword [esp + 0x10], ebx
je 0x40a150
cmp dword [esp + 0x20], 5
mov dword [esp + 0x18], 0x44eab8
mov dword [esp + 0x1c], ebx
jne 0x40a100
mov eax, dword [esp + 0x24]
push 0x10
push ebx
push dword [eax + 0x10]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push 0x400000
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x40a100
cmp dword [eax], ebx
jne 0x40a100
cmp dword [eax + 4], 0x3ffff4
ja 0x40a100
push str.WuaSetContext
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a100
lea ecx, [esp + 0x18]
push ecx
call eax
mov eax, dword [esp + 0x24]
push 0xa
push ebx
push dword [eax + 0xc]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push eax
call dword [esp + 0x14]
test eax, eax
jne 0x40a123
mov esi, 0x600f0001
jmp 0x40a132
mov esi, 0x600f0002
cmp eax, 1
je 0x40a132
mov esi, 0x80004005
mov dword [esp + 0x18], 0x44eab8
cmp dword [esp + 0x1c], ebx
je 0x40a157
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0x1c], ebx
jmp 0x40a157
call fcn.0041390d
mov esi, eax
lea ecx, [esp + 0x28]
call fcn.00411b4e
lea ecx, [edi - 0x10]
call fcn.004025d7
jmp 0x40a9a8
push str._RunTarget
push dword [edi]
call esi
test eax, eax
jne 0x40a9a3
cmp dword [esp + 0x20], 6
je 0x40a190
cmp dword [esp + 0x20], 7
jne 0x40a9a3
push dword [edi + 4]
lea ecx, [esp + 0x14]
call fcn.00401e23
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
call fcn.00414098
mov edi, dword [esp + 0x10]
mov ecx, edi
call fcn.00420630
test eax, eax
je 0x40a04c
mov ecx, edi
call fcn.00413bc1
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
je 0x40a150
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push dword [eax + 8]
call fcn.0040cb1c
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
mov dword [esp + 0x10], eax
call fcn.004025d7
cmp dword [esp + 0x10], ebx
je 0x40a150
cmp dword [esp + 0x20], 7
mov dword [esp + 0x18], 0x44eab8
mov dword [esp + 0x1c], ebx
jne 0x40a262
mov eax, dword [esp + 0x24]
push 0x10
push ebx
push dword [eax + 0x18]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push 0x400000
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x40a262
cmp dword [eax], ebx
jne 0x40a262
cmp dword [eax + 4], 0x3ffff4
ja 0x40a262
push str.WuaSetContext
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a262
lea ecx, [esp + 0x18]
push ecx
call eax
mov esi, dword [esp + 0x24]
push 0x10
push ebx
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x34], eax
push 0xa
push ebx
push dword [esi + 0x10]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push 0x40a9e4
push 0xa
push ebx
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push eax
call dword [esp + 0x1c]
mov esi, eax
jmp 0x40a132
push str._Hotfix
push dword [edi]
call esi
test eax, eax
jne 0x40a4cf
cmp dword [esp + 0x20], 2
jl 0x40a9a3
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x40a9a8
push 0x208
lea eax, [esp + 0x194]
mov byte [esp + 0x1b], 1
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [esp + 0x190]
mov esi, 0x104
mov edx, esi
call fcn.004204b0
test eax, eax
jne 0x40a4c5
cmp ax, word [esp + 0x190]
je 0x40a4c5
lea eax, [esp + 0x190]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401e23
lea eax, [esp + 0x190]
push eax
lea ecx, [esp + 0x30]
call fcn.00401e23
lea eax, [esp + 0x190]
push eax
lea ecx, [esp + 0x14]
call fcn.00401e23
push esi
lea ecx, [esp + 0x2c]
call fcn.00402070
push 0x104
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.004020f5
push str.360Base.dll
mov edx, 0x104
mov ecx, esi
call fcn.00420550
test eax, eax
jne 0x40a494
push 0x104
lea ecx, [esp + 0x30]
call fcn.00402070
push 0x104
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.004020f5
push str.UtilsImmunehfdef.dat
mov edx, 0x104
mov ecx, esi
call fcn.00420550
test eax, eax
jne 0x40a494
push 0x104
lea ecx, [esp + 0x14]
call fcn.00402070
push 0x104
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.004020f5
push str.UtilsImmunehfstate.dat
mov edx, 0x104
mov ecx, esi
call fcn.00420550
test eax, eax
jne 0x40a494
push ecx
lea ecx, [esp + 0x12c]
mov dword [0x47ee1c], ebx
call fcn.0040262c
lea eax, [esp + 0x128]
mov ecx, 0x47ede8
push eax
call fcn.0040f2bb
lea ecx, [esp + 0x128]
call fcn.00402b20
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push str.Inst
push dword [edi + 4]
call ebx
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x40a45b
xor ecx, ecx
inc ecx
mov edx, dword [esp + 0x28]
push edi
push esi
call fcn.004097e3
pop ecx
pop ecx
mov ebx, eax
jmp 0x40a475
mov eax, dword [esp + 0x24]
push str.Uninst
push dword [eax + 4]
call ebx
test eax, eax
jne 0x40a471
xor ecx, ecx
jmp 0x40a44a
mov ebx, dword [esp + 0x18]
push 0x4e20
mov ecx, 0x47edb8
call fcn.0040f263
mov ecx, 0x47edb8
call fcn.0040f239
mov dword [esp + 0x18], ebx
jmp 0x40a4a4
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x18], 0x80004005
lea ecx, [edi - 0x10]
call fcn.004025d7
lea ecx, [esi - 0x10]
call fcn.004025d7
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.004025d7
jmp 0x40a693
mov esi, 0x80004005
jmp 0x40a9a8
push str._SpecialLog
push dword [edi]
call esi
test eax, eax
jne 0x40a9a3
cmp dword [esp + 0x20], 2
jl 0x40a9a3
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
jne 0x40a9a8
push str.Hotfix
mov byte [esp + 0x1b], 1
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40a9a3
push ecx
lea ecx, [esp + 0x12c]
mov dword [0x47ee1c], ebx
call fcn.0040262c
lea eax, [esp + 0x128]
mov ecx, 0x47ede8
push eax
call fcn.0040f2bb
lea ecx, [esp + 0x128]
call fcn.00402b20
call fcn.00409752
mov ebx, 0x47edb8
mov esi, eax
push 0x4e20
mov ecx, ebx
call fcn.0040f263
mov ecx, ebx
call fcn.0040f239
jmp 0x40a9a8
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], eax
cmp eax, 5
je 0x40a583
cmp eax, 3
jne 0x409c79
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 0xffffffffffffffff
call dword [0x44a650]
xor eax, eax
cmp ax, word [esp + 0x10]
jne 0x409c9e
push 0x3c
lea eax, [esp + 0x130]
mov dword [esp + 0x12c], 0x40
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [esp + 0x14c], ebx
ja 0x40a5ee
jb 0x409cec
cmp dword [esp + 0x148], 0x10000000
jb 0x409cec
call fcn.0040934a
test eax, eax
jne 0x40a62b
mov esi, dword [sym.imp.msvcrt.dll_wcstoul]
mov byte [esp + 0x17], 1
push dword [edi + 0xc]
push 0x10
push ebx
push dword [edi + 8]
call esi
add esp, 0xc
push eax
push 0x10
push ebx
push dword [edi + 4]
call esi
add esp, 0xc
mov ecx, 0x47e688
push eax
call fcn.004072b4
test eax, eax
je 0x40a62f
mov ebx, eax
jmp 0x40a68b
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40a67d
cmp eax, 0xffffffff
je 0x40a67d
cmp dword [esp + 0x40], 0x8123
jne 0x40a667
push dword [esp + 0x48]
mov edx, dword [esp + 0x48]
mov ecx, dword [0x47e71c]
call fcn.0040d4c4
push dword [0x47e710]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x40a67d
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x48]
push eax
call esi
test eax, eax
jne 0x40a637
mov eax, ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x18]
jmp 0x40a9a8
call fcn.004046ed
test eax, eax
je 0x40a9a3
call fcn.00407bca
cmp eax, 1
jne 0x40a8cf
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
test esi, esi
jne 0x40a9a8
push ebx
lea eax, [esp + 0x6c]
mov byte [esp + 0x1b], 1
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x70], 1
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 8
push eax
mov dword [esp + 0x3c], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub esp, 0xc
call fcn.0040f470
lea ecx, [esp + 0xc0]
call fcn.00407ebb
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0xc8]
call fcn.0040c5f3
mov esi, eax
call fcn.0040f3d9
push dword [esp + 0x28]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
call fcn.00402506
push eax
lea ecx, [esp + 0x1c]
call fcn.00402331
lea edx, [esp + 0x18]
mov ecx, 0x400000
call fcn.004141aa
cmp esi, 1
jne 0x40a83c
call fcn.00402506
push eax
lea ecx, [esp + 0x14]
call fcn.00402331
push dword [esp + 0x120]
lea eax, [esp + 0x14]
push ebx
push str._Result__r_nType_u_r_nResult0x_.8X
push eax
call fcn.0040f2e4
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi - 0xc], ebx
je 0x40a7d5
push str..del
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x28]
call fcn.00401ec9
pop ecx
push 1
push dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.004025d7
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040cb8b
mov edi, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x40a81b
inc eax
lea ecx, [esp + 0x18]
push eax
call fcn.004020f5
mov esi, str.360PatchMgrResult.txt
mov ecx, esi
call fcn.00401f04
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.0040173d
push dword [edi - 0xc]
mov esi, dword [esp + 0x1c]
mov edx, edi
mov ecx, esi
call fcn.0041410a
pop ecx
lea ecx, [edi - 0x10]
call fcn.004025d7
lea ecx, [esi - 0x10]
call fcn.004025d7
lea ecx, [esp + 0xc0]
call fcn.004092cd
jmp 0x40a68f
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x12c], 0x7365525b
mov dword [esp + 0x130], 0x5d746c75
mov dword [esp + 0x134], 0x79540a0d
mov dword [esp + 0x138], 0x313d6570
mov byte [esp + 0x13c], bl
call fcn.0040cb8b
cmp eax, 0xffffffff
je 0x40a8b7
inc eax
lea ecx, [esp + 0x18]
push eax
call fcn.004020f5
mov esi, str.360PatchMgrResult.txt
mov ecx, esi
call fcn.00401f04
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.0040173d
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x128]
push 0x10
mov ecx, esi
call fcn.0041410a
pop ecx
jmp 0x40a8bb
mov esi, dword [esp + 0x18]
lea ecx, [esi - 0x10]
call fcn.004025d7
lea ecx, [esp + 0xc0]
call fcn.004092cd
push 0x40
lea eax, [esp + 0x80]
mov dword [esp + 0x7c], 0x44
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [esp + 0x64]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x208
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov word [esp + 0xb0], ax
mov dword [esp + 0xac], eax
lea eax, [esp + 0x198]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x190]
push 0x104
push eax
push str._SystemDrive__sources_recoveryRecEnv.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x7c]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40a965
call fcn.00413ed5
jmp 0x409fbc
push 0xffffffffffffffff
push dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x80004005
push eax
push dword [esp + 0x5c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x58]
call esi
mov eax, dword [esp + 0x2c]
jmp 0x409fbc
mov esi, 0x80070057
lea ecx, [esp + 0x168]
call fcn.00411ad6
mov eax, esi
jmp 0x40a9c2
lea ecx, [esi - 0x10]
call fcn.004025d7
mov eax, edi
mov ecx, dword [esp + 0x594]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004488a4
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00402310
int3