Function at 0x418360
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448bab
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x45c070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edx, dword [0x45d48c]
mov dword [ebp - 0xe0], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
call eax
add eax, 0x10
mov dword [ebp - 0xd8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1dc], ebx
mov dword [ebp - 0x1d8], ebx
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - method.COptionsDlg.virtual_0], vtable.COptionsDlg.0
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], ebx
mov byte [ebp - 4], 3
cmp byte [ebp + 0xc], bl
jne 0x418516
mov edx, dword [0x45d48c]
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
call eax
add eax, 0x10
mov dword [ebp - 0xe8], eax
mov edi, 0xc6
mov byte [ebp - 4], 4
call fcn.004032e0
cmp eax, ebx
je 0x418474
push eax
mov eax, edi
lea edi, [ebp - 0xe8]
call fcn.00403490
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0xe8]
add edi, 0xfffffff0
mov eax, edi
call fcn.00403230
lea esi, [eax + 0x10]
mov dword [ebp - 0xe8], esi
mov byte [ebp - 4], 7
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4184ae
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
cmp dword [0x45f350], ebx
je 0x4184e6
cmp dword [esi - 4], 1
jle 0x4184d2
mov eax, dword [esi - 0xc]
push eax
lea ecx, [ebp - 0xe8]
push ecx
call fcn.00403590
mov esi, dword [ebp - 0xe8]
mov edx, dword [0x45f350]
push ebx
push esi
push 0x800f
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xe0]
push 3
push eax
xor ecx, ecx
call fcn.00413760
lea eax, [esi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418516
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [0x45d48c]
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xec], edi
mov byte [ebp - 4], 8
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x41855c
mov ecx, esi
lea eax, [ebp - 0xec]
call fcn.00403650
mov edi, dword [ebp - 0xec]
cmp dword [edi - 8], esi
jge 0x41856b
push 0x80070057
call fcn.004036a0
push esi
xor ecx, ecx
mov dword [edi - 0xc], esi
push edi
mov word [edi + 0x208], cx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x418584
sub eax, edx
sar eax, 1
cmp eax, ebx
jl 0x418561
cmp eax, dword [edi - 8]
jg 0x418561
mov dword [edi - 0xc], eax
xor edx, edx
mov word [edi + eax*2], dx
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov ebx, 0x4536e0
call fcn.00406e70
add esp, 8
mov byte [ebp - 4], 9
cmp dword [0x45f3e8], 0
mov edx, 0x4536f4
jne 0x4185d4
mov edx, ebx
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4185e0
sub eax, esi
sar eax, 1
push eax
push edx
lea edx, [ebp - 0xec]
push edx
call fcn.00403a70
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp - 0xe0]
test bl, bl
jne 0x418617
push 4
push edi
mov ecx, 2
call fcn.00413760
push 0
xor edx, edx
mov ecx, str.Time_Control_Service
call fcn.0040e070
add esp, 4
test eax, eax
je 0x418658
mov esi, dword [0x45f3ec]
cmp dword [esi - 0xc], 0
je 0x418658
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x432
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, esi
call fcn.00403b40
add esp, 0xc
test bl, bl
jne 0x418669
push 6
push edi
mov ecx, 0x14
call fcn.00413760
push 0
push str.Time_Control_Service
call fcn.0040db00
add esp, 8
test eax, eax
je 0x4186a8
mov esi, dword [0x45f3ec]
cmp dword [esi - 0xc], 0
je 0x4186a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x434
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, esi
call fcn.00403b40
add esp, 0xc
test bl, bl
jne 0x4186b9
push 4
push edi
mov ecx, 0x15
call fcn.00413760
lea eax, [ebp - 0xd0]
push eax
mov eax, 0xfffe
mov dword [ebp - 0xd0], 0
call fcn.00420bc0
mov byte [ebp - 4], 0xa
mov eax, dword [0x460238]
add eax, 0xfffffff0
call fcn.00403230
add eax, 0x10
mov dword [ebp - 0x10c], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xd0]
push 0x7fff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x418734
sub esp, 0x84
mov edi, esp
mov ecx, 0x21
lea esi, [ebp - 0xd0]
rep movsd dword es:[edi], dword [esi]
push 0x453724
lea edi, [ebp - 0x10c]
call fcn.00403fa0
add esp, 0x88
mov edx, dword [0x45d48c]
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
call eax
add eax, 0x10
mov dword [ebp - 0x124], eax
mov byte [ebp - 4], 0xc
mov esi, dword [ebp - 0x10c]
push esi
push str.__U__sFileDrvFileMonitorInstallation.inf___SW
lea edi, [ebp - 0x124]
call fcn.00403fa0
add esp, 8
lea eax, [esi - 0x10]
call fcn.00403230
add eax, 0x10
mov dword [ebp - 0xe8], eax
mov byte [ebp - 4], 0xd
cmp dword [0x45f3e8], 0
je 0x4187b0
push 0x13
push str.x64_Signed_Drivers_
lea ecx, [ebp - 0xe8]
push ecx
call fcn.00403a70
mov edx, dword [ebp - 0xe8]
push edx
push str.__U__sFileDrvFileMonitorInstallation64.inf___SW
call fcn.00403fa0
add esp, 8
push 2
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x418a22
lea eax, [ebp - 0xf4]
push eax
push ebx
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x418a14
mov edx, dword [ebp - 0xf4]
lea ecx, [ebp - 0xdc]
push ecx
push 1
push 2
push ebx
push 0x2000000
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x418b2d
push 0x44
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.00431310
mov ecx, dword [ebp - 0xdc]
add esp, 0xc
push ebx
xor eax, eax
push ecx
lea edx, [ebp - 0xd4]
push edx
mov dword [ebp - 0x240], 0x44
mov dword [ebp - 0x238], 0x452e70
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xd4], ebx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x4188b7
mov eax, dword [ebp - 0xdc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0xf4]
push ecx
call edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], ebx
je 0x418a22
push 0x45b
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.Failed_to_CreateEnvironmentBlock
call fcn.00403d80
add esp, 0xc
jmp 0x418a22
mov edx, str.dpinst_64.exe_
cmp dword [0x45f3e8], ebx
jne 0x4188c9
mov edx, str.dpinst_32.exe_
lea edi, [ebp - 0x10c]
call fcn.004038b0
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov edx, edi
push edx
call fcn.00403a70
xor eax, eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax - 0xc]
lea esi, [eax + eax*2]
call fcn.00405440
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0xd4]
lea edx, [ebp - 0x240]
push edx
mov edx, dword [ebp - 0xdc]
push 0
push ecx
push 0x428
push 0
push 0
push 0
push eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x418afd
mov eax, dword [ebp - 0x104]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41895f
push eax
call esi
mov eax, dword [ebp - 0xdc]
push eax
call esi
mov ecx, dword [ebp - 0xf4]
push ecx
call esi
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], ebx
je 0x418998
push 0x469
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.Start_remove_the_file_driver
call fcn.00403d80
add esp, 0xc
mov edx, dword [ebp - 0x108]
push 0xbb8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x108]
lea eax, [ebp - 0xe4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0xe4], ebx
jne 0x418a07
push 0
xor edx, edx
mov ecx, str.CaptureFileMonitor
call fcn.0040e070
add esp, 4
test eax, eax
je 0x418a07
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], ebx
je 0x418a02
push 0x47b
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.File_driver_removed_successfully
call fcn.00403d80
add esp, 0xc
mov ebx, 1
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebx, ebx
jne 0x418b70
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], 0
je 0x418a4a
push 0x48f
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.Start_remove_file_driver_other_method
call fcn.00403d80
add esp, 0xc
push 0
xor edx, edx
mov ecx, str.CaptureFileMonitor
call fcn.0040e070
add esp, 4
test eax, eax
je 0x418a8b
mov edi, dword [0x45f3ec]
cmp dword [edi - 0xc], 0
je 0x418a8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x491
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, edi
call fcn.00403b40
add esp, 0xc
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp - 0xe0]
jne 0x418aa4
push 6
push esi
mov ecx, 0x16
call fcn.00413760
push 0
push str.CaptureFileMonitor
call fcn.0040db00
mov edi, eax
add esp, 8
test edi, edi
je 0x418b76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x418b76
lea ecx, [ebp - 0x170]
push ecx
mov ecx, str.Failed_to_uninstall_file_driver_service
mov byte [ebp - 0x178], 0
call fcn.004037a0
push 0x456afc
lea edx, [ebp - 0x178]
push edx
mov dword [ebp - 0x174], edi
call fcn.00434818
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], ebx
je 0x418a22
push 0x46e
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.Failed_to_CreateEnvironmentBlock
call fcn.00403d80
add esp, 0xc
jmp 0x418a22
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], ebx
je 0x418a22
push 0x486
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.Failed_to_CreateEnvironmentBlock
call fcn.00403d80
add esp, 0xc
jmp 0x418a22
mov esi, dword [ebp - 0xe0]
mov bl, byte [ebp + 0xc]
test bl, bl
jne 0x418b8a
push 0
push esi
mov ecx, 0x17
call fcn.00413760
call fcn.0041aea0
test eax, eax
je 0x418bbf
mov edi, dword [0x45f3ec]
cmp dword [edi - 0xc], 0
je 0x418bbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x499
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, edi
call fcn.00403b40
add esp, 0xc
test bl, bl
jne 0x418bd0
push 9
push esi
mov ecx, 0x55
call fcn.00413760
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
jne 0x418bec
push 7
push esi
mov ecx, 0x56
call fcn.00413760
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x453980
call fcn.004037a0
mov byte [ebp - 4], 0xe
cmp dword [0x45f3e8], 0
mov ecx, 0x4539a0
jne 0x418c11
mov ecx, 0x4539d8
lea edx, [ebp - 0x40]
push edx
call fcn.004037a0
lea eax, [ebp - 0x3c]
push eax
mov ecx, str.ProcObsrv.inf
mov byte [ebp - 4], 0xf
call fcn.004037a0
mov byte [ebp - 4], 0x10
cmp dword [0x45f3e8], 0
mov ecx, str.ProcObsrv64.sys
jne 0x418c43
mov ecx, 0x453a50
lea edx, [ebp - 0x38]
push edx
call fcn.004037a0
lea eax, [ebp - 0x34]
push eax
mov ecx, str._sstray64.exe
mov byte [ebp - 4], 0x11
call fcn.004037a0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, str._sstray.exe
mov byte [ebp - 4], 0x12
call fcn.004037a0
lea edx, [ebp - 0x2c]
push edx
mov ecx, str.ltvlib.dll
mov byte [ebp - 4], 0x13
call fcn.004037a0
lea eax, [ebp - 0x28]
push eax
mov ecx, str.LTVSrv.ini
mov byte [ebp - 4], 0x14
call fcn.004037a0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, str.LTVSrvOff.ini
mov byte [ebp - 4], 0x15
call fcn.004037a0
lea edx, [ebp - 0x20]
push edx
mov ecx, str._sstray.ini
mov byte [ebp - 4], 0x16
call fcn.004037a0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x453b0c
mov byte [ebp - 4], 0x17
call fcn.004037a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x453b20
mov byte [ebp - 4], 0x18
call fcn.004037a0
mov byte [ebp - 4], 0x19
xor esi, esi
mov dword [ebp - 0xf4], 0xc
mov dword [ebp - 0xd4], esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, dword [ebp - 0xf4]
jae 0x418ef8
mov esi, dword [ebp - 0xd4]
lea esi, [ebp + esi*4 - 0x44]
lea edx, [ebp - 0xe4]
push esi
push edx
lea ebx, [ebp - 0xec]
call fcn.0040bd10
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 0xe4]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418d54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x418df7
mov eax, dword [0x45f3ec]
cmp dword [eax - 0xc], 0
je 0x418df7
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4b4
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, edi
call fcn.00403b40
mov eax, dword [0x45f3ec]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x418df7
lea ecx, [ebp - 0x114]
push esi
push ecx
lea ebx, [ebp - 0xec]
call fcn.0040bd10
add esp, 8
push 0x4b5
mov byte [ebp - 4], 0x1a
mov ecx, dword [eax]
mov edx, dword [0x45f3ec]
push str.CInstaller::UninstallAgent
push str.Installer.cpp
call fcn.00403d80
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x114]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x418df7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp + 0xc], 0
jne 0x418ee7
mov ecx, dword [0x45f350]
test ecx, ecx
je 0x418e9c
mov edx, dword [ebp - 0xd4]
fild dword [ebp - 0xd4]
push 0
test edx, edx
jns 0x418e27
fadd qword [0x454bf0]
mov eax, dword [ebp - 0xf4]
fmul qword [0x454be8]
fild dword [ebp - 0xf4]
test eax, eax
jns 0x418e43
fadd qword [0x454bf0]
fdivp st(1)
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
fnstcw word [ebp - 0xda]
movzx eax, word [ebp - 0xda]
or eax, 0xc00
mov dword [ebp - 0xfc], eax
fldcw word [ebp - 0xfc]
fistp qword [ebp - 0x100]
mov edx, dword [ebp - 0x100]
add edx, 0x56
push edx
push 0x800d
fldcw word [ebp - 0xda]
push ecx
call esi
mov eax, dword [0x45f350]
test eax, eax
je 0x418e9c
push 0
push 0
push 0x800e
push eax
call esi
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x418ee7
lea ecx, [ebp - 0x17c]
push ecx
mov ecx, str.Agent_install_terminated
mov byte [ebp - 0x184], 1
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x456afc
lea edx, [ebp - 0x184]
push edx
mov dword [ebp - 0x180], eax
call fcn.00434818
inc dword [ebp - 0xd4]
mov esi, dword [ebp - 0xd4]
jmp 0x418cf2
cmp dword [0x45f3e8], 0
je 0x41902f
lea eax, [ebp - 0xe4]
push eax
mov dword [ebp - 0xe4], 0
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x41911c
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0xfc]
push edx
mov ebx, str.DriversCaptureFileMonitor64.sys
call fcn.00406e70
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 0xfc]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418f6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x41901d
mov eax, dword [0x45f3ec]
cmp dword [eax - 0xc], 0
je 0x41901d
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c1
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, edi
call fcn.00403b40
mov eax, dword [0x45f3ec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x41901d
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0xfc]
push edx
mov ebx, str.DriversCaptureFileMonitor64.sys
call fcn.00406e70
add esp, 8
push 0x4c2
mov byte [ebp - 4], 0x1b
mov ecx, dword [eax]
mov edx, dword [0x45f3ec]
push str.CInstaller::UninstallAgent
push str.Installer.cpp
call fcn.00403d80
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0xfc]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41901d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x41911c
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0xfc]
push eax
mov ebx, str.DriversCaptureFileMonitor.sys
call fcn.00406e70
mov edi, dword [eax]
mov eax, dword [ebp - 0xfc]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41906e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x419116
mov eax, dword [0x45f3ec]
cmp dword [eax - 0xc], 0
je 0x419116
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4c9
push str.CInstaller::UninstallAgent
mov edx, str.Installer.cpp
mov ecx, edi
call fcn.00403b40
mov eax, dword [0x45f3ec]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x419116
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x114]
push edx
mov ebx, str.DriversCaptureFileMonitor.sys
call fcn.00406e70
add esp, 8
push 0x4ca
mov byte [ebp - 4], 0x1c
mov ecx, dword [eax]
mov edx, dword [0x45f3ec]
push str.CInstaller::UninstallAgent
push str.Installer.cpp
call fcn.00403d80
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x114]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419116
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [ebp + 0xc], 0
jne 0x419206
mov ecx, dword [0x45f350]
test ecx, ecx
je 0x4191bb
mov dword [ebp - 0xd4], esi
fild dword [ebp - 0xd4]
push 0
test esi, esi
jns 0x41914c
fadd qword [0x454bf0]
mov edx, dword [ebp - 0xf4]
fmul qword [0x454be8]
fild dword [ebp - 0xf4]
test edx, edx
jns 0x419168
fadd qword [0x454bf0]
fdivp st(1)
fnstcw word [ebp - 0xda]
movzx eax, word [ebp - 0xda]
or eax, 0xc00
mov dword [ebp - 0xf4], eax
fldcw word [ebp - 0xf4]
fistp qword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
add eax, 0x56
push eax
push 0x800d
fldcw word [ebp - 0xda]
push ecx
call edi
mov eax, dword [0x45f350]
test eax, eax
je 0x4191bb
push 0
push 0
push 0x800e
push eax
call edi
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ecx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x419206
lea edx, [ebp - 0x158]
push edx
mov ecx, str.Agent_install_terminated
mov byte [ebp - 0x160], 1
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x15c], eax
push 0x456afc
lea eax, [ebp - 0x160]
push eax
call fcn.00434818
lea ecx, [ebp - 0xec]
push ecx
lea edx, [ebp - 0xfc]
push edx
mov ebx, str.Ltprx
call fcn.00406e70
add esp, 8
push eax
mov byte [ebp - 4], 0x1d
call fcn.00410cb0
add esp, 4
test eax, eax
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0xfc]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419259
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x419285
mov edx, dword [0x45f3ec]
cmp dword [edx - 0xc], 0
je 0x419285
push 0x4d0
push str.CInstaller::UninstallAgent
push str.Installer.cpp
mov ecx, str.Proxy_directory_not_deleted
call fcn.00403d80
add esp, 0xc
mov bl, byte [ebp + 0xc]
test bl, bl
jne 0x419301
mov eax, dword [0x45f350]
test eax, eax
je 0x4192b6
push 0
push 0x5a
push 0x800d
push eax
call edi
mov eax, dword [0x45f350]
test eax, eax
je 0x4192b6
push 0
push 9
push 0x800e
push eax
call edi
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ecx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x419301
lea edx, [ebp - 0x188]
push edx
mov ecx, str.Agent_install_terminated
mov byte [ebp - 0x190], 1
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18c], eax
push 0x456afc
lea eax, [ebp - 0x190]
push eax
call fcn.00434818
cmp dword [0x45f370], 0
je 0x419314
call fcn.00405640
call fcn.004064a0
test bl, bl
jne 0x41938d
mov eax, dword [0x45f350]
test eax, eax
je 0x419342
push 0
push 0x5b
push 0x800d
push eax
call edi
mov eax, dword [0x45f350]
test eax, eax
je 0x419342
push 0
push 7
push 0x800e
push eax
call edi
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ecx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41938d
lea edx, [ebp - 0x194]
push edx
mov ecx, str.Agent_install_terminated
mov byte [ebp - 0x19c], 1
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x198], eax
push 0x456afc
lea eax, [ebp - 0x19c]
push eax
call fcn.00434818
cmp dword [0x45f374], 0
je 0x419450
lea ecx, [ebp - 0xec]
push ecx
lea edx, [ebp - 0x114]
push edx
mov ebx, str.TimeCtrlLibs
call fcn.00406e70
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, dword [eax]
mov edi, dword [ebp - 0xd8]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x419412
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x419402
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x419402
call fcn.00403230
mov esi, eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x4193f7
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [ebp - 0xd8], esi
jmp 0x419412
mov ebx, dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0xd8]
push ecx
call fcn.004036c0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x114]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419438
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xd8]
push ecx
call fcn.00410cb0
mov bl, byte [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
test bl, bl
jne 0x4194c9
mov eax, dword [0x45f350]
test eax, eax
je 0x41947e
push 0
push 0x5c
push 0x800d
push eax
call edi
mov eax, dword [0x45f350]
test eax, eax
je 0x41947e
push 0
push 9
push 0x800e
push eax
call edi
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4194c9
lea eax, [ebp - 0x164]
push eax
mov ecx, str.Agent_install_terminated
mov byte [ebp - 0x16c], 1
call fcn.004037a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x456afc
lea ecx, [ebp - 0x16c]
push ecx
mov dword [ebp - 0x168], eax
call fcn.00434818
cmp dword [0x45d528], 0
je 0x41958f
cmp dword [0x45f3e8], 0
mov edx, str.SOFTWAREWow6432Node
jne 0x4194e9
mov edx, str.SOFTWARE
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4194f0
sub eax, edi
push edx
sar eax, 1
lea edx, [ebp - 0xd8]
push edx
mov ebx, eax
call fcn.004036c0
mov ecx, dword [0x45d530]
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xe4]
push eax
push ecx
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xe4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41958f
mov ecx, dword [ebp - 0x120]
test ecx, ecx
je 0x41954f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x120], ecx
test eax, eax
jne 0x41958f
push str.TCtrl
lea ecx, [ebp - 0x120]
call fcn.00421150
cmp dword [ebp - 0x120], 0
je 0x41958f
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x120], 0
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d48c
call edx
add eax, 0x10
mov dword [ebp - 0xe4], eax
mov edi, 0x68
mov byte [ebp - 4], 0x1f
call fcn.004032e0
test eax, eax
je 0x4195c7
push eax
mov eax, edi
lea edi, [ebp - 0xe4]
call fcn.00403490
mov byte [ebp - 4], 0x20
mov edi, dword [ebp - 0xe4]
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add edi, 0xfffffff0
call edx
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x4195f8
cmp eax, dword [edi]
jne 0x4195f8
mov ebx, edi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x419634
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
jne 0x419611
call fcn.00407470
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [edi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.0042e1e7
add esp, 0x10
add ebx, 0x10
mov dword [ebp - 0xdc], ebx
mov byte [ebp - 4], 0x22
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x41965a
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
xor eax, eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xe4], eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jge 0x419d2a
test eax, eax
je 0x41969b
push str.StaffCop
lea ecx, [ebp - 0xdc]
push ecx
mov ebx, 0xe
call fcn.004036c0
mov dword [ebp - 0xf4], 3
cmp dword [0x45f3e8], 0
mov eax, str.Wow6432Node_
jne 0x4196ae
mov eax, 0x451920
push eax
push str.SOFTWARE_sMicrosoftWindowsCurrentVersionUninstall
lea edi, [ebp - 0xd8]
call fcn.00403fa0
mov edx, dword [0x45d48c]
mov eax, dword [edx + 0xc]
add esp, 8
mov ecx, 0x45d48c
call eax
add eax, 0x10
mov dword [ebp - 0xd4], eax
mov eax, str.DisplayName
shr eax, 0x10
mov byte [ebp - 4], 0x23
mov dword [ebp - 0xfc], eax
test eax, eax
jne 0x419712
mov ecx, str.DisplayName
movzx edi, cx
call fcn.004032e0
test eax, eax
je 0x419728
push eax
mov eax, edi
lea edi, [ebp - 0xd4]
call fcn.00403490
jmp 0x419728
push str.DisplayName
lea edx, [ebp - 0xd4]
push edx
mov ebx, 0xb
call fcn.004036c0
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0xe8]
push eax
lea ecx, [ebp - 0xdc]
push ecx
lea edx, [ebp - 0xd4]
push edx
lea eax, [ebp - 0xd8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041e830
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41977b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp + 0xc], 0
jne 0x419863
mov eax, dword [0x45f350]
test eax, eax
je 0x4197b7
mov ecx, dword [ebp - 0xf4]
push 0
add ecx, 0x5d
push ecx
push 0x800d
push eax
call esi
mov eax, dword [0x45f350]
test eax, eax
je 0x4197b7
push 0
push 0
push 0x800e
push eax
call esi
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x419863
mov edx, dword [0x45d48c]
lea eax, [ebp - 0x14c]
mov dword [ebp - 0xfc], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
mov byte [ebp - 0x154], 1
call eax
add eax, 0x10
mov dword [ebp - 0x14c], eax
mov ecx, str.Agent_install_terminated
mov byte [ebp - 4], 0x25
test ecx, 0xffff0000
jne 0x41982c
mov edx, ecx
movzx edi, dx
call fcn.004032e0
test eax, eax
je 0x419842
push eax
mov eax, edi
lea edi, [ebp - 0x14c]
call fcn.00403490
jmp 0x419842
push str.Agent_install_terminated
lea eax, [ebp - 0x14c]
push eax
mov ebx, 0x18
call fcn.004036c0
mov byte [ebp - 4], 0x22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x456afc
lea ecx, [ebp - 0x154]
push ecx
mov dword [ebp - 0x150], eax
call fcn.00434818
push str.InstallerProducts
lea edx, [ebp - 0xd8]
push edx
mov ebx, 0x12
call fcn.004036c0
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d48c
call edx
add eax, 0x10
mov dword [ebp - 0xd4], eax
mov esi, str.ProductName
shr esi, 0x10
mov byte [ebp - 4], 0x26
test esi, esi
jne 0x4198c2
mov eax, str.ProductName
movzx edi, ax
call fcn.004032e0
test eax, eax
je 0x4198d8
push eax
mov eax, edi
lea edi, [ebp - 0xd4]
call fcn.00403490
jmp 0x4198d8
push str.ProductName
lea ecx, [ebp - 0xd4]
push ecx
mov ebx, 0xb
call fcn.004036c0
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0xe8]
push edx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0xd4]
push ecx
lea edx, [ebp - 0xd8]
push edx
push connect
call fcn.0041e830
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41992b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp + 0xc], 0
jne 0x419a19
mov eax, dword [0x45f350]
test eax, eax
je 0x41996d
mov ecx, dword [ebp - 0xf4]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
add ecx, 0x5e
push ecx
push 0x800d
push eax
call edi
mov eax, dword [0x45f350]
test eax, eax
je 0x41996d
push 0
push 0
push 0x800e
push eax
call edi
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x419a19
mov edx, dword [0x45d48c]
lea eax, [ebp - 0x140]
mov dword [ebp - 0xfc], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
mov byte [ebp - 0x148], 1
call eax
add eax, 0x10
mov dword [ebp - 0x140], eax
mov ecx, str.Agent_install_terminated
mov byte [ebp - 4], 0x28
test ecx, 0xffff0000
jne 0x4199e2
mov edx, ecx
movzx edi, dx
call fcn.004032e0
test eax, eax
je 0x4199f8
push eax
mov eax, edi
lea edi, [ebp - 0x140]
call fcn.00403490
jmp 0x4199f8
push str.Agent_install_terminated
lea eax, [ebp - 0x140]
push eax
mov ebx, 0x18
call fcn.004036c0
mov byte [ebp - 4], 0x22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x456afc
lea ecx, [ebp - 0x148]
push ecx
mov dword [ebp - 0x144], eax
call fcn.00434818
push str.SoftwareClassesInstallerProducts
lea edx, [ebp - 0xd8]
push edx
mov ebx, 0x23
call fcn.004036c0
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d48c
call edx
add eax, 0x10
mov dword [ebp - 0xd4], eax
mov byte [ebp - 4], 0x29
test esi, esi
jne 0x419a70
mov eax, str.ProductName
movzx edi, ax
call fcn.004032e0
test eax, eax
je 0x419a86
push eax
mov eax, edi
lea edi, [ebp - 0xd4]
call fcn.00403490
jmp 0x419a86
push str.ProductName
lea ecx, [ebp - 0xd4]
push ecx
mov ebx, 0xb
call fcn.004036c0
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0xe8]
push edx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0xd4]
push ecx
lea edx, [ebp - 0xd8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041e830
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419ad9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [ebp + 0xc], 0
jne 0x419bc7
mov eax, dword [0x45f350]
test eax, eax
je 0x419b1b
mov ecx, dword [ebp - 0xf4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
add ecx, 0x5f
push ecx
push 0x800d
push eax
call esi
mov eax, dword [0x45f350]
test eax, eax
je 0x419b1b
push 0
push 0
push 0x800e
push eax
call esi
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x419bc7
mov edx, dword [0x45d48c]
lea eax, [ebp - 0x128]
mov dword [ebp - 0xfc], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
mov byte [ebp - 0x130], 1
call eax
add eax, 0x10
mov dword [ebp - 0x128], eax
mov ecx, str.Agent_install_terminated
mov byte [ebp - 4], 0x2b
test ecx, 0xffff0000
jne 0x419b90
mov edx, ecx
movzx edi, dx
call fcn.004032e0
test eax, eax
je 0x419ba6
push eax
mov eax, edi
lea edi, [ebp - 0x128]
call fcn.00403490
jmp 0x419ba6
push str.Agent_install_terminated
lea eax, [ebp - 0x128]
push eax
mov ebx, 0x18
call fcn.004036c0
mov byte [ebp - 4], 0x22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x456afc
lea ecx, [ebp - 0x130]
push ecx
mov dword [ebp - 0x12c], eax
call fcn.00434818
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData
lea edx, [ebp - 0xd8]
push edx
mov ebx, 0x3c
call fcn.004036c0
mov eax, dword [0x45d48c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45d48c
call edx
add eax, 0x10
mov dword [ebp - 0xd4], eax
mov byte [ebp - 4], 0x2c
cmp dword [ebp - 0xfc], 0
jne 0x419c23
mov eax, str.DisplayName
movzx edi, ax
call fcn.004032e0
test eax, eax
je 0x419c39
push eax
mov eax, edi
lea edi, [ebp - 0xd4]
call fcn.00403490
jmp 0x419c39
push str.DisplayName
lea ecx, [ebp - 0xd4]
push ecx
mov ebx, 0xb
call fcn.004036c0
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0xfc]
push edx
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0xd4]
push ecx
lea edx, [ebp - 0xd8]
push edx
call fcn.0041eba0
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419c87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.SYSTEMCurrentControlSetServices
lea ecx, [ebp - 0xd8]
push ecx
mov ebx, 0x21
call fcn.004036c0
mov eax, dword [0x45d530]
lea edx, [ebp - 0xd4]
push edx
push eax
push 0
push str.SYSTEMCurrentControlSetServices
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419d19
mov ecx, dword [ebp - 0x120]
test ecx, ecx
je 0x419cdb
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x120], ecx
test eax, eax
jne 0x419d19
cmp dword [0x45f3e8], eax
mov eax, str.sstray64.exe
jne 0x419cfd
mov eax, 0x452c10
push eax
lea ecx, [ebp - 0x120]
call fcn.00421150
push str.csrss_tc.exe
lea ecx, [ebp - 0x120]
call fcn.00421150
inc dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
jmp 0x419668
cmp byte [ebp + 0xc], 0
jne 0x419e0a
mov eax, dword [0x45f350]
test eax, eax
je 0x419d5e
push 0
push 0x64
push 0x800d
push eax
call esi
mov eax, dword [0x45f350]
test eax, eax
je 0x419d5e
push 0
push 8
push 0x800e
push eax
call esi
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x78]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x419e0a
mov edx, dword [0x45d48c]
lea eax, [ebp - 0x134]
mov dword [ebp - 0xfc], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x45d48c
mov byte [ebp - 0x13c], 1
call eax
add eax, 0x10
mov dword [ebp - 0x134], eax
mov ecx, str.Agent_install_terminated
mov byte [ebp - 4], 0x2e
test ecx, 0xffff0000
jne 0x419dd3
mov edx, ecx
movzx edi, dx
call fcn.004032e0
test eax, eax
je 0x419de9
push eax
mov eax, edi
lea edi, [ebp - 0x134]
call fcn.00403490
jmp 0x419de9
push str.Agent_install_terminated
lea eax, [ebp - 0x134]
push eax
mov ebx, 0x18
call fcn.004036c0
mov byte [ebp - 4], 0x22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x456afc
lea ecx, [ebp - 0x13c]
push ecx
mov dword [ebp - 0x138], eax
call fcn.00434818
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0xdc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419e30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push fcn.004032c0
push 0xc
push 4
lea ecx, [ebp - 0x44]
push ecx
mov byte [ebp - 4], 0xd
call fcn.00430a9d
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0xe8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419e6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419e92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x10c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419eb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xcc]
cmp dword [ebp - 0xd0], ecx
je 0x419ed1
lea eax, [ebp - 0xd0]
call fcn.00420c40
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x110]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419ef7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419f1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x1dc]
test eax, eax
je 0x419f34
push eax
call fcn.004450bb
mov eax, dword [ebp - 0x120]
test eax, eax
je 0x419f45
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xd8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419f6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x41a06b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042decf
mov esp, ebp
pop ebp
ret 8