Function at 0x43146a
Capabilities:
Create process on windows
Read .ini file

Disassembly:
mov eax, 0x14cc
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x14c4], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2828
jg 0x430841
je 0x4307b9
sub ecx, 0x1b6
je 0x4307af
sub ecx, 1
je 0x4306c0
sub ecx, 1
jne case.0x4319b4.20373
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push ecx
push 0x4c6f30
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x430633
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430627
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430614
push str.unnamed
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b731c
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x43068f
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430683
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430670
push 0x24
push str.unnamed
lea eax, [esp + 0xc8]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4319b4.20373
lea ecx, [eax - 4]
call fcn.00478890
jmp case.0x4319b4.20373
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4c6f28
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x43071f
nop dword [eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430713
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430700
push str.unnamed
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b731c
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x43077f
nop dword [eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430773
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430760
push 0x24
push str.unnamed
lea eax, [esp + 0xc8]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4319b4.20373
xor ecx, ecx
call fcn.00478890
jmp case.0x4319b4.20373
call fcn.0047a580
jmp case.0x4319b4.20373
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x2830
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 0
je 0x430803
sub eax, 1
je 0x4307f7
sub eax, 1
jne 0x43080d
mov dword [0x4d9cc0], 0x2999
jmp 0x43080d
mov dword [0x4d9cc0], 0x2843
jmp 0x43080d
mov dword [0x4d9cc0], 0x2828
call fcn.0046d3f0
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 0x34
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x34
jmp 0x431852
cmp ecx, 0x2994
jg 0x431142
je 0x430a19
add ecx, 0xffffd7d7
cmp ecx, 0xe5
ja case.0x4319b4.20373
movzx eax, byte [ecx + 0x431fa0]
jmp dword [eax*4 + 0x431f20]
push 0x11
push 0xf
push 0x4e5a00
push dword [0x4e6030]
call fcn.00401149
jmp case.0x4319b4.20373
call fcn.0043d290
call fcn.0046cb60
jmp case.0x4319b4.20373
call fcn.0043d590
call fcn.0046cb60
jmp case.0x4319b4.20373
call fcn.0043cfe0
call fcn.0046cb60
jmp case.0x4319b4.20373
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x43cce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x4319b4.20373
push 0x7fc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x4d4], 0
push 0
push eax
call fcn.0048fb10
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x288c
push dword [0x4e6030]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x4d0]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x1073
push 0x288c
push dword [0x4e6030]
mov dword [esp + 0x48], 0x400
call edi
push eax
call esi
mov ecx, 0x288c
call fcn.0043a7f0
call fcn.0046cb60
jmp case.0x4319b4.20373
call fcn.00444680
jmp case.0x4319b4.20373
push 1
push 0
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
jmp 0x4319c6
call fcn.0043af40
jmp case.0x4319b4.20373
call fcn.004442c0
jmp case.0x4319b4.20373
call fcn.00444500
jmp case.0x4319b4.20373
mov eax, dword [0x4e4f44]
cmp eax, 1
jne 0x4309cf
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x4319b4.20373
cmp eax, 0xe9
jl 0x4309dd
cmp eax, 0xeb
jle 0x4309fb
push 0
push 0x472350
push dword [0x4e6030]
push str.NAGSCREEN
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.0043a960
jmp case.0x4319b4.20373
call fcn.0043a680
jmp case.0x4319b4.20373
mov ecx, 0x290a
call fcn.0043a7f0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x439ea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x4319b4.20373
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x2876
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 5
ja case.default.0x430a5e
jmp dword [eax*4 + 0x432088]
mov dword [0x4d9cc0], 0x2829
jmp case.default.0x430a5e
mov dword [0x4d9cc0], 0x2844
jmp case.default.0x430a5e
mov dword [0x4d9cc0], 0x2846
jmp case.default.0x430a5e
mov dword [0x4d9cc0], 0x2847
jmp case.default.0x430a5e
mov dword [0x4d9cc0], 0x2845
jmp case.default.0x430a5e
mov dword [0x4d9cc0], 0x29ce
call fcn.0046d3f0
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 0x66
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x66
jmp 0x431852
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x289a
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x430b07
jmp dword [eax*4 + 0x4320a0]
mov dword [0x4d9cc0], 0x282a
jmp case.default.0x430b07
mov dword [0x4d9cc0], 0x2848
jmp case.default.0x430b07
mov dword [0x4d9cc0], 0x2849
jmp case.default.0x430b07
mov dword [0x4d9cc0], 0x284a
jmp case.default.0x430b07
mov dword [0x4d9cc0], 0x284b
call fcn.0046d3f0
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 0x98
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x98
jmp 0x431852
cmp dword [0x4cc1d8], 0x12c
jne 0x430bf0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x29d1
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 0
je 0x430bdf
sub eax, 1
je 0x430bce
sub eax, 1
jne 0x430be9
mov dword [0x4d9cc0], 0x29d3
call fcn.0046d3f0
jmp 0x430c05
mov dword [0x4d9cc0], 0x29d2
call fcn.0046d3f0
jmp 0x430c05
mov dword [0x4d9cc0], 0x2a34
call fcn.0046d3f0
jmp 0x430c05
mov dword [0x4d9cc0], 0x282b
call fcn.0046d3f0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 0xca
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0xca
jmp 0x431852
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x289b
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x430c5f
jmp dword [eax*4 + 0x4320b4]
mov dword [0x4d9cc0], 0x282c
jmp case.default.0x430c5f
mov dword [0x4d9cc0], 0x284c
jmp case.default.0x430c5f
mov dword [0x4d9cc0], 0x284d
jmp case.default.0x430c5f
mov dword [0x4d9cc0], 0x284e
jmp case.default.0x430c5f
mov dword [0x4d9cc0], 0x284f
call fcn.0046d3f0
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 0xfc
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0xfc
jmp 0x431852
mov dword [0x4d9cc0], 0x282d
call fcn.0046d3f0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 0x12e
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x12e
jmp 0x431852
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b35b4
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x285e
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp case.0x4319b4.20373
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b35b0
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x285f
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b35b8
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2860
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b32cc
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2861
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b32e0
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2862
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b3310
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2863
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b330c
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2864
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b331c
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2865
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b3314
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2866
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b361c
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2867
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b3684
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2868
jmp 0x430d70
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
add esp, 0xc
mov edx, 0x4b36c0
mov ecx, str.TWEAK
call fcn.00478640
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.004770b0
test eax, eax
je case.0x4319b4.20373
lea eax, [esp + 0xc0]
push eax
push 0x2869
jmp 0x430d70
cmp ecx, 0x4f8e
jg 0x4319a5
je 0x431999
add ecx, 0xffffd66b
cmp ecx, 0xac
ja case.0x4319b4.20373
movzx eax, byte [ecx + 0x432100]
jmp dword [eax*4 + 0x4320c8]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b731c
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x4311cf
nop dword [eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x4311c3
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x4311b0
push str.unnamed
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b999c
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x43122f
nop dword [eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x431223
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x431210
push 0x24
lea eax, [esp + 0x2cc]
push eax
push str.unnamed
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4319b4.20373
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048fb10
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0xcc]
add esp, 0xc
push 0x104
push eax
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xc0]
push str.System32OneDriveSetup.exe
push eax
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0xc0]
push 5
push 0
push str._uninstall
push eax
push str.open
push dword [0x4e6030]
call esi
push 0x104
lea eax, [esp + 0xc4]
push eax
call ebx
push str.SysWOW64OneDriveSetup.exe
lea eax, [esp + 0xc4]
push eax
call edi
push 5
push 0
push str._uninstall
lea eax, [esp + 0xcc]
push eax
push str.open
push dword [0x4e6030]
call esi
jmp case.0x4319b4.20373
mov edx, 0x4b6ad4
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.photoviewer.reg
call fcn.00444c90
jmp case.0x4319b4.20373
mov edx, 0x4b6afc
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_ico.reg
call fcn.00444c90
jmp case.0x4319b4.20373
mov edx, 0x4b6b1c
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_lnk.reg
call fcn.00444c90
jmp case.0x4319b4.20373
mov edx, 0x4b6b3c
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_exe.reg
call fcn.00444c90
jmp case.0x4319b4.20373
mov edx, 0x4b6b5c
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_folder.reg
call fcn.00444c90
jmp case.0x4319b4.20373
mov edx, 0x4b6b84
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_drive.reg
call fcn.00444c90
jmp case.0x4319b4.20373
push 1
push 0
push str.system
push str.control
jmp 0x4319c6
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x43c1a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x4319b4.20373
push 0x7fc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x4d4], 0
push 0
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0xcd0], 0
lea eax, [esp + 0xcd4]
push 0x7fc
push 0
push eax
call fcn.0048fb10
add esp, 0xc
push 0x28c8
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call edi
mov esi, eax
mov dword [esp + 0x70], 6
lea eax, [esp + 0x4d0]
mov dword [esp + 0x80], 0x400
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x68]
push eax
push esi
push 0x1073
push ebx
call edi
lea eax, [esp + 0xcd0]
mov dword [esp + 0x70], 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x68]
push eax
push esi
push 0x1073
push ebx
mov dword [esp + 0x90], 0x400
call edi
cmp word [esp + 0x4d0], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
jne 0x431610
push 0x4b32e4
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x431594
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x431588
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x431575
push str.unnamed
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b7314
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x4315f0
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x4315e4
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x4315d1
push 0x30
lea eax, [esp + 0x2cc]
push eax
push str.unnamed
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x4319b4.20373
push 0x4b4dc8
push 0x4b3c0c
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x431651
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x431645
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x431632
push str.unnamed
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xcd0]
push eax
lea eax, [esp + 0xc4]
push eax
call esi
push 0x4b4868
lea eax, [esp + 0xc4]
push eax
call esi
push 0x4e6260
push 0x400
push str.unnamed
push 0
push 0x4b3f2c
push str.PRVCY
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x4316d4
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x4316c8
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x4316b5
push 0x24
push str.unnamed
lea eax, [esp + 0xc8]
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x4319b4.20373
lea eax, [esp + 0x4d0]
push eax
push str._T:97__K_pnputil__d__s
lea eax, [esp + 0xcd8]
push 0x400
push eax
call fcn.0040a420
mov eax, dword [0x4e6030]
add esp, 0x10
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
lea eax, [esp + 0xcd0]
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x30], eax
mov eax, dword [0x4e5c0c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x2c], str.open
mov dword [esp + 0x30], 0x4b67b4
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0043b3b0
jmp case.0x4319b4.20373
lea eax, [esp + 0x10]
push eax
push 0
push 0
push fcn.0043b3b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x4319b4.20373
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x29f9
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x4317e2
jmp dword [eax*4 + 0x4321b0]
mov dword [0x4d9cc0], 0x29fa
jmp case.default.0x4317e2
mov dword [0x4d9cc0], 0x29fb
jmp case.default.0x4317e2
mov dword [0x4d9cc0], 0x29fc
jmp case.default.0x4317e2
mov dword [0x4d9cc0], 0x29fd
jmp case.default.0x4317e2
mov dword [0x4d9cc0], 0x29fe
call fcn.0046d3f0
push 0
push 0x4e7e
push dword [0x4e6030]
mov dword [0x4cb9a4], 2
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 2
mov eax, dword [0x4e6034]
add eax, 0x336
push eax
push 0x4e7e
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push 0x4e7e
push dword [0x4e6030]
call edi
push eax
call esi
call fcn.0046cb60
jmp case.0x4319b4.20373
push 0x208
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x68]
push 0x58
push 0
push eax
call fcn.0048fb10
mov eax, dword [0x4e5c0c]
add esp, 0xc
mov dword [esp + 0x70], eax
mov eax, dword [0x4e6030]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0xc0]
mov dword [esp + 0x84], eax
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x6c], 0x58
mov dword [esp + 0xa0], 0x81824
mov dword [esp + 0x78], str.BMP_Files__.bmp_
mov dword [esp + 0x9c], str.Select_a_logo_file:
mov dword [esp + 0x98], 0x4b6c94
mov dword [esp + 0x8c], 0x104
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0xb0], 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0xc0]
push eax
push 0x29a6
push dword [0x4e6030]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x10
push 0x78
push 0x78
push 0
lea eax, [esp + 0xd0]
push eax
push dword [0x4e5c0c]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0
push 0x172
push 0x29a9
push dword [0x4e6030]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x4319b4.20373
push 1
push str.cleanmgr__sageset:1
jmp 0x431efb
add ecx, 0xffffb071
cmp ecx, 0x16
ja case.0x4319b4.20373
jmp dword [ecx*4 + 0x4321c4]
push 5
push 0
push 0
push str.Shell:::D20EA4E1_3957_11d2_A40B_0C5020524153
push str.open
push dword [0x4e6030]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x4319b4.20373
push 1
push str.control__name_Microsoft.Troubleshooting
jmp 0x431efb
push 5
push 0
push 0
push str.Shell:::74246bfc_4c96_11d0_abef_0020af6b0b7a
jmp 0x4319c6
push 5
push 0
push 0
push str.Shell:::BB64F8A7_BEE7_4E1A_AB8D_7D8273F7FDB6
jmp 0x4319c6
push 5
push 0
push 0
push str.Shell:::d450a8a1_9568_45c7_9c0e_b4f9fb4537bd
jmp 0x4319c6
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.logscbscbs.log
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
lea eax, [esp + 0xc8]
push eax
push str.notepad.exe
jmp 0x4319c6
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.logsDISMdism.log
jmp 0x431a27
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3af0
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_SFC__scannow
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3af8
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_DISM__Online__Cleanup_Image__ScanHealth
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3b00
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_DISM__Online__Cleanup_Image__RestoreHealth
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3b28
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_Dism.exe__Online__Cleanup_Image__AnalyzeComponentStore
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3b30
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_Dism.exe__Online__Cleanup_Image__StartComponentCleanup
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3b9c
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_Dism.exe__online__Cleanup_Image__StartComponentCleanup__ResetBase
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3bc4
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431ef0
push 1
push 0
push str._T:97__K_Dism__Cleanup_Mountpoints
push 0x4b67b4
jmp 0x4319c6
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3bcc
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
push dword [0x4e6030]
call edi
cmp eax, 6
jne 0x431ef0
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor eax, eax
mov word [esp + 0xc6], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
lea eax, [esp + 0xcc]
push eax
call esi
mov eax, dword [0x4e6030]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
mov eax, dword [0x4e5c0c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x440
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], str.cleanmgr
mov dword [esp + 0x34], str._sagerun:1
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x54]
test eax, eax
je 0x431e0f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x58]
xorps xmm0, xmm0
push eax
push 0
push 0
lea eax, [esp + 0xcc]
movlpd qword [esp + 0x6c], xmm0
push eax
call esi
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x5c]
cmp ecx, esi
jb 0x431e4b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x58]
ja 0x431e45
cmp eax, edx
jbe 0x431e4b
sub eax, edx
sbb ecx, esi
jmp 0x431e53
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
push ecx
push eax
call fcn.00465af0
add esp, 8
mov edx, 0x4b3bdc
mov ecx, str.WNFX
push eax
call fcn.00478640
push eax
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.0040a420
add esp, 0x10
mov edx, 0x4b4d80
mov ecx, str.PRVCY
push 0x40
call fcn.00478640
push eax
lea eax, [esp + 0xc8]
push eax
push dword [0x4e6030]
call edi
jmp case.0x4319b4.20373
mov edx, 0x4b32e4
mov ecx, 0x4b3c0c
call fcn.00478640
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4b3bd4
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x431ef4
xor eax, eax
jmp 0x431f06
push 1
push str.cleanmgr__verylowdisk
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
mov ecx, dword [esp + 0x14d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x14cc
ret