Function at 0x404319
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Query or enumerate registry value
Shutdown system

Disassembly:
push 0
push str.ISsetup
call sub.user32.dll_FindWindowA
or eax, eax
jne 0x404c5d
push 0x7f89
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x40bc38], eax
push 0x104
push 0x40a9ef
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0x40a9ef
call sub.KERNEL32.DLL__lopen
mov dword [0x40bb9c], eax
push 0
push 0x4df0
push dword [0x40bb9c]
call sub.KERNEL32.DLL__llseek
push 4
push 0x40bba4
push dword [0x40bb9c]
call sub.KERNEL32.DLL__hread
push 4
push 0x40bc4e
push dword [0x40bb9c]
call sub.KERNEL32.DLL__hread
push 4
push 0x40bba0
push dword [0x40bb9c]
call sub.KERNEL32.DLL__hread
mov eax, dword [0x40bba0]
mov dword [0x40bbac], eax
push 0
push dword [0x40bc4e]
push dword [0x40bb9c]
call sub.KERNEL32.DLL__llseek
call sub.KERNEL32.DLL_GetProcessHeap
mov dword [0x40bc1a], eax
push 0x100000
push 8
push eax
call sub.KERNEL32.DLL_HeapAlloc
or eax, eax
jne 0x4043ec
mov byte [0x40bbf4], 0xfe
jmp 0x4048fb
mov dword [0x40bbb4], eax
mov dword [0x40bba8], 1
mov eax, 0x100000
cmp dword [0x40bbac], eax
jge 0x40440d
mov eax, dword [0x40bbac]
push eax
push dword [0x40bbb4]
push dword [0x40bb9c]
call sub.KERNEL32.DLL__hread
sub dword [0x40bbac], eax
push eax
push dword [0x40bbb4]
push 0x40bba8
call fcn.0040739d
cmp dword [0x40bbac], 0
jg 0x4043fb
mov eax, dword [0x40bba8]
cmp dword [0x40bba4], eax
je 0x40447c
push 0x14
push 0x40a053
push str.Installer_corrupted_or_incomplete._r_nYou_may_want_to_contact_the_author_of_this_installer_to_obtain_a_new_copy._r_n_r_nAre_you_sure_that_you_want_to_continue_installation_
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 6
je 0x40447c
push dword [0x40bbb4]
push 0
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapFree
jmp 0x404c5d
push 0
push dword [0x40bc4e]
push dword [0x40bb9c]
call sub.KERNEL32.DLL__llseek
push 4
push 0x40bba4
push dword [0x40bb9c]
call sub.KERNEL32.DLL__hread
push dword [0x40bba0]
push dword [0x40bbb4]
push 8
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapReAlloc
or eax, eax
jne 0x4044dd
push dword [0x40bbb4]
push 0
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapFree
mov byte [0x40bbf4], 0xfe
jmp 0x4048fb
mov dword [0x40bbb4], eax
push str.BZh91AYSY
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov ecx, dword [0x40bba0]
sub ecx, 0xa
add eax, 0xa
push ecx
push eax
push dword [0x40bb9c]
call sub.KERNEL32.DLL__hread
push dword [0x40bba4]
push 8
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapAlloc
or eax, eax
je 0x4044be
mov dword [0x40bbb8], eax
mov dword [0x40bbcc], eax
push dword [0x40bbb4]
pop dword [0x40b99a]
mov dword [0x40b9aa], eax
push dword [0x40bba0]
pop dword [0x40b99e]
push dword [0x40bba4]
pop dword [0x40b9ae]
mov dword [0x40b9be], 0x40729b
mov dword [0x40b9c2], 0x4072c3
push 0
push 0
push 0x40b99a
call fcn.00401006
push 0x40b99a
call fcn.004010f3
push 0x40b99a
call fcn.00401d2b
push dword [0x40bbb4]
push 0
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapFree
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40bb30], eax
call sub.KERNEL32.DLL_GetCommandLineA
inc eax
cmp byte [eax], 0
je 0x40463c
cmp word [eax], 0x732f
jne 0x4045aa
mov byte [0x40bc5e], 1
cmp byte [eax + 2], 0x20
jne 0x4045dc
add eax, 3
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcpyA
inc byte [0x40bc5e]
mov eax, dword [0x40bbcc]
cmp dword [eax], 0
je 0x4045f5
mov ecx, dword [0x40bbcc]
mov eax, dword [ecx]
inc eax
add dword [0x40bbcc], eax
add dword [0x40bbcc], 4
mov eax, dword [0x40bbcc]
mov edx, dword [eax]
or edx, edx
je 0x404610
add edx, 4
add dword [0x40bbcc], edx
add dword [0x40bbcc], 4
mov eax, dword [0x40bbcc]
cmp dword [eax], 0
je 0x404630
mov ecx, dword [0x40bbcc]
mov eax, dword [ecx]
inc eax
add dword [0x40bbcc], eax
add dword [0x40bbcc], 4
jmp 0x4048da
mov eax, dword [0x40bbcc]
cmp dword [eax], 0
je 0x4047b7
call fcn.0040721b
mov dword [0x40b850], 0x30
mov dword [0x40b854], 3
mov dword [0x40b858], 0x404c87
mov dword [0x40b85c], 0
mov dword [0x40b860], 0
push dword [0x40bb30]
pop dword [0x40b864]
mov dword [0x40b870], 6
mov dword [0x40b874], 0
mov dword [0x40b878], 0x40a43b
push 0
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40b868], eax
mov dword [0x40b87c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x40b86c], eax
push 0x40b850
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x40bb30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x80000000
push 0
push str.ISsetup
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x40bb34], eax
push 0
call sub.user32.dll_GetSystemMetrics
shr eax, 1
mov ecx, dword [0x40bbdc]
shr ecx, 1
sub eax, ecx
push eax
push 1
call sub.user32.dll_GetSystemMetrics
shr eax, 1
mov ecx, dword [0x40bbe0]
shr ecx, 1
sub eax, ecx
sub eax, 0xa
pop ebx
push 0
push dword [0x40bb30]
push 0
push dword [0x40bb34]
push dword [0x40bbe0]
push dword [0x40bbdc]
push eax
push ebx
push 0x90000000
push 0
push str.ISsetup
push 8
call sub.user32.dll_CreateWindowExA
mov ecx, dword [0x40bbcc]
mov eax, dword [ecx]
inc eax
add dword [0x40bbcc], eax
xor eax, eax
mov al, byte [ecx + 4]
inc eax
mov ebx, 0x3e8
mul ebx
push 0
push eax
push 1
push dword [0x40bb34]
call sub.user32.dll_SetTimer
push 0
push 0
push 0
push 0x40b810
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4047b7
push 0x40b810
call sub.user32.dll_TranslateMessage
push 0x40b810
call sub.user32.dll_DispatchMessageA
jmp 0x40478d
add dword [0x40bbcc], 4
mov eax, dword [0x40bbcc]
mov edx, dword [eax]
or edx, edx
je 0x404852
mov ecx, dword [eax + 4]
mov dword [0x40bc5a], ecx
add edx, 4
add dword [0x40bbcc], edx
lea edx, [eax + 8]
mov eax, 0xe
add eax, edx
mov dword [0x40bbe4], eax
mov esi, eax
add edx, dword [edx + 0xa]
mov dword [0x40bbe8], edx
xor eax, eax
cmp dword [esi], 0xc
jne 0x40480f
mov ax, word [esi + 4]
mov dword [0x40bbec], eax
mov ax, word [esi + 6]
jmp 0x404821
mov eax, dword [esi + 4]
mov dword [0x40bbec], eax
mov eax, dword [esi + 8]
cmp eax, 1
jae 0x404821
neg eax
mov dword [0x40bbf0], eax
cmp dword [0x40bbf0], 0x130
jle 0x40483c
mov dword [0x40bbf0], 0x130
cmp dword [0x40bbec], 0x1f3
jle 0x404852
mov dword [0x40bbec], 0x1f3
add dword [0x40bbcc], 4
mov eax, dword [0x40bbcc]
cmp dword [eax], 0
je 0x4048d3
call fcn.0040721b
cmp dword [0x40bbe0], 0x3d
jle 0x40487b
mov dword [0x40bbe0], 0x3d
cmp dword [0x40bbdc], 0x1f3
jle 0x404891
mov dword [0x40bbdc], 0x1f3
mov ecx, dword [0x40bbcc]
mov eax, dword [ecx]
inc eax
add dword [0x40bbcc], eax
xor eax, eax
mov al, byte [ecx + 4]
cmp al, 1
jne 0x4048b7
mov eax, dword [0x40bbdc]
shr eax, 1
sub eax, 0xfa
jmp 0x4048c5
cmp al, 2
jne 0x4048c5
mov eax, dword [0x40bbdc]
sub eax, 0x1f3
neg eax
mov dword [0x40bc01], eax
mov byte [0x40bc18], 1
add dword [0x40bbcc], 4
push 0x100000
push 8
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapAlloc
mov dword [0x40bbb4], eax
mov dword [0x40bbc4], eax
call fcn.00405bf7
mov eax, 0x40a07a
cmp byte [0x40bbf4], 0xfe
je 0x404917
cmp byte [0x40bbf4], 0xfd
jne 0x40492b
mov eax, str.This_program_does_not_support_your_operating_system._r_n_r_nPlease_refer_to_the_system_requirements_in_the_programs_documentation.
push 0x10
push 0x40a053
push eax
push 0
call sub.user32.dll_MessageBoxA
jmp 0x404c5d
cmp byte [0x40bbf4], 0xfc
jne 0x404a36
cmp byte [0x40bc19], 1
jne 0x404948
mov eax, 0x40a9a3
jmp 0x4049a6
cmp byte [0x40bc19], 2
jne 0x404958
mov eax, 0x40a9a7
jmp 0x4049a6
cmp byte [0x40bc19], 3
jne 0x404968
mov eax, 0x40a9ab
jmp 0x4049a6
cmp byte [0x40bc19], 4
jne 0x404978
mov eax, 0x40a9af
jmp 0x4049a6
cmp byte [0x40bc19], 5
jne 0x404988
mov eax, 0x40a9b3
jmp 0x4049a6
cmp byte [0x40bc19], 6
jne 0x404998
mov eax, 0x40a9b7
jmp 0x4049a6
cmp byte [0x40bc19], 7
jne 0x4049a6
mov eax, 0x40a9bb
inc dword [0x40bbcc]
mov ecx, dword [0x40bbcc]
mov dword [0x40bba4], ecx
mov cl, byte [ecx]
mov byte [0x40bc19], cl
xor edx, edx
or cl, cl
je 0x4049cf
mov edx, str._r_n_r_nWould_you_like_to_install_it_now_
push 0x14
jmp 0x4049d1
push 0x10
push edx
push eax
push str.This_installation_requires_the_.NET_Framework_version__s_and_above._r_nPlease_install_the_.NET_Framework_and_run_this_setup_again._s
push 0x40a9ef
call sub.user32.dll_wsprintfA
add esp, 0x10
push dword [0x40bbcc]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bbcc], eax
push dword [0x40bbcc]
push 0x40a9ef
push 0
call sub.user32.dll_MessageBoxA
cmp byte [0x40bc19], 0
je 0x404a2f
cmp eax, 6
jne 0x404a2f
push 5
push 0
push 0
push dword [0x40bba4]
push str.Open
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x404c5d
cmp byte [0x40bbf4], 0xfb
jne 0x404a70
push 0x30
push dword [0x40bbd0]
push str.You_must_be_a_user_with_administrative_rights_to_install__s._r_nPlease_log_in_as_an_Administrator.
push 0x40a9ef
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x40bbcc]
push 0x40a9ef
push 0
call sub.user32.dll_MessageBoxA
jmp 0x404c5d
cmp byte [0x40bc5e], 0
jne 0x404a91
push 0
push 0x404d2b
push 0
push 1
push dword [0x40bb30]
call sub.user32.dll_DialogBoxParamA
jmp 0x404a96
call fcn.00406136
cmp byte [0x40bc16], 6
jne 0x404c5d
push dword [0x40bc0a]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc0a]
cmp byte [eax], 1
jne 0x404b4d
push 0x34
push str.Installer_Information
push str.This_system_must_be_restarted_to_complete_the_installation._r_nPress_the_OK_button_to_restart_this_computer_or_No_to_return_to_Windows_without_restarting.
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x404c5d
cmp dword [0x40b8f0], 2
jne 0x404b3f
call sub.KERNEL32.DLL_GetCurrentProcessId
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
push 0x40bba4
push 0x20
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [0x40b800], 1
mov dword [0x40b80c], 2
push 0x40b804
push str.SeShutdownPrivilege
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
push 0
push 0
push 0
push 0x40b800
push 0
push dword [0x40bba4]
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 2
call sub.user32.dll_ExitWindowsEx
jmp 0x404c5d
inc eax
cmp byte [eax], 0
je 0x404c5d
mov dword [0x40bc0a], eax
inc dword [0x40bc0a]
cmp byte [eax], 1
je 0x404bfe
cmp byte [eax], 2
jne 0x404bc0
push 0x40bba4
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
mov dword [0x40bba8], 0x104
push 0x40bba8
push 0x40acfb
push 0
push 0
push str.ProgramFilesDir
push dword [0x40bba4]
call sub.advapi32.dll_RegQueryValueExA
push dword [0x40bba4]
call sub.advapi32.dll_RegCloseKey
jmp 0x404bfe
cmp byte [eax], 3
jne 0x404bd6
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetWindowsDirectoryA
jmp 0x404bfe
cmp byte [eax], 4
jne 0x404bec
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetSystemDirectoryA
jmp 0x404bfe
push dword [0x40bc0a]
push 0x40acfb
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x404c19
push 0x40a957
push 0x40acfb
call sub.KERNEL32.DLL_lstrcatA
push dword [0x40bc0a]
push eax
call sub.KERNEL32.DLL_lstrcatA
xor eax, eax
mov ecx, 0x40acfb
cmp dword [ecx], 0x70747468
je 0x404c3b
inc ecx
cmp byte [ecx], 0
je 0x404c3b
cmp word [ecx], 0x2f20
jne 0x404c28
mov byte [ecx], 0
inc ecx
mov eax, ecx
push eax
push 0x1f4
call sub.KERNEL32.DLL_Sleep
pop eax
push 1
push 0
push eax
push 0x40acfb
push str.Open
push 0
call sub.shell32.dll_ShellExecuteA
push dword [0x40bbb8]
push 0
push dword [0x40bc1a]
call sub.KERNEL32.DLL_HeapFree
push dword [0x40bb9c]
call sub.KERNEL32.DLL__lclose
push 0
call sub.KERNEL32.DLL_ExitProcess
call sub.comctl32.dll_InitCommonControls
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x113
jne 0x404cbe
push 1
push dword [0x40bb34]
call sub.user32.dll_KillTimer
push dword [0x40bb34]
call sub.user32.dll_DestroyWindow
push 0x96
call sub.KERNEL32.DLL_Sleep
push 0
call sub.user32.dll_PostQuitMessage
jmp 0x404d25
cmp dword [ebp + 0xc], 0xf
jne 0x404d10
push 0x40b880
push dword [ebp + 8]
call sub.user32.dll_BeginPaint
push 0
push dword [0x40bbd4]
push dword [0x40bbd8]
push dword [0x40bbe0]
push 0
push 0
push 0
push dword [0x40bbe0]
push dword [0x40bbdc]
push 0
push 0
push eax
call sub.gdi32.dll_SetDIBitsToDevice
push 0x40b880
push dword [ebp + 8]
call sub.user32.dll_EndPaint
jmp 0x404d25
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.user32.dll_DefWindowProcA
leave
ret 0x10
xor eax, eax
leave
ret 0x10