Function at 0x403901
Capabilities:
Accept command line arguments
Check os version
Delete file
Delete registry value
Get common file path
Get file size
Persist via run registry key
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Shutdown system
Terminate process

Disassembly:
sub esp, 0xf14
push ebx
push esi
push 4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax]
cmp cl, 0x22
mov dword [esp + 0x40], eax
jne 0x403962
jmp 0x40393f
cmp cl, 0x22
je 0x40394f
inc eax
mov cl, byte [eax]
cmp cl, bl
mov dword [esp + 0x40], eax
jne 0x40393a
cmp cl, 0x22
jne 0x403966
inc eax
mov dword [esp + 0x40], eax
jmp 0x403966
cmp cl, 0x20
je 0x40396b
inc eax
mov cl, byte [eax]
mov dword [esp + 0x40], eax
cmp cl, bl
jne 0x403956
cmp byte [eax], 0x20
jne 0x403975
inc eax
cmp byte [eax], 0x20
je 0x40396b
mov dword [esp + 0x40], eax
mov cl, byte [eax]
cmp cl, 0x2f
je 0x403996
mov esi, eax
jmp 0x403988
cmp cl, 0x3d
je 0x40398c
inc esi
mov cl, byte [esi]
cmp cl, bl
jne 0x403980
cmp byte [esi], bl
jne 0x403996
mov eax, esi
mov dword [esp + 0x40], eax
push eax
call fcn.00403054
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x100
lea ecx, [esp + 0x104]
push ecx
push eax
mov dword [0x408810], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xa88], bl
je 0x403a3b
lea eax, [esp + 0xa88]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xa88]
jmp 0x4039f9
cmp byte [esi], 0x5c
je 0x403a09
dec esi
lea eax, [esp + 0xa88]
cmp esi, eax
ja 0x4039f3
cmp byte [esi], 0x5c
jne 0x403a24
lea eax, [esp + 0xa88]
push eax
push str.WiseSourceDir
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [esi], 0x5c
inc esi
jmp 0x403a39
lea eax, [esp + 0xa88]
push eax
push str.WiseSourceDir
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [esi], bl
push ebx
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [0x408bd8], eax
jl 0x403a86
call fcn.004028bf
push 0x10000
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x408be0], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [0x408bd8]
mov dword [0x408b44], eax
call fcn.00402b4e
test eax, eax
pop ecx
je 0x403a94
push ebx
call fcn.004029ce
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x408800], ebx
push ebp
lea eax, [esp + 0xd20]
push edi
mov edi, dword [sym.imp.KERNEL32.dll__lread]
mov dword [0x408bd0], eax
mov esi, 0x408820
mov ebp, str.WiseInstaller
je 0x403df8
push 0x24
push 0x408ba0
push dword [0x408bd8]
mov dword [esp + 0x38], 1
call edi
cmp dword [0x408ba4], ebx
jge 0x403aed
neg dword [0x408ba4]
mov dword [0x408be4], 1
push 1
push 0x408bcc
push dword [0x408bd8]
call edi
push 4
push 0x408b60
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b60]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b61]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b62]
push eax
lea eax, [esp + 0x614]
push eax
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b63]
push eax
lea eax, [esp + 0xb94]
push eax
push dword [0x408bd8]
call edi
push 0x14
push 0x408b60
push dword [0x408bd8]
call edi
lea eax, [esp + 0x208]
mov dword [0x408b7c], eax
movzx eax, byte [0x408b62]
push eax
push dword [0x408bd0]
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b63]
push eax
lea eax, [esp + 0xe28]
push eax
push dword [0x408bd8]
call edi
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [0x408b84], eax
movzx eax, byte [0x408b64]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b65]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b66]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b67]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b68]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b69]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b6a]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b73]
push eax
push esi
push dword [0x408bd8]
call edi
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x34], eax
movzx eax, byte [0x408b6b]
push eax
push esi
push dword [0x408bd8]
mov dword [esp + 0x58], eax
call edi
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x54], eax
movzx eax, byte [0x408b6c]
push eax
push esi
push dword [0x408bd8]
mov dword [esp + 0x50], eax
call edi
push 4
lea eax, [esp + 0x6c]
push eax
push dword [0x408bd8]
call edi
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x5c], eax
movzx eax, byte [0x408b6d]
push eax
push esi
push dword [0x408bd8]
mov dword [esp + 0x48], eax
call edi
push 4
lea eax, [esp + 0x68]
push eax
push dword [0x408bd8]
call edi
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x74], eax
movzx eax, byte [0x408b6e]
push eax
push esi
push dword [0x408bd8]
mov dword [esp + 0x4c], eax
call edi
push 4
lea eax, [esp + 0x70]
push eax
push dword [0x408bd8]
call edi
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [esp + 0x40], 1
mov dword [esp + 0x60], eax
movzx eax, byte [0x408b71]
mov dword [esp + 0x30], eax
jg 0x403d44
cmp eax, 1
jle 0x403d4e
mov dword [0x408be4], 1
push dword [esp + 0x30]
push esi
push dword [0x408bd8]
call edi
push 4
lea eax, [esp + 0x74]
push eax
push dword [0x408bd8]
call edi
cmp byte [0x408b72], bl
jne 0x403dd2
movzx eax, byte [0x408b6f]
push eax
push esi
push dword [0x408bd8]
call edi
movzx eax, byte [0x408b70]
push eax
push esi
push dword [0x408bd8]
call edi
mov eax, dword [0x408bac]
cmp eax, ebx
je 0x403daf
and eax, 0xffff0000
cmp eax, 0x20000
jge 0x403daf
mov byte [0x408bcc], bl
cmp dword [0x408a2c], ebx
je 0x40441c
mov eax, dword [0x408808]
cmp eax, ebx
je 0x403dcb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push sym.STUB32.EXE__LanguageDlg_16
push ebx
push 0x6f
push dword [0x408810]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
jne 0x403d94
mov dword [0x408a2c], 1
jmp 0x403d94
cmp byte [esp + 0x108], bl
mov dword [esp + 0x2c], ebx
mov dword [0x408bb4], ebx
mov dword [0x408bb0], ebx
mov dword [0x408bac], ebx
mov dword [0x408ba4], ebx
mov byte [0x408b60], bl
mov byte [0x408b61], 8
mov byte [esp + 0xe24], bl
mov byte [esp + 0xd26], bl
mov byte [esp + 0xd25], bl
mov byte [esp + 0xd24], bl
je 0x403daf
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x108]
jmp 0x403e67
cmp byte [eax], 0x2e
je 0x403e7b
dec eax
lea ecx, [esp + 0x108]
cmp eax, ecx
ja 0x403e61
cmp byte [eax], 0x2e
jne 0x403d94
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeUpdateVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
jne 0x403ed9
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
call fcn.00402bfc
shl eax, 0x10
mov dword [0x408bac], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x7c]
pop ecx
jmp 0x403f08
cmp al, 0x2e
je 0x403f15
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
jne 0x403efa
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x403f19
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00402bfc
or dword [0x408bac], eax
pop ecx
jmp 0x403f33
cmp al, 0x2e
je 0x403f46
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
jne 0x403f2b
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x403f4a
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00402bfc
shl eax, 0x10
pop ecx
mov dword [0x408bb0], eax
jmp 0x403f66
cmp al, 0x2e
je 0x403f79
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
jne 0x403f5e
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x403f7d
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00402bfc
or dword [0x408bb0], eax
pop ecx
lea eax, [esp + 0x108]
push eax
push 0x100
push dword [0x408bd0]
push str.MS_Sans_Serif
push str.CharFont
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push ebx
push str.CharSet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x408b60], al
lea eax, [esp + 0x108]
push eax
push 8
push str.CharSize
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x408b61], al
lea eax, [esp + 0x108]
push eax
push ebx
push str.WiseInitLangAlwaysPrompt
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x404006
or byte [0x408b61], 0x80
push dword [0x408bd0]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x408bd0]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.ProductName
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
lea eax, [ecx + eax + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push str.Initializing
push str.WiseInitPrefix
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4040b9
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x78], 0x20
je 0x4040b9
push 0x406bdc
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [esp + 0x10], eax
push str.Wise_Installation
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push str._Wizard...
push str.WiseInitSuffix
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], 0x5e
jne 0x404125
mov byte [esp + 0x78], 0x20
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40416a
mov dword [0x408ba4], 1
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeSizeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4041a5
lea eax, [esp + 0x78]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.Runtime9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4041db
mov dword [0x408bb4], 1
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
call fcn.00403054
pop ecx
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeSize9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x404247
lea eax, [esp + 0x78]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x404280
xor eax, eax
inc eax
mov dword [0x408ba4], eax
mov dword [0x408be4], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4042b6
mov dword [0x408bb4], 1
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeSizeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4042f1
lea eax, [esp + 0x78]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x40], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.RuntimeSizeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40432c
lea eax, [esp + 0x78]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x80]
push eax
push 0x40645d
push str.ProductCode
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x618]
push eax
push 0x40645d
push str.ProductVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0xb98]
push eax
push 0x40645d
push str.TransformMSI
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push ebx
push str.Remove_Previous
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4043bc
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x108]
push eax
push ebx
push str.DelayReboot
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [esp + 0x78], bl
mov byte [0x408bcc], al
je 0x404415
cmp byte [esp + 0x610], bl
je 0x404415
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x40645d
push str.Language1
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x408820], bl
je 0x403d94
jmp 0x403dd2
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [esp + 0x78], bl
je 0x40445a
lea eax, [esp + 0x18]
push eax
push 0x2001b
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40445a
push str.WiseStubReboot
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x408810]
push ecx
call fcn.0040296d
add esp, 4
test eax, eax
jne 0x404474
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
call fcn.004030de
test eax, eax
pop ecx
jne 0x404486
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x408800], ebx
je 0x4044e7
cmp dword [0x408ba8], ebx
je 0x4044e7
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
push 2
push ebx
push dword [0x408bd8]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x20]
mov dword [esp + 0x2c], eax
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x24]
cmp eax, dword [0x408ba8]
je 0x4044e7
push ebx
call fcn.004029ce
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0xc90]
push eax
mov dword [esp + 0xc94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0xca0], 2
push 0x100
sete al
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [esp + 0x14], esi
dec dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
cmp byte [eax + ecx], 0x5c
je 0x404542
push 0x406680
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x408be4], ebx
je 0x404551
push str.MSCOREE.DLL
jmp 0x404556
push str.MSI.DLL
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.004029ec
add esp, 0xc
cmp dword [0x408be4], ebx
je 0x4045e8
cmp dword [esp + 0x38], 0x10000
jne 0x4045e8
cmp dword [esp + 0x20], 0xe790000
jne 0x4045e8
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
cmp byte [eax + ecx], 0x5c
je 0x4045b5
push 0x406680
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Microsoft.NETFramework_v1.0.3705caspol.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.004029ec
add esp, 0xc
test eax, eax
jne 0x4045e8
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x28], ebx
je 0x4046e3
lea eax, [esp + 0x14]
push eax
push 0x2001b
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push closesocket
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4046e3
lea eax, [esp + 0x10]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x6a4]
push eax
mov dword [esp + 0x68], 0x400
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
push ebx
jmp 0x404685
cmp dword [esp + 0x24], 2
jne 0x404657
cmp dword [esp + 0x10], 1
jbe 0x404695
inc dword [esp + 0x18]
mov eax, 0x400
mov dword [esp + 0x10], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x10]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x6a4]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x404649
jmp 0x4046cf
lea eax, [esp + 0x690]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4046cf
push 1
push 0x40645d
push 1
push ebx
lea eax, [esp + 0x6a0]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4046cf
mov dword [esp + 0x1c], ebx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x1c], ebx
je 0x4045f2
mov eax, dword [0x408bac]
cmp dword [esp + 0x38], eax
jb 0x40471a
jne 0x404707
mov ecx, dword [esp + 0x20]
mov edx, dword [0x408bb0]
mov eax, 0xffff0000
and ecx, eax
and edx, eax
cmp ecx, edx
jb 0x40471a
cmp dword [0x408be4], ebx
je 0x40475a
mov eax, dword [0x408bb0]
cmp dword [esp + 0x20], eax
jae 0x40475a
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x404736
mov ecx, dword [esp + 0x3c]
mov edx, dword [0x408ba4]
add edx, ecx
test edx, edx
jg 0x4047fa
cmp dword [0x408be4], ebx
jne 0x4047fa
cmp eax, ebx
jne 0x40475a
mov eax, dword [esp + 0x44]
mov ecx, dword [0x408bb4]
add ecx, eax
test ecx, ecx
jg 0x40485d
cmp dword [0x408800], ebx
je 0x40477e
mov eax, dword [0x408bb4]
mov ecx, dword [0x408ba4]
push 1
add eax, ecx
push eax
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp byte [0x408bc4], bl
jne 0x405bd7
cmp dword [0x408b80], ebx
jne 0x405beb
cmp dword [0x408800], ebx
je 0x405093
cmp byte [0x408b63], 1
jbe 0x405093
push ebx
push sym.STUB32.EXE__PasswordDlg_16
push ebx
push 0x6d
push dword [0x408810]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x405222
push dword [0x408b7c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, byte [0x408b63]
dec ecx
cmp eax, ecx
jne 0x4047af
mov ecx, dword [0x408b7c]
mov dword [0x408b78], 0x5bc25a
jmp 0x40503e
cmp eax, ebx
je 0x40485d
push 0xe0000000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
jne 0x404856
push 1
push str.AdminError
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x214]
push 5
push eax
call fcn.00402c39
mov eax, dword [0x408bd0]
add esp, 0x14
jmp 0x404838
inc eax
cmp byte [eax], bl
jne 0x404837
push ebx
inc eax
push eax
lea eax, [esp + 0x210]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
cmp dword [0x408800], ebx
jne 0x4048e8
xor eax, eax
inc eax
cmp dword [esp + 0x40], eax
jg 0x4048e8
cmp dword [esp + 0x28], ebx
je 0x404882
cmp dword [esp + 0x3c], eax
jmp 0x404886
cmp dword [esp + 0x44], eax
jg 0x4048e8
cmp dword [0x408be4], ebx
je 0x4048c1
cmp dword [esp + 0x14], eax
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x40645d
jne 0x4048ba
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x404c46
push str.RuntimeDotNet
jmp 0x4048ae
cmp dword [esp + 0x28], ebx
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x40645d
je 0x4048e1
push str.RuntimeNT
jmp 0x4048ae
push str.Runtime9X
jmp 0x4048ae
push esi
call fcn.0040299a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x40492b
lea eax, [eax + 0x40881c]
push str..TMP
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40492b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..exe
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x404f10
xor eax, eax
inc eax
cmp dword [esp + 0x40], eax
jle 0x40495e
cmp dword [esp + 0x14], ebx
je 0x4049a5
cmp dword [esp + 0x30], eax
jle 0x40496a
cmp dword [esp + 0x14], eax
je 0x4049a5
cmp dword [esp + 0x28], ebx
je 0x40499b
cmp dword [esp + 0x3c], eax
jg 0x4049a5
cmp dword [0x408be4], ebx
jne 0x404be7
push 1
push dword [0x408bb4]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x404be7
cmp dword [esp + 0x44], eax
jle 0x404bdf
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408800], ebx
je 0x404a86
cmp dword [0x408be4], ebx
je 0x4049e6
cmp dword [esp + 0x14], 1
jne 0x4049d8
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
jmp 0x404a06
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
jmp 0x404a06
cmp dword [esp + 0x28], ebx
je 0x4049fa
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
jmp 0x404a06
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x44]
push 1
push ebx
push dword [0x408bd8]
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x24]
mov dword [esp + 0x24], eax
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
push dword [esp + 0x38]
lea eax, [esp + 0x410]
push eax
push dword [0x408bd8]
call edi
push ebx
push dword [esp + 0x20]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [0x408be4], ebx
je 0x404a74
cmp dword [esp + 0x14], 1
jne 0x404a6b
mov eax, dword [esp + 0x70]
jmp 0x404afb
mov eax, dword [esp + 0x6c]
jmp 0x404afb
cmp dword [esp + 0x28], ebx
je 0x404a80
mov eax, dword [esp + 0x64]
jmp 0x404afb
mov eax, dword [esp + 0x68]
jmp 0x404afb
cmp dword [0x408be4], ebx
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x414]
push eax
push 0x40645d
je 0x404ad3
cmp dword [esp + 0x24], 1
jne 0x404ac1
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x30]
jmp 0x404afb
push str.RuntimeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x40]
jmp 0x404afb
cmp dword [esp + 0x38], ebx
je 0x404aeb
push str.RuntimeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x3c]
jmp 0x404afb
push str.Runtime9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x44]
mov dword [0x408a28], eax
call fcn.004037af
push ebx
push 0xfa
push 0x4d2
push dword [0x408bdc]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00402a98
lea eax, [esp + 0x308]
push eax
mov eax, dword [0x408a28]
push ebx
push ebx
push eax
push eax
push 0x408b74
push dword [0x408bdc]
lea eax, [esp + 0x428]
push esi
push eax
push 0x408a2c
mov byte [esp + 0x330], bl
call sym.STUB32.EXE__t1_40
mov dword [esp + 0x18], eax
mov eax, dword [0x408b74]
cmp eax, dword [0x408a28]
jne 0x404ba1
push ebx
push ebx
push 3
push ebx
push 1
push closesocket
push esi
mov dword [0x408b74], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x404ba1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [esp + 0x1c]
mov dword [0x408b74], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x408a2c], ebx
jne 0x404f1e
cmp dword [esp + 0x18], ebx
jl 0x404f1e
cmp dword [0x408b74], 0xf4240
jl 0x404f1e
cmp dword [0x408be4], ebx
jne 0x404c46
cmp dword [esp + 0x28], ebx
push 1
je 0x404c34
push dword [0x408bb4]
jmp 0x404c3a
cmp dword [0x408be4], ebx
je 0x404bf3
cmp dword [esp + 0x14], 1
mov eax, dword [0x408ba4]
jne 0x404bf8
mov eax, dword [0x408bb4]
push ebx
push eax
push dword [esp + 0x18]
call fcn.004037f8
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
jne 0x404f6e
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408a2c], ebx
jne 0x404fb7
cmp dword [esp + 0x28], ebx
jne 0x404c46
cmp dword [0x408be4], ebx
jne 0x404c46
push 1
push dword [0x408ba4]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov ecx, dword [0x408be4]
cmp ecx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str._q__r:n
je 0x404c9d
mov eax, 0xffff
test dword [0x408bb0], eax
je 0x404c95
mov edx, dword [0x408bac]
and edx, eax
cmp edx, 1
je 0x404c95
cmp dword [esp + 0x14], ebx
jne 0x404c8b
cmp dword [0x408bb4], ebx
jne 0x404c95
cmp dword [esp + 0x30], 1
jg 0x404c95
mov dword [esp + 0x10], str._q:a
jmp 0x404c9d
mov dword [esp + 0x10], str._q:a__c:_Install__q_
cmp byte [0x408bcc], bl
je 0x404cb1
cmp ecx, ebx
jne 0x404cb1
mov dword [esp + 0x10], str._c:_msiinst__delayrebootq_
cmp dword [0x408800], ebx
jne 0x404d4a
cmp ecx, ebx
jne 0x404d4a
lea eax, [esp + 0x108]
push eax
push 0x80
lea eax, [esp + 0x518]
push eax
push str._q__r:n
push str.InstMsi_CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x510]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404d09
mov dword [esp + 0x18], 1
cmp byte [0x408bcc], bl
je 0x404d3f
push str._q__r:n
lea eax, [esp + 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404d3f
push str._c:_msiinst__delayrebootq_
lea eax, [esp + 0x514]
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x510]
mov dword [esp + 0x10], eax
call fcn.00403282
cmp dword [0x408be4], ebx
mov dword [esp + 0x1c], eax
je 0x404dbb
call fcn.004037af
mov eax, dword [0x408bdc]
cmp eax, ebx
je 0x404dbb
push 0x3ef
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x404d81
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x70
push dword [0x408bdc]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x404d9c
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [0x408bdc]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x404db6
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.00402f55
lea eax, [esp + 0x78]
push eax
push 1
push dword [esp + 0x18]
push esi
call fcn.004030e7
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x20], eax
jne 0x404deb
call fcn.00403282
cmp dword [esp + 0x1c], eax
je 0x404deb
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
jmp 0x404dee
xor ecx, ecx
inc ecx
mov eax, dword [0x408be4]
cmp eax, ebx
je 0x404e0b
cmp dword [esp + 0x20], 0x661
jne 0x404e0b
cmp dword [esp + 0x14], ebx
je 0x404fc5
cmp dword [esp + 0x20], 0x800401fa
je 0x404fe6
cmp dword [0x408800], ebx
jne 0x404e59
cmp eax, ebx
je 0x404e31
cmp dword [esp + 0x40], ecx
jle 0x404e31
cmp dword [esp + 0x14], ebx
je 0x404e59
cmp dword [esp + 0x28], ebx
je 0x404e3d
cmp dword [esp + 0x3c], ecx
jg 0x404e59
cmp eax, ebx
je 0x404e4d
cmp dword [esp + 0x30], ecx
jle 0x404e4d
cmp dword [esp + 0x14], ecx
je 0x404e59
cmp dword [esp + 0x28], ebx
jne 0x404e60
cmp dword [esp + 0x44], ecx
jle 0x404e60
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00402a98
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402a98
cmp dword [esp + 0x20], ebx
je 0x404eda
cmp dword [esp + 0x18], ebx
jne 0x404eda
cmp byte [0x408bcc], bl
jne 0x404ed2
cmp dword [esp + 0x24], ebx
jne 0x404eda
push 4
push str.Reboot
lea eax, [esp + 0x110]
push eax
push 9
push esi
mov dword [esp + 0x38], 1
call fcn.00402c39
mov eax, dword [0x408bd0]
add esp, 0x14
jmp 0x404eb9
inc eax
cmp byte [eax], bl
jne 0x404eb8
push 4
inc eax
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x405023
mov dword [esp + 0x58], 1
cmp dword [esp + 0x14], ebx
jne 0x40477e
cmp dword [0x408be4], ebx
je 0x40477e
cmp dword [0x408bb4], ebx
jne 0x404f03
cmp dword [esp + 0x30], 1
jle 0x40477e
mov dword [esp + 0x14], 1
jmp 0x404865
push ebx
call fcn.004029ce
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x408a2c], ebx
jne 0x404f67
push 6
push str.Internet
lea eax, [esp + 0x110]
push eax
push 0xa
push esi
call fcn.00402c39
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
push 0x406bdc
push esi
call edi
lea eax, [esp + 0x308]
push eax
push esi
call edi
push esi
call fcn.004029ce
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40880c], ebx
lea eax, [esp + 0x108]
je 0x404f96
push 2
push str.CRCError
push eax
push 8
jmp 0x404fa0
push 3
push str.SpaceError
push eax
push 7
push esi
call fcn.00402c39
add esp, 0x14
push esi
call fcn.004029ce
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402ad5
lea eax, [esp + 0x78]
push eax
push 1
push str._q:a
push esi
call fcn.004030e7
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402ad5
push 0x13
push str.MinVerMessage
lea eax, [esp + 0x110]
push eax
push 0x13
push esi
call fcn.00402c39
mov eax, dword [0x408bd0]
add esp, 0x14
jmp 0x40500d
inc eax
cmp byte [eax], bl
jne 0x40500c
push ebx
inc eax
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402ad5
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, byte [ecx]
cmp al, 0x61
jl 0x40503d
cmp al, 0x7a
jg 0x40503d
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x40502f
movzx eax, byte [0x408b63]
dec eax
push eax
push dword [0x408b7c]
call fcn.004031f2
mov eax, dword [0x408b7c]
pop ecx
pop ecx
movzx ecx, byte [0x408b63]
dec ecx
mov dword [esp + 0x18], ecx
je 0x405082
lea ecx, [esp + 0xe24]
sub ecx, eax
mov dl, byte [eax]
cmp dl, byte [ecx + eax]
jne 0x405082
inc eax
dec dword [esp + 0x18]
jne 0x405074
xor eax, eax
cmp dword [esp + 0x18], ebx
sete al
cmp eax, ebx
je 0x4047af
cmp byte [esp + 0x78], bl
je 0x4050f2
cmp byte [esp + 0x610], bl
je 0x4050f2
cmp dword [esp + 0x2c], ebx
je 0x4050f2
push str.MSI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x50], eax
je 0x4050f2
push str.MsiGetProductInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MsiConfigureProductA
push dword [esp + 0x54]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esp + 0x18], ebx
mov dword [esp + 0x24], eax
jne 0x405340
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x408800], ebx
je 0x4056a9
cmp dword [esp + 0x4c], 1
jle 0x405385
push 1
push ebx
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x38]
mov dword [esp + 0x5c], eax
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
push dword [esp + 0x4c]
push esi
push dword [0x408bd8]
call edi
push ebx
push dword [esp + 0x58]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [0x408bd4]
cmp eax, ebx
mov byte [esp + 0x690], bl
je 0x4057ac
xor ecx, ecx
inc ecx
cmp eax, ecx
mov dword [esp + 0x2c], ecx
jle 0x40519b
push 4
lea eax, [esp + 0x1c]
push eax
push dword [0x408bd8]
call edi
push 1
push dword [esp + 0x1c]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp eax, dword [0x408bd4]
jl 0x40516a
push 4
lea eax, [esp + 0x1c]
push eax
push dword [0x408bd8]
call edi
push esi
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
cmp eax, ebx
jle 0x4051e1
push str..MST
lea eax, [esp + eax + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jge 0x4055fb
push ebx
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x408808]
cmp eax, ebx
je 0x405232
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.0040290e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [esp + 0x690], bl
je 0x4050e8
lea eax, [esp + 0x610]
push eax
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4050e8
push 5
push str.ExistError
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x418]
push 6
push eax
call fcn.00402c39
add esp, 0x14
cmp dword [0x408800], ebx
je 0x4052a6
mov eax, dword [0x408bd0]
jmp 0x40529b
inc eax
cmp byte [eax], bl
jne 0x40529a
inc eax
mov dword [esp + 0x1c], eax
jmp 0x4052d7
lea eax, [esp + 0x308]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x310]
push eax
push 0x40645d
push str.ProductName
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x614]
push ecx
push eax
lea ecx, [esp + 0x69c]
push ecx
push eax
lea eax, [esp + 0x420]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x408bd0]
add esp, 0x1c
jmp 0x405308
inc eax
cmp byte [eax], bl
jne 0x405307
push 0x104
inc eax
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x405373
cmp dword [esp + 0x24], ebx
je 0x405340
push 2
push ebx
lea eax, [esp + 0x80]
push eax
call dword [esp + 0x30]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x694]
push eax
lea eax, [esp + 0x80]
push str.VersionString
push eax
mov dword [esp + 0x3c], 0x100
call dword [esp + 0x28]
test eax, eax
je 0x40523f
jmp 0x4050e8
call fcn.0040290e
call fcn.00402ad5
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x4c]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40546a
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x5c]
push eax
push ebx
push str.CommonFilesDir
push dword [esp + 0x60]
mov dword [esp + 0x4c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405460
cmp byte [esp + 0x308], bl
je 0x405460
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x308]
dec ecx
add eax, ecx
cmp byte [eax], 0x5c
jne 0x405402
mov byte [eax], bl
push str.Wise_Installation_Wizard_
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb90], bl
mov eax, 0x4068ec
jne 0x40543e
mov eax, 0x4068e8
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x30c]
sub ecx, 3
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x308]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x108], bl
je 0x4054fa
cmp byte [0x408820], bl
jne 0x405509
lea eax, [esp + 0x510]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + 0x510], bl
je 0x4054fa
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x510]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x4054d5
push 0x406680
lea eax, [esp + 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x510]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0x408820], bl
jne 0x405509
push esi
call fcn.0040299a
pop ecx
push esi
call fcn.0040323a
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [esp + 0x10], 0xffffffff
jne 0x405547
push esi
call fcn.0040299a
push esi
call fcn.0040323a
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jge 0x405567
push ebx
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov al, 1
cmp al, byte [0x408b63]
sbb eax, eax
neg eax
push eax
push dword [0x408bb8]
push dword [esp + 0x18]
call fcn.004037f8
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
je 0x4055da
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40880c], ebx
lea eax, [esp + 0x108]
je 0x4055b8
push 2
push str.CRCError
push eax
push 8
jmp 0x4055c2
push 3
push str.SpaceError
push eax
push 7
push esi
call fcn.00402c39
add esp, 0x14
push esi
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408a2c], ebx
je 0x40514b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov al, 1
cmp al, byte [0x408b63]
sbb eax, eax
neg eax
push eax
push dword [esp + 0x1c]
push dword [esp + 0x18]
call fcn.004037f8
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
je 0x405681
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40880c], ebx
lea eax, [esp + 0x108]
je 0x405651
push 2
push str.CRCError
push eax
push 8
jmp 0x40565b
push 3
push str.SpaceError
push eax
push 7
lea eax, [esp + 0x6a0]
push eax
call fcn.00402c39
lea eax, [esp + 0x6a4]
add esp, 0x14
push eax
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408a2c], ebx
je 0x4057ac
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x414]
push eax
push 0x40645d
push str.ProductFile
push ebp
mov byte [esp + 0x6a8], bl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x408bd4]
cmp eax, ebx
je 0x405758
push eax
push str.LanguageFile_d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x108]
push eax
push 0x104
lea eax, [esp + 0x698]
push eax
push 0x40645d
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x405758
push str..mst
lea eax, [esp + eax + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405758
lea eax, [esp + 0x690]
push eax
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esp + 0x690], bl
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.http:__
push esi
mov byte [0x408827], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40579d
lea eax, [esp + 0xa90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4057ac
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00402ad5
mov eax, dword [esp + 0x48]
mov byte [esp + 0x208], bl
cmp byte [eax], bl
jne 0x405839
cmp dword [0x408800], ebx
je 0x405813
mov ebp, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push ebx
push dword [0x408bd8]
call ebp
push ebx
push dword [0x408b84]
mov dword [esp + 0x3c], eax
push dword [0x408bd8]
call ebp
movzx eax, byte [0x408b64]
push eax
lea eax, [esp + 0x20c]
push eax
push dword [0x408bd8]
call edi
push ebx
push dword [esp + 0x38]
push dword [0x408bd8]
call ebp
jmp 0x405839
lea eax, [esp + 0x108]
push eax
push 0x100
lea eax, [esp + 0x210]
push eax
push 0x40645d
push str.CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x690], bl
je 0x40586e
lea eax, [esp + 0x690]
push eax
push str._TRANSFORMS__s_
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [esp + 0x48]
mov al, byte [edi]
cmp al, 0x2f
jne 0x4058a2
cmp byte [edi + 1], 0x2a
jne 0x4058a2
lea eax, [edi + 2]
jmp 0x405884
inc eax
cmp byte [eax], 0x20
je 0x405883
push 0x200
lea ecx, [esp + 0x694]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x4059e2
cmp byte [esp + 0x208], bl
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
je 0x4058b5
cmp al, bl
je 0x4058d7
cmp al, bl
lea eax, [esp + 0x208]
je 0x4058cb
push 0x200
push eax
push edi
call ebp
jmp 0x4058d7
push 0x4068ac
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov cl, byte [esp + 0x208]
cmp cl, 0x2f
jne 0x405919
cmp byte [esp + 0x209], 0x2a
jne 0x405919
cmp byte [esp + 0x20a], 0x20
lea eax, [esp + 0x20a]
jne 0x405904
inc eax
cmp byte [eax], 0x20
je 0x4058fe
push 0x200
lea ecx, [esp + 0x694]
push ecx
push eax
call ebp
jmp 0x4059e2
cmp cl, bl
lea eax, [esp + 0x208]
je 0x405972
cmp cl, 0x2f
jne 0x405954
mov cl, byte [eax + 1]
cmp cl, 0x49
je 0x40595b
cmp cl, 0x69
je 0x40595b
cmp cl, 0x4a
je 0x40595b
cmp cl, 0x6a
je 0x40595b
cmp cl, 0x58
je 0x40595b
cmp cl, 0x78
je 0x40595b
cmp cl, 0x41
je 0x40595b
cmp cl, 0x61
je 0x40595b
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x405924
cmp byte [eax], bl
jne 0x405985
push 0x406bdc
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4068ac
lea eax, [esp + 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb90], bl
lea eax, [esp + 0xb90]
jne 0x405997
mov eax, esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x698]
push str._s___s_
push eax
call edi
add esp, 0x10
cmp byte [esp + 0xb90], bl
je 0x4059e2
push esi
push str._TRANSFORMS__s_
lea eax, [esp + 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x698]
push eax
call edi
add esp, 0xc
call fcn.00402a98
cmp dword [0x408b80], ebx
jne 0x405beb
cmp byte [esp + 0x690], bl
je 0x405beb
push 0x100
push esi
push dword [0x408810]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push str._WISE_SETUP_EXE_PATH__s_
lea eax, [esp + 0x698]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + eax + 0x698]
push eax
call edi
add esp, 0xc
cmp dword [esp + 0x58], ebx
je 0x405ae5
cmp byte [0x408bcc], bl
jne 0x405ae5
lea eax, [esp + 0x690]
push eax
push str.MSIEXEC
push str._s__s
push esi
call edi
lea eax, [esp + 0x88]
push esi
push eax
call fcn.00402e3d
add esp, 0x18
lea eax, [esp + 0x34]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405acd
lea eax, [esp + 0xfc]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x104]
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x110], 1
mov dword [esp + 0x11c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [0x408b80], 1
jmp 0x405beb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.MSIEXEC
lea eax, [esp + 0x410]
push eax
call esi
cmp dword [esp + 0x58], ebx
je 0x405bb6
cmp byte [0x408bcc], bl
je 0x405bb6
lea eax, [esp + 0x4c]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405ba3
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x5c]
push eax
push ebx
push str.InstallerLocation
push dword [esp + 0x60]
mov dword [esp + 0x4c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405b99
cmp byte [esp + 0x308], bl
je 0x405b99
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x308]
push eax
lea eax, [esp + 0x410]
push eax
call esi
push str.MSIEXEC.EXE
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._WISEDELAYEDREBOOT1
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x78]
push eax
push 1
lea eax, [esp + 0x698]
push eax
lea eax, [esp + 0x418]
push eax
call fcn.004030e7
add esp, 0x10
jmp 0x405beb
cmp dword [0x408b80], ebx
jne 0x405beb
call fcn.00402ad5
push ebx
call fcn.004029ce
pop ecx
call fcn.00402ad5
call fcn.0040290e
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x408808]
cmp eax, ebx
je 0x405c11
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]