Function at 0x417250
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4335a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x448090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.MsiInstallStart
call fcn.00402990
mov eax, dword [0x448020]
add esp, 4
mov ecx, 0x448020
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov eax, dword [0x44add0]
cmp dword [eax - 0xc], 0
je 0x417343
push 0x10
push str.INSTALLLOCATION
lea ecx, [ebp - 0x10]
call fcn.00402440
mov ecx, 0x44add0
call fcn.00418080
mov ecx, eax
call fcn.00418100
mov eax, dword [0x44add0]
cmp dword [eax - 0xc], 0
jle 0x417337
push 0x20
push eax
call fcn.00421055
mov ecx, eax
mov eax, dword [0x44add0]
add esp, 8
test ecx, ecx
je 0x417337
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x417337
cmp dword [eax - 0xc], 0
jge 0x41730a
push 0x80070057
call fcn.00402950
cmp word [eax], 0x22
je 0x417337
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00408ab0
mov eax, dword [0x44add0]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004032b0
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00408ab0
jmp 0x417343
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.004032b0
cmp dword [0x44ad58], 0
je 0x41735b
push 0xa
push str._NOSTART1
lea ecx, [ebp - 0x10]
call fcn.004032b0
cmp dword [0x449418], 0
jne 0x417373
push 9
push str._NODESK1
lea ecx, [ebp - 0x10]
call fcn.004032b0
push 0x16
push str._REBOOTReallySuppress
lea ecx, [ebp - 0x10]
call fcn.004032b0
mov eax, dword [0x448020]
mov ecx, 0x448020
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004041e0
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
push str.Antivirus:__u____s.
push 1
push 3
push 0x79
push str.CInstActionPCKeeper::Install
push str.d:_bioticdev_zeoinsight_pckeeperinstallerActionsInstActionPCKeeper.h
call fcn.0041e2e0
push eax
call fcn.0041e500
mov edi, dword [esi - 0xc]
add esp, 0x18
test edi, edi
jns 0x4173e2
push 0x80070057
call fcn.00402950
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4173ff
push edi
lea ecx, [ebp - 0x14]
call fcn.004026b0
mov esi, dword [ebp - 0x14]
lea eax, [edi + 1]
push eax
push esi
call fcn.0042100e
add esp, 8
cmp edi, dword [esi - 8]
jg 0x417300
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov edi, dword [ebp - 0x18]
cmp edi, 1
jne 0x41746e
cmp dword [esi - 0xc], eax
jl 0x41746e
push str.WINDOWS_DEFENDER
push esi
call fcn.004202a7
add esp, 8
test eax, eax
je 0x41746e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x41746e
push str.Ignoring_presence_of_registered_PCKeeper_AV.
push 1
push 3
push 0x7e
push str.CInstActionPCKeeper::Install
push str.d:_bioticdev_zeoinsight_pckeeperinstallerActionsInstActionPCKeeper.h
lea ecx, [ebp - 0x24]
xor edi, edi
call fcn.0041e2e0
push eax
call fcn.0041e500
add esp, 0x10
mov eax, dword [0x44ae20]
test al, 1
jne 0x417496
or eax, 1
mov dword [0x44ae20], eax
call fcn.004014a0
push 0x434070
call fcn.00420047
mov eax, dword [0x44ae20]
add esp, 4
movzx ecx, byte [0x44ae36]
mov dword [ebp - 0x18], ecx
test al, 1
jne 0x4174be
or eax, 1
mov dword [0x44ae20], eax
call fcn.004014a0
push 0x434070
call fcn.00420047
add esp, 4
push dword [0x44ae30]
lea ecx, [ebp - 0x24]
push str.CAffid::GetInstance__.GetTrtPolicyInfo__.Trt___d
push 1
push 3
push 0x83
push str.CInstActionPCKeeper::Install
push str.d:_bioticdev_zeoinsight_pckeeperinstallerActionsInstActionPCKeeper.h
call fcn.0041e2e0
push eax
call fcn.0041e500
add esp, 0x14
lea ecx, [ebp - 0x24]
push dword [ebp - 0x18]
push str.isAVAllowed___d
push 1
push 3
push 0x84
push str.CInstActionPCKeeper::Install
push str.d:_bioticdev_zeoinsight_pckeeperinstallerActionsInstActionPCKeeper.h
call fcn.0041e2e0
push eax
call fcn.0041e500
add esp, 0x14
cmp dword [ebx + 0xbc], 0
jne 0x41752b
test edi, edi
jne 0x41753a
cmp dword [ebp - 0x18], edi
je 0x41753a
push 5
push str._AV1
lea ecx, [ebp - 0x10]
call fcn.004032b0
mov edi, dword [ebp - 0x10]
push ecx
push edi
push dword [ebx + 0x70]
lea eax, [ebx + 0x78]
push eax
lea ecx, [ebx + 0x7c]
call fcn.00414c70
test eax, eax
jne 0x41759a
push str.InstallFailed
call fcn.00402990
add esp, 4
lea ecx, [ebp - 0x24]
push str.Install_error.
push 3
push 3
push 0x8e
push str.CInstActionPCKeeper::Install
push str.d:_bioticdev_zeoinsight_pckeeperinstallerActionsInstActionPCKeeper.h
call fcn.0041e2e0
push eax
call fcn.0041e500
add esp, 0x10
call fcn.004146a0
push dword [ebx + 0x70]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
jmp 0x4175a6
mov ecx, ebx
call fcn.00417050
mov ebx, 1
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4175c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4175e4
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret