Function at 0x403c70
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Create directory
Delete file
Delete registry key
Get common file path
Get file attributes
Get installed programs
Persist via lnk shortcut
Resolve function by parsing pe exports
Set file attributes
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x42dd19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xde8
push ebx
push ebp
push esi
push edi
push str.DATA_PATH
lea eax, [esp + 0x4c]
push str.INSTALL
mov ebp, ecx
push eax
call fcn.00402890
lea esi, [ebp + 0x9bc]
lea ecx, [esp + 0x10]
push esi
mov dword [esp + 0xe04], 0
call fcn.0041e2a3
mov ecx, dword [esp + 0x10]
mov byte [esp + 0xe00], 1
mov edi, dword [ecx - 8]
lea ecx, [esp + 0x10]
lea edx, [edi + 1]
push edx
call fcn.0041e912
push eax
mov ecx, ebp
call fcn.004069a0
cmp eax, 1
jne 0x403d75
push eax
push 0x5c
lea ecx, [esp + 0x60]
call fcn.0041b612
lea eax, [esp + 0x44]
push 1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xe08], 2
call fcn.0041b6ff
mov ecx, dword [esp + 0x58]
mov eax, dword [eax]
push ecx
push eax
call fcn.0040d7a5
add esp, 8
lea ecx, [esp + 0x44]
test eax, eax
sete bl
call fcn.0041e52e
lea ecx, [esp + 0x58]
mov byte [esp + 0xe00], 1
call fcn.0041e52e
test bl, bl
je 0x403d75
dec edi
lea edx, [esp + 0x44]
push edi
push edx
mov ecx, esi
call fcn.0041b77b
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xe04], 3
call fcn.0041e61b
lea ecx, [esp + 0x44]
mov byte [esp + 0xe00], 1
call fcn.0041e52e
push str.DATA_PATH2
lea eax, [esp + 0x38]
push str.INSTALL
push eax
mov ecx, ebp
call fcn.00402890
mov eax, dword [0x43ab24]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x34]
push 0x43c424
push ecx
mov byte [esp + 0xe08], 6
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x403e2d
lea edx, [esp + 0x34]
lea eax, [esp + 0x5c]
push edx
push 0x43a150
push eax
call fcn.0041e7eb
push 0x43a10c
lea ecx, [esp + 0x48]
mov bl, 7
push eax
push ecx
mov byte [esp + 0xe0c], bl
call fcn.0041e777
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xe04], 8
call fcn.0041e61b
lea ecx, [esp + 0x44]
mov byte [esp + 0xe00], bl
call fcn.0041e52e
lea ecx, [esp + 0x5c]
mov byte [esp + 0xe00], 6
call fcn.0041e52e
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x18]
push edx
call fcn.0041e61b
lea ecx, [esp + 0x18]
call fcn.0041ea04
push str.DATA_PATH3
lea eax, [esp + 0x3c]
push str.INSTALL
push eax
mov ecx, ebp
call fcn.00402890
mov eax, dword [0x43ab24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x38]
push 0x43c424
push ecx
mov byte [esp + 0xe08], 0xb
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x403ee5
lea edx, [esp + 0x38]
lea eax, [esp + 0x5c]
push edx
push 0x43a150
push eax
call fcn.0041e7eb
push 0x43a10c
lea ecx, [esp + 0x48]
mov bl, 0xc
push eax
push ecx
mov byte [esp + 0xe0c], bl
call fcn.0041e777
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0xe04], 0xd
call fcn.0041e61b
lea ecx, [esp + 0x44]
mov byte [esp + 0xe00], bl
call fcn.0041e52e
lea ecx, [esp + 0x5c]
mov byte [esp + 0xe00], 0xb
call fcn.0041e52e
lea edx, [esp + 0x30]
lea ecx, [esp + 0x14]
push edx
call fcn.0041e61b
lea ecx, [esp + 0x14]
call fcn.0041ea04
push str.DATA_PATH4
lea eax, [esp + 0x44]
push str.INSTALL
push eax
mov ecx, ebp
call fcn.00402890
mov eax, dword [0x43ab24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x40]
push 0x43c424
push ecx
mov byte [esp + 0xe08], 0x10
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x403f9d
lea edx, [esp + 0x40]
lea eax, [esp + 0x5c]
push edx
push 0x43a150
push eax
call fcn.0041e7eb
push 0x43a10c
lea ecx, [esp + 0x48]
mov bl, 0x11
push eax
push ecx
mov byte [esp + 0xe0c], bl
call fcn.0041e777
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xe04], 0x12
call fcn.0041e61b
lea ecx, [esp + 0x44]
mov byte [esp + 0xe00], bl
call fcn.0041e52e
lea ecx, [esp + 0x5c]
mov byte [esp + 0xe00], 0x10
call fcn.0041e52e
lea edx, [esp + 0x28]
lea ecx, [esp + 0x20]
push edx
call fcn.0041e61b
lea ecx, [esp + 0x20]
call fcn.0041ea04
push str.DATA_PATH5
lea eax, [esp + 0x40]
push str.INSTALL
push eax
mov ecx, ebp
call fcn.00402890
mov eax, dword [0x43ab24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x3c]
push 0x43c424
push ecx
mov byte [esp + 0xe08], 0x15
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x404055
lea edx, [esp + 0x3c]
lea eax, [esp + 0x5c]
push edx
push 0x43a150
push eax
call fcn.0041e7eb
push 0x43a10c
lea ecx, [esp + 0x48]
mov bl, 0x16
push eax
push ecx
mov byte [esp + 0xe0c], bl
call fcn.0041e777
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe04], 0x17
call fcn.0041e61b
lea ecx, [esp + 0x44]
mov byte [esp + 0xe00], bl
call fcn.0041e52e
lea ecx, [esp + 0x5c]
mov byte [esp + 0xe00], 0x15
call fcn.0041e52e
lea edx, [esp + 0x24]
lea ecx, [esp + 0x1c]
push edx
call fcn.0041e61b
lea ecx, [esp + 0x1c]
call fcn.0041ea04
lea ecx, [esp + 0xb8]
lea ebx, [ebp + 0xa04]
call fcn.0041c224
push 0xffffffffffffffff
push 0xa
lea ecx, [esp + 0xc0]
mov byte [esp + 0xe08], 0x18
call fcn.0041c2b7
call fcn.0042ba6e
mov eax, dword [eax + 4]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, eax
call fcn.004015e0
test eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x74], 0
jle 0x40418c
mov edi, str._f_:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._f_:
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x74]
not ecx
dec ecx
push eax
add ebx, ecx
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0xc0]
call fcn.00401720
mov edi, dword [eax]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
call fcn.0041e52e
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x5c]
push eax
push ecx
lea ecx, [esp + 0xc0]
call fcn.00401720
mov edi, dword [eax]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebx, ecx
lea ecx, [esp + 0x5c]
call fcn.0041e52e
mov edi, 0x43a488
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43a488
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x74]
not ecx
dec ecx
add ebx, ecx
mov ecx, dword [esp + 0x58]
inc eax
mov dword [esp + 0x74], eax
cmp eax, ecx
jl 0x4040aa
mov eax, dword [ebp + 0xa00]
mov edi, dword [ebp + 0xcd54]
mov esi, 1
mov dword [esp + 0x58], edi
cmp eax, esi
jne 0x4041af
add edi, dword [ebp + 0x14e5c]
mov dword [esp + 0x58], edi
fild dword [esp + 0x58]
fmul qword [0x430878]
call fcn.0040e0b8
cmp edi, eax
mov dword [ebp + 0x14e60], eax
jne 0x4041cf
inc eax
mov dword [ebp + 0x14e60], eax
call fcn.0042ba6e
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x1c]
call fcn.00429706
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0xcd54]
test eax, eax
mov dword [esp + 0x74], 0
jle 0x40478e
lea eax, [ebp + 0xcd58]
mov dword [esp + 0x58], 0x64
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x88]
call fcn.0040a390
cmp eax, 1
je 0x4047b5
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x48]
cdq
idiv dword [ebp + 0x14e60]
push ecx
lea edx, [esp + 0xd4]
push 0x43a150
push edx
mov dword [ebp + 0x14a58], eax
call fcn.0041e7eb
push 0x43a10c
push eax
lea eax, [esp + 0x74]
mov byte [esp + 0xe08], 0x19
push eax
call fcn.0041e777
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe00], 0x1b
call fcn.0041e52e
mov ecx, dword [esp + 0x50]
push ecx
lea ecx, [esp + 0x58]
call fcn.0041e2a3
lea ecx, [esp + 0x54]
mov byte [esp + 0xe00], 0x1c
call fcn.0041ea04
lea edx, [esp + 0x6c]
lea ecx, [esp + 0x64]
push edx
call fcn.0041e2a3
lea ecx, [esp + 0x64]
mov byte [esp + 0xe00], 0x1d
call fcn.0041ea04
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x54]
push eax
call fcn.0041b7f3
mov ecx, dword [esp + 0x18]
push 0x43c424
push ecx
mov esi, eax
or edi, 0xffffffff
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x4042ee
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x54]
push edx
call fcn.0041b7f3
mov edi, eax
mov eax, dword [esp + 0x14]
push 0x43c424
push eax
mov dword [esp + 0xa0], 0xffffffff
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x404324
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x58]
call fcn.0041b7f3
mov dword [esp + 0x98], eax
mov edx, dword [esp + 0x20]
push 0x43c424
push edx
mov dword [esp + 0x64], 0xffffffff
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x404354
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x54]
push eax
call fcn.0041b7f3
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x1c]
push 0x43c424
push ecx
mov dword [esp + 0x4c], 0xffffffff
call fcn.0040d7a5
add esp, 8
test eax, eax
je 0x404384
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x54]
push edx
call fcn.0041b7f3
mov dword [esp + 0x44], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x4c]
push eax
call fcn.0041e2a3
test esi, esi
mov byte [esp + 0xe00], 0x1e
jne 0x4043a7
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx - 8]
jmp 0x4043e9
test edi, edi
jne 0x4043b1
mov edx, dword [esp + 0x2c]
jmp 0x4043e6
mov eax, dword [esp + 0x98]
test eax, eax
jne 0x4043c5
mov eax, dword [esp + 0x30]
mov eax, dword [eax - 8]
jmp 0x4043e9
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x4043d6
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 8]
jmp 0x4043e9
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x40447a
mov edx, dword [esp + 0x24]
mov eax, dword [edx - 8]
mov edi, dword [esp + 0x50]
lea esi, [eax - 1]
lea eax, [esp + 0xd8]
push esi
push eax
mov ecx, edi
call fcn.0041b646
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0xe04], 0x1f
call fcn.0041e8fa
lea ecx, [esp + 0xd8]
mov byte [esp + 0xe00], 0x1e
call fcn.0041e52e
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [ebp + 0x54]
call fcn.0041e61b
inc esi
lea edx, [esp + 0xd4]
push esi
push edx
mov ecx, edi
call fcn.0041b646
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2ec]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xd4]
call fcn.0041e52e
jmp 0x4044ea
mov esi, dword [esp + 0x50]
lea ecx, [esp + 0x8c]
push esi
push 0x43a10c
push ecx
call fcn.0041e7eb
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0xe04], 0x20
call fcn.0041e8fa
lea ecx, [esp + 0x8c]
mov byte [esp + 0xe00], 0x1e
call fcn.0041e52e
lea edx, [esp + 0x4c]
lea ecx, [ebp + 0x54]
push edx
call fcn.0041e61b
mov edi, dword [esi]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2ec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push 0
push 0
mov ecx, ebp
call fcn.0042544e
mov esi, dword [esp + 0x88]
mov ecx, esi
call fcn.0040a390
cmp eax, 1
je 0x4047dd
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
push ecx
test byte [edi + 4], 0x10
je 0x404602
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404551
mov ecx, esi
call fcn.0040a390
cmp eax, 1
je 0x4048cc
mov edx, dword [esp + 0x4c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x404844
or ecx, 0xffffffff
mov edi, str._d_:
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._d_:
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x2ec]
add ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2ec]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x43a488
add ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43a488
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebx, ecx
mov ecx, dword [esp + 0x88]
call fcn.0040a390
cmp eax, 1
je 0x4048cc
jmp 0x404718
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404627
test al, 1
je 0x404627
mov edx, dword [esp + 0x4c]
and al, 0xfe
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x404862
mov ecx, esi
call fcn.0040a390
cmp eax, 1
je 0x4048cc
mov ecx, dword [esp + 0x4c]
mov eax, dword [edi]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404883
lea edi, [esp + 0x2ec]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2ec]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x43a488
add ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x43a488
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x154a8]
not ecx
dec ecx
add ebx, ecx
test eax, eax
je 0x404703
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x94], esp
push edx
call fcn.0041e2a3
mov eax, dword [esp + 0x54]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
mov byte [esp + 0xe0c], 0x21
call fcn.0041e2a3
mov ecx, ebp
mov byte [esp + 0xe08], 0x1e
call fcn.00409350
test eax, eax
je 0x4048bb
mov ecx, dword [esp + 0x88]
call fcn.0040a390
cmp eax, 1
je 0x4048cc
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe00], 0x1d
call fcn.0041e52e
lea ecx, [esp + 0x64]
mov byte [esp + 0xe00], 0x1c
call fcn.0041e52e
lea ecx, [esp + 0x54]
mov byte [esp + 0xe00], 0x1b
call fcn.0041e52e
lea ecx, [esp + 0x6c]
mov byte [esp + 0xe00], 0x18
call fcn.0041e52e
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x58]
mov edx, dword [esp + 0x50]
mov ecx, dword [ebp + 0xcd54]
inc eax
add esi, 0x64
add edx, 0x10
cmp eax, ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x58], esi
mov dword [esp + 0x50], edx
jl 0x40420e
mov esi, 1
cmp dword [ebp + 0xa00], esi
jne 0x4048e5
mov ecx, ebp
call fcn.00407b90
test eax, eax
jne 0x4048e5
mov ecx, ebp
call fcn.004060d0
jmp 0x405229
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x4047cc
mov ecx, ebp
call fcn.00407af0
push 0x2130
mov ecx, ebp
call fcn.00406500
jmp 0x405229
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x4047f4
mov ecx, ebp
call fcn.00407af0
push 0x2130
mov ecx, ebp
call fcn.00406500
lea ecx, [esp + 0x4c]
mov byte [esp + 0xe00], 0x1d
call fcn.0041e52e
lea ecx, [esp + 0x64]
mov byte [esp + 0xe00], 0x1c
call fcn.0041e52e
lea ecx, [esp + 0x54]
mov byte [esp + 0xe00], 0x1b
call fcn.0041e52e
mov byte [esp + 0xe00], 0x18
lea ecx, [esp + 0x6c]
jmp 0x405224
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x40485b
mov ecx, ebp
call fcn.00407af0
push 0x2100
jmp 0x4047f9
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x4048c2
mov ecx, ebp
call fcn.00407af0
push 0x2ff0
jmp 0x4047f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebp
mov esi, eax
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x4048a2
mov ecx, ebp
call fcn.00407af0
cmp esi, 0xd
jne 0x4048b1
push 0x2120
jmp 0x4047f9
push 0x2110
jmp 0x4047f9
mov ecx, ebp
call fcn.004060d0
push 0x2ff0
jmp 0x4047f9
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x4047f4
jmp 0x4047ed
mov ecx, ebp
call fcn.00405dd0
lea edx, [ebp + 0xa04]
mov ebx, eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x404917
mov eax, edx
mov edx, 0xfffff5fc
sub edx, ebp
inc byte [eax]
inc eax
lea edi, [edx + eax]
cmp edi, ecx
jl 0x40490d
test ebx, ebx
jne 0x40493a
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], esi
jne 0x405229
mov ecx, ebp
call fcn.00408d80
jmp 0x405229
cmp dword [ebp + 0xa00], esi
jne 0x404981
mov eax, dword [ebp + 0x9e0]
test eax, eax
je 0x404957
mov ecx, ebp
call fcn.00408680
test eax, eax
je 0x404962
mov ecx, ebp
call fcn.00408b10
test eax, eax
jne 0x404981
mov ecx, ebp
call fcn.004060d0
mov ecx, ebp
call fcn.00408d80
push 0x2ff0
mov ecx, ebp
call fcn.00406500
jmp 0x405229
call fcn.0042ba6e
mov eax, dword [eax + 4]
mov dword [esp + 0x8c], eax
mov ecx, dword [eax + 0xc0]
test ecx, ecx
je 0x4049a6
lea ecx, [esp + 0xb4]
push ecx
push 0x17
jmp 0x4049b0
lea edx, [esp + 0xb4]
push edx
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 0xb4]
lea eax, [esp + 0xe4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push str.PRODUCT_KEY_FILE1
lea edx, [esp + 0x84]
push str.INSTALL
push edx
mov ecx, ebp
call fcn.00402890
mov edi, dword [ebp + 0x9bc]
lea ebx, [ebp + 0x9bc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x3f0]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x3f0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push str.PROGRAM_FOLDER_NAME
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x84]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.INSTALL
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x8c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
mov byte [esp + 0xe0c], 0x22
call fcn.00402890
push str.SHORTCUT_NAME
lea ecx, [esp + 0x80]
push str.INSTALL
push ecx
mov ecx, ebp
mov byte [esp + 0xe0c], 0x23
call fcn.00402890
mov edi, 0x43a10c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xe4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xe00], 0x24
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xe4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x84]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xe4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
call fcn.0041e59c
lea ecx, [esp + 0xe4]
mov byte [esp + 0xe00], 0x25
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404b26
test al, 0x10
jne 0x404b62
lea edx, [esp + 0xe4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x404b62
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], 1
jne 0x404b51
mov ecx, ebp
call fcn.00408d80
push 0x2ff0
mov ecx, ebp
call fcn.00406500
jmp 0x4051df
or ecx, 0xffffffff
mov edi, 0x43a10c
xor eax, eax
lea edx, [esp + 0xe4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.ICON_NAME
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xe8]
and ecx, 3
push str.INSTALL
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x84]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xec]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..lnk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x9c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00402890
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xe00], 0x26
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x4f4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x94]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x4f4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xe8]
push 0x43a43c
lea edx, [esp + 0x3f8]
push ecx
push edx
mov ecx, ebp
call fcn.00403580
test eax, eax
jne 0x404cd8
mov ecx, ebp
call fcn.004060d0
push ecx
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.0041e2a3
lea ecx, [esp + 0xe8]
push ecx
mov ecx, ebp
call fcn.00406400
cmp dword [ebp + 0xa00], 1
jne 0x4051cb
mov ecx, ebp
call fcn.00408d80
jmp 0x4051cb
push str.FLAG_DESKTOP_ICON
lea edx, [esp + 0x74]
push str.INSTALL
push edx
mov ecx, ebp
call fcn.00402890
mov eax, dword [esp + 0x70]
push str.TRUE
push eax
mov byte [esp + 0xe08], 0x27
call fcn.0040ded2
add esp, 8
test eax, eax
jne 0x404e5c
mov ecx, 0x41
lea edi, [esp + 0x1e8]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x8c]
mov eax, dword [ecx + 0xc0]
test eax, eax
je 0x404d3b
lea edx, [esp + 0xb4]
push edx
push 0x19
jmp 0x404d45
lea eax, [esp + 0xb4]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0xb4]
lea ecx, [esp + 0x1e8]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
or ecx, 0xffffffff
mov edi, 0x43a10c
xor eax, eax
lea edx, [esp + 0x1e8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1e8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x7c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1e8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..lnk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x4f4]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1ec]
push 0x43a43c
lea edx, [esp + 0x3f8]
push ecx
push edx
mov ecx, ebp
call fcn.00403580
test eax, eax
jne 0x404e5c
mov ecx, ebp
call fcn.004060d0
push ecx
lea eax, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x94], esp
push eax
call fcn.0041e2a3
lea ecx, [esp + 0xe8]
push ecx
mov ecx, ebp
call fcn.00406400
cmp dword [ebp + 0xa00], 1
jne 0x4051ba
mov ecx, ebp
call fcn.00408d80
jmp 0x4051ba
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [esp + 0x6c]
call fcn.0041e59c
push str.UNINSTALL_KEY
lea edx, [esp + 0xac]
push str.UNINSTALL
push edx
mov ecx, ebp
mov byte [esp + 0xe0c], 0x28
call fcn.00402890
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x68]
push eax
mov byte [esp + 0xe04], 0x29
call fcn.0041e8fa
push str.UNINSTALL_NAME
lea ecx, [esp + 0xa0]
push str.INSTALL
push ecx
mov ecx, ebp
call fcn.00402890
push str.UNINSTALL_FILE
lea edx, [esp + 0xb4]
push str.UNINSTALL
push edx
mov ecx, ebp
mov byte [esp + 0xe0c], 0x2a
call fcn.00402890
lea eax, [esp + 0xb0]
lea ecx, [esp + 0x78]
push eax
push ebx
push ecx
mov byte [esp + 0xe0c], 0x2b
call fcn.0041e711
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0xe0]
lea eax, [esp + 0xa4]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push 0x80000002
mov byte [esp + 0xe24], 0x2c
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x404f92
mov ecx, ebp
call fcn.004060d0
push ecx
lea edx, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x94], esp
push edx
call fcn.0041e2a3
lea eax, [esp + 0xe8]
mov ecx, ebp
push eax
call fcn.00406400
mov ecx, dword [esp + 0x70]
push str.TRUE
push ecx
call fcn.0040ded2
add esp, 8
test eax, eax
jne 0x404f80
lea edx, [esp + 0x1e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xa00], 1
jne 0x405150
jmp 0x405149
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0x9c]
mov eax, dword [eax - 8]
inc eax
push eax
call fcn.0041e912
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xa4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x5f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x5fc]
push ecx
push 1
push eax
push str.DisplayName
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405073
mov ecx, ebp
call fcn.004060d0
mov eax, dword [esp + 0x68]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ecx
lea edx, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x94], esp
push edx
call fcn.0041e2a3
lea eax, [esp + 0xe8]
mov ecx, ebp
push eax
call fcn.00406400
mov ecx, dword [esp + 0x70]
push str.TRUE
push ecx
call fcn.0040ded2
add esp, 8
test eax, eax
jne 0x405061
lea edx, [esp + 0x1e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xa00], 1
jne 0x405150
jmp 0x405149
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x78]
mov eax, dword [eax - 8]
inc eax
push eax
call fcn.0041e912
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xa4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x5f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x5fc]
push ecx
push 1
push eax
push str.UninstallString
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405335
mov ecx, ebp
call fcn.004060d0
mov eax, dword [esp + 0x68]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ecx
lea edx, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x94], esp
push edx
call fcn.0041e2a3
lea eax, [esp + 0xe8]
mov ecx, ebp
push eax
call fcn.00406400
mov ecx, dword [esp + 0x70]
push str.TRUE
push ecx
call fcn.0040ded2
add esp, 8
test eax, eax
jne 0x405140
lea edx, [esp + 0x1e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xa00], 1
jne 0x405150
mov ecx, ebp
call fcn.00408d80
push 0x2ff0
mov ecx, ebp
call fcn.00406500
lea ecx, [esp + 0x78]
mov byte [esp + 0xe00], 0x2b
call fcn.0041e52e
lea ecx, [esp + 0xb0]
mov byte [esp + 0xe00], 0x2a
call fcn.0041e52e
lea ecx, [esp + 0x9c]
mov byte [esp + 0xe00], 0x29
call fcn.0041e52e
lea ecx, [esp + 0xa8]
mov byte [esp + 0xe00], 0x28
call fcn.0041e52e
lea ecx, [esp + 0x68]
mov byte [esp + 0xe00], 0x27
call fcn.0041e52e
lea ecx, [esp + 0x70]
mov byte [esp + 0xe00], 0x26
call fcn.0041e52e
lea ecx, [esp + 0x94]
mov byte [esp + 0xe00], 0x25
call fcn.0041e52e
lea ecx, [esp + 0x60]
mov byte [esp + 0xe00], 0x24
call fcn.0041e52e
lea ecx, [esp + 0x7c]
mov byte [esp + 0xe00], 0x23
call fcn.0041e52e
lea ecx, [esp + 0x84]
mov byte [esp + 0xe00], 0x22
call fcn.0041e52e
mov byte [esp + 0xe00], 0x18
lea ecx, [esp + 0x80]
call fcn.0041e52e
lea ecx, [esp + 0xb8]
mov byte [esp + 0xe00], 0x15
call fcn.0041c257
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe00], 0x14
call fcn.0041e52e
lea ecx, [esp + 0x24]
mov byte [esp + 0xe00], 0x13
call fcn.0041e52e
lea ecx, [esp + 0x3c]
mov byte [esp + 0xe00], 0x10
call fcn.0041e52e
lea ecx, [esp + 0x20]
mov byte [esp + 0xe00], 0xf
call fcn.0041e52e
lea ecx, [esp + 0x28]
mov byte [esp + 0xe00], 0xe
call fcn.0041e52e
lea ecx, [esp + 0x40]
mov byte [esp + 0xe00], 0xb
call fcn.0041e52e
lea ecx, [esp + 0x14]
mov byte [esp + 0xe00], 0xa
call fcn.0041e52e
lea ecx, [esp + 0x30]
mov byte [esp + 0xe00], 9
call fcn.0041e52e
lea ecx, [esp + 0x38]
mov byte [esp + 0xe00], 6
call fcn.0041e52e
lea ecx, [esp + 0x18]
mov byte [esp + 0xe00], 5
call fcn.0041e52e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xe00], 4
call fcn.0041e52e
lea ecx, [esp + 0x34]
mov byte [esp + 0xe00], 1
call fcn.0041e52e
lea ecx, [esp + 0x10]
mov byte [esp + 0xe00], 0
call fcn.0041e52e
lea ecx, [esp + 0x48]
mov dword [esp + 0xe00], 0xffffffff
call fcn.0041e52e
xor eax, eax
jmp 0x405d51
mov eax, dword [ebx]
mov ecx, dword [0x43ab24]
mov esi, dword [eax - 8]
mov dword [esp + 0xac], ecx
mov eax, dword [eax - 8]
mov ecx, ebx
inc eax
mov byte [esp + 0xe00], 0x2d
push eax
call fcn.0041e912
push eax
mov ecx, ebp
call fcn.004069a0
cmp eax, 1
jne 0x40540f
push eax
push 0x5c
lea ecx, [esp + 0x4c]
call fcn.0041b612
lea edx, [esp + 0x8c]
push 1
push edx
mov ecx, ebx
mov byte [esp + 0xe08], 0x2e
call fcn.0041b6ff
mov ecx, dword [esp + 0x44]
mov eax, dword [eax]
push ecx
push eax
call fcn.0040d7a5
add esp, 8
lea ecx, [esp + 0x8c]
test eax, eax
sete byte [esp + 0xa3]
call fcn.0041e52e
lea ecx, [esp + 0x44]
mov byte [esp + 0xe00], 0x2d
call fcn.0041e52e
mov al, byte [esp + 0xa3]
test al, al
je 0x40541c
dec esi
lea edx, [esp + 0x8c]
push esi
push edx
mov ecx, ebx
call fcn.0041b77b
push eax
lea ecx, [esp + 0xb0]
mov byte [esp + 0xe04], 0x2f
call fcn.0041e61b
lea ecx, [esp + 0x8c]
mov byte [esp + 0xe00], 0x2d
call fcn.0041e52e
jmp 0x40541c
push ebx
lea ecx, [esp + 0xb0]
call fcn.0041e61b
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xac]
mov eax, dword [eax - 8]
inc eax
push eax
call fcn.0041e912
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xa4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x5f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
lea ecx, [esp + 0x5fc]
push ecx
push ebx
push eax
push str.UninstallFolder
push edx
call esi
test eax, eax
je 0x4056fd
mov ecx, ebp
call fcn.004060d0
cmp dword [ebp + 0xa00], ebx
jne 0x4054ad
mov ecx, ebp
call fcn.00408d80
mov eax, dword [esp + 0x68]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ecx
lea edx, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x94], esp
push edx
call fcn.0041e2a3
lea eax, [esp + 0xe8]
mov ecx, ebp
push eax
call fcn.00406400
mov ecx, dword [esp + 0x70]
push str.TRUE
push ecx
call fcn.0040ded2
add esp, 8
test eax, eax
jne 0x405504
lea edx, [esp + 0x1e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x2ff0
mov ecx, ebp
call fcn.00406500
lea ecx, [esp + 0xac]
mov byte [esp + 0xe00], 0x2c
call fcn.0041e52e
lea ecx, [esp + 0x78]
mov byte [esp + 0xe00], 0x2b
call fcn.0041e52e
lea ecx, [esp + 0xb0]
mov byte [esp + 0xe00], 0x2a
call fcn.0041e52e
lea ecx, [esp + 0x9c]
mov byte [esp + 0xe00], 0x29
call fcn.0041e52e
lea ecx, [esp + 0xa8]
mov byte [esp + 0xe00], 0x28
call fcn.0041e52e
lea ecx, [esp + 0x68]
mov byte [esp + 0xe00], 0x27
call fcn.0041e52e
lea ecx, [esp + 0x70]
mov byte [esp + 0xe00], 0x26
call fcn.0041e52e
lea ecx, [esp + 0x94]
mov byte [esp + 0xe00], 0x25
call fcn.0041e52e
lea ecx, [esp + 0x60]
mov byte [esp + 0xe00], 0x24
call fcn.0041e52e
lea ecx, [esp + 0x7c]
mov byte [esp + 0xe00], 0x23
call fcn.0041e52e
lea ecx, [esp + 0x84]
mov byte [esp + 0xe00], 0x22
call fcn.0041e52e
lea ecx, [esp + 0x80]
mov byte [esp + 0xe00], 0x18
call fcn.0041e52e
lea ecx, [esp + 0xb8]
mov byte [esp + 0xe00], 0x15
call fcn.0041c257
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe00], 0x14
call fcn.0041e52e
lea ecx, [esp + 0x24]
mov byte [esp + 0xe00], 0x13
call fcn.0041e52e
lea ecx, [esp + 0x3c]
mov byte [esp + 0xe00], 0x10
call fcn.0041e52e
lea ecx, [esp + 0x20]
mov byte [esp + 0xe00], 0xf
call fcn.0041e52e
lea ecx, [esp + 0x28]
mov byte [esp + 0xe00], 0xe
call fcn.0041e52e
lea ecx, [esp + 0x40]
mov byte [esp + 0xe00], 0xb
call fcn.0041e52e
lea ecx, [esp + 0x14]
mov byte [esp + 0xe00], 0xa
call fcn.0041e52e
lea ecx, [esp + 0x30]
mov byte [esp + 0xe00], 9
call fcn.0041e52e
lea ecx, [esp + 0x38]
mov byte [esp + 0xe00], 6
call fcn.0041e52e
lea ecx, [esp + 0x18]
mov byte [esp + 0xe00], 5
call fcn.0041e52e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xe00], 4
call fcn.0041e52e
lea ecx, [esp + 0x34]
mov byte [esp + 0xe00], 1
call fcn.0041e52e
lea ecx, [esp + 0x10]
mov byte [esp + 0xe00], 0
call fcn.0041e52e
lea ecx, [esp + 0x48]
mov dword [esp + 0xe00], 0xffffffff
call fcn.0041e52e
xor eax, eax
jmp 0x405d51
lea edi, [esp + 0x5f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x5f8]
push ecx
mov ecx, dword [esp + 0xa8]
push eax
push ebx
push 0
push str.InstallLocation
push ecx
call esi
push str.COMPANY_NAME
lea edx, [esp + 0xe0]
push str.INSTALL
push edx
mov ecx, ebp
call fcn.00402890
push str.PRODUCT_NUM
lea eax, [esp + 0xd0]
push str.INSTALL
push eax
mov ecx, ebp
mov byte [esp + 0xe0c], 0x30
call fcn.00402890
mov ecx, dword [esp + 0xcc]
mov byte [esp + 0xe00], 0x31
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40577f
mov eax, 2
jmp 0x405795
push eax
lea ecx, [esp + 0xd0]
call fcn.0041e912
push eax
call fcn.0040dec7
add esp, 4
cmp eax, ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x74], ebx
jl 0x405b27
mov bl, 0x35
mov edx, dword [0x43ab24]
mov dword [esp + 0x50], edx
mov esi, dword [esp + 0x74]
lea eax, [esp + 0x50]
push esi
push str.PRODUCT_NAME_d
push eax
mov byte [esp + 0xe0c], 0x32
call fcn.0041bb34
mov ecx, dword [esp + 0x5c]
add esp, 0xc
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.0041e912
push eax
lea edx, [esp + 0x5c]
push str.INSTALL
push edx
mov ecx, ebp
call fcn.00402890
push esi
lea eax, [esp + 0x54]
push str.PRODUCT_LANGUAGE_d
push eax
mov byte [esp + 0xe0c], 0x33
call fcn.0041bb34
mov ecx, dword [esp + 0x5c]
add esp, 0xc
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.0041e912
push eax
lea edx, [esp + 0x9c]
push str.INSTALL
push edx
mov ecx, ebp
call fcn.00402890
push esi
lea eax, [esp + 0x54]
push str.PRODUCT_KEY_FILE_d
push eax
mov byte [esp + 0xe0c], 0x34
call fcn.0041bb34
mov ecx, dword [esp + 0x5c]
add esp, 0xc
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x50]
push eax
call fcn.0041e912
push eax
lea edx, [esp + 0x8c]
push str.INSTALL
push edx
mov ecx, ebp
call fcn.00402890
mov eax, dword [esp + 0x58]
mov byte [esp + 0xe00], bl
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x405acc
mov ecx, dword [esp + 0x98]
mov eax, dword [ecx - 8]
test eax, eax
je 0x405acc
mov edx, dword [esp + 0x88]
mov eax, dword [edx - 8]
test eax, eax
je 0x405acc
lea eax, [esp + 0xdc]
lea ecx, [esp + 0x5c]
push eax
push str.Software_
push ecx
call fcn.0041e7eb
push 0x43a10c
lea edx, [esp + 0xd4]
push eax
push edx
mov byte [esp + 0xe0c], 0x36
call fcn.0041e777
lea ecx, [esp + 0x58]
lea edx, [esp + 0xd8]
push ecx
push eax
push edx
mov byte [esp + 0xe0c], 0x37
call fcn.0041e711
push 0x43a10c
push eax
lea eax, [esp + 0xdc]
mov byte [esp + 0xe08], 0x38
push eax
call fcn.0041e777
lea ecx, [esp + 0x98]
lea edx, [esp + 0x8c]
push ecx
push eax
push edx
mov byte [esp + 0xe0c], 0x39
call fcn.0041e711
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0xe04], 0x3a
call fcn.0041e61b
lea ecx, [esp + 0x8c]
mov byte [esp + 0xe00], 0x39
call fcn.0041e52e
lea ecx, [esp + 0xd4]
mov byte [esp + 0xe00], 0x38
call fcn.0041e52e
lea ecx, [esp + 0xd8]
mov byte [esp + 0xe00], 0x37
call fcn.0041e52e
lea ecx, [esp + 0xd0]
mov byte [esp + 0xe00], 0x36
call fcn.0041e52e
lea ecx, [esp + 0x5c]
mov byte [esp + 0xe00], bl
call fcn.0041e52e
lea eax, [esp + 0x88]
lea ecx, [esp + 0x90]
push eax
lea eax, [ebp + 0x9bc]
push eax
push ecx
call fcn.0041e711
push eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0xe04], 0x3b
call fcn.0041e61b
lea ecx, [esp + 0x90]
mov byte [esp + 0xe00], bl
call fcn.0041e52e
lea edx, [esp + 0xe0]
mov ecx, dword [esp + 0x68]
lea eax, [esp + 0xa4]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x78]
mov eax, dword [edx - 8]
inc eax
push eax
call fcn.0041e912
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0xa4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x5f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x5fc]
push ecx
push 1
push eax
push str.KeyFile
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x88]
mov byte [esp + 0xe00], 0x34
call fcn.0041e52e
lea ecx, [esp + 0x98]
mov byte [esp + 0xe00], 0x33
call fcn.0041e52e
lea ecx, [esp + 0x58]
mov byte [esp + 0xe00], 0x32
call fcn.0041e52e
lea ecx, [esp + 0x50]
mov byte [esp + 0xe00], 0x31
call fcn.0041e52e
mov esi, dword [esp + 0x74]
jmp 0x405b16
lea ecx, [esp + 0x88]
mov byte [esp + 0xe00], 0x34
call fcn.0041e52e
lea ecx, [esp + 0x98]
mov byte [esp + 0xe00], 0x33
call fcn.0041e52e
lea ecx, [esp + 0x58]
mov byte [esp + 0xe00], 0x32
call fcn.0041e52e
lea ecx, [esp + 0x50]
mov byte [esp + 0xe00], 0x31
call fcn.0041e52e
mov eax, dword [esp + 0x44]
inc esi
cmp esi, eax
mov dword [esp + 0x74], esi
jle 0x4057a7
push 0
push 0
push 0
mov ecx, ebp
mov dword [ebp + 0x14a58], 0x64
call fcn.0042544e
lea ecx, [esp + 0xcc]
mov byte [esp + 0xe00], 0x30
call fcn.0041e52e
lea ecx, [esp + 0xdc]
mov byte [esp + 0xe00], 0x2d
call fcn.0041e52e
lea ecx, [esp + 0xac]
mov byte [esp + 0xe00], 0x2c
call fcn.0041e52e
lea ecx, [esp + 0x78]
mov byte [esp + 0xe00], 0x2b
call fcn.0041e52e
lea ecx, [esp + 0xb0]
mov byte [esp + 0xe00], 0x2a
call fcn.0041e52e
lea ecx, [esp + 0x9c]
mov byte [esp + 0xe00], 0x29
call fcn.0041e52e
lea ecx, [esp + 0xa8]
mov byte [esp + 0xe00], 0x28
call fcn.0041e52e
lea ecx, [esp + 0x68]
mov byte [esp + 0xe00], 0x27
call fcn.0041e52e
lea ecx, [esp + 0x70]
mov byte [esp + 0xe00], 0x26
call fcn.0041e52e
lea ecx, [esp + 0x94]
mov byte [esp + 0xe00], 0x25
call fcn.0041e52e
lea ecx, [esp + 0x60]
mov byte [esp + 0xe00], 0x24
call fcn.0041e52e
lea ecx, [esp + 0x7c]
mov byte [esp + 0xe00], 0x23
call fcn.0041e52e
lea ecx, [esp + 0x84]
mov byte [esp + 0xe00], 0x22
call fcn.0041e52e
lea ecx, [esp + 0x80]
mov byte [esp + 0xe00], 0x18
call fcn.0041e52e
lea ecx, [esp + 0xb8]
mov byte [esp + 0xe00], 0x15
call fcn.0041c257
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe00], 0x14
call fcn.0041e52e
lea ecx, [esp + 0x24]
mov byte [esp + 0xe00], 0x13
call fcn.0041e52e
lea ecx, [esp + 0x3c]
mov byte [esp + 0xe00], 0x10
call fcn.0041e52e
lea ecx, [esp + 0x20]
mov byte [esp + 0xe00], 0xf
call fcn.0041e52e
lea ecx, [esp + 0x28]
mov byte [esp + 0xe00], 0xe
call fcn.0041e52e
lea ecx, [esp + 0x40]
mov byte [esp + 0xe00], 0xb
call fcn.0041e52e
lea ecx, [esp + 0x14]
mov byte [esp + 0xe00], 0xa
call fcn.0041e52e
lea ecx, [esp + 0x30]
mov byte [esp + 0xe00], 9
call fcn.0041e52e
lea ecx, [esp + 0x38]
mov byte [esp + 0xe00], 6
call fcn.0041e52e
lea ecx, [esp + 0x18]
mov byte [esp + 0xe00], 5
call fcn.0041e52e
lea ecx, [esp + 0x2c]
mov byte [esp + 0xe00], 4
call fcn.0041e52e
lea ecx, [esp + 0x34]
mov byte [esp + 0xe00], 1
call fcn.0041e52e
lea ecx, [esp + 0x10]
mov byte [esp + 0xe00], 0
call fcn.0041e52e
lea ecx, [esp + 0x48]
mov dword [esp + 0xe00], 0xffffffff
call fcn.0041e52e
mov eax, 1
mov ecx, dword [esp + 0xdf8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xdf4
ret