Function at 0x425bf7
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x4fc
mov eax, 0x48eef7
call fcn.00459b85
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4e1]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x4e0]
push 1
push eax
xor ebx, ebx
mov dword [ebp - 0x4fc], edi
push esi
mov dword [ebp - 0x504], esi
mov dword [ebp - 0x4f8], ebx
call fcn.0041099e
mov dword [ebp - 4], ebx
movzx eax, word [esi]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x424de7.71
movzx eax, byte [eax + 0x425f6c]
jmp dword [eax*4 + 0x425f10]
push 0x4a70ac
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x424e25
mov eax, dword [edi + 0x268]
mov ecx, edi
push ebx
push ebx
push str._auto
mov byte [eax + 2], 1
call fcn.0043d761
mov eax, dword [edi + 0x268]
mov byte [eax + 2], 1
jmp 0x425003
lea eax, [edi + 4]
mov dword [ebp - 0x4e8], eax
mov eax, dword [eax]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
test eax, eax
jne case.0x424de7.71
mov ecx, edi
call fcn.00441257
test eax, eax
je 0x424eaa
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4b0], 0x4b6748
push eax
push str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x488], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x4b0]
push eax
push 0x86d
push edi
call fcn.00426b9d
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4b0]
call fcn.00404cc0
jmp 0x425ef6
fldz
lea eax, [ebp - 0x500]
push eax
mov ecx, edi
fstp qword [ebp - 0x500]
call fcn.00441275
test eax, eax
je 0x424ee2
fld qword [ebp - 0x500]
push ecx
push ecx
fstp qword [esp]
push 0x86f
push edi
call fcn.00426be4
add esp, 0x10
jmp 0x425ef6
push ebx
push ebx
push 0x4a8b74
mov ecx, edi
mov dword [edi + 0x14], 1
call fcn.0043d761
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0041099e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x450]
mov edi, dword [ebp - 0x4e8]
push ebx
push ecx
push 0xe
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
mov ecx, edi
call esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404cc0
jmp 0x425003
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0041099e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x450]
mov eax, dword [edi + 4]
push ebx
push ecx
push 0xc
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
jmp 0x424f3d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x425003
push eax
mov ecx, edi
call fcn.00442b52
mov dword [edi + 0x44], 1
jmp 0x425003
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4b0], 0x4b6748
push eax
push str.debuglog
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x488], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x4ac]
push ebx
push eax
lea ecx, [ebp - 0x4dc]
call fcn.00413f72
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4b0]
call fcn.00404cc0
test esi, esi
jne 0x42500b
xor ebx, ebx
inc ebx
jmp 0x425ef6
push 1
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4a8b90
jmp 0x425ee3
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x450], 0x4b6748
push eax
push str.embed
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x428], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 0x10
xor eax, eax
inc eax
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x44c]
push ebx
push eax
call fcn.00413f72
test eax, eax
jne 0x4250cd
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4b0], 0x4b6748
push eax
push 0x4a8ba8
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x488], 0x4b6750
call fcn.0041070a
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x4e0]
push 3
pop eax
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.004246d9
mov byte [ebp - 0x4e1], 1
test al, al
jne 0x4250d3
mov byte [ebp - 0x4e1], bl
push 0x10
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x4f8]
test al, 2
je 0x425100
and eax, 0xfffffffd
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x4b0]
call fcn.00404cc0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 4], ebx
test al, 1
je 0x42511e
and eax, 0xfffffffe
mov dword [ebp - 0x4f8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404cc0
cmp byte [ebp - 0x4e1], 0
je 0x42515d
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0041499b
mov byte [ebp - 4], 0x15
mov edx, dword [edi + 4]
push ebx
push eax
push 0x10
mov esi, dword [edx + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
jmp 0x425be9
push 0x4a8bac
lea ecx, [ebp - 0x4dc]
call fcn.00419617
test al, al
jne 0x425003
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_E_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4251a0
push esi
mov esi, 0x4de288
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x425269
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x4f4]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404b50
test eax, eax
jne 0x425e20
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004714b0
add esp, 0xc
mov dword [ebp - 0x4e8], 0x104
lea eax, [ebp - 0x4e8]
lea ecx, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00404c40
lea eax, [ebp - 0x218]
push eax
push 0x4de288
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [ebp - 0x4f4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x425244
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
mov dword [ebp - 0x4f4], esi
mov dword [ebp - 0x4f0], ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x42525e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
mov esi, 0x4de288
push esi
call fcn.00458947
mov dword [edi + 0x44], 1
mov eax, 0x4d9530
cmp dword [0x4d9544], 8
cmovae eax, dword [0x4d9530]
push eax
push esi
push 0x4dda78
call fcn.004573a9
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x450], 0x4b6748
push eax
push 0x4b65d4
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x428], 0x4b6750
call fcn.00407aa0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x4e1]
push 1
push eax
push dword [0x4a6fe8]
lea ecx, [ebp - 0x480]
call fcn.00406b40
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x4e1]
push 1
push eax
push dword [0x4a6fe4]
lea ecx, [ebp - 0x4b0]
call fcn.00406b40
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x480]
mov ecx, edi
push eax
lea eax, [ebp - 0x4b0]
push eax
push 5
call fcn.004193c2
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x4b0]
call fcn.00404cc0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x480]
call fcn.00404cc0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404cc0
push 2
mov ecx, edi
call fcn.00442679
jmp 0x425003
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx eax, word [eax]
sub eax, 0x31
je 0x4253c1
sub eax, 1
je 0x4253a7
sub eax, 1
je 0x425385
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4a8bd0
jmp 0x425ee3
push esi
mov byte [edi + 0x264], 1
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
mov ecx, edi
call fcn.00442a16
jmp 0x425003
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4a8bc8
jmp 0x425ee3
push 1
lea eax, [ebp - 0x4e1]
push eax
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
lea ecx, [ebp - 0x450]
call fcn.0041099e
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x480]
push ebx
push ebx
push ecx
mov ecx, eax
mov dword [ebp - 0x4f8], 4
call fcn.00414265
mov dword [ebp - 4], 0x21
add eax, 4
mov dword [ebp - 0x4f8], 0xc
cmp dword [eax + 0x14], 8
jb 0x42541e
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x425475
sub esp, 0x30
lea eax, [ebp - 0x4e1]
mov esi, esp
mov dword [ebp - 0x4e8], esp
push 1
push eax
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
mov ecx, esi
call fcn.0041099e
mov dword [ebp - 4], 0x22
mov byte [ebp - 4], 0x21
call fcn.0045eae4
add esp, 0x30
mov byte [ebp - 0x4e1], bl
test al, al
je 0x42547c
mov byte [ebp - 0x4e1], 1
push 0x20
pop eax
mov dword [ebp - 4], eax
push 0xc
pop esi
mov dword [ebp - 0x4f8], esi
and esi, 0xfffffff7
mov dword [ebp - 0x4f8], esi
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x480]
call fcn.00404cc0
mov dword [ebp - 4], ebx
and esi, 0xfffffffb
mov dword [ebp - 0x4f8], esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404cc0
cmp byte [ebp - 0x4e1], 0
je case.0x424de7.71
push 1
lea eax, [ebp - 0x4e1]
push eax
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
lea ecx, [ebp - 0x450]
call fcn.0041099e
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x480]
push ebx
push ebx
push ecx
mov ecx, eax
call fcn.00414265
mov byte [ebp - 4], 0x26
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x425514
mov eax, dword [eax]
push eax
call fcn.004575ce
pop ecx
mov esi, eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x480]
call fcn.00404cc0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404cc0
test esi, esi
je case.0x424de7.71
push ebx
push dword [ebp - 0x504]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4a8758
mov ecx, edi
call fcn.0043d761
mov dword [edi + 0x48], 1
jmp 0x425003
push str.hide_progress
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x425586
mov byte [edi + 0x25e], 1
push str.hide_splash
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x425003
mov byte [edi + 0x25f], 1
jmp 0x425003
push 1
lea eax, [ebp - 0x4e1]
push eax
push str.instance
lea ecx, [ebp - 0x480]
call fcn.0041099e
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x47c]
push ebx
push eax
lea ecx, [ebp - 0x4dc]
call fcn.00413f72
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404cc0
test esi, esi
jne 0x425641
push 0xfffffffffffffffd
pop esi
push 0xffffffffffffffff
add edi, 0x260
lea eax, [ebp - 0x450]
push 9
push eax
lea ecx, [ebp - 0x4e0]
mov dword [edi], esi
call fcn.0041499b
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x44c]
push 0x4a8bec
call fcn.00419617
test al, al
je 0x425628
or dword [edi], 0xffffffff
jmp 0x42563c
push 0xa
push edi
lea ecx, [ebp - 0x450]
call fcn.00428b5f
test al, al
jne 0x42563c
mov dword [edi], esi
jmp 0x424f3d
push str.IS_temp
lea ecx, [ebp - 0x4dc]
call fcn.00419617
test al, al
je 0x425003
mov byte [edi + 0x266], 1
jmp 0x425003
lea eax, [edi + 4]
mov dword [ebp - 0x4e8], eax
mov eax, dword [eax]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
test eax, eax
jne case.0x424de7.71
push dword [ebp - 0x504]
mov dword [edi + 0x14], 3
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
lea ecx, [ebp - 0x480]
push 1
lea eax, [ebp - 0x4e1]
push eax
push edi
call fcn.0041099e
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x4e8]
push ebx
mov edx, dword [eax]
lea eax, [ebp - 0x480]
push eax
push 8
mov esi, dword [edx + 0x18]
mov ecx, esi
call dword [0x4a5608]
mov ecx, dword [ebp - 0x4e8]
call esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404cc0
mov ecx, dword [ebp - 0x4fc]
push ebx
push edi
push 0x4a8bfc
jmp 0x425ee5
push edi
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x4e8], ebx
push eax
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.00425fa6
add esp, 0xc
test eax, eax
je case.0x424de7.71
mov ecx, dword [edi + 0x268]
mov ax, word [ebp - 0x4e8]
mov word [ecx + 0x52], ax
jmp 0x425003
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
sub ecx, 0x31
je 0x425758
sub ecx, 1
je 0x425751
mov esi, 0x4a8c14
jmp 0x425764
mov esi, 0x4a8c0c
jmp 0x42575d
mov esi, 0x4a8c04
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push ebx
push eax
push esi
jmp 0x425ee3
push str.noscript_uninst
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
jne 0x425789
push ebx
push ebx
push str._noscript_uninst
jmp 0x425ee3
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0041099e
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x480]
mov eax, dword [edi + 4]
push ebx
push ecx
push 5
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404cc0
mov esi, dword [ebp - 0x4fc]
mov ecx, esi
push 2
call fcn.00442679
mov dword [esi + 0x44], 1
jmp 0x425003
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4dced8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x425003
mov byte [edi + 0x265], 1
jmp 0x425003
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42582f
push ebx
push ebx
push 0x4a7ca0
jmp 0x425ee3
push str.runas
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
je 0x425003
push str.runfromtemp
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
je 0x425003
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x450], 0x4b6748
push eax
push str.runprerequisites
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x428], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x44c]
push ebx
push eax
lea ecx, [ebp - 0x4dc]
call fcn.00413f72
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404cc0
test esi, esi
je 0x425003
mov esi, dword [ebp - 0x504]
push 6
push str.reboot
push esi
call fcn.00476b67
add esp, 0xc
test eax, eax
je 0x425003
push str.removeasmajorupgrade
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
je 0x425003
push ebx
push ebx
push 0x4a8cc8
jmp 0x425ee3
push str.skip_clone_wait
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
je 0x425003
push 0x4a8cf0
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
jne 0x425925
push ebx
push ebx
push str._SMS
jmp 0x425ee3
push str.show_eval_msg
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
jne 0x425945
mov eax, dword [edi + 0x268]
mov byte [eax + 0x18], 1
jmp 0x425003
push str.show_beta_msg
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
jne 0x425965
mov eax, dword [edi + 0x268]
mov byte [eax + 0x19], 1
jmp 0x425003
push str.show_reboot_msg
push esi
call fcn.00476def
pop ecx
pop ecx
mov ecx, dword [edi + 0x268]
test eax, eax
jne 0x425985
mov byte [ecx + 0x1d], 1
jmp 0x425003
push ebx
push ebx
mov byte [ecx + 1], 1
mov ecx, edi
push 0x4a8d24
call fcn.0043d761
mov eax, dword [edi + 0x268]
mov byte [eax + 1], 1
jmp 0x425003
push ebx
push str.tempdisk1folder
lea ecx, [ebp - 0x4dc]
call fcn.00413fa5
test eax, eax
je 0x425003
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4259e5
push esi
mov ecx, edi
call fcn.00442acf
jmp 0x425ab1
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x4f4]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404b50
test eax, eax
jne 0x425e20
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004714b0
add esp, 0xc
mov dword [ebp - 0x4e8], 0x104
lea eax, [ebp - 0x4e8]
lea ecx, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00404c40
lea eax, [ebp - 0x218]
push eax
call fcn.00458947
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00442acf
push esi
mov esi, dword [ebp - 0x4f4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x425a91
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
mov dword [ebp - 0x4f4], esi
mov dword [ebp - 0x4f0], ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x425aab
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
push 3
mov ecx, edi
call fcn.00442679
jmp 0x424fa3
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov eax, ecx
cmp eax, 0x41
je 0x425ba5
cmp eax, 0x4d
je 0x425b5f
cmp eax, 0x57
je 0x425b16
cmp eax, 0x61
je 0x425ba5
cmp eax, 0x6d
je 0x425b5f
cmp ecx, 0x77
je 0x425b16
push str.uninst
push esi
call fcn.00476def
pop ecx
pop ecx
test eax, eax
jne 0x425003
push ebx
push ebx
push str._uninst
jmp 0x425ee3
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0041099e
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x480]
mov eax, dword [edi + 4]
push ebx
push ecx
push 0xa
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
jmp 0x425be9
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0041099e
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x480]
mov eax, dword [edi + 4]
push ebx
push ecx
push 0xb
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
jmp 0x425be9
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0041099e
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x480]
mov eax, dword [edi + 4]
push ebx
push ecx
push 9
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
jmp 0x424f46
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x4f4]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404b50
test eax, eax
jne 0x425c5c
mov eax, dword [ebp - 0x4f4]
push str.ISSetup
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x4f4]
test eax, eax
je 0x425c56
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4f0], ebx
push 7
push str.verbose
push esi
call fcn.00476b67
add esp, 0xc
test eax, eax
je 0x425e50
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_V_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x425d21
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0x4fc], 7
push eax
lea eax, [ebp - 0x508]
push eax
lea ecx, [edi + 0xc]
call fcn.004260cc
mov eax, dword [eax]
lea ecx, [eax + 0x18]
mov dword [ebp - 0x4e8], ecx
cmp dword [eax + 0x28], ebx
je 0x425cdd
push 0x4a7020
call fcn.00473ca3
pop ecx
mov ecx, dword [ebp - 0x4e8]
push eax
push 0x4a7020
call fcn.0041529e
push 1
lea eax, [ebp - 0x4e1]
push eax
push esi
lea ecx, [ebp - 0x480]
call fcn.0041099e
mov byte [ebp - 4], 0x41
add eax, 4
mov ecx, dword [ebp - 0x4e8]
push eax
call fcn.00415247
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x480]
call fcn.00404cc0
push 1
push esi
push 0x4a789c
jmp 0x425e5b
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4f4]
call fcn.00404b50
test eax, eax
jne 0x425e20
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004714b0
add esp, 0xc
mov dword [ebp - 0x4e8], 0x104
lea eax, [ebp - 0x4e8]
lea ecx, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.00404c40
push esi
mov esi, dword [ebp - 0x4f4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x425d9b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f4], ebx
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4f0], ebx
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x450], 0x4b6748
push eax
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x428], 0x4b6750
call fcn.0041070a
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x450]
mov eax, dword [edi + 4]
push ebx
push ecx
push 7
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x450]
call fcn.00404cc0
mov ecx, dword [ebp - 0x4fc]
lea eax, [ebp - 0x420]
push 1
push eax
push 0x4a789c
call fcn.0043d761
lea esi, [ebp - 0x420]
jmp 0x425e62
push edi
call fcn.004267f9
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x4f4], 0
je 0x425e45
push dword [ebp - 0x4f4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
jmp 0x425ef6
push 1
add esi, 0xe
push esi
push str._verbose
mov ecx, edi
call fcn.0043d761
test esi, esi
je 0x425e79
push esi
push 0x4daed8
mov byte [0x4dcfa0], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x4f4]
test eax, eax
je 0x425e93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
jmp 0x425003
mov dword [edi + 0x3c], 1
jmp 0x425003
mov eax, dword [edi + 4]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4a5608]
lea ecx, [edi + 4]
call esi
mov esi, dword [ebp - 0x4fc]
test eax, eax
je 0x425ec9
push esi
jmp 0x425ef0
mov dword [esi + 0x14], 4
jmp 0x425003
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4a8e20
mov ecx, edi
call fcn.0043d761
jmp 0x425003
push edi
call fcn.004267f9
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e0]
call fcn.00404cc0
mov eax, ebx
call fcn.00459b34
ret