Function at 0x4239ad
Capabilities:
Check for time delay via gettickcount
Create directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x9c8
push ebx
push esi
push edi
mov esi, ecx
push 0x4ad684
mov dword [ebp + 0x18], esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
call fcn.0040c376
push 0x104
lea eax, [ebp - 0x954]
push eax
push 0x2711
push dword [0x4ace04]
xor ebx, ebx
mov byte [0x4ace90], bl
call fcn.00430de0
add esp, 0x10
lea ecx, [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov dword [0x4ace70], ebx
mov dword [0x4ace74], ebx
mov dword [ebp + 0x30], 0x80000000
call fcn.00435d62
lea ecx, [ebp + 0x24]
call fcn.00435d62
push 0x498c90
lea ecx, [ebp]
mov dword [ebp - 0x1c], ebx
call fcn.004403c3
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], eax
lea eax, [ebp]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x44], esi
mov dword [0x4ace64], eax
mov byte [0x4ace68], bl
mov dword [0x4ace6c], ebx
call fcn.0040d786
shrd eax, edx, 0x10
shr edx, 0x10
mov edx, 0x60000
cmp eax, edx
sbb cl, cl
inc cl
cmp eax, edx
mov dword [ebp - 0x34], eax
mov byte [ebp + 0x4f], cl
jb 0x423a79
cmp eax, 0x6ffff
mov byte [ebp + 0x5b], 1
jbe 0x423a7c
mov byte [ebp + 0x5b], bl
lea ecx, [ebp + 0x50]
mov byte [ebp + 0x3b], bl
mov byte [0x4ace91], bl
call fcn.00435d62
push 7
pop ecx
xor eax, eax
mov esi, str._SystemRoot__
lea edi, [ebp - 0xa0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x18]
lea edi, [ebp - 0x84]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
push ebx
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0043d5b3
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [ebp - 0x30], eax
add eax, 0x1e
push eax
lea ecx, [ebp + 0x50]
call fcn.00435da9
cmp byte [ebp + 0x5b], bl
jl 0x423b0e
push dword [ebp + 0x50]
lea ecx, [ebp - 0x14]
call fcn.004403c3
push str.System32Drvload.exe
lea ecx, [ebp - 0x14]
call fcn.00435dd0
push dword [ebp - 0x14]
call fcn.0047f7b4
neg eax
sbb al, al
pop ecx
lea ecx, [ebp - 0x14]
and eax, 3
mov byte [ebp + 0x5b], al
call fcn.0043092f
mov al, byte [ebp + 0x5b]
mov byte [ebp + 0x1c], al
mov dword [ebp + 0x20], 1
mov byte [ebp + 0x66], bl
push dword [ebp + 0x7c]
inc byte [ebp + 0x66]
lea ecx, [ebp - 0x1c]
mov byte [0x4ace69], bl
call fcn.00440487
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x6e], bl
mov dword [0x4ace8c], ebx
mov dword [0x4ace6c], ebx
mov byte [ebp + 0x17], 2
call fcn.0040bc51
push 8
push dword [ebp + 0x70]
xor esi, esi
push str.listdev:
mov byte [ebp + 0x3a], bl
mov byte [ebp + 0x5a], 2
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x59], bl
mov byte [0x4ace8a], bl
mov byte [0x4ace92], bl
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
call fcn.004318b1
add esp, 0xc
test al, al
je 0x423bd9
add dword [ebp + 0x70], 0x10
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
mov byte [ebp + 0x6f], 0x10
je 0x423bac
call fcn.0040bc38
test al, al
jne 0x423bac
mov eax, dword [ebp + 0x70]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x70]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x423bc5
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040bc51
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x424e4a
xor edi, edi
cmp dword [ebp - 0x34], 0x60000
mov byte [ebp + 0x67], 0xff
mov word [0x4ace7c], bx
mov byte [0x4ace78], bl
jb 0x423bf9
mov byte [ebp + 0x1c], 3
mov eax, dword [ebp + 0x70]
cmp word [eax], 0x2a
jne 0x42407e
push 8
lea eax, [ebp + 0x70]
push eax
push str.extract
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423c2d
mov byte [0x4ace8a], 1
mov byte [ebp + 0x5a], 1
jmp 0x424065
push 8
lea eax, [ebp + 0x70]
push eax
push str.nocheck
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423c50
mov byte [0x4ace92], 1
jmp 0x424065
push 7
lea eax, [ebp + 0x70]
push eax
push str.rescan
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423c70
mov byte [ebp + 0x59], 1
jmp 0x424065
push 7
lea eax, [ebp + 0x70]
push eax
push str.devcon
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423c93
mov byte [0x4ace90], 1
jmp 0x424065
push 9
lea eax, [ebp + 0x70]
push eax
push str.norescan
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423cb3
mov byte [ebp + 0x59], 0xff
jmp 0x424065
push 6
lea eax, [ebp + 0x70]
push eax
push str.dummy
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423cd6
mov byte [0x4ace68], 1
jmp 0x424065
push 4
lea eax, [ebp + 0x70]
push eax
push str.sub
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423cf6
mov byte [ebp + 0x3a], 1
jmp 0x424065
push 5
lea eax, [ebp + 0x70]
push eax
push str.self
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423d16
mov byte [ebp + 0x3a], 2
jmp 0x424065
push 4
lea eax, [ebp + 0x70]
push eax
push str.7pe
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423d36
mov byte [ebp + 0x1c], 3
jmp 0x424065
push 4
lea eax, [ebp + 0x70]
push eax
push str.7pe_
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x424065
push 8
lea eax, [ebp + 0x70]
push eax
push str.drvload
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423d73
mov al, byte [ebp + 0x5b]
mov byte [ebp + 0x1c], al
jmp 0x424065
push 6
lea eax, [ebp + 0x70]
push eax
push str.inner
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423d93
mov byte [ebp + 0x1c], 0xc0
jmp 0x424065
push 9
lea eax, [ebp + 0x70]
push eax
push str.nnverify
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x423c24
push 8
lea eax, [ebp + 0x70]
push eax
push str.rverify
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423dcd
mov byte [ebp + 0x5a], bl
jmp 0x424065
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdevi
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423df3
mov al, byte [ebp + 0x6f]
and al, 0xf2
or al, 2
mov byte [ebp + 0x6f], al
jmp 0x424065
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdevc
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423e13
mov al, byte [ebp + 0x6f]
and al, 0xf4
or al, 4
jmp 0x423deb
push 4
lea eax, [ebp + 0x70]
push eax
push str.All
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423e33
or byte [ebp + 0x6f], 0x20
jmp 0x424065
push 5
lea eax, [ebp + 0x70]
push eax
push str.auto
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423e58
mov word [0x4ace7c], 3
jmp 0x424065
push 4
lea eax, [ebp + 0x70]
push eax
push str.sys
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423e7b
mov byte [0x4ace78], 1
jmp 0x424065
mov eax, dword [str.disverify]
push 0xa
lea ecx, [ebp + 0x70]
inc eax
push ecx
push eax
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423e9d
or byte [ebp + 0x6e], 1
jmp 0x424065
push 0xb
lea eax, [ebp + 0x70]
push eax
push dword [0x4ab2b4]
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423ebe
or byte [ebp + 0x6e], 3
jmp 0x424065
push 0xe
lea eax, [ebp + 0x70]
push eax
push dword [0x4ab2b0]
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x423edf
or byte [ebp + 0x6e], 0x10
jmp 0x424065
push 7
push dword [ebp + 0x70]
push str.retid:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x423f42
mov ecx, dword [ebp + 0x70]
add ecx, 0xe
xor eax, eax
mov dword [ebp + 0x70], ecx
mov ax, word [ecx]
cmp ax, bx
je 0x423f1c
call fcn.0040bc38
test al, al
jne 0x423f1c
lea eax, [ebp]
mov dword [ebp - 0x58], ecx
mov dword [0x4ace64], eax
lea eax, [ebp + 0x70]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x423f35
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040bc51
jmp 0x424065
push 0xa
push dword [ebp + 0x70]
push str.DevClass:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x423f7c
mov ecx, dword [ebp + 0x70]
add ecx, 0x14
xor eax, eax
mov dword [ebp + 0x70], ecx
mov ax, word [ecx]
cmp ax, bx
je 0x423f1c
call fcn.0040bc38
test al, al
jne 0x423f1c
mov dword [0x4ace6c], ecx
jmp 0x423f1c
push 7
push dword [ebp + 0x70]
push str.DevID:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x423ffa
add dword [ebp + 0x70], 0xe
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
je 0x423fad
call fcn.0040bc38
test al, al
jne 0x423fad
mov esi, dword [ebp + 0x70]
lea eax, [ebp + 0x70]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x423fc6
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040bc51
cmp esi, ebx
je 0x424065
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, ebx
jle 0x423ff6
cmp word [esi + eax*2 - 2], 0x26
jne 0x423ff2
mov word [esi + eax*2], bx
dec eax
cmp eax, ebx
jg 0x423fe1
cmp eax, ebx
jg 0x424065
xor esi, esi
jmp 0x424065
push 9
push dword [ebp + 0x70]
push str.disable:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x424019
add dword [ebp + 0x70], 2
mov byte [ebp + 0x67], bl
jmp 0x424033
push 8
push dword [ebp + 0x70]
push str.enable:
call fcn.004318b1
add esp, 0xc
test al, al
je 0x42405b
mov byte [ebp + 0x67], 1
add dword [ebp + 0x70], 0x10
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
je 0x423f1c
call fcn.0040bc38
test al, al
jne 0x423f1c
mov edi, dword [ebp + 0x70]
jmp 0x423f1c
lea eax, [ebp + 0x70]
push eax
call fcn.0040459d
pop ecx
mov eax, dword [ebp + 0x70]
cmp word [eax], 0x2a
je 0x423c06
cmp byte [ebp + 0x6e], bl
mov dword [ebp - 0x10], esi
jne 0x424ea4
cmp byte [ebp + 0x1c], bl
setl al
dec al
and eax, dword [ebp + 0x1c]
or byte [ebp + 0x4f], al
mov byte [0x4ace91], al
mov al, byte [ebp + 0x6f]
and al, 0x10
mov byte [ebp + 0x6e], al
je 0x4240a4
cmp dword [ebp - 4], ebx
je 0x424eb7
cmp byte [ebp + 0x67], bl
jl 0x4240b1
cmp edi, ebx
jne 0x424ec3
cmp dword [ebp - 0x10], ebx
push 0x200010
setne al
lea ecx, [ebp + 0x34]
mov byte [0x4ace69], al
call fcn.00435c56
mov eax, dword [ebp + 0x34]
push 8
add eax, 0x200000
push ebx
push eax
call fcn.0047fd70
mov eax, dword [ebp + 0x34]
mov dword [ebp - 8], eax
add eax, 2
mov esi, eax
mov word [esi + 2], bx
mov word [esi], bx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x78], 0x1c
mov dword [ebp - 0x74], ebx
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x70]
xor ecx, ecx
add esp, 0xc
cmp word [eax], 0x24
mov dword [ebp + 0x68], ebx
sete cl
cmp ecx, ebx
mov dword [ebp + 0x3c], ecx
je 0x42412c
jmp 0x424121
inc dword [ebp + 0x68]
inc eax
inc eax
mov dword [ebp + 0x70], eax
cmp word [eax], 0x24
je 0x42411e
lea ecx, [ebp + 0x70]
call fcn.0040bc51
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
push dword [ebp + 0x70]
call edi
cmp eax, ebx
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x40], ebx
je 0x424183
add dword [ebp + 0x48], 2
lea ecx, [ebp + 0x48]
mov word [eax], bx
call fcn.0040bc51
push 0x2c
push dword [ebp + 0x48]
call edi
cmp eax, ebx
mov dword [ebp + 0x60], eax
je 0x42417a
add dword [ebp + 0x60], 2
lea ecx, [ebp + 0x60]
mov word [eax], bx
call fcn.0040bc51
push dword [ebp + 0x48]
call fcn.0040cd10
pop ecx
push dword [ebp + 0x70]
call fcn.0040cd10
cmp dword [ebp + 0x60], ebx
pop ecx
je 0x4241c1
push 0x2c
push dword [ebp + 0x60]
call edi
cmp eax, ebx
mov dword [ebp + 0x40], eax
je 0x4241b8
mov word [eax], bx
inc eax
inc eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x40], eax
call fcn.0040bc51
push dword [ebp + 0x40]
call fcn.0040cd10
pop ecx
push dword [ebp + 0x60]
call fcn.0040cd10
pop ecx
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
je 0x424262
lea eax, [ebp + 0x70]
push 1
push eax
call fcn.0043d37b
cmp eax, ebx
pop ecx
pop ecx
je 0x424262
cmp word [eax], 0x23
jne 0x424262
lea ecx, [ebp - 0x3c]
call fcn.00435d62
push str..tmp.cab
push str.devi
push ebx
lea eax, [ebp - 0x3c]
push eax
push ebx
call fcn.004046c0
add esp, 0x14
push str.__dd__len16M___
lea ecx, [ebp + 0x10]
call fcn.004403c3
push dword [ebp - 0x3c]
lea ecx, [ebp + 0x10]
call fcn.00435dd0
push 0x498b00
lea ecx, [ebp + 0x10]
call fcn.00435dd0
push dword [ebp + 0x70]
lea ecx, [ebp + 0x10]
call fcn.00435dd0
mov ecx, dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
call fcn.0045f339
push dword [ebp - 0x3c]
lea ecx, [ebp + 0x24]
call fcn.0040dd12
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x70], eax
call fcn.0043092f
lea ecx, [ebp - 0x3c]
call fcn.0043092f
push dword [ebp + 0x70]
call fcn.0047f62b
pop ecx
push dword [ebp + 0x70]
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp dword [ebp - 0x54], ebx
mov edi, eax
jne 0x4242a1
cmp edi, 4
jle 0x4242a1
mov eax, dword [ebp + 0x70]
lea eax, [eax + edi*2 - 8]
push str..CAB
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
mov dword [ebp + 0xc], 1
je 0x4242a4
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x4242b4
cmp word [eax], 0x2a
jne 0x4242b4
mov dword [ebp + 0x60], ebx
cmp edi, 4
jle 0x4242d3
mov eax, dword [ebp + 0x70]
lea eax, [eax + edi*2 - 8]
push 0x4971ec
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x4242d3
inc eax
jmp 0x4242d5
xor eax, eax
cmp dword [ebp - 0x54], ebx
jne 0x4242e5
cmp eax, ebx
mov dword [ebp + 0x5c], 1
jne 0x4242e8
mov dword [ebp + 0x5c], ebx
cmp dword [ebp + 0x68], 1
je 0x42430b
cmp eax, ebx
je 0x4242fc
cmp dword [ebp + 0x3c], ebx
je 0x4242fc
cmp dword [ebp + 0x60], ebx
jne 0x42430b
cmp dword [ebp + 0x5c], ebx
je 0x424306
cmp dword [ebp + 0x3c], ebx
jne 0x42430b
mov byte [ebp + 0x67], bl
jmp 0x42430f
mov byte [ebp + 0x67], 1
mov edi, dword [ebp + 0x60]
cmp edi, ebx
mov dword [ebp + 0x54], ebx
mov dword [0x4ace80], ebx
mov dword [0x4ace84], ebx
mov word [0x4ace88], bx
je 0x4243aa
cmp word [edi], bx
je 0x4243aa
push edi
lea ecx, [ebp + 0x54]
call fcn.00440487
push dword [ebp + 0x54]
call fcn.004104d1
pop ecx
push ebx
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0x105
lea ecx, [ebp - 0x38]
call fcn.00435d80
push 0x104
push dword [ebp - 0x38]
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
mov eax, dword [ebp - 0x38]
cmp word [eax], bx
je 0x42437c
mov ecx, dword [ebp + 0x54]
mov dword [ebp + 0x54], eax
mov dword [ebp - 0x38], ecx
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp word [edi + eax*2 - 2], 0x5c
je 0x42439a
push 0x494cb0
lea ecx, [ebp + 0x54]
call fcn.00435dd0
mov eax, dword [ebp + 0x54]
lea ecx, [ebp - 0x38]
mov dword [0x4ace80], eax
call fcn.0043092f
cmp dword [ebp + 0x3c], ebx
jne 0x4243bc
cmp byte [ebp + 0x4f], bl
je 0x4243d7
cmp byte [0x4ace8a], bl
jne 0x4243d7
cmp byte [0x4ace78], bl
jne 0x4243d7
cmp byte [ebp + 0x6e], bl
jne 0x4243d7
cmp byte [ebp + 0x5a], 1
je 0x4243d7
lea ecx, [ebp + 0x30]
call fcn.0040dd74
cmp byte [ebp + 0x5a], 2
jne 0x4243e0
mov dword [ebp + 0x30], ebx
cmp dword [ebp + 0xc], ebx
je 0x424411
mov eax, dword [ebp + 0x48]
cmp eax, ebx
je 0x424411
or dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00438b8e
mov eax, dword [ebp - 0xc]
cmp eax, ebx
pop ecx
pop ecx
jle 0x424411
cmp eax, 0x14
jge 0x424411
mov byte [ebp + 0x17], al
cmp byte [ebp + 0x66], 1
jne 0x424466
cmp byte [0x4ace8a], bl
jne 0x424466
movsx eax, byte [ebp + 0x59]
push eax
movsx eax, byte [0x4ace92]
push eax
push dword [ebp + 0x3c]
movsx eax, byte [0x4ace91]
push dword [ebp + 0x5c]
push eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x438]
push str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x438]
push eax
push 0x498a6c
push dword [ebp + 0x18]
call fcn.0040cde2
add esp, 0x2c
cmp byte [ebp + 0x59], bl
jg 0x4244a3
cmp byte [ebp + 0x6f], bl
jne 0x42458a
cmp byte [ebp + 0x59], bl
jl 0x42457e
cmp byte [0x4ace91], bl
je 0x42457e
cmp dword [ebp + 0x5c], ebx
jne 0x424497
cmp dword [ebp + 0x3c], ebx
je 0x42457e
cmp byte [0x4ace92], bl
jne 0x42457e
cmp byte [ebp + 0x66], 1
jne 0x4244be
push 0x4949a4
push 0x498a54
push dword [ebp + 0x18]
call fcn.0040cde2
add esp, 0xc
call fcn.0040d9bf
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp + 0x68], ebx
call edi
add eax, 0x32
mov dword [ebp - 0xc], eax
call edi
mov ecx, dword [ebp - 0xc]
sub ecx, eax
cmp ecx, ebx
jle 0x424579
cmp byte [0x4ab290], bl
jle 0x424579
cmp ecx, ebx
jbe 0x424569
cmp ecx, 0x7d0
jbe 0x424502
mov ecx, 0x3e8
jmp 0x42450a
cmp ecx, 0x64
jbe 0x42450a
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp - 0xa8]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x424569
cmp dword [ebp + 0x68], ebx
jg 0x424531
call edi
mov ecx, dword [ebp - 0xc]
sub ecx, eax
test ecx, ecx
jle 0x424571
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x424571
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp + 0x68], ebx
jle 0x424569
dec dword [ebp + 0x68]
cmp byte [0x4ab290], bl
jg 0x424521
mov dword [ebp + 0x68], ebx
jmp 0x4244d4
cmp byte [ebp + 0x6f], bl
jne 0x42458a
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
je 0x424f41
lea ecx, [ebp + 0x28]
call fcn.00435d62
push dword [ebp + 0x70]
call fcn.0040eec0
push ebx
lea ecx, [ebp + 0x28]
push ecx
push eax
mov dword [ebp + 0x70], eax
call fcn.00473899
mov dword [ebp + 0x70], eax
add esp, 0x10
xor eax, eax
cmp byte [ebp + 0x6f], bl
je 0x4245be
test byte [ebp + 0x6f], 0x20
jne 0x4245be
push 2
pop eax
or eax, 4
push eax
push ebx
push ebx
push ebx
call dword [0x4acdc0]
cmp eax, 0xffffffff
mov dword [ebp + 0x68], eax
jne 0x4245df
cmp dword [ebp + 0x5c], ebx
mov dword [ebp + 0x68], ebx
je 0x424f49
test byte [ebp + 0x6f], 4
push 0
pop eax
setne al
inc eax
cmp dword [ebp + 0x5c], ebx
mov dword [ebp - 0x50], eax
jne 0x4245fa
cmp byte [ebp + 0x67], bl
mov dword [ebp - 0xc], ebx
je 0x424601
mov dword [ebp - 0xc], 1
lea ecx, [ebp + 0x44]
call fcn.00435d62
push 0x3f
xor eax, eax
pop ecx
mov word [ebp - 0x2a8], bx
lea edi, [ebp - 0x2a6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
xor eax, eax
cmp byte [0x4ace8a], bl
mov word [ebp - 0x1a8], bx
pop ecx
lea edi, [ebp - 0x1a6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x78], 0x1c
jne 0x424834
cmp dword [ebp + 0x68], ebx
je 0x424834
mov eax, esi
sub eax, dword [ebp - 8]
mov dword [ebp + 0x5c], ebx
cmp eax, 0x200000
jge 0x424834
push 0x1c
pop edi
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
call dword [0x4acdd4]
test eax, eax
je 0x424834
cmp byte [ebp + 0x6f], bl
je 0x424725
cmp dword [0x4ace6c], ebx
je 0x4246c2
push ebx
push 0x80
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
push dword [0x4ace6c]
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x424821
test byte [ebp + 0x6f], 2
je 0x424725
push ebx
push 0x80
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
cmp byte [ebp + 0x6e], bl
je 0x424708
mov eax, dword [ebp + 0x44]
cmp word [eax], bx
je 0x4246fc
push 0x494d34
lea ecx, [ebp + 0x44]
call fcn.00435dd0
lea eax, [ebp - 0x1a8]
push eax
jmp 0x4247a2
cmp dword [ebp - 0x10], ebx
je 0x424725
lea eax, [ebp - 0x1a8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
jne 0x424821
mov eax, dword [0x4acde4]
cmp eax, ebx
mov dword [ebp - 0x5c], ebx
je 0x424749
push ebx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x28], 0x400
call eax
mov eax, dword [ebp - 8]
sub eax, esi
add eax, 0x200000
mov ecx, 0x800
cmp eax, ecx
mov word [esi + 2], bx
mov word [esi], bx
jle 0x424765
mov eax, ecx
push ebx
push eax
push esi
push ebx
push dword [ebp - 0x50]
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp - 0x78], edi
call dword [0x4acdc4]
cmp eax, ebx
mov dword [ebp - 0x78], edi
je 0x424821
cmp byte [ebp + 0x6e], bl
je 0x4247ac
mov eax, dword [ebp + 0x44]
cmp word [eax], bx
je 0x4247a1
push 0x494d34
lea ecx, [ebp + 0x44]
call fcn.00435dd0
push esi
lea ecx, [ebp + 0x44]
call fcn.00435dd0
jmp 0x424821
push 4
push str.ACPI
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x424821
cmp byte [ebp + 0x66], 1
jne 0x4247d6
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x4c]
push dword [ebp + 0x18]
call fcn.0040cde2
add esp, 0x10
xor eax, eax
mov ax, word [esi]
xor ecx, ecx
xor edx, edx
cmp ax, bx
je 0x42481b
cmp ax, 0x26
jne 0x4247f3
movsx eax, byte [ebp + 0x17]
inc edx
cmp edx, eax
jge 0x424800
inc ecx
movzx eax, cx
mov ax, word [esi + eax*2]
cmp ax, bx
jne 0x4247e4
cmp cx, bx
jbe 0x42481b
movzx eax, cx
mov word [esi - 2], cx
lea esi, [esi + eax*2]
jmp 0x424813
inc esi
inc esi
cmp word [esi], bx
jne 0x424811
add esi, 4
test byte [ebp + 0x6f], 2
jne 0x424834
inc dword [ebp + 0x5c]
mov eax, esi
sub eax, dword [ebp - 8]
cmp eax, 0x200000
jl 0x424667
cmp byte [ebp + 0x6e], bl
jne 0x424f55
cmp dword [ebp - 0xc], ebx
je 0x424851
test byte [ebp + 0x6f], 2
je 0x424851
mov dword [ebp - 0x28], 1
jmp 0x42488e
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], ebx
je 0x42488e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, dword [ebp - 0x2c]
mov edi, eax
mov eax, dword [ebp - 8]
mov word [eax], di
lea eax, [edi + 1]
push eax
push dword [ebp - 0x10]
push esi
call fcn.00404561
lea esi, [esi + edi*2 + 2]
mov word [esi], bx
add esp, 0xc
inc esi
inc esi
mov word [esi + 4], bx
mov word [esi + 2], bx
push dword [ebp + 0x68]
mov word [esi - 2], bx
call dword [0x4acdc8]
cmp byte [0x4ace8a], bl
jne 0x4248b8
push 0x4949a4
push 0x494d34
push dword [ebp + 0x18]
call fcn.0040cde2
add esp, 0xc
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp + 0x50]
push 8
add edi, edi
add eax, edi
push 0x498a40
push eax
call fcn.004102e0
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x424f6b
cmp dword [ebp + 0x68], ebx
je 0x4253ec
cmp byte [0x4ace8a], bl
jne 0x42490a
mov esi, dword [ebp - 8]
cmp word [esi], bx
je 0x4253f8
cmp dword [ebp - 0x54], ebx
jne 0x425404
cmp dword [ebp + 0xc], ebx
je 0x425404
mov eax, dword [0x4ace80]
cmp eax, ebx
je 0x42491d
cmp word [eax], 0x2a
jne 0x4249e1
cmp dword [ebp + 0x3c], ebx
mov cl, byte [0x4ace91]
je 0x424934
cmp cl, bl
jne 0x42493c
cmp byte [0x4ace78], bl
jne 0x42493c
cmp cl, bl
jne 0x4249e9
lea ecx, [ebp - 0x24]
call fcn.00435d62
push 0x498a38
push str.devi
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.004046c0
add esp, 0x14
push 0x105
lea ecx, [ebp - 0x40]
call fcn.00435d80
push 0x104
push dword [ebp - 0x40]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
mov eax, dword [ebp - 0x40]
cmp word [eax], bx
je 0x42498b
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], ecx
push 0x494cb0
lea ecx, [ebp - 0x24]
call fcn.00435dd0
push dword [ebp - 0x24]
lea ecx, [ebp + 0x2c]
call fcn.0040dd12
cmp byte [0x4ace91], bl
jne 0x4249c7
cmp byte [0x4ace78], bl
jne 0x4249c7
push eax
mov dword [0x4ace84], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov word [0x4ace88], ax
jmp 0x4249cc
mov dword [0x4ace80], eax
lea ecx, [ebp - 0x40]
call fcn.0043092f
lea ecx, [ebp - 0x24]
call fcn.0043092f
mov eax, dword [0x4ace80]
cmp byte [0x4ace91], bl
je 0x424a04
cmp byte [0x4ace8a], bl
jne 0x424a04
cmp eax, ebx
je 0x424a04
cmp byte [0x4ace92], bl
jne 0x424a04
mov dword [ebp + 0x3c], 1
cmp byte [ebp + 0x3b], bl
je 0x424a10
xor eax, eax
mov dword [0x4ace80], eax
cmp byte [0x4ace92], bl
je 0x424a24
cmp eax, ebx
je 0x424a24
cmp dword [ebp + 0x40], ebx
je 0x424a24
mov dword [ebp + 0x3c], ebx
movzx ecx, word [0x4ace7c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
shl ecx, 0x10
or eax, ecx
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x50]
push 0xa
add edi, eax
push str.INF_
push edi
call fcn.004102e0
add esp, 0xc
push 0x1040
lea ecx, [ebp - 0x14]
call fcn.00435d80
xor eax, eax
mov dword [ebp - 0x748], ebx
mov ecx, 0x93
lea edi, [ebp - 0x744]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x748]
push eax
push dword [ebp + 0x70]
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ebx
call fcn.0047f714
add esp, 0xc
cmp dword [ebp - 0x20], ebx
je 0x425467
push dword [ebp + 0x70]
lea ecx, [ebp + 4]
call fcn.004403c3
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x70]
call fcn.0044726b
pop ecx
pop ecx
push 0x494cb0
lea ecx, [ebp + 4]
call fcn.00435dd0
push str.DefaultInstall_132
lea ecx, [ebp + 8]
call fcn.004403c3
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
call esi
push dword [ebp + 4]
mov dword [ebp + 0xc], eax
call esi
cmp dword [ebp + 0x3c], ebx
mov ecx, eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x2c], ecx
mov word [eax + ecx*2], bx
jne 0x424afc
cmp byte [0x4ace8a], bl
mov dword [ebp + 0x60], 1
je 0x424aff
mov dword [ebp + 0x60], ebx
mov eax, dword [0x4ace80]
neg eax
sbb eax, eax
and eax, 0x20000
add eax, 0x10000
or dword [ebp + 0x5c], eax
jmp 0x424b1a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov word [eax], bx
test byte [ebp - 0x748], 0x10
mov dword [0x4acdec], eax
mov dword [0x4acdf0], eax
mov dword [0x4ace8c], ebx
jne 0x424d98
mov eax, dword [ebp + 4]
mov word [eax + ecx*2], bx
lea eax, [ebp - 0x71c]
push eax
lea ecx, [ebp + 4]
call fcn.00435dd0
push dword [ebp - 8]
push 0x41cd9c
push ebx
push dword [ebp + 4]
call dword [0x4acdd8]
cmp dword [ebp + 0x3c], ebx
je 0x424c6f
mov edi, dword [0x4acdf0]
cmp edi, dword [0x4acdec]
jae 0x424c66
add edi, 4
push edi
mov esi, edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp byte [ebp + 0x66], 1
lea edi, [edi + eax*2 + 2]
jle 0x424ba8
push 0xffffffffffffffff
mov eax, esi
call fcn.0040d688
test eax, eax
pop ecx
jne 0x424c56
cmp byte [0x4ace78], bl
mov dword [ebp + 0x48], 4
je 0x424bc7
push dword [ebp + 0x5c]
push edi
call fcn.0041294a
pop ecx
pop ecx
jmp 0x424c56
cmp byte [0x4ace91], 3
je 0x424bd8
cmp byte [0x4ace90], bl
je 0x424c0d
or dword [ebp + 0x48], 1
cmp byte [0x4ace90], bl
je 0x424bed
push esi
push edi
call fcn.0040d814
jmp 0x424bfd
cmp byte [0x4ace91], 3
jne 0x424c02
push esi
push edi
call fcn.0040d8da
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], ebx
je 0x424c56
test byte [ebp + 0x48], 2
jne 0x424c2b
push dword [ebp + 0x5c]
or dword [ebp + 0x48], 2
push edi
push esi
call fcn.0041285a
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x60], eax
je 0x424c56
test byte [ebp + 0x48], 1
je 0x424bd8
test byte [ebp + 0x48], 4
jne 0x424c56
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov word [eax + ecx*2], bx
push edi
lea ecx, [ebp + 8]
call fcn.00435dd0
push 0x100000
push dword [ebp + 8]
push ebx
push ebx
call fcn.0040dd2c
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edi, [edi + eax*2 + 2]
jmp 0x424b74
cmp dword [ebp + 0x3c], ebx
jne 0x424d98
cmp byte [0x4ace92], bl
je 0x424d98
cmp dword [ebp + 0x40], ebx
je 0x424d98
mov eax, dword [0x4ace80]
cmp eax, ebx
je 0x424d98
push eax
lea ecx, [ebp - 0x18]
call fcn.004403c3
push dword [ebp + 0x40]
lea ecx, [ebp - 0x18]
call fcn.00435dd0
push dword [ebp - 0x18]
push 0x4989e4
push dword [ebp + 0x18]
call fcn.0040cde2
push dword [ebp - 0x18]
push dword [ebp - 8]
call fcn.0041c942
mov edi, eax
add esp, 0x14
cmp edi, ebx
mov esi, edi
jne 0x424cd0
mov esi, 0x4949a4
cmp byte [0x4ace91], 3
mov dword [ebp + 0x68], 4
je 0x424ce8
cmp byte [0x4ace90], bl
je 0x424d2a
or dword [ebp + 0x68], 1
cmp byte [0x4ace90], bl
je 0x424cff
push esi
push dword [ebp - 0x18]
call fcn.0040d814
jmp 0x424d11
cmp byte [0x4ace91], 3
jne 0x424d16
push esi
push dword [ebp - 0x18]
call fcn.0040d8da
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], 2
jge 0x424d89
cmp dword [ebp + 0x60], ebx
je 0x424d89
test byte [ebp + 0x68], 2
jne 0x424d5c
or dword [ebp + 0x68], 2
cmp edi, ebx
je 0x424d44
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push edi
call fcn.0041285a
add esp, 0xc
mov dword [ebp + 0x60], eax
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], 2
jge 0x424d89
cmp edi, ebx
je 0x424d56
cmp dword [ebp + 0x60], ebx
je 0x424d89
test byte [ebp + 0x68], 2
je 0x424ce8
test byte [ebp + 0x68], 4
jne 0x424d89
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov word [eax + ecx*2], bx
push dword [ebp - 0x18]
lea ecx, [ebp + 8]
call fcn.00435dd0
push 0x100000
push dword [ebp + 8]
push ebx
push ebx
call fcn.0040dd2c
add esp, 0x10
cmp edi, ebx
je 0x424d90
mov word [edi], bx
lea ecx, [ebp - 0x18]
call fcn.0043092f
lea eax, [ebp - 0x748]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040466f
test eax, eax
jne 0x424b17
lea ecx, [ebp - 0x20]
call fcn.00402b5c
cmp dword [ebp + 0x60], ebx
mov eax, dword [ebp]
mov word [eax], 0x5f
jne 0x424dc7
mov dword [ebp + 0x20], ebx
cmp dword [ebp + 0x3c], ebx
je 0x425470
cmp dword [0x4ace80], ebx
je 0x425470
cmp byte [0x4ace91], 1
jne 0x425470
cmp byte [ebp + 0x3b], bl
jne 0x425470
cmp dword [ebp + 0x40], ebx
jne 0x425470
lea ecx, [ebp + 8]
mov dword [0x4ace80], ebx
mov byte [ebp + 0x3b], 1
call fcn.0043092f
lea ecx, [ebp + 4]
call fcn.0043092f
lea ecx, [ebp - 0x20]
call fcn.00402b5c
lea ecx, [ebp - 0x14]
call fcn.0043092f
lea ecx, [ebp + 0x44]
call fcn.0043092f
lea ecx, [ebp + 0x28]
call fcn.0043092f
lea ecx, [ebp + 0x54]
call fcn.0043092f
lea ecx, [ebp + 0x34]
call fcn.0043092f
jmp 0x423b1e
lea ecx, [ebp + 0x50]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0040dd8a
lea ecx, [ebp]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x24]
call fcn.0041d0ba
lea ecx, [ebp + 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x2c]
call fcn.0041d0ba
lea ecx, [ebp + 0x2c]
call fcn.0043092f
cmp dword [ebp + 0x30], ebx
jle 0x424e9a
push ebx
push dword [ebp + 0x30]
call fcn.004731b9
pop ecx
pop ecx
mov ebx, 0x80070057
jmp 0x425527
xor eax, eax
mov al, byte [ebp + 0x6e]
and eax, 0x12
push eax
push ebx
call fcn.004731b9
pop ecx
pop ecx
jmp 0x424ee8
mov dword [ebp + 0x20], 0x80070057
jmp 0x4254cb
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040bba7
push 0x100
push dword [eax]
movsx eax, byte [ebp + 0x67]
push eax
call fcn.00431bb2
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.0043092f
lea ecx, [ebp + 0x50]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0040dd8a
lea ecx, [ebp]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x24]
call fcn.0041d0ba
lea ecx, [ebp + 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x2c]
call fcn.0041d0ba
lea ecx, [ebp + 0x2c]
call fcn.0043092f
cmp dword [ebp + 0x30], ebx
jle 0x425527
push ebx
push dword [ebp + 0x30]
call fcn.004731b9
pop ecx
pop ecx
jmp 0x425527
mov dword [ebp + 0x20], ebx
jmp 0x4254bb
mov dword [ebp + 0x20], 1
jmp 0x4254b3
push dword [ebp + 0x44]
mov ecx, dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.00435749
mov dword [ebp + 0x20], ebx
jmp 0x4254ab
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x5c], ebx
jne 0x425005
mov eax, dword [ebp - 8]
cmp word [eax], bx
jne 0x425005
cmp byte [0x4ace92], bl
jne 0x425005
lea ecx, [ebp + 0x44]
call fcn.0043092f
lea ecx, [ebp + 0x28]
call fcn.0043092f
lea ecx, [ebp + 0x54]
call fcn.0043092f
lea ecx, [ebp + 0x34]
call fcn.0043092f
lea ecx, [ebp + 0x50]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0040dd8a
lea ecx, [ebp]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x24]
call fcn.0041d0ba
lea ecx, [ebp + 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x2c]
call fcn.0041d0ba
lea ecx, [ebp + 0x2c]
call fcn.0043092f
cmp dword [ebp + 0x30], ebx
jle 0x424ffb
push ebx
push dword [ebp + 0x30]
call fcn.004731b9
pop ecx
pop ecx
mov ebx, 0x491
jmp 0x425527
mov esi, dword [ebp - 0x30]
lea eax, [esi + 4]
mov dword [ebp - 0x34], eax
add eax, 0x3c
push eax
lea ecx, [ebp - 4]
call fcn.00435d80
mov eax, dword [ebp + 0x50]
push 0x22
lea edi, [esi + esi]
add eax, edi
push str.System32DRIVERS
push eax
call fcn.004102e0
push dword [ebp + 0x50]
call fcn.0047f62b
add esp, 0x10
test eax, eax
jne 0x425048
push ebx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov eax, dword [ebp + 0x50]
push 8
add eax, edi
push 0x498a40
push eax
call fcn.004102e0
push dword [ebp + 0x50]
call fcn.0047f62b
add esp, 0x10
test eax, eax
jne 0x425073
push ebx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov eax, dword [ebp + 0x50]
push 0xa
add edi, eax
push str.INF_
push edi
call fcn.004102e0
movzx eax, word [0x4ace7c]
shl eax, 0x10
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp - 0x4f8], ebx
mov ecx, 0x93
lea edi, [ebp - 0x4f4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4f8]
push eax
push dword [ebp + 0x70]
lea eax, [ebp + 0x1c]
push eax
mov dword [ebp + 0x1c], ebx
call fcn.0047f714
add esp, 0x18
cmp dword [ebp + 0x1c], ebx
jne 0x4250dc
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x20], 2
call fcn.00402b5c
lea ecx, [ebp - 4]
jmp 0x4254a6
push dword [ebp + 0x70]
lea ecx, [ebp + 0x68]
call fcn.004403c3
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call fcn.0044726b
pop ecx
pop ecx
push 0x494cb0
lea ecx, [ebp + 0x68]
call fcn.00435dd0
mov esi, dword [ebp + 0x60]
cmp esi, ebx
je 0x42510e
cmp word [esi], bx
jne 0x425113
mov esi, 0x4989b8
mov eax, dword [ebp + 0x48]
cmp eax, ebx
je 0x42511f
cmp word [eax], bx
jne 0x425124
mov eax, str.DefaultInstall
push eax
lea ecx, [ebp + 0x40]
call fcn.004403c3
mov edi, 0x4951ec
push edi
lea ecx, [ebp + 0x40]
call fcn.00435dd0
push esi
lea ecx, [ebp + 0x40]
call fcn.00435dd0
push edi
lea ecx, [ebp + 0x40]
call fcn.00435dd0
push dword [ebp + 0x40]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
call edi
push dword [ebp + 0x68]
mov dword [ebp - 0x4c], eax
call edi
mov dword [ebp - 0x2c], eax
test byte [ebp - 0x4f8], 0x10
jne 0x42533d
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp - 0x2c]
mov word [eax + ecx*2], bx
lea eax, [ebp - 0x4cc]
push eax
lea ecx, [ebp + 0x68]
call fcn.00435dd0
mov esi, dword [ebp + 0x68]
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x50], esi
mov byte [ebp + 0x7f], bl
call fcn.00435d62
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], ebx
mov word [eax], bx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
call fcn.00473899
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp + 0x10]
add esp, 0xc
sar eax, 1
cmp dword [ebp - 0x34], eax
jne 0x4251dd
push dword [ebp - 0x34]
push dword [ebp + 0x10]
push dword [ebp + 0x50]
call fcn.0040bb25
add esp, 0xc
test al, al
je 0x4251dd
mov byte [ebp + 0x7f], 1
cmp dword [ebp - 0x28], ebx
je 0x4251e9
mov esi, dword [ebp - 0x10]
cmp esi, ebx
jne 0x4251f8
push dword [ebp + 0x68]
push dword [ebp - 8]
call fcn.0041c942
pop ecx
pop ecx
mov esi, eax
cmp byte [0x4ace92], bl
jne 0x425218
cmp dword [ebp + 0x3c], ebx
jne 0x42522b
cmp byte [ebp + 0x4f], bl
je 0x42520f
cmp byte [ebp + 0x7f], bl
jne 0x42522b
cmp esi, ebx
jne 0x42522b
jmp 0x425335
push dword [ebp + 0x68]
push 0x4989e4
push dword [ebp + 0x18]
call fcn.0040cde2
add esp, 0xc
cmp esi, ebx
mov edi, esi
jne 0x425236
mov edi, 0x4949a4
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x7c], 4
jne 0x4252d4
cmp byte [0x4ace78], bl
je 0x425260
push dword [ebp + 0xc]
push dword [ebp + 0x68]
call fcn.0041294a
pop ecx
pop ecx
jmp 0x42531f
cmp byte [0x4ace91], 3
je 0x425271
cmp byte [0x4ace90], bl
je 0x4252aa
or dword [ebp + 0x7c], 1
cmp byte [0x4ace90], bl
je 0x425288
push edi
push dword [ebp + 0x68]
call fcn.0040d814
jmp 0x42529a
cmp byte [0x4ace91], 3
jne 0x42529f
push edi
push dword [ebp + 0x68]
call fcn.0040d8da
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x5c], ebx
je 0x42531f
test byte [ebp + 0x7c], 2
jne 0x4252ce
or dword [ebp + 0x7c], 2
cmp esi, ebx
je 0x4252c8
push dword [ebp + 0xc]
push dword [ebp + 0x68]
push esi
call fcn.0041285a
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x42531f
test byte [ebp + 0x7c], 1
je 0x425271
test byte [ebp + 0x7c], 4
jne 0x42531f
cmp byte [0x4ace78], bl
jne 0x42524e
cmp byte [0x4ace68], bl
jne 0x42531f
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov word [eax + ecx*2], bx
lea ecx, [ebp + 0x40]
call fcn.00435dd0
push ebx
push dword [ebp + 0x40]
push ebx
push ebx
call fcn.0040dd2c
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 0x5c], eax
jne 0x42531f
cmp dword [0x4ace64], ebx
je 0x42531f
call fcn.0040d6ab
cmp esi, ebx
je 0x425326
mov word [esi], bx
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x425335
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [ebp + 0x10]
call fcn.0043092f
lea eax, [ebp - 0x4f8]
push eax
lea ecx, [ebp + 0x1c]
call fcn.0040466f
test eax, eax
jne 0x425163
lea ecx, [ebp + 0x40]
call fcn.0043092f
lea ecx, [ebp + 0x68]
call fcn.0043092f
lea ecx, [ebp + 0x1c]
call fcn.00402b5c
lea ecx, [ebp - 4]
call fcn.0043092f
lea ecx, [ebp + 0x44]
call fcn.0043092f
lea ecx, [ebp + 0x28]
call fcn.0043092f
lea ecx, [ebp + 0x54]
call fcn.0043092f
lea ecx, [ebp + 0x34]
call fcn.0043092f
lea ecx, [ebp + 0x50]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0040dd8a
lea ecx, [ebp]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x24]
call fcn.0041d0ba
lea ecx, [ebp + 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x2c]
call fcn.0041d0ba
lea ecx, [ebp + 0x2c]
call fcn.0043092f
cmp dword [ebp + 0x30], ebx
jle 0x4253e4
push ebx
push dword [ebp + 0x30]
call fcn.004731b9
pop ecx
pop ecx
mov ebx, dword [ebp + 0x5c]
jmp 0x425527
mov dword [ebp + 0x20], 1
jmp 0x4254ab
mov dword [ebp + 0x20], 0x491
jmp 0x4254ab
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, eax
dec ecx
cmp ecx, 1
jl 0x425431
mov eax, dword [ebp + 0x70]
lea edx, [eax + ecx*2]
xor eax, eax
mov ax, word [edx]
push eax
call fcn.0040bcc9
add esp, 4
test al, al
je 0x425431
mov word [edx], bx
dec ecx
cmp ecx, ebx
jge 0x42543e
mov dword [ebp + 0x20], 0x80070057
jmp 0x4254ab
mov ecx, dword [ebp + 0x48]
cmp ecx, ebx
je 0x42544c
cmp word [ecx], bx
jne 0x42544c
xor ecx, ecx
xor eax, eax
mov al, byte [ebp + 0x3a]
or eax, 0x10
push eax
push ecx
push esi
push dword [ebp + 0x70]
call fcn.0041ca49
add esp, 0x10
mov dword [ebp + 0x20], eax
jmp 0x4254ab
mov dword [ebp + 0x20], 2
jmp 0x42549b
push 0x4949a4
push 0x494d34
push dword [ebp + 0x18]
mov dword [0x4ace80], ebx
call fcn.0040cde2
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.0043092f
lea ecx, [ebp + 4]
call fcn.0043092f
lea ecx, [ebp - 0x20]
call fcn.00402b5c
lea ecx, [ebp - 0x14]
call fcn.0043092f
lea ecx, [ebp + 0x44]
call fcn.0043092f
lea ecx, [ebp + 0x28]
call fcn.0043092f
lea ecx, [ebp + 0x54]
call fcn.0043092f
lea ecx, [ebp + 0x34]
call fcn.0043092f
mov ecx, dword [ebp + 0x18]
push ebx
call fcn.00447ee8
lea ecx, [ebp + 0x50]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0040dd8a
lea ecx, [ebp]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x24]
call fcn.0041d0ba
lea ecx, [ebp + 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x2c]
call fcn.0041d0ba
lea ecx, [ebp + 0x2c]
call fcn.0043092f
cmp dword [ebp + 0x30], ebx
jle 0x425524
push ebx
push dword [ebp + 0x30]
call fcn.004731b9
pop ecx
pop ecx
mov ebx, dword [ebp + 0x20]
mov eax, 0x4ad684
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x74
leave
ret 4