Function at 0x417990
Capabilities:
Check os version
Delete registry key
Delete registry value
Get system information on windows
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468d12
mov eax, dword fs:[0]
push eax
sub esp, 0x5fc
mov eax, dword [0x4a5590]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x17
xor eax, eax
push str.SoftwareAVGAWLSetup_
lea ecx, [ebp - 0x460]
mov byte [edi + 0x504], 0
mov dword [ebp - 0x44c], 7
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
call fcn.0040a100
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x404], 7
mov dword [ebp - 0x408], 0
mov word [ebp - 0x418], ax
push 0x11
push str.SoftwareAVGAWL_
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.004092b0
xor eax, eax
mov dword [ebp - 0x3d4], 7
mov dword [ebp - 0x3d8], 0
mov word [ebp - 0x3e8], ax
push 0x15
push str.SoftwareAVGAWL2015_
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 2
call fcn.004092b0
push 0x11c
lea eax, [ebp - 0x580]
push 0
push eax
call fcn.00450d00
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x580]
push eax
mov dword [ebp - 0x580], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x417fb9
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x57c]
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417afa
xor ecx, ecx
jmp 0x417b12
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417b03
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x18]
push eax
mov ecx, esi
call fcn.004092b0
push 1
push 0x47bd64
mov ecx, esi
call fcn.004092b0
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x578]
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417b5c
xor ecx, ecx
jmp 0x417b74
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417b65
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004092b0
push 1
push 0x47bd64
mov ecx, esi
call fcn.004092b0
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x574]
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417bbb
xor ecx, ecx
jmp 0x417bd3
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417bc4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004092b0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
cmp esi, ebx
je 0x417c20
cmp dword [esi + 0x14], 8
jb 0x417c05
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x417c37
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
movzx eax, word [ebp - 0x46c]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417c63
xor ecx, ecx
jmp 0x417c7f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417c70
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x78]
push eax
mov ecx, esi
call fcn.004092b0
push 1
push 0x47bd64
mov ecx, esi
call fcn.004092b0
movzx eax, word [ebp - 0x46a]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417ccb
xor ecx, ecx
jmp 0x417ce3
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417cd4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004092b0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
cmp esi, ebx
je 0x417d30
cmp dword [esi + 0x14], 8
jb 0x417d15
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x417d47
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
cmp dword [ebp - 0x57c], 5
jbe 0x417dff
push str.GetProductInfo
push str.kernel32.dll
mov dword [ebp - 0x5d0], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417f09
lea ecx, [ebp - 0x5d0]
push ecx
movzx ecx, word [ebp - 0x46a]
push ecx
movzx ecx, word [ebp - 0x46c]
push ecx
push dword [ebp - 0x578]
push dword [ebp - 0x57c]
call eax
test eax, eax
je 0x417f09
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x5d0]
call fcn.0044e181
add esp, 0x10
lea eax, [ebp - 0x218]
lea esi, [edi + 0xa8]
push eax
mov ecx, esi
call fcn.004093e0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
push eax
mov ecx, esi
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
jmp 0x417f09
xor eax, eax
cmp byte [ebp - 0x466], 1
jne 0x417e5a
lea esi, [eax + 4]
mov eax, dword [ebp - 0x468]
test eax, 0x200
je 0x417e21
mov esi, 1
jmp 0x417e2a
test al, 0x40
je 0x417e2a
mov esi, 8
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x57
call ebx
test eax, eax
je 0x417e3f
mov eax, 9
jmp 0x417e5a
push 0x56
call ebx
test eax, eax
je 0x417e4e
mov eax, 7
jmp 0x417e5a
push 0x58
call ebx
neg eax
sbb eax, eax
not eax
and eax, esi
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417e7f
xor ecx, ecx
jmp 0x417e9f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x417e90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417e90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0xa8]
push eax
mov ecx, esi
call fcn.004092b0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
cmp esi, ebx
je 0x417ef2
cmp dword [esi + 0x14], 8
jb 0x417ed7
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x417f09
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
movzx eax, word [ebp - 0x468]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e181
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417f35
xor ecx, ecx
jmp 0x417f4f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417f40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0xd8]
push eax
mov ecx, esi
call fcn.004092b0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
cmp esi, ebx
je 0x417fa2
cmp dword [esi + 0x14], 8
jb 0x417f87
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x417fb9
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x604], 9
mov edx, 0x47be44
je 0x417fda
mov edx, 0x47b7f0
xor eax, eax
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
cmp word [edx], ax
jne 0x418000
xor ecx, ecx
jmp 0x418014
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418005
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3b8]
call fcn.0040a100
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x3d0]
push eax
mov byte [ebp - 4], 3
call fcn.00415a30
mov ebx, eax
lea esi, [edi + 0x48]
cmp esi, ebx
je 0x41806c
cmp dword [esi + 0x14], 8
jb 0x418051
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3bc], 8
jb 0x418083
push dword [ebp - 0x3d0]
call fcn.0044d5f9
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3a4], 8
mov dword [ebp - 0x3bc], 7
mov dword [ebp - 0x3c0], 0
mov word [ebp - 0x3d0], ax
jb 0x4180b7
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [ebp - 0x434], 7
mov dword [ebp - 0x438], 0
mov word [ebp - 0x448], ax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.00415930
test al, al
je 0x41815c
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
lea esi, [edi + 0x108]
cmp esi, ebx
je 0x418145
cmp dword [esi + 0x14], 8
jb 0x41812a
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x41815c
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.00415930
test al, al
je 0x4181e0
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
lea esi, [edi + 0x138]
cmp esi, ebx
je 0x4181c9
cmp dword [esi + 0x14], 8
jb 0x4181ae
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x4181e0
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
lea eax, [ebp - 0x3d0]
push eax
call fcn.00415870
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 5
call fcn.00415a30
mov ebx, eax
lea esi, [edi + 0x168]
cmp esi, ebx
je 0x418234
cmp dword [esi + 0x14], 8
jb 0x418219
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x41824b
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x418283
push dword [ebp - 0x3d0]
call fcn.0044d5f9
add esp, 4
push 0xd
lea ebx, [edi + 0x538]
push 0x47be48
mov ecx, ebx
call fcn.0040a100
push ebx
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
lea esi, [edi + 0x198]
cmp esi, ebx
je 0x4182db
cmp dword [esi + 0x14], 8
jb 0x4182c0
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x4182f2
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor bl, bl
cmp dword [edi + 0x560], 0
mov byte [ebp - 0x5c5], bl
jne 0x4185a6
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418322
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418460
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5d0]
push eax
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41844c
cmp dword [ebp - 0x5d0], 1
jne 0x418417
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x418411
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call eax
push esi
lea ecx, [ebp - 0x3b8]
call fcn.0040a200
push eax
lea ecx, [edi + 0x550]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push esi
call fcn.0044d5ca
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
mov bl, byte [ebp - 0x5c5]
cmp dword [edi + 0x560], 0
je 0x41844c
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
push eax
lea ecx, [edi + 0x1f8]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
mov bl, 1
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x4185dc
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418475
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
jne 0x4185dc
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5d0]
push eax
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x418598
cmp dword [ebp - 0x5d0], 1
jne 0x418565
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x418565
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call eax
push esi
lea ecx, [ebp - 0x3b8]
call fcn.0040a200
push eax
lea ecx, [edi + 0x550]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push esi
call fcn.0044d5ca
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
cmp dword [edi + 0x560], 0
je 0x418598
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
push eax
lea ecx, [edi + 0x1f8]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4185dc
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
push eax
lea ecx, [edi + 0x1f8]
call fcn.00409220
cmp dword [ebp - 0x3a4], 8
jb 0x4185dc
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
cmp dword [ebp - 0x44c], 8
mov eax, dword [ebp - 0x460]
jae 0x4185f1
lea eax, [ebp - 0x460]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x2001b
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x418a69
push 0x47ac50
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 0x5c5], al
call fcn.0040a200
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0
mov byte [ebp - 4], 6
push 0x47ac50
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5d0], 0x80
call esi
test eax, eax
jne 0x4186bc
cmp dword [ebp - 0x5e0], 1
jne 0x4186bc
mov eax, dword [ebp - 0x5d0]
test eax, eax
je 0x4186bc
shr eax, 1
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x2a0]
push 0x41
push eax
call fcn.0044ebc0
add esp, 0x10
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
setns bl
mov byte [ebp - 0x5c5], bl
test bl, bl
jne 0x4189c9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.TUU2011
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x4187cd
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5d4], eax
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5d4]
push eax
push 0
push 0x47ac50
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x41892b
cmp dword [ebp - 0x5d4], 1
jne 0x41892b
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41892b
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47ac50
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x418922
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0
push ebx
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5cc], 0x80
call esi
test eax, eax
jne 0x418922
cmp dword [ebp - 0x5d8], 1
jne 0x418922
mov eax, dword [ebp - 0x5cc]
jmp 0x4188d1
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.TUU2010
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x418937
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0x47ac50
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x41892b
cmp dword [ebp - 0x5cc], 1
jne 0x41892b
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41892b
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47ac50
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x418922
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0
push ebx
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5d4], 0x80
call esi
test eax, eax
jne 0x418922
cmp dword [ebp - 0x5d8], 1
jne 0x418922
mov eax, dword [ebp - 0x5d4]
test eax, eax
je 0x418922
shr eax, 1
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x2a0]
push 0x41
push eax
call fcn.0044ebc0
add esp, 0x10
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2a0]
push eax
mov eax, dword [sym.imp.ole32.dll_IIDFromString]
call eax
test eax, eax
js 0x418922
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 0x5c5], 1
call fcn.00409260
push ebx
call fcn.0044d5ca
add esp, 4
push dword [ebp - 0x5c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3a8], 0
je 0x4189bc
mov esi, dword [ebp - 0x3a4]
mov edx, dword [ebp - 0x3b8]
mov ecx, edx
cmp esi, 8
jae 0x41895d
lea ecx, [ebp - 0x3b8]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418960
sub ecx, ebx
sar ecx, 1
cmp esi, 8
jae 0x41897a
lea edx, [ebp - 0x3b8]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x47ac50
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4189bc
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.TUU2011
push dword [ebp - 0x5bc]
call esi
push str.TUU2010
push dword [ebp - 0x5bc]
call esi
cmp byte [ebp - 0x5c5], 0
je 0x418a42
rol word [ebp - 0x3f4], 8
mov ecx, dword [ebp - 0x3f8]
mov edx, ecx
rol word [ebp - 0x3f2], 8
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebp - 0x3f8], edx
push 0x10
lea edx, [ebp - 0x3f8]
lea ecx, [ebp - 0x3d0]
call fcn.00415b70
add esp, 4
lea ecx, [edi + 0x258]
push eax
call fcn.00409220
cmp dword [ebp - 0x3bc], 8
jb 0x418a42
push dword [ebp - 0x3d0]
call fcn.0044d5f9
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3a4], 8
jb 0x418a69
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
push str.AWL2015
lea ecx, [ebp - 0x3b8]
call fcn.0040a200
mov ebx, eax
lea esi, [edi + 0x288]
cmp esi, ebx
je 0x418ab0
cmp dword [esi + 0x14], 8
jb 0x418a95
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x418ac7
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
mov ecx, esi
call fcn.00413840
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
mov ebx, eax
cmp esi, ebx
je 0x418b0c
cmp dword [esi + 0x14], 8
jb 0x418af1
push dword [esi]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c10
cmp dword [ebp - 0x3a4], 8
jb 0x418b23
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
lea eax, [ebp - 0x3d0]
push eax
call fcn.00416480
mov byte [ebp - 4], 7
cmp dword [ebp - 0x3bc], 8
mov eax, dword [ebp - 0x3d0]
jae 0x418b48
lea eax, [ebp - 0x3d0]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x47ac50
push str.TUAppMode
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x418bec
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x400]
call fcn.0040a200
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 8
call fcn.00415a30
push eax
lea ecx, [edi + 0x2b8]
call fcn.00409220
cmp dword [ebp - 0x3a4], 8
jb 0x418bb8
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3ec], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x418bec
push dword [ebp - 0x400]
call fcn.0044d5f9
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
jb 0x418c07
push dword [ebp - 0x3d0]
call fcn.0044d5f9
add esp, 4
cmp dword [edi + 0x530], 0
jne 0x418f6e
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418c29
lea eax, [ebp - 0x3e8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x418db3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x418ce2
cmp dword [ebp - 0x5c4], 1
jne 0x418da1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x418da1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.CurSID
jmp 0x418d64
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push 0x47bed8
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x418da1
cmp dword [ebp - 0x5c4], 1
jne 0x418da1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x418da1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push 0x47bed8
push dword [ebp - 0x5bc]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call eax
test eax, eax
jne 0x418d98
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.0040a200
push eax
lea ecx, [edi + 0x520]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push ebx
call fcn.0044d5ca
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [edi + 0x530], 0
jne 0x418f6e
lea eax, [ebp - 0x5bc]
push eax
push 0x2001f
push 0
push str.SoftwareAVGAWL_
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x418f6e
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418eb0
cmp dword [ebp - 0x5cc], 1
jne 0x418eb0
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x418eb0
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418ea7
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.0040a200
push eax
lea ecx, [edi + 0x520]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push ebx
call fcn.0044d5ca
add esp, 4
cmp dword [edi + 0x530], 0
je 0x418f51
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418ed2
lea eax, [ebp - 0x3e8]
push 0
lea ecx, [ebp - 0x5d4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x418f51
cmp dword [edi + 0x534], 8
lea edx, [edi + 0x520]
jb 0x418f0b
mov ecx, dword [edx]
jmp 0x418f0d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418f10
sub ecx, esi
sar ecx, 1
cmp dword [edx + 0x14], 8
jb 0x418f27
mov edx, dword [edx]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.CurSID
push dword [ebp - 0x5d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3d0]
call fcn.0040a200
lea ecx, [edi + 0x520]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 9
call fcn.00409ac0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418fa1
mov eax, dword [eax]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
sete bl
cmp dword [ebp - 0x3a4], 8
jb 0x418fd8
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x419010
push dword [ebp - 0x3d0]
call fcn.0044d5f9
add esp, 4
test bl, bl
je 0x419439
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.Download
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41910e
cmp dword [ebp - 0x5c0], 1
jne 0x41910e
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41910e
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.Download
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419105
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040a200
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xa
call fcn.00415a30
push eax
lea ecx, [edi + 0x3a8]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.0040a2c0
push ebx
call fcn.0044d5ca
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push 0x47b83c
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419204
cmp dword [ebp - 0x5c0], 1
jne 0x419204
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x419204
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47b83c
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4191fb
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040a200
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xb
call fcn.00415a30
push eax
lea ecx, [edi + 0x378]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.0040a2c0
push ebx
call fcn.0044d5ca
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.tbar
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419337
cmp dword [ebp - 0x5c0], 1
jne 0x419337
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x419337
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.tbar
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41932e
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.0040a200
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x3a8], 0
je 0x41931f
lea edx, [ebp - 0x3b8]
lea ecx, [ebp - 0x400]
call fcn.00413890
mov byte [ebp - 4], 0xd
push dword [ebp - 0x3a8]
mov ecx, eax
call fcn.00406910
mov edx, eax
lea ecx, [ebp - 0x3d0]
call fcn.00415b70
add esp, 4
lea ecx, [edi + 0x438]
push eax
call fcn.00409220
lea ecx, [ebp - 0x3d0]
call fcn.0040a2c0
lea ecx, [ebp - 0x400]
call fcn.004068e0
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 4
call fcn.0040a2c0
push ebx
call fcn.0044d5ca
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push 0x47b860
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41942d
cmp dword [ebp - 0x5c0], 1
jne 0x41942d
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41942d
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47b860
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419424
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040a200
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xe
call fcn.00415a30
push eax
lea ecx, [edi + 0x498]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.0040a2c0
push ebx
call fcn.0044d5ca
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x404], 8
mov eax, dword [ebp - 0x418]
jae 0x41944e
lea eax, [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x4194a1
cmp dword [ebp - 0x404], 8
mov eax, dword [ebp - 0x418]
jae 0x419483
lea eax, [ebp - 0x418]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x4195f2
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.RegistrationMail
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4195e6
cmp dword [ebp - 0x5cc], 1
jne 0x4195e6
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x4195e0
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
mov dword [ebp - 0x5d0], esi
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push esi
push 0
push 0
push str.RegistrationMail
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4195d7
push eax
push eax
push eax
push eax
push ebx
push esi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x5d4], eax
test eax, eax
jle 0x4195d7
push eax
call fcn.0044bd80
add esp, 4
mov esi, eax
push 0
push 0
push dword [ebp - 0x5d4]
push esi
push ebx
push dword [ebp - 0x5d0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x5d4]
mov edx, esi
lea ecx, [ebp - 0x3b8]
call fcn.00415b70
add esp, 4
lea ecx, [edi + 0x3d8]
push eax
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push esi
call fcn.0044d5ca
mov esi, dword [ebp - 0x5d0]
add esp, 4
push esi
call fcn.0044d5ca
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419607
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x419665
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419636
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x419665
push 0x47ac50
lea ecx, [edi + 0x568]
call fcn.00409260
jmp 0x419764
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.ProductKey
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419758
cmp dword [ebp - 0x5cc], 1
jne 0x419758
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x419758
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.ProductKey
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419749
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.0040a200
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415fe0
push eax
lea ecx, [edi + 0x228]
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
push ebx
lea ecx, [edi + 0x568]
call fcn.00409260
push ebx
call fcn.0044d5ca
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
lea esi, [edi + 0x2e8]
push 0x47bf10
mov ecx, esi
call fcn.0040a100
push 7
push str.AWL2015
mov ecx, esi
call fcn.004092b0
mov ecx, esi
call fcn.00413840
push 0x47bf18
lea ecx, [ebp - 0x430]
call fcn.0040a200
mov byte [ebp - 4], 0xf
cmp byte [edi + 0x5b0], 0
je 0x4197c1
push 2
push 0x47bf20
lea ecx, [ebp - 0x430]
call fcn.0040a100
jmp 0x419937
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x4197d6
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x419834
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419805
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x419834
push 0x47bf18
lea ecx, [ebp - 0x430]
call fcn.00409260
jmp 0x419937
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.PKStatus
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41990b
cmp dword [ebp - 0x5cc], 1
jne 0x41992b
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x41992b
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x5d8], eax
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.PKStatus
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419900
push ebx
lea ecx, [ebp - 0x430]
call fcn.00409260
push 0x47bf3c
lea ecx, [ebp - 0x430]
call fcn.004093e0
push ebx
call fcn.0044d5ca
add esp, 4
jmp 0x41992b
cmp dword [edi + 0x578], 0
lea ecx, [ebp - 0x430]
je 0x419921
push 0x47bf40
jmp 0x419926
push 0x47bf48
call fcn.00409260
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00409560
cmp dword [edi + 0x560], 0
je 0x4199b9
cmp dword [edi + 0x564], 8
lea ebx, [edi + 0x550]
jb 0x419965
mov eax, dword [ebx]
jmp 0x419967
mov eax, ebx
mov ecx, str.silent
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x419996
test dx, dx
je 0x419992
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x419996
add eax, 4
add ecx, 4
test dx, dx
jne 0x419970
xor eax, eax
jmp 0x41999b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4199b9
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00409560
push 0x47bf3c
mov ecx, esi
call fcn.004093e0
jmp 0x4199c7
push 6
push str.xx_xx_
mov ecx, esi
call fcn.004092b0
push 0xffffffffffffffff
push 0
lea ebx, [edi + 0x520]
push ebx
mov ecx, esi
call fcn.00409560
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3d0]
call fcn.0040a200
push ebx
mov edx, eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x10
call fcn.00409ac0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x419a06
mov eax, dword [eax]
lea ecx, [ebp - 0x5bc]
push ecx
push 0xf003f
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
sete bl
cmp dword [ebp - 0x3a4], 8
jb 0x419a3d
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x419a75
push dword [ebp - 0x3d0]
call fcn.0044d5f9
add esp, 4
test bl, bl
je 0x419ad5
cmp dword [esi + 0x14], 8
jb 0x419a83
mov ecx, dword [esi]
jmp 0x419a85
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x419a90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419a90
sub ecx, edx
sar ecx, 1
cmp dword [esi + 0x14], 8
jb 0x419aa9
mov edx, dword [esi]
jmp 0x419aab
mov edx, esi
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.x_sid
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00413840
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
push eax
mov ecx, esi
call fcn.00409220
cmp dword [ebp - 0x3a4], 8
jb 0x419b08
push dword [ebp - 0x3b8]
call fcn.0044d5f9
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5bc]
push eax
push 0x20019
push 0
push str.SoftwareAVGAWLSIDData_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x419e66
xor ebx, ebx
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], 0x104
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], ebx
mov word [ebp - 0x3b8], ax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
mov byte [ebp - 4], 0x11
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x419de8
jmp 0x419b90
push 0x19
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3b8]
call fcn.0040a100
cmp word [ebp - 0x218], 0
jne 0x419bb0
xor ecx, ecx
jmp 0x419bcf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419bc0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.004092b0
cmp dword [ebp - 0x3a4], 8
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
jae 0x419c0b
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x5c4]
push ecx
push 0xf003f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x419d96
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.x_sid
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419cef
cmp dword [ebp - 0x5cc], 1
jne 0x419d84
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x419d84
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bd80
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.x_sid
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419cdb
push ebx
lea ecx, [edi + 0x348]
call fcn.004093e0
push 0x47bf70
lea ecx, [edi + 0x348]
call fcn.004093e0
push ebx
call fcn.0044d5ca
mov ebx, dword [ebp - 0x5d4]
add esp, 4
jmp 0x419d84
cmp eax, 2
jne 0x419d84
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3d0]
call fcn.0040a200
push 0
push 0x47bf74
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x12
call fcn.0041a400
cmp eax, 0xffffffff
je 0x419d4b
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3d0]
push eax
lea ecx, [edi + 0x348]
call fcn.00409560
push 0x47bf70
lea ecx, [edi + 0x348]
call fcn.004093e0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x3bc]
cmp eax, 8
jb 0x419d6d
inc eax
push eax
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x5c5]
call fcn.0040a260
push 0
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x3bc], 7
call fcn.0040a290
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x208
lea eax, [ebp - 0x218]
push 0
inc ebx
push eax
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], 0x104
call fcn.00450d00
add esp, 0xc
lea eax, [ebp - 0x5d0]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x419b90
lea esi, [edi + 0x348]
mov ecx, esi
call fcn.00409500
test al, al
jne 0x419e45
lea eax, [ebp - 0x5d8]
push eax
mov ecx, esi
call fcn.00409bb0
mov ecx, eax
call fcn.0041a450
push dword [eax]
lea eax, [ebp - 0x5e0]
push eax
mov ecx, esi
call fcn.0041a3c0
mov ecx, esi
call fcn.00413840
push esi
lea eax, [ebp - 0x3d0]
push eax
call fcn.00415a30
push eax
mov ecx, esi
call fcn.00409220
lea ecx, [ebp - 0x3d0]
call fcn.0040a2c0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0xf
call fcn.0040a2c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x47ac50
push 0x47ac50
push 0
push ecx
lea ecx, [edi + 0x598]
call fcn.00409be0
push eax
lea ecx, [edi + 0x538]
call fcn.00409be0
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00408900
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x13
call fcn.00408e10
lea ebx, [edi + 0x468]
push eax
mov ecx, ebx
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
mov ecx, ebx
call fcn.00409500
test al, al
jne 0x419f8b
mov edx, ebx
lea ecx, [ebp - 0x3d0]
call fcn.00413890
mov esi, eax
mov ecx, ebx
mov byte [ebp - 4], 0x14
call fcn.004094f0
push eax
mov ecx, esi
call fcn.00406910
mov edx, eax
lea ecx, [ebp - 0x3b8]
call fcn.00415b70
add esp, 4
mov ecx, ebx
push eax
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x13
call fcn.004068e0
lea eax, [ebp - 0x5bc]
push eax
push 0x2001b
push 0
lea ecx, [ebp - 0x3e8]
call fcn.00409be0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x419f8b
mov ecx, ebx
call fcn.004094f0
lea eax, [eax*2 + 2]
push eax
mov ecx, ebx
call fcn.00409be0
push eax
push 1
push 0
push 0x47bf8c
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5bc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x3e8]
call fcn.00409be0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41a13b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push str.CurRIT
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41a094
cmp dword [ebp - 0x5c4], 4
jne 0x41a094
cmp dword [ebp - 0x5c0], eax
jbe 0x41a094
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0
push str.CurRIT
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 4
call esi
test eax, eax
jne 0x41a094
push ecx
mov ecx, dword [ebp - 0x5cc]
lea edx, [ebp - 0x3cc]
call fcn.0041aaf0
add esp, 4
lea esi, [edi + 0x408]
push str.tcp2_
mov ecx, esi
call fcn.004093e0
lea eax, [ebp - 0x3cc]
push eax
mov ecx, esi
call fcn.004093e0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a30
push eax
mov ecx, esi
call fcn.00409220
lea ecx, [ebp - 0x3b8]
call fcn.0040a2c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, ebx
call fcn.00409500
test al, al
je 0x41a12f
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push 0x47bf8c
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41a12f
cmp dword [ebp - 0x5c4], 1
jne 0x41a12f
mov eax, dword [ebp - 0x5c0]
test eax, eax
je 0x41a12f
push eax
lea ecx, [ebp - 0x5dc]
call fcn.0041a500
push ecx
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x15
call fcn.0041a560
mov esi, eax
lea eax, [ebp - 0x5c0]
push eax
push esi
push 0
push 0
push 0x47bf8c
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a120
push esi
mov ecx, ebx
call fcn.00409260
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x13
call fcn.0041a530
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.00416a10
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0xf
call fcn.004089a0
lea ecx, [ebp - 0x430]
call fcn.0040a2c0
lea ecx, [ebp - 0x448]
call fcn.0040a2c0
lea ecx, [ebp - 0x3e8]
call fcn.0040a2c0
lea ecx, [ebp - 0x418]
call fcn.0040a2c0
lea ecx, [ebp - 0x460]
call fcn.0040a2c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044c2ed
mov esp, ebp
pop ebp
ret