Function at 0x41fb70
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry value
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x13d8]
mov eax, 0x13d8
call fcn.00621970
push 0xffffffffffffffff
push 0x6444f4
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x13d4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044a7d0
call fcn.00448cf0
mov ecx, ebx
call fcn.00418770
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], edi
push 0x75da08
call fcn.00415790
mov eax, dword [0x75da08]
push eax
push 0x678ea8
push 0x75da0c
call fcn.00402f80
add esp, 0x10
mov dword [ebp - 0xc8], 0x400
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp + 0xf94]
push edx
push edi
push edi
push str.szCustomUserAgent
mov eax, dword [0x75dbe4]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x41fc46
lea ecx, [ebp + 0xf94]
push ecx
push 0x678ea8
push 0x75da08
call fcn.00402f80
add esp, 0xc
mov ecx, ebx
call fcn.0041c7a0
mov ecx, ebx
call fcn.0040fe70
cmp dword [0x75dbd4], edi
jne 0x41fd18
mov dword [ebp - 0x30], 0x40
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp + 0x1394]
push eax
push 0
push 0
push str.idmvers
mov ecx, dword [0x75dbe4]
push ecx
call esi
test eax, eax
jne 0x41fd0e
mov edx, dword [0x75dda0]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fc97
sub eax, esi
push eax
push edx
lea edx, [ebp + 0x1394]
push edx
call fcn.0062199b
add esp, 0xc
test eax, eax
je 0x41fcce
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41fcce
cmp byte [eax + 0x51], 0
jne 0x41fcce
mov dword [0x75dbd4], 1
push 8
push str.v6.35b09
lea eax, [ebp + 0x1394]
push eax
call fcn.00624cad
add esp, 0xc
test eax, eax
je 0x41fd02
push 8
push str.v6.35b10
lea ecx, [ebp + 0x1394]
push ecx
call fcn.00624cad
add esp, 0xc
test eax, eax
jne 0x41fd18
mov dword [0x75dbd8], 1
jmp 0x41fd18
mov dword [0x75dbd4], 1
cmp dword [0x75dbb8], edi
je 0x41fd41
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41fd37
cmp byte [eax + 0x51], 0
jne 0x41fd37
cmp dword [0x75dbd4], edi
je 0x41fd41
call fcn.00414430
call fcn.00410000
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41fd58
cmp byte [eax + 0x51], 0
jne 0x41fd58
cmp dword [0x75dbd4], edi
je 0x41fd69
push 1
call fcn.0046d470
push 0
call fcn.00473740
add esp, 8
call fcn.0041b4c0
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp + 0xed0], 0x94
lea edx, [ebp + 0xed0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41fdd0
cmp dword [ebp + 0xee0], 2
jne 0x41fdd0
mov esi, 1
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0xed4], 6
jb 0x41fdd0
mov dword [ebp - 0x28], esi
push 0x80000001
call fcn.00412780
push 0x80000002
call fcn.00412780
add esp, 8
mov dword [ebp - 0x40], 4
test esi, esi
je 0x41ff1d
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.EnableDriver
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fe0a
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov esi, 1
mov dword [ebp - 0xb4], esi
lea edx, [ebp - 0x1c]
push edx
push 0x20019
push 0
push 0x678e18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fe73
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.AdvIntDriverEnabled2
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fe69
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xb4], esi
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], esi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
jne 0x41fed2
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.bVistaAdvInt
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x41fecf
mov eax, 1
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0x4c], eax
push 4
lea edx, [ebp - 0x4c]
push edx
push 4
push 0
push str.bVistaAdvInt
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x41fed2
mov dword [ecx + 0x1c], esi
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
je 0x41ff1d
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
call fcn.004101d0
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x3c], edi
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
sete bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], 1
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push 0
push str.EnableDriver
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41ff3c
cmp byte [eax + 0x51], 0
jne 0x41ff4b
cmp dword [0x75dbd4], 0
je 0x41ffcd
cmp byte [eax + 0x51], 0
jne 0x41ff4b
cmp dword [0x75dbd4], 0
je 0x41ff85
lea ecx, [ebp - 0x18]
call fcn.00500b30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00500b90
test eax, eax
je 0x41ff79
lea ecx, [ebp - 0x18]
call fcn.00500b50
test eax, eax
jne 0x41ff79
push 1
lea ecx, [ebp - 0x18]
call fcn.00501080
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00500b40
mov dword [ebp - 0x2c], 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.DebugFlags
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ffcd
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push str.DebugFlags
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x4201f0
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x18]
call fcn.00500b30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00500b90
test eax, eax
jne 0x420160
xor edi, edi
cmp dword [0x75dbcc], edi
jne 0x420013
push edi
lea ecx, [ebp - 0x18]
call fcn.00501080
lea ecx, [ebp - 0x18]
call fcn.00500c80
mov dword [ebp - 0x20], edi
mov dword [ebp + 0xf64], edi
mov dword [ebp + 0xf6c], edi
xor edx, edx
mov word [ebp + 0xf68], dx
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041e980
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0xf64]
push ecx
mov ecx, esi
call fcn.00417190
test eax, eax
je 0x4200f3
mov ebx, dword [ebp - 0x20]
cmp ebx, 1
je 0x4200f3
xor esi, esi
mov dword [ebp - 0xc0], esi
mov edx, dword [ebp - 0x14]
cmp esi, dword [edx + 0x28]
jge 0x4200f3
mov edi, edx
add edi, 0x20
push esi
mov ecx, edi
call fcn.0045e770
mov eax, dword [eax]
cmp ebx, dword [eax + 8]
jne 0x42015a
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
push esi
mov ecx, edi
call fcn.0045e770
mov eax, dword [eax]
add eax, 0x14
cmp ebx, dword [eax + 8]
jge 0x4200f3
mov eax, dword [ebp + 0xf64]
test eax, eax
je 0x4200b1
mov dword [ebp - 0x1c], eax
jmp 0x4200ba
lea ecx, [ebp + 0xf68]
mov dword [ebp - 0x1c], ecx
push esi
mov ecx, edi
call fcn.0045e770
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d100
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
push eax
call fcn.0062574a
add esp, 8
test eax, eax
jne 0x420154
push esi
mov ecx, edi
call fcn.0045e770
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d100
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], eax
jne 0x420126
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0xbc], eax
push 4
lea edx, [ebp - 0xbc]
push edx
push 4
push eax
push str.AdvancedIntegration
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0041f480
mov dword [0x75da04], 1
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xf64]
call fcn.00401210
mov edi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x70]
jmp 0x4201e1
inc ebx
jmp 0x42008a
inc esi
jmp 0x42005e
cmp dword [ebp - 0x28], 0
je 0x4201e4
call fcn.00516f90
mov esi, eax
test esi, esi
je 0x4201e1
mov dword [ebp - 0xc4], 4
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push str.StEnableBFEMsg
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4201d7
mov dword [ebp - 0x48], 1
push 4
lea ecx, [ebp - 0x48]
push ecx
push 4
push 0
push str.StEnableBFEMsg
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
push 0
push esi
push 0x411280
call fcn.005ffc0d
jmp 0x4201e1
xor ebx, ebx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x3c], edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00500b40
cmp dword [esi + 0x1c], 0
je 0x4205c0
test ebx, ebx
je 0x4205a0
xor esi, esi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x34], esi
je 0x42056a
push esi
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041b880
cmp dword [ebp - 0x28], esi
jne 0x42025c
push 1
mov ecx, ebx
call fcn.0041a4f0
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [0x75da00], 1
mov ecx, ebx
test edi, edi
je 0x42024d
call fcn.00416580
xor edi, edi
mov dword [ebp - 0x3c], edi
jmp 0x420566
call fcn.00410110
xor edi, edi
mov dword [ebp - 0x3c], edi
jmp 0x420566
mov dword [ebp + 0xf88], esi
mov dword [ebp + 0xf90], esi
xor eax, eax
mov word [ebp + 0xf8c], ax
mov byte [ebp - 4], 4
mov eax, dword [0x75dc58]
cmp eax, esi
jne 0x420283
mov eax, 0x75dc5c
push esi
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xf88]
call fcn.00402330
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x42037c
cmp dword [0x75dbd4], esi
jne 0x42037c
cmp byte [eax + 0x29], 0
je 0x42037c
mov edi, 1
mov dword [ebx + 0x4c], edi
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebx + 4]
call fcn.0040db90
test eax, eax
je 0x42054f
push 0x3c
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.00620920
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf88]
cmp eax, esi
je 0x42031f
mov dword [ebp - 0xa0], eax
jmp 0x42032b
lea ecx, [ebp + 0xf8c]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420374
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], edi
jmp 0x42054f
push 0x3c
push esi
lea ecx, [ebp - 0xb0]
push ecx
call fcn.00620920
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf88]
cmp eax, esi
je 0x4203be
mov dword [ebp - 0xa0], eax
jmp 0x4203ca
lea edx, [ebp + 0xf8c]
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._instdriv
mov eax, dword [ebp + 0xf88]
cmp eax, esi
jne 0x420408
lea eax, [ebp + 0xf8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42054f
mov eax, dword [ebp + 0xf88]
cmp eax, esi
jne 0x420428
lea eax, [ebp + 0xf8c]
push esi
push eax
mov ecx, ebx
call fcn.00416340
test al, al
je 0x42054f
lea eax, [ebp - 0xb0]
push eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call esi
test eax, eax
je 0x420549
mov dword [ebp - 0x54], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42047d
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x54], ecx
push 1
mov ecx, dword [ebp - 0x14]
call fcn.004112e0
test eax, eax
je 0x420495
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4c], 2
mov dword [0x75da00], 1
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040db90
test eax, eax
je 0x42054f
push 0x3c
push 0
lea edx, [ebp - 0xb0]
push edx
call fcn.00620920
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf88]
test eax, eax
jne 0x4204fb
lea eax, [ebp + 0xf8c]
mov dword [ebp - 0xa0], eax
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], eax
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea ecx, [ebp - 0xb0]
push ecx
call esi
test eax, eax
je 0x420540
push 0xffffffffffffffff
mov edx, dword [ebp - 0x78]
push edx
call ebx
mov dword [ebp - 0x44], 1
jmp 0x42054f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x3c], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf88]
call fcn.00401210
mov esi, dword [ebp - 0x54]
test esi, esi
jne 0x420571
mov dword [ebp - 0x24], 0
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0xcc], eax
push 4
lea ecx, [ebp - 0xcc]
push ecx
push 4
push 0
push str.lastintres
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x34], 0
je 0x4205c0
test edi, edi
je 0x4205b3
mov ecx, esi
call fcn.00416580
jmp 0x4205c0
cmp dword [ebp - 0x28], 0
jne 0x4205c0
mov ecx, esi
call fcn.00410110
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4205d8
cmp byte [eax + 0x51], 0
jne 0x4205d8
cmp dword [0x75dbd4], 0
je 0x4205df
mov ecx, esi
call fcn.0041cd50
cmp dword [ebp - 0x34], 0
je 0x4205ee
mov dword [ebp - 0x24], 0
jmp 0x4205f4
cmp dword [ebp - 0x24], 0
jne 0x420640
mov dword [ebp - 0x74], 4
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0
push str.NeedChAfRb
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420864
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x24], esi
push str.NeedChAfRb
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420864
push str.NeedChAfRb
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push str.ClChIDMRes
mov ecx, dword [0x75dbe4]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x420688
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push str.ClChIERes
mov ecx, dword [0x75dbe4]
push ecx
call edi
test eax, eax
jne 0x4206b5
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x4206be
cmp ebx, 1
jne 0x420864
mov edi, 1
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x30]
call fcn.00500b30
mov byte [ebp - 4], 5
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
lea ecx, [ebp - 0x30]
call fcn.00500cd0
cmp esi, edi
jne 0x4206f3
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4206f3
xor edi, edi
mov dword [ebp - 0x38], edi
cmp ebx, 1
jne 0x420707
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420707
mov dword [ebp - 0x38], 0
jmp 0x42070f
test edi, edi
jne 0x420803
push 0x50030
mov ecx, dword [0x75f038]
push ecx
mov edx, dword [0x75f048]
push edx
push 0
call fcn.00472fb0
add esp, 0x10
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 4]
call fcn.0040ebf0
mov dword [ebp - 0x18], 0
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.AdvancedIntegration
mov ecx, dword [0x75dbe4]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov dword [edi + 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.00500b30
mov byte [ebp - 4], 6
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
lea ecx, [ebp - 0x4c]
call fcn.00500cd0
mov eax, 1
mov dword [ebp - 0x38], eax
cmp esi, eax
jne 0x420798
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420798
xor eax, eax
mov dword [ebp - 0x38], eax
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x4207b1
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4207b1
mov dword [ebp - 0x38], 0
jmp 0x4207b5
test eax, eax
jne 0x4207f2
mov dword [ebp - 0x18], esi
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
push str.NeedSnRpAfRb
mov edx, dword [0x75dbe4]
push edx
call ebx
push 0x50030
mov eax, dword [0x75f038]
push eax
mov ecx, dword [0x75f04c]
push ecx
push 0
call fcn.00472fb0
add esp, 0x10
push esi
call fcn.004111b0
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.00500b40
jmp 0x420858
push 0x50000
cmp dword [ebp - 0x2c], 1
jne 0x42081d
mov edx, dword [0x75f038]
push edx
mov eax, dword [0x75f078]
push eax
jmp 0x42082b
mov ecx, dword [0x75f038]
push ecx
mov edx, dword [0x75f050]
push edx
push 0
call fcn.00472fb0
add esp, 0x10
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.AdvancedIntegration
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00500b40
cmp dword [ebp - 0x60], 0
jne 0x4208af
mov dword [ebp - 0x5c], 4
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push str.NeedSnRpAfRb
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4208d1
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
push str.NeedSnRpAfRb
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x4208d1
push 0
lea ecx, [ebp]
call fcn.0052d5d0
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.005f647d
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00414f90
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.00410330
push 1
mov ecx, edi
call fcn.0041b880
mov ecx, edi
call fcn.00410100
xor ebx, ebx
test eax, eax
jne 0x420913
push ebx
push ebx
call fcn.00416e50
push ebx
push ebx
mov ecx, edi
call fcn.00416ef0
push ebx
push ebx
mov ecx, edi
call fcn.0041ccc0
push ebx
push ebx
mov ecx, edi
call fcn.00416eb0
mov ecx, edi
cmp dword [edi + 0x1c], ebx
je 0x420923
push 1
call fcn.00414e20
jmp 0x420934
call fcn.00410a40
test eax, eax
jne 0x420934
push ebx
mov ecx, edi
call fcn.0041f480
cmp dword [0x75dbd4], ebx
je 0x420943
mov ecx, edi
call fcn.0041ef30
cmp dword [ebp - 0x34], ebx
je 0x420c3f
lea esi, [edi + 4]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, esi
call fcn.0040db90
test eax, eax
je 0x420aad
cmp dword [ebp - 0x28], ebx
jne 0x42097e
mov ecx, esi
call fcn.0040ebf0
mov dword [ebp - 0x44], 1
jmp 0x420c44
mov dword [ebp + 0xf7c], ebx
mov dword [ebp + 0xf84], ebx
xor edx, edx
mov word [ebp + 0xf80], dx
mov byte [ebp - 4], 8
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x4209a5
mov eax, 0x75dc5c
push ebx
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xf7c]
call fcn.00402330
mov eax, dword [ebp + 0xf7c]
cmp eax, ebx
jne 0x4209cc
lea eax, [ebp + 0xf80]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420a9e
mov eax, dword [ebp + 0xf7c]
cmp eax, ebx
jne 0x4209ec
lea eax, [ebp + 0xf80]
push ebx
push eax
mov ecx, edi
call fcn.00416340
test al, al
je 0x420a9e
push 0x3c
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.00620920
add esp, 0xc
mov dword [ebp - 0x108], 0x3c
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
mov eax, dword [ebp + 0xf7c]
cmp eax, ebx
je 0x420a3f
mov dword [ebp - 0xf8], eax
jmp 0x420a4b
lea ecx, [ebp + 0xf80]
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], str._uninstlsp
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420a97
push 0xffffffffffffffff
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf7c]
call fcn.00401210
cmp dword [ebp - 0x28], ebx
je 0x420c3f
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x420adb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420b16
call fcn.00447810
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
lea ecx, [ebp - 0x5c]
push ecx
push eax
push ebx
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x420c3f
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xf70], ebx
mov dword [ebp + 0xf78], ebx
xor eax, eax
mov word [ebp + 0xf74], ax
mov byte [ebp - 4], 9
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x420b3d
mov eax, 0x75dc5c
push ebx
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xf70]
call fcn.00402330
mov eax, dword [ebp + 0xf70]
cmp eax, ebx
jne 0x420b64
lea eax, [ebp + 0xf74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420c30
mov eax, dword [ebp + 0xf70]
cmp eax, ebx
jne 0x420b84
lea eax, [ebp + 0xf74]
push 1
push eax
mov ecx, edi
call fcn.00416340
test al, al
je 0x420c30
push 0x3c
push ebx
lea ecx, [ebp + 0x1398]
push ecx
call fcn.00620920
add esp, 0xc
mov dword [ebp + 0x1398], 0x3c
mov dword [ebp + 0x139c], 0x40
mov dword [ebp + 0x13a4], str.open
mov eax, dword [ebp + 0xf70]
cmp eax, ebx
je 0x420bd8
mov dword [ebp + 0x13a8], eax
jmp 0x420be4
lea edx, [ebp + 0xf74]
mov dword [ebp + 0x13a8], edx
mov dword [ebp + 0x13b0], ebx
mov dword [ebp + 0x13b4], 3
mov dword [ebp + 0x13b8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp + 0x13a0], eax
mov dword [ebp + 0x13ac], str._uninsttdi
lea eax, [ebp + 0x1398]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420c30
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x13d0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf70]
call fcn.00401210
cmp dword [ebp - 0x44], ebx
je 0x420c5f
push 0x50030
mov edx, dword [0x75f01c]
push edx
mov eax, dword [0x75f070]
push eax
push ebx
call fcn.00472fb0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x13d4]
xor ecx, ebp
call fcn.0062023e
add ebp, 0x13d8
mov esp, ebp
pop ebp
ret