Function at 0x402ec0
Capabilities:
Accept command line arguments
Create a process with modified i/o handles and window
Create process on windows
Delete file
Query or enumerate registry value
Read file on windows
Reference sql statements
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xab8
push esi
push edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x14]
mov ecx, eax
call fcn.004040c0
mov esi, dword [esp + 0x14]
mov edi, eax
cmp esi, 1
jne 0x402f53
push 0x5c
push dword [edi]
call fcn.00404750
add esp, 8
test eax, eax
je 0x402f53
push 0x40
push eax
call fcn.00404690
mov esi, eax
add esp, 8
test esi, esi
je 0x402f4f
push 0x2e
push esi
call fcn.00404750
add esp, 8
test eax, eax
je 0x402f29
mov byte [eax], 0
mov byte [esi], 0x20
inc esi
mov al, byte [esi]
test al, al
je 0x402f42
cmp al, 0x2b
jne 0x402f3a
mov byte [esi], 0x20
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402f33
mov ecx, dword [edi]
lea edx, [esp + 0x14]
call fcn.004040c0
mov edi, eax
mov esi, dword [esp + 0x14]
push 0x4054ac
mov edx, edi
mov ecx, esi
call fcn.00404050
xor ecx, ecx
add esp, 4
test eax, eax
mov edx, edi
setne cl
mov dword [esp + 0x18], ecx
mov ecx, esi
push 0x4054b0
call fcn.00404050
add esp, 4
mov ecx, 2
test eax, eax
mov edx, edi
mov eax, dword [esp + 0x18]
cmovne eax, ecx
mov ecx, esi
push 0x4054b4
mov dword [esp + 0x1c], eax
call fcn.00404050
add esp, 4
mov ecx, 3
test eax, eax
mov edx, edi
mov eax, dword [esp + 0x18]
cmovne eax, ecx
mov ecx, esi
push 0x4054b8
mov dword [esp + 0x1c], eax
call fcn.00404050
mov dword [esp + 0x28], eax
mov esi, 1
mov eax, dword [esp + 0x18]
add esp, 4
dec eax
mov byte [esp + 0xf0], 0
mov dword [esp + 0x20], eax
cmp eax, esi
jle 0x4031d1
nop dword [eax + eax]
mov edx, dword [edi + esi*4]
lea eax, [edi + esi*4]
mov dword [esp + 0x28], eax
mov al, byte [edx]
cmp al, 0x2d
je 0x403004
cmp al, 0x2f
jne 0x403031
inc edx
cmp byte [edx], 0
je 0x403031
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403013
sub ecx, dword [esp + 0x10]
push ecx
push edx
push str.platform
call fcn.004046f0
add esp, 0xc
test eax, eax
je 0x40303d
inc esi
cmp esi, dword [esp + 0x20]
jl 0x402ff0
jmp 0x4031d1
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 4]
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x403047
sub esi, edx
mov eax, 0xff
cmp esi, eax
cmovg esi, eax
lea eax, [esp + 0xf0]
push esi
mov byte [esp + esi + 0xf4], 0
push dword [ecx + 4]
push eax
call fcn.00404630
add esp, 0xc
test esi, esi
je 0x4031d1
lea eax, [esp + 0xf0]
push 0x4054c8
push eax
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403190
lea eax, [esp + 0xf0]
push str.i386
push eax
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403190
lea eax, [esp + 0xf0]
push 0x4054d4
push eax
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403190
lea eax, [esp + 0xf0]
push str.Intel
push eax
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403190
lea eax, [esp + 0xf0]
push 0x4054e0
push eax
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403141
lea eax, [esp + 0xf0]
push 0x4054e4
push eax
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403141
lea eax, [esp + 0xf0]
push str.x86_64
push eax
call fcn.004046c0
add esp, 8
test eax, eax
jne 0x4031d1
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.KERNEL32
call eax
test eax, eax
je 0x403e4f
push str.IsWow64Process
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov esi, eax
test esi, esi
je 0x403e4f
lea eax, [esp + 0x10]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push eax
call esi
test eax, eax
je 0x403e4f
cmp dword [esp + 0x10], 0
je 0x403e4f
jmp 0x4031d1
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.KERNEL32
call eax
test eax, eax
je 0x4031d1
push str.IsWow64Process
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov esi, eax
test esi, esi
je 0x4031d1
lea eax, [esp + 0x10]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
push eax
call esi
test eax, eax
je 0x4031d1
cmp dword [esp + 0x10], 0
jne 0x403e4f
mov esi, dword [esp + 0x14]
mov edx, edi
push 0x4054f0
mov ecx, esi
call fcn.00404050
add esp, 4
test eax, eax
jne 0x403207
push str.quiet
mov edx, edi
mov ecx, esi
call fcn.00404050
add esp, 4
mov dword [esp + 0x2c], 0
test eax, eax
je 0x40320f
mov dword [esp + 0x2c], 1
push 0x4054fc
mov edx, edi
mov ecx, esi
call fcn.00404050
add esp, 4
test eax, eax
jne 0x403241
push str.fast
mov edx, edi
mov ecx, esi
call fcn.00404050
add esp, 4
mov dword [esp + 0x28], 0
test eax, eax
je 0x403249
mov dword [esp + 0x28], 1
mov edx, 1
xor esi, esi
cmp dword [esp + 0x20], edx
jle 0x403297
mov ecx, dword [edi + edx*4]
mov al, byte [ecx]
cmp al, 0x2d
je 0x403263
cmp al, 0x2f
jne 0x403290
mov al, byte [ecx + 1]
cmp al, 0x76
je 0x40326e
cmp al, 0x56
jne 0x403290
mov ecx, dword [edi + edx*4 + 4]
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403280
sub ecx, dword [esp + 0x10]
add esi, 3
add esi, ecx
inc edx
cmp edx, dword [esp + 0x20]
jl 0x403256
cmp dword [esp + 0x2c], 0
lea ecx, [esi + 0x25]
cmove ecx, esi
cmp dword [esp + 0x28], 0
lea eax, [ecx + 0xc]
cmove eax, ecx
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x40345a
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0xc], ecx
cmp eax, 1
jle 0x4033ee
add edi, 8
dec eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], eax
nop dword [eax + eax]
mov edx, dword [edi - 4]
mov al, byte [edx]
cmp al, 0x2d
je 0x403301
cmp al, 0x2f
jne 0x4033dc
mov al, byte [edx + 1]
cmp al, 0x76
je 0x403310
cmp al, 0x56
jne 0x4033dc
test ecx, ecx
jle 0x40331d
mov byte [ecx + esi], 0x20
inc ecx
mov dword [esp + 0xc], ecx
push 0x20
push dword [edi]
call fcn.00404690
mov edx, dword [edi]
add esp, 8
test eax, eax
jne 0x403359
mov ecx, dword [esp + 0xc]
add esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi], al
lea esi, [esi + 1]
test al, al
jne 0x403335
mov edx, dword [edi]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x403348
sub edx, esi
mov esi, dword [esp + 0x14]
add ecx, edx
jmp 0x4033d8
push 0x3d
push edx
call fcn.00404690
mov edi, eax
add esp, 8
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test edi, edi
jne 0x403378
mov ecx, dword [esp + 0xc]
mov edi, eax
jmp 0x40339a
inc edi
mov esi, edi
sub esi, eax
push esi
push eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x1c]
push eax
call fcn.00404630
mov ecx, dword [esp + 0x18]
add esp, 0xc
add ecx, esi
mov esi, dword [esp + 0x14]
mov byte [ecx + esi], 0x22
mov edx, edi
inc ecx
mov eax, ecx
sub eax, edi
add eax, esi
mov dword [esp + 0xc], eax
mov esi, eax
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edx + esi - 1], al
test al, al
jne 0x4033b0
mov esi, dword [esp + 0x14]
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4033c4
sub edi, edx
add ecx, edi
mov edi, dword [esp + 0x20]
mov byte [ecx + esi], 0x22
inc ecx
mov dword [esp + 0xc], ecx
add edi, 4
sub dword [esp + 0x10], 1
mov dword [esp + 0x20], edi
jne 0x4032f0
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x40342b
test ecx, ecx
jle 0x4033ff
mov byte [ecx + esi], 0x20
inc ecx
movups xmm0, xmmword [str.PROP_SILENCE2_REBOOTReallySuppress]
movups xmmword [ecx + esi], xmm0
movups xmm0, xmmword [0x405518]
movups xmmword [ecx + esi + 0x10], xmm0
mov eax, dword [0x405528]
mov dword [ecx + esi + 0x20], eax
mov al, byte [0x40552c]
mov byte [ecx + esi + 0x24], al
add ecx, 0x24
cmp dword [esp + 0x28], 0
je 0x403454
test ecx, ecx
jle 0x40343b
mov byte [ecx + esi], 0x20
inc ecx
movq xmm0, qword [str.PROP_FAST1]
movq qword [ecx + esi], xmm0
mov eax, dword [0x405538]
mov dword [ecx + esi + 8], eax
add ecx, 0xb
mov byte [ecx + esi], 0
jmp 0x40345e
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0x40350d
cmp dword [esp + 0x24], edi
jne 0x40350d
cmp dword [esp + 0x18], edi
jne 0x40350d
call section..text
test eax, eax
jne 0x40350d
push 0x100
lea eax, [esp + 0x8c4]
push eax
push 0x67
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jg 0x4034b7
mov ecx, 0x4b
lea edi, [esp + 0x8c0]
mov esi, 0x405540
rep movsd dword es:[edi], dword [esi]
push 0x40
lea eax, [esp + 0x43c]
push eax
push 0x65
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jg 0x4034e6
mov ecx, 0x18
lea edi, [esp + 0x438]
mov esi, str.Sassafras_KeyServer_Platform_Component_Installer
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0
lea eax, [esp + 0x43c]
push eax
lea eax, [esp + 0x8c8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x4b8]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00402be0
push 0
test eax, eax
je 0x403652
mov eax, dword [str..exe]
lea edx, [esp + 0x4bc]
mov dword [esp + 0x1f4], eax
lea ecx, [esp + 0x1f4]
mov al, byte [0x4056d8]
mov byte [esp + 0x1f8], al
call fcn.004041d0
add esp, 4
test eax, eax
je 0x403575
test edi, edi
jne 0x40377a
mov ecx, esi
jmp 0x40376f
lea eax, [esp + 0x40]
mov dword [esp + 0x50], 0x44
push eax
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x214]
movaps xmmword [esp + 0x64], xmm0
push eax
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
movlpd qword [esp + 0x9c], xmm0
movlpd qword [esp + 0xa4], xmm0
movlpd qword [esp + 0xac], xmm0
movlpd qword [esp + 0xb4], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40361c
test edi, edi
jne 0x40363a
mov edx, 0xfa1
mov ecx, esi
call fcn.00403f60
lea eax, [esp + 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0xffffffffffffffff
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x44]
call esi
lea eax, [esp + 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x4d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403720
lea edx, [esp + 0x98]
mov dword [esp + 0x10], 0
mov ecx, esi
call fcn.00404410
test eax, eax
jle 0x4036e7
mov eax, dword [esp + 0x98]
mov edi, dword [esp + 0x9c]
test eax, eax
je 0x4036e3
test edi, edi
je 0x4036e3
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 0xfe
cmp edi, eax
push 0
cmova edi, eax
lea eax, [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x1fd]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
cmovne ecx, edi
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
je 0x403720
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x1f0], 0x5c
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403705
mov eax, dword [str..msi]
mov dword [ecx], eax
mov al, byte [0x4056f0]
mov byte [ecx + 4], al
jmp 0x40374b
mov eax, dword [0x4056e4]
movq xmm0, qword [str.KSClient.msi]
mov dword [esp + 0x1f8], eax
mov ax, word [0x4056e8]
movq qword [esp + 0x1f0], xmm0
mov word [esp + 0x1fc], ax
push 1
lea edx, [esp + 0x4bc]
lea ecx, [esp + 0x1f4]
call fcn.004041d0
add esp, 4
test eax, eax
je 0x403787
test edi, edi
jne 0x40377a
mov ecx, dword [esp + 0x34]
lea edx, [eax + 0x3e8]
call fcn.00403f60
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
xor edi, edi
mov byte [esp + 0xb0], 0
mov dword [esp + 0xc], edi
cmp dword [0x406128], edi
je 0x403905
lea eax, [esp + 0x1c]
push eax
push edi
lea eax, [esp + 0x1f8]
push eax
call dword [0x406228]
test eax, eax
jne 0x403905
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x3f8]
push 0x40
push eax
mov edx, str.SELECT_Value_FROM_Property_WHERE_PropertyProductCode
call fcn.00403e60
add esp, 8
test eax, eax
jle 0x40382c
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x10], ecx
cmp byte [esp + ecx + 0x3f8], 0
je 0x403822
movsx eax, byte [ecx + 0x405254]
cmp eax, 0x3e
ja 0x403812
mov cl, byte [esp + ecx + 0x3f8]
mov byte [esp + eax + 0xb0], cl
inc eax
mov ecx, dword [esp + 0x10]
cmp edx, eax
cmovl edx, eax
inc ecx
mov dword [esp + 0x10], ecx
cmp byte [ecx + 0x405254], 0xfe
jne 0x4037e4
jmp 0x403824
xor edx, edx
mov byte [esp + edx + 0xb0], 0
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x5c0]
push 0x100
push eax
mov edx, str.SELECT_Value_FROM_Property_WHERE_PropertyProductCode
call fcn.00403e60
add esp, 8
test eax, eax
je 0x403878
cmp dword [0x406128], edi
je 0x403878
lea eax, [esp + 0x5c0]
push eax
call dword [0x406260]
cmp eax, 1
je 0x40386e
cmp eax, 5
jne 0x403878
mov edi, str.REINSTALLALL_REINSTALLMODEvamus_PROP_EXESPAWN1
jmp 0x403901
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x6c0]
push 0x100
push eax
mov edx, str.SELECT_Value_FROM_Property_WHERE_PropertyPROP_UPGRADE_PRODUCTID
call fcn.00403e60
add esp, 8
test eax, eax
je 0x4038ba
cmp dword [0x406128], edi
je 0x4038ba
lea eax, [esp + 0x6c0]
push eax
call dword [0x406260]
cmp eax, 1
je 0x4038fc
cmp eax, 5
je 0x4038fc
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x7c0]
push 0x100
push eax
mov edx, str.SELECT_UpgradeCode_FROM_Upgrade
call fcn.00403e60
add esp, 8
test eax, eax
je 0x403905
cmp dword [0x406128], edi
je 0x403905
lea eax, [esp + 0x7c0]
push eax
call dword [0x406260]
cmp eax, 1
je 0x4038fc
cmp eax, 5
jne 0x403905
mov edi, str.PROP_EXESPAWN1_PROP_REPLACING1
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x4039a8
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xf0]
push 0x100
push eax
mov edx, str.SELECT_Value_FROM_Property_WHERE_PropertyPROP_GPOMODE
call fcn.00403e60
add esp, 8
test eax, eax
jne 0x4039a4
lea eax, [esp + 0xf0]
push 0x405824
push eax
call fcn.004046c0
add esp, 8
test eax, eax
jne 0x403957
mov ecx, 1
mov dword [esp + 0x18], ecx
jmp 0x4039a8
lea eax, [esp + 0xf0]
push 0x4054b0
push eax
call fcn.004046c0
add esp, 8
test eax, eax
jne 0x40397b
mov ecx, 2
mov dword [esp + 0x18], ecx
jmp 0x4039a8
lea eax, [esp + 0xf0]
push 0x4054b4
push eax
call fcn.004046c0
mov ecx, dword [esp + 0x20]
add esp, 8
test eax, eax
mov eax, 3
cmove ecx, eax
mov dword [esp + 0x18], ecx
jmp 0x4039a8
mov ecx, dword [esp + 0x18]
test edi, edi
jne 0x4039b6
mov edi, str.PROP_EXESPAWN1
jmp 0x403b0d
test ecx, ecx
je 0x403b11
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xf0]
push 0x100
push eax
mov edx, str.SELECT__Key__FROM_Registry_WHERE_RegistryREG2_VERSION
call fcn.00403e60
add esp, 8
test eax, eax
je 0x403b11
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x403a23
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403a23
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x403a23
cmp dword [esp + 0x24], 0
mov ecx, 0x40
jne 0x403a28
mov ecx, 0x20
lea eax, [esp + 0x38]
cmp ecx, 0x40
push eax
mov edx, 1
mov eax, 0x101
cmove eax, edx
push eax
push 0
lea eax, [esp + 0xfc]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403b11
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x104
push eax
lea eax, [esp + 0x4bc]
push eax
push 0
push 0
push str.version
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x38]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x403b11
mov esi, dword [esp + 0x18]
cmp esi, 2
jne 0x403aa4
xor edi, edi
jmp 0x403b0d
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xf0]
push 0x100
push eax
mov edx, str.SELECT_Value_FROM_Property_WHERE_PropertyPROP_VERSION
call fcn.00403e60
add esp, 8
test eax, eax
je 0x403b11
lea ecx, [esp + 0x4b8]
lea eax, [esp + 0xf0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403af4
test dl, dl
je 0x403af0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403af4
add eax, 2
add ecx, 2
test dl, dl
jne 0x403ad4
xor eax, eax
jmp 0x403af9
sbb eax, eax
or eax, 1
cmp esi, 3
jne 0x403b06
test eax, eax
jg 0x403b11
xor edi, edi
jmp 0x403b0d
xor ecx, ecx
test eax, eax
cmove edi, ecx
mov dword [esp + 0xc], edi
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x10], 5
jne 0x403b4c
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xf0]
push 0x100
push eax
mov edx, str.SELECT_Value_FROM_Property_WHERE_PropertyPROP_SILENCE
call fcn.00403e60
add esp, 8
test eax, eax
je 0x403b54
cmp byte [esp + 0xf0], 0x32
jne 0x403b54
mov dword [esp + 0x10], 2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x403b6c
cmp dword [0x406128], 0
je 0x403b6c
push eax
call dword [0x406200]
test edi, edi
je 0x403e27
cmp byte [esp + 0xb0], 0
je 0x403d2f
movups xmm0, xmmword [str.SOFTWAREClassesInstallerProducts_]
mov eax, dword [0x405914]
lea edx, [esp + 0xb0]
mov dword [esp + 0x318], eax
mov esi, edx
mov al, byte [0x405918]
movups xmmword [esp + 0x2f8], xmm0
mov byte [esp + 0x31c], al
movups xmm0, xmmword [0x405904]
movups xmmword [esp + 0x308], xmm0
mov al, byte [edx]
inc edx
test al, al
jne 0x403bc1
lea edi, [esp + 0x2f8]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403bd2
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2f8]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403bf0
mov eax, dword [str.SourceList]
mov dword [ecx], eax
mov eax, dword [0x405920]
mov dword [ecx + 4], eax
mov eax, dword [0x405924]
push str.KERNEL32
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x403c50
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403c50
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x403c50
cmp dword [esp + 0x24], 0
mov ecx, 0x40
jne 0x403c55
mov ecx, 0x20
lea eax, [esp + 0x28]
cmp ecx, 0x40
push eax
mov ecx, 3
mov eax, 0x103
cmove eax, ecx
push eax
push 0
lea eax, [esp + 0x304]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403d2b
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x100
push eax
lea eax, [esp + 0x2fc]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push str.PackageName
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403d21
cmp dword [esp + 0x20], 1
jne 0x403d21
lea eax, [esp + 0x1f0]
push 0x5c
push eax
call fcn.00404750
mov esi, eax
add esp, 8
test esi, esi
je 0x403cd9
inc esi
jmp 0x403ce0
lea esi, [esp + 0x1f0]
lea eax, [esp + 0x2f8]
push eax
push esi
call fcn.004046c0
add esp, 8
test eax, eax
je 0x403d21
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403d00
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
push str.PackageName
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x403de2
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403d40
sub ecx, edx
mov edx, esi
lea eax, [edx + 1]
mov dword [esp + 0x24], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x403d52
sub edx, dword [esp + 0x24]
lea eax, [edx + 2]
add eax, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x403de2
mov ecx, edx
sub ecx, edi
nop dword [eax]
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x403d80
lea edi, [edx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x403d90
mov ax, word [0x405214]
mov ecx, esi
mov word [edi], ax
mov dword [esp + 0x24], ecx
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x403db0
sub esi, ecx
lea edi, [edx - 1]
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403dc0
mov ecx, esi
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
cmp dword [0x406128], 0
je 0x403e27
push 0
push dword [esp + 0x14]
call dword [0x406264]
cmp dword [0x406128], 0
je 0x403e27
push 0
push 0x20
push 0x403f40
call dword [0x406268]
cmp dword [0x406128], 0
je 0x403e27
push edi
lea eax, [esp + 0x1f4]
push eax
call dword [0x40625c]
lea eax, [esp + 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x406128]
test eax, eax
je 0x403e4f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x406128], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8