Function at 0x4049b0
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Check os version
Copy file
Delete directory
Delete file
Delete registry value
Get common file path
Get file attributes
Get file size
Move file
Query or enumerate registry value
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
sub esp, 0x608
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push str.Astrum_Uninstaller
push 0x40c924
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esp + 3], 0
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0x70]
call fcn.00402880
lea ecx, [esp + 0x6c]
call fcn.00403450
push 1
push 0
push str._SILENT
lea ecx, [esp + 0x78]
call fcn.00402da0
cmp eax, 0xffffffff
je 0x404a0b
mov byte [esp + 3], 1
push 1
push 0
push str._NOREMOVE
lea ecx, [esp + 0x78]
call fcn.00402da0
cmp eax, 0xffffffff
je 0x404a27
mov byte [esp + 0x2f], 1
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x514]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x514]
push ecx
lea ecx, [esp + 0x54]
call fcn.00402880
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x68]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404a9f
mov al, byte [esp + 0x13]
test al, al
jne 0x406179
push 0x10
push 0x40c924
push str.Couldnt_read_uninstallation_information._Aborting.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x406179
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0xfffffffffffffffc
push esi
mov edi, eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x120]
push 0
push edx
lea eax, [esp + 0xcc]
push 4
push eax
push esi
call ebx
push 0
push 0
mov ecx, dword [esp + 0xcc]
push ecx
push esi
call ebp
sub edi, dword [esp + 0xc4]
sub edi, 4
push edi
call fcn.0040688b
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x404b29
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
test al, al
jne 0x406179
push 0x10
push 0x40c924
push str.Out_of_memory._Aborting.
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x406179
lea edx, [esp + 0x120]
push 0
push edx
push edi
push ebp
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x28]
call fcn.00402850
push edi
push ebp
lea ecx, [esp + 0x30]
call fcn.00402aa0
push ebp
call fcn.00406880
lea eax, [esp + 0x2c]
push eax
call fcn.00403c70
add esp, 8
test al, al
je 0x406154
lea ecx, [esp + 0x28]
push ecx
call fcn.00403c70
add esp, 4
test al, al
je 0x406154
mov eax, dword [esp + 0x28]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebp, 2
cmp eax, ebp
jae 0x404bae
mov al, byte [esp + 0x13]
test al, al
jne 0x404bae
push 0x10
push 0x40c924
push str.Uninstallation_information_corrupt._Aborting.
push 0
call edi
lea ecx, [esp + 0x60]
call fcn.00402850
push 0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 0x31
call fcn.00402a40
cmp al, 0x5c
jne 0x404c0d
push 1
lea ecx, [esp + 0x2c]
call fcn.00402a40
push ebp
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], al
call fcn.00403040
mov esi, eax
lea ecx, [esp + 0x28]
push esi
push 6
call fcn.00403370
push eax
lea ecx, [esp + 0x64]
call fcn.004029e0
add esi, 6
lea ecx, [esp + 0x28]
push esi
push 0
call fcn.00402c80
jmp 0x404c12
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x60]
test eax, eax
jbe 0x404c56
push 0
lea ecx, [esp + 0x64]
call fcn.00403040
push eax
push 4
lea ecx, [esp + 0x68]
call fcn.00403370
push eax
lea ecx, [esp + 0x48]
call fcn.004028f0
lea eax, [esp + 0x44]
mov edx, dword [esp + 0x40]
push edx
push eax
call fcn.004036d0
add esp, 8
lea ecx, [esp + 0x44]
call fcn.00402950
push 1
lea ecx, [esp + 0x120]
push 0x40c918
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x128], 0
call fcn.00403080
push 0
call fcn.004035e0
add esp, 4
lea ecx, [esp + 0xc8]
push eax
call fcn.00402880
mov ecx, 0x40c918
call fcn.00403410
lea edx, [esp + 0xc8]
push eax
push edx
call fcn.00403550
add esp, 8
lea ecx, [esp + 0xc8]
call fcn.00403410
push eax
push 0x40c924
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.auin_
lea ecx, [esp + 0xa4]
call fcn.00402880
mov ecx, 0x40c918
call fcn.00403410
push 0
push eax
lea ecx, [esp + 0xa8]
call fcn.00402aa0
push 0
push str._mutex
lea ecx, [esp + 0xa8]
call fcn.00402aa0
lea ecx, [esp + 0xa0]
call fcn.00403410
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x405368
push 1
call fcn.004035e0
add esp, 4
lea ecx, [esp + 0xd4]
push eax
call fcn.00402880
mov ecx, 0x40c918
call fcn.00403410
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.00403550
mov bl, byte [esp + 0x1b]
add esp, 8
test bl, bl
jne 0x404d83
push 0x24
push 0x40c924
lea ecx, [esp + 0xdc]
call fcn.00403410
push eax
push 0
call edi
cmp eax, 7
je 0x40535c
mov ecx, 0x40c918
call fcn.00403410
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov ecx, 0x40c918
inc esi
call fcn.00403410
add eax, esi
lea ecx, [esp + 0xec]
push eax
call fcn.00402880
mov eax, dword [esp + 0xec]
test eax, eax
jbe 0x404e50
push 1
push 0x40c348
lea ecx, [esp + 0xf4]
call fcn.00402c40
test al, al
jne 0x404e50
push 1
push 0x40c344
lea ecx, [esp + 0xf4]
call fcn.00402c40
test al, al
jne 0x404e50
mov ecx, 0x40c918
call fcn.00403410
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov ecx, 0x40c918
inc edi
call fcn.00403410
add eax, edi
lea ecx, [esp + 0x44]
add eax, esi
push eax
call fcn.00402880
mov eax, dword [esp + 0x44]
test eax, eax
jbe 0x404e47
lea ecx, [esp + 0x44]
call fcn.00403410
push eax
call fcn.004042c0
add esp, 4
test eax, eax
jne 0x404e47
lea ecx, [esp + 0x44]
jmp 0x40534b
lea ecx, [esp + 0x44]
call fcn.00402950
test bl, bl
jne 0x404f29
push 0
lea ecx, [esp + 0x64]
call fcn.00403040
mov esi, eax
lea ecx, [esp + 0x60]
add esi, 4
push esi
call fcn.00403040
mov edi, eax
add esi, 4
push edi
push esi
lea ecx, [esp + 0x68]
call fcn.00403370
push eax
lea ecx, [esp + 0x148]
call fcn.004028f0
add esi, edi
lea ecx, [esp + 0x60]
push esi
call fcn.00403040
add esi, 4
push eax
push esi
lea ecx, [esp + 0x68]
call fcn.00403370
push eax
lea ecx, [esp + 0x13c]
call fcn.004028f0
lea ecx, [esp + 0x138]
push ecx
call fcn.00401640
push 0x74
call fcn.0040688b
add esp, 8
test eax, eax
je 0x404edc
mov ecx, eax
call fcn.00406580
mov ebx, eax
jmp 0x404ede
xor ebx, ebx
mov edx, dword [esp + 0x61c]
lea eax, [esp + 0x144]
push edx
push 0
push eax
mov ecx, ebx
mov dword [esp + 0x4c], ebx
call fcn.00401290
mov ecx, dword [ebx + 4]
push 0x40c924
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00403ad0
lea ecx, [esp + 0x138]
call fcn.00402950
lea ecx, [esp + 0x144]
call fcn.00402950
jmp 0x404f2d
mov ebx, dword [esp + 0x40]
push 1
push 0
push str.Shared:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
mov edx, eax
mov edi, str.Shared:_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x28]
push edx
push eax
call fcn.00402c80
push 1
push 0
push str.Backups:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
push eax
push 0
lea ecx, [esp + 0x30]
call fcn.00403370
push eax
lea ecx, [esp + 0xfc]
call fcn.004028f0
push 1
push 0
push str.Backups:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
mov edx, eax
mov edi, str.Backups:_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x28]
push edx
push eax
call fcn.00402c80
push 1
push 0
push str.Files:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
push eax
push 0
lea ecx, [esp + 0x30]
call fcn.00403370
push eax
lea ecx, [esp + 0x8c]
call fcn.004028f0
push 1
push 0
push str.Files:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
mov edx, eax
mov edi, str.Files:_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x28]
push edx
push eax
call fcn.00402c80
push 1
push 0
push str.Directories:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
push eax
push 0
lea ecx, [esp + 0x30]
call fcn.00403370
push eax
lea ecx, [esp + 0x108]
call fcn.004028f0
push 1
push 0
push str.Directories:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
mov edx, eax
mov edi, str.Directories:_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x28]
push edx
push eax
call fcn.00402c80
push 1
push 0
push str.Registry:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
push eax
push 0
lea ecx, [esp + 0x30]
call fcn.00403370
push eax
lea ecx, [esp + 0x114]
call fcn.004028f0
push 1
push 0
push str.Registry:_r_n
lea ecx, [esp + 0x34]
call fcn.00402da0
mov edx, eax
mov edi, str.Registry:_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
lea ecx, [esp + 0x28]
push edx
push eax
call fcn.00402c80
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x174]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x174]
mov dword [esp + 0x174], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x184], ebp
jne 0x405160
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x405160
xor esi, esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], esi
call fcn.00403410
mov edi, eax
cmp esi, 1
mov eax, 0x80000000
jne 0x405125
mov eax, 0x80000001
jmp 0x40513a
cmp esi, ebp
jne 0x405130
mov eax, 0x80000002
jmp 0x40513a
cmp esi, 3
jne 0x40513a
mov eax, 0x80000003
push 0
lea ecx, [esp + 0x28]
push 1
lea edx, [esp + 0x30]
push ecx
push edx
push edi
push eax
call fcn.00403e60
add esp, 0x18
test al, al
je 0x4052fd
inc esi
cmp esi, 4
jl 0x405114
mov al, byte [esp + 0x13]
test al, al
jne 0x405182
mov eax, dword [ebx + 4]
push 1
push 0x3d
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00403ad0
lea ecx, [esp + 0x14]
call fcn.00402850
lea ecx, [esp + 0x94]
call fcn.00402850
mov eax, dword [esp + 0xf8]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x34], edi
jbe 0x4054da
mov al, byte [esp + 0x13]
mov byte [esp + 0x23], 0
test al, al
mov byte [esp + 0x3e], 0
je 0x4051c9
mov byte [esp + 0x23], 1
lea eax, [esp + 0x24]
push eax
push 0x2001f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054da
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0xfc]
call fcn.00403190
test al, al
je 0x4054c3
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x104]
xor bl, bl
call fcn.00403080
push 0
push 0x7c
lea ecx, [esp + 0x1c]
call fcn.00402d70
mov esi, eax
cmp esi, 0xffffffff
je 0x40528d
mov ecx, dword [esp + 0x14]
sub ecx, esi
push ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.00403370
push eax
lea ecx, [esp + 0x48]
call fcn.004028f0
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x14]
sub edx, esi
push edx
push esi
call fcn.00402c80
lea ecx, [esp + 0x44]
call fcn.00403450
push 1
push str.CTRL
lea ecx, [esp + 0x4c]
call fcn.00402c40
test al, al
je 0x405284
mov bl, 1
lea ecx, [esp + 0x44]
call fcn.00402950
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x38]
push eax
push ecx
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0
mov dword [esp + 0x6c], 4
call fcn.00403410
mov edx, dword [esp + 0x34]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x40538e
test eax, eax
je 0x40538e
jbe 0x4052dc
dec eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push 4
push eax
push 4
push 0
lea ecx, [esp + 0x24]
call fcn.00403410
mov ecx, dword [esp + 0x34]
push eax
push ecx
call ebp
jmp 0x4054aa
mov al, byte [esp + 0x13]
test al, al
jne 0x405320
mov esi, dword [ebx + 4]
push 0
push 0x40c924
push ebp
call fcn.004035e0
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x110]
call fcn.00402950
lea ecx, [esp + 0x104]
call fcn.00402950
lea ecx, [esp + 0x88]
call fcn.00402950
lea ecx, [esp + 0xf8]
call fcn.00402950
lea ecx, [esp + 0xec]
call fcn.00402950
lea ecx, [esp + 0xd4]
call fcn.00402950
lea ecx, [esp + 0xa0]
call fcn.00402950
lea ecx, [esp + 0xc8]
call fcn.00402950
lea ecx, [esp + 0x60]
call fcn.00402950
jmp 0x406170
lea edx, [esp + 0x14]
lea eax, [esp + 0x94]
push edx
push eax
call fcn.00404660
mov edi, eax
add esp, 8
cmp edi, 1
jne 0x4053d3
lea ecx, [esp + 0x38]
push 4
push ecx
push 4
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0
call fcn.00403410
mov edx, dword [esp + 0x34]
push eax
push edx
call ebp
jmp 0x4054aa
cmp edi, 2
je 0x405447
mov al, byte [esp + 0x3e]
test al, al
je 0x4053ed
mov dword [esp + 0x38], 0
jmp 0x4052dc
mov al, byte [esp + 0x23]
test al, al
jne 0x405447
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x14]
mov esi, dword [edx + 4]
call fcn.00403410
push eax
mov eax, dword [esp + 0x620]
push 0x4061a0
push esi
push 0x69
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov esi, eax
cmp esi, 0x3f0
je 0x405831
cmp esi, 0x3ee
je 0x405831
cmp esi, 0x3ef
jne 0x4057e1
mov byte [esp + 0x23], 1
lea ecx, [esp + 0x14]
call fcn.00403410
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405484
and al, 0xfe
lea ecx, [esp + 0x14]
push eax
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test bl, bl
je 0x40549a
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call fcn.00404440
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xf8]
push eax
call fcn.00403190
test al, al
jne 0x40520b
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
mov ebx, dword [esp + 0x40]
mov al, byte [esp + 0x13]
test al, al
jne 0x4054fc
mov eax, dword [ebx + 4]
push 1
push 0x3e
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00403ad0
cmp dword [esp + 0x88], 2
jbe 0x40593f
mov al, byte [esp + 0x13]
test al, al
jne 0x4058b7
mov esi, dword [ebx + 4]
push 4
push 0x40c924
push 3
call fcn.004035e0
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4058b7
push edi
lea ecx, [esp + 0x8c]
mov dword [esp + 0x28], edi
call fcn.00403190
test al, al
je 0x405947
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x94]
call fcn.00403080
cmp dword [esp + 0x14], 3
jb 0x4057b7
push 0
push 9
lea ecx, [esp + 0x1c]
call fcn.00402d70
mov esi, eax
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00403370
push eax
lea ecx, [esp + 0x70]
call fcn.004028f0
inc esi
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00402c80
push 0
push 9
lea ecx, [esp + 0x1c]
call fcn.00402d70
mov esi, eax
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00403370
push eax
lea ecx, [esp + 0x48]
call fcn.004028f0
inc esi
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00402c80
push 0
push 9
lea ecx, [esp + 0x1c]
call fcn.00402d70
mov esi, eax
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00403370
push eax
lea ecx, [esp + 0xb0]
call fcn.004028f0
inc esi
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00402c80
lea ecx, [esp + 0xac]
call fcn.00403410
push eax
call fcn.00406899
add esp, 4
lea ecx, [esp + 0x14]
mov edi, eax
push 0
push 9
call fcn.00402d70
mov esi, eax
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00403370
push eax
lea ecx, [esp + 0xb0]
call fcn.004029e0
inc esi
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00402c80
lea ecx, [esp + 0xac]
call fcn.00403410
push eax
call fcn.00406899
add esp, 4
mov ebp, eax
push 0
push 9
lea ecx, [esp + 0x1c]
call fcn.00402d70
mov esi, eax
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00403370
push eax
lea ecx, [esp + 0xb0]
call fcn.004029e0
inc esi
lea ecx, [esp + 0x14]
push esi
push 0
call fcn.00402c80
lea ecx, [esp + 0xac]
call fcn.00403410
push eax
call fcn.00406899
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], eax
call fcn.00403410
push eax
call fcn.00406899
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x130], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
call fcn.00403410
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40576d
lea ecx, [esp + 0x150]
push ecx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x130]
lea eax, [esp + 0x150]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jne 0x405789
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x38]
push ecx
push edx
lea ecx, [esp + 0x4c]
call fcn.00403410
push eax
call fcn.00403b30
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x44]
push ebp
push edi
push eax
push ecx
call fcn.00403c00
add esp, 0x1c
test eax, eax
jne 0x405789
push 0
lea ecx, [esp + 0x48]
call fcn.00403410
push eax
lea ecx, [esp + 0x74]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x6c]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xac]
call fcn.00402950
lea ecx, [esp + 0x44]
call fcn.00402950
lea ecx, [esp + 0x6c]
call fcn.00402950
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x88]
push edx
call fcn.00403190
test al, al
jne 0x40555a
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [esp + 0x40]
xor edi, edi
jmp 0x405947
cmp edi, 0xffffffff
jne 0x405447
mov eax, dword [esp + 0x94]
test eax, eax
jbe 0x405808
push 0
push 0x40c1bc
lea ecx, [esp + 0x9c]
call fcn.00402aa0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x98]
call fcn.00402b10
push 0
push 0x40c2c0
lea ecx, [esp + 0x9c]
call fcn.00402aa0
jmp 0x405447
lea edx, [esp + 0x38]
push 4
push edx
push 4
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0
call fcn.00403410
push eax
mov eax, dword [esp + 0x38]
push eax
call ebp
cmp esi, 0x3f0
jne 0x405867
mov byte [esp + 0x3e], 1
jmp 0x4054aa
cmp edi, 0xffffffff
jne 0x4054aa
mov eax, dword [esp + 0x94]
test eax, eax
jbe 0x40588e
push 0
push 0x40c1bc
lea ecx, [esp + 0x9c]
call fcn.00402aa0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x98]
call fcn.00402b10
push 0
push 0x40c2bc
lea ecx, [esp + 0x9c]
call fcn.00402aa0
jmp 0x4054aa
cmp dword [esp + 0x88], 2
jbe 0x40593f
push edi
lea ecx, [esp + 0x8c]
mov dword [esp + 0x28], edi
call fcn.00403190
test al, al
je 0x40593f
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x94]
call fcn.00403080
cmp dword [esp + 0x14], 3
jb 0x40592a
push edi
push 9
lea ecx, [esp + 0x1c]
call fcn.00402d70
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.00403370
push eax
lea ecx, [esp + 0x48]
call fcn.004028f0
lea ecx, [esp + 0x44]
call fcn.00403410
push eax
call ebp
lea ecx, [esp + 0x44]
call fcn.00402950
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x88]
push edx
call fcn.00403190
test al, al
jne 0x4058d6
mov al, byte [esp + 0x13]
test al, al
jne 0x405961
mov eax, dword [ebx + 4]
push 1
push 0x3f
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00403ad0
lea ecx, [esp + 0xb8]
call fcn.00402850
push edi
lea ecx, [esp + 0x108]
mov dword [esp + 0x38], edi
call fcn.00403190
test al, al
je 0x405a5c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0x38]
push eax
push ecx
lea ecx, [esp + 0x110]
call fcn.00403080
cmp dword [esp + 0x14], 3
jb 0x405a43
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059d7
and al, 0xfe
lea ecx, [esp + 0x14]
push eax
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call ebp
test eax, eax
jne 0x405a43
call edi
mov esi, eax
cmp esi, 2
je 0x405a15
cmp esi, 3
je 0x405a15
lea edx, [esp + 0x14]
mov ecx, 0x40c908
push edx
call fcn.00402b10
push 0
push 0x40c1bc
mov ecx, 0x40c908
call fcn.00402aa0
cmp esi, 5
je 0x405a1f
cmp esi, 0x20
jne 0x405a43
lea eax, [esp + 0x14]
lea ecx, [esp + 0xb8]
push eax
call fcn.00402b10
push 0
push 0x40c1bc
lea ecx, [esp + 0xc0]
call fcn.00402aa0
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x108]
call fcn.00403190
test al, al
jne 0x40598c
mov al, byte [esp + 0x13]
test al, al
jne 0x405a7e
mov eax, dword [ebx + 4]
push 1
push 0x40
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00403ad0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x30d]
mov byte [esp + 0x30c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x30c]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x30c]
lea ecx, [esp + 0x124]
push eax
call fcn.00402880
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0xe4]
call fcn.004028f0
push 1
push 0
push 0x40c1d0
lea ecx, [esp + 0xec]
call fcn.00402ed0
cmp eax, 0xffffffff
je 0x405b02
mov edx, dword [esp + 0xe0]
lea ecx, [esp + 0xe0]
sub edx, eax
push edx
push eax
call fcn.00402c80
lea ecx, [esp + 0x124]
call fcn.00403450
lea ecx, [esp + 0xe0]
call fcn.00403450
lea eax, [esp + 0xe0]
push 1
push eax
lea ecx, [esp + 0x12c]
call fcn.00402b80
test al, al
jne 0x405bdb
mov byte [esp + 0x410], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x411]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x410]
push ecx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x209]
mov byte [esp + 0x208], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x208]
stosb byte es:[edi], al
push edx
push 0
lea eax, [esp + 0x418]
push 0x40c2b8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov al, byte [esp + 0x208]
test al, al
je 0x405bdb
lea ecx, [esp + 0x208]
push ecx
call ebp
lea edx, [esp + 0x208]
lea ecx, [esp + 0x50]
push edx
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [esp + 0x208]
lea ecx, [esp + 0x50]
push eax
call fcn.00402970
push 0x40c2b4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
lea ecx, [esp + 0x114]
mov dword [esp + 0x38], 0
call fcn.00403190
test al, al
je 0x405caa
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x38]
push ecx
push edx
lea ecx, [esp + 0x11c]
call fcn.00403080
cmp dword [esp + 0x14], 3
jb 0x405c91
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405c51
and al, 0xfe
lea ecx, [esp + 0x14]
push eax
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x14]
call fcn.00403410
push eax
call esi
test eax, eax
jne 0x405c91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x405c91
cmp eax, 2
je 0x405c91
lea eax, [esp + 0x14]
mov ecx, 0x40cb38
push eax
call fcn.00402b10
push 0
push 0x40c1bc
mov ecx, 0x40cb38
call fcn.00402aa0
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x114]
call fcn.00403190
test al, al
jne 0x405c0a
mov al, byte [esp + 0x13]
test al, al
jne 0x405ccc
mov eax, dword [ebx + 4]
push 1
push 0x41
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00403ad0
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x405d94
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x5c], edi
call fcn.00403410
mov ebp, eax
lea ecx, [esp + 0x6c]
call fcn.00403780
lea ecx, [esp + 0x44]
call fcn.00402850
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x48]
mov esi, 0x80000000
call fcn.00402970
cmp edi, 1
jne 0x405d1f
mov esi, 0x80000001
push str.HKEY_CURRENT_USER
jmp 0x405d3f
cmp edi, 2
jne 0x405d30
mov esi, 0x80000002
push str.HKEY_LOCAL_MACHINE
jmp 0x405d3f
cmp edi, 3
jne 0x405d48
mov esi, 0x80000003
push str.HKEY_USERS
lea ecx, [esp + 0x48]
call fcn.00402970
push 0xffffffffffffffff
lea ecx, [esp + 0x48]
call fcn.00403410
push eax
lea ecx, [esp + 0x74]
call fcn.00403800
lea edx, [esp + 0x6c]
lea eax, [esp + 0x5c]
push edx
push 0
lea ecx, [esp + 0x30]
push eax
push ecx
push ebp
push esi
call fcn.00403e60
add esp, 0x18
lea ecx, [esp + 0x44]
call fcn.00402950
lea ecx, [esp + 0x6c]
call fcn.004037b0
inc edi
cmp edi, 4
jl 0x405ce9
mov al, byte [esp + 0x3f]
test al, al
jne 0x405e33
lea edx, [esp + 0x50]
lea ecx, [esp + 0x6c]
push edx
call fcn.004028f0
push 0
push str..bak
lea ecx, [esp + 0x74]
call fcn.00402aa0
lea ecx, [esp + 0x6c]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
lea ecx, [esp + 0x6c]
push eax
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x6c]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x6c]
call fcn.00403410
push eax
lea ecx, [esp + 0x54]
call fcn.00403410
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x405e1d
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x50]
push eax
call fcn.004029e0
lea ecx, [esp + 0x50]
push ecx
call fcn.00404750
add esp, 4
lea ecx, [esp + 0x6c]
call fcn.00402950
push 0
lea ecx, [esp + 0xbc]
mov dword [esp + 0x38], 0
call fcn.00403190
test al, al
je 0x405e92
mov esi, 3
lea edx, [esp + 0x14]
push 0
lea eax, [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0xc4]
call fcn.00403080
cmp dword [esp + 0x14], esi
jbe 0x405e7d
lea ecx, [esp + 0x14]
push ecx
call fcn.00404750
add esp, 4
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0xb8]
push edx
call fcn.00403190
test al, al
jne 0x405e52
mov ecx, dword [esp + 0xb8]
test ecx, ecx
seta al
mov byte [0x40cb44], al
mov al, byte [esp + 0x13]
test al, al
je 0x405f7e
lea ecx, [esp + 0xe0]
call fcn.00402950
lea ecx, [esp + 0x124]
call fcn.00402950
lea ecx, [esp + 0xb8]
call fcn.00402950
lea ecx, [esp + 0x94]
call fcn.00402950
lea ecx, [esp + 0x14]
call fcn.00402950
lea ecx, [esp + 0x110]
call fcn.00402950
lea ecx, [esp + 0x104]
call fcn.00402950
lea ecx, [esp + 0x88]
call fcn.00402950
lea ecx, [esp + 0xf8]
call fcn.00402950
lea ecx, [esp + 0xec]
call fcn.00402950
lea ecx, [esp + 0xd4]
call fcn.00402950
lea ecx, [esp + 0xa0]
call fcn.00402950
lea ecx, [esp + 0xc8]
call fcn.00402950
lea ecx, [esp + 0x60]
call fcn.00402950
lea ecx, [esp + 0x28]
call fcn.00402950
lea ecx, [esp + 0x50]
call fcn.00402950
lea ecx, [esp + 0x7c]
call fcn.00402950
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x608
ret 0x10
mov edi, dword [esp + 0x40]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x37
mov eax, dword [edi + 4]
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
mov ecx, dword [edi + 4]
push 1
push 1
push 0xf4
push 0x37
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [edi + 4]
push 5
push 0x47
push eax
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
mov eax, dword [edi + 4]
push 0x37
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x40cb38]
test eax, eax
ja 0x405fed
mov eax, dword [0x40c908]
test eax, eax
ja 0x405fed
mov eax, dword [0x40cb28]
test eax, eax
jbe 0x406007
mov eax, dword [edi + 4]
push 1
push 0x36
push eax
call ebx
push eax
call esi
mov eax, dword [edi + 4]
push 5
push 0x48
push eax
call ebx
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
mov esi, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
push 0
push 0
push 0
lea edx, [esp + 0x164]
push 0
push edx
call edi
test eax, eax
je 0x406079
push 0
push 0
lea eax, [esp + 0x160]
push 0
push eax
call ebx
test eax, eax
je 0x406081
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x158]
push edx
mov eax, dword [ecx + 4]
push eax
call esi
test eax, eax
jne 0x40601f
lea eax, [esp + 0x158]
push eax
call ebp
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40601f
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x40601f
mov esi, dword [esp + 0x160]
lea ecx, [esp + 0xe0]
call fcn.00402950
lea ecx, [esp + 0x124]
call fcn.00402950
lea ecx, [esp + 0xb8]
call fcn.00402950
lea ecx, [esp + 0x94]
call fcn.00402950
lea ecx, [esp + 0x14]
call fcn.00402950
lea ecx, [esp + 0x110]
call fcn.00402950
lea ecx, [esp + 0x104]
call fcn.00402950
lea ecx, [esp + 0x88]
call fcn.00402950
lea ecx, [esp + 0xf8]
call fcn.00402950
lea ecx, [esp + 0xec]
call fcn.00402950
lea ecx, [esp + 0xd4]
call fcn.00402950
lea ecx, [esp + 0xa0]
call fcn.00402950
lea ecx, [esp + 0xc8]
call fcn.00402950
lea ecx, [esp + 0x60]
call fcn.00402950
lea ecx, [esp + 0x28]
call fcn.00402950
lea ecx, [esp + 0x50]
call fcn.00402950
lea ecx, [esp + 0x7c]
call fcn.00402950
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x608
ret 0x10
mov al, byte [esp + 0x13]
test al, al
jne 0x406170
push 0x10
push 0x40c924
push str.Uninstallation_information_corrupt._Aborting.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x28]
call fcn.00402950
lea ecx, [esp + 0x50]
call fcn.00402950
lea ecx, [esp + 0x7c]
call fcn.00402950
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x608
ret 0x10