Function at 0x406d0c
Capabilities:
Query or enumerate registry value
Read .ini file
Set current directory

Disassembly:
mov eax, 0x41c4fe
call fcn.00412df4
mov eax, 0x1d70
call fcn.00412fd0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00401046
xor esi, esi
mov ecx, edi
mov ebx, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], esi
call fcn.0040105f
push esi
mov ecx, ebx
call fcn.0040b5c8
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
call fcn.004098ca
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x18], eax
mov edi, 0x426180
je 0x40703c
push edi
lea eax, [ebp - 0x68]
push 0x14
push eax
push 0x4253a0
push dword [0x41d5c8]
push dword [0x41d570]
call esi
cmp byte [ebp - 0x68], 0x79
je 0x406d94
cmp byte [ebp - 0x68], 0x59
jne 0x406e99
cmp dword [0x427050], 0
je 0x406dd9
push edi
lea eax, [ebp - 0x54]
push 0x14
push eax
push 0x4253a0
push dword [0x41d5cc]
push dword [0x41d570]
call esi
cmp byte [ebp - 0x54], 0x79
je 0x406dcd
cmp byte [ebp - 0x54], 0x59
je 0x406dcd
xor edi, edi
mov dword [ebp - 0x18], edi
jmp 0x40703e
mov dword [ebp - 0x18], 1
jmp 0x406ea3
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.0040e41d
and byte [ebp - 0x670], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x66f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x670]
push 0x400
push eax
push 0x66e
call fcn.0040d474
add esp, 0x14
lea eax, [ebx + 0x410]
push eax
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x401
push dword [0x42616c]
call esi
lea eax, [ebp - 0x54]
push 0x24
push eax
lea eax, [ebp - 0x16c]
push eax
push dword [0x42616c]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x406e88
push 0x3ea
xor edi, edi
push dword [0x42616c]
mov dword [ebp - 0x18], edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push edi
push 0xf
push eax
call esi
jmp 0x406e8a
xor edi, edi
push edi
push edi
push 0x401
push dword [0x42616c]
call esi
cmp dword [ebp - 0x18], 0
je 0x40703c
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
push 1
push eax
xor edi, edi
lea eax, [ebp - 0x16c]
push edi
push eax
push dword [0x41d5b4]
call fcn.00408ac5
test eax, eax
je 0x4074de
cmp dword [ebp - 0x20], 1
jne 0x406f09
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x270]
push eax
push dword [0x41d5b8]
call fcn.00408c39
test eax, eax
je 0x4074de
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x197c]
push eax
push dword [0x41d5bc]
call fcn.00408c39
test eax, eax
je 0x4074de
cmp dword [ebp - 0x3c], edi
je 0x406f20
lea eax, [ebp - 0x16c]
push str.__q:a__c:_install__q_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, 0x104
lea eax, [ebp - 0x1478]
push esi
push eax
push 0x452
call fcn.0040d474
add esp, 0xc
lea eax, [ebp - 0x1478]
push str.Microsoft_R__.NET_Framework
push eax
lea eax, [ebp - 0x1374]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1374]
mov ecx, ebx
push eax
call fcn.0040bb8d
xor eax, eax
cmp dword [0x427050], edi
push ebx
sete al
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0040e480
cmp eax, 0x2000
je 0x406fb7
cmp eax, 0xbc2
je 0x406fb7
cmp eax, edi
je 0x40703e
cmp eax, 0x1008
je 0x40703e
mov ecx, 0x66d
push eax
push ecx
mov dword [0x42704c], ecx
call fcn.0040d394
pop ecx
pop ecx
jmp 0x4074de
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x1c], edi
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.00407509
test eax, eax
jne 0x407028
and byte [ebp - 0x270], al
push 0x40
pop ecx
lea edi, [ebp - 0x26f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x30]
and dword [ebp - 0x2c], 0
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.InstallerLocation
mov dword [ebp - 0x30], esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor edi, edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], edi
je 0x40703e
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40703e
xor edi, edi
cmp dword [ebp - 0x18], edi
mov dword [ebp - 0x34], edi
jne 0x407146
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + 0x10]
push eax
call fcn.004084db
cmp eax, edi
jne 0x40713b
mov ecx, ebx
call fcn.0040b5ae
test eax, eax
je 0x407141
push 1
mov ecx, ebx
pop esi
mov dword [ebp - 0x34], esi
call fcn.0040b4e2
mov eax, dword [eax]
dec eax
je 0x4070bd
dec eax
jne 0x40710d
cmp dword [ebx + 0x185c], edi
je 0x4070a6
lea eax, [ebx + 0x1860]
push eax
lea eax, [ebp - 0x1878]
push eax
call fcn.00412860
pop ecx
mov dword [ebp - 0x14], esi
pop ecx
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x1878]
push dword [ebp - 0x14]
push eax
push dword [0x421c30]
jmp 0x4070f2
cmp dword [ebx + 0x1458], edi
je 0x4070dd
lea eax, [ebx + 0x145c]
push eax
lea eax, [ebp - 0x1878]
push eax
call fcn.00412860
pop ecx
mov dword [ebp - 0x14], esi
pop ecx
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x1878]
push dword [ebp - 0x14]
push eax
push dword [0x421c2c]
mov ecx, dword [ebp - 0x10]
call fcn.00408ac5
test eax, eax
jne 0x40710d
mov dword [0x42704c], 0x482
jmp 0x4074de
lea eax, [ebp - 0x1878]
push eax
call fcn.0040dc1c
test eax, eax
jne 0x407149
lea ecx, [ebp - 0x1878]
mov eax, 0x482
push ecx
push eax
mov dword [0x42704c], eax
call fcn.0040d394
pop ecx
pop ecx
jmp 0x4074e3
jg 0x4074e3
mov dword [ebp - 0x14], edi
jmp 0x40714c
push 1
pop esi
mov dword [ebp - 0x14], esi
and byte [ebp - 0x1270], 0
mov esi, 0xff
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x126f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebx + 0x1c60], eax
je 0x407189
lea eax, [ebx + 0x1c64]
push eax
lea eax, [ebp - 0x1270]
push eax
call fcn.00412860
pop ecx
pop ecx
push 1
pop eax
xor edi, edi
xor ecx, ecx
cmp dword [ebp - 0x14], edi
lea edx, [ebp - 0x38]
sete cl
mov dword [ebp - 0x1c], ecx
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x810]
push edx
push eax
lea eax, [ebp - 0x1270]
mov dword [ebp - 0x30], ecx
push eax
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00408ac5
test eax, eax
je 0x4074de
cmp dword [ebp - 0x38], 2
mov dword [ebp - 0x2c], edi
jne 0x4071d4
cmp dword [ebp - 0x14], edi
je 0x4071d4
mov dword [ebp - 0x2c], 1
and byte [ebp - 0xa70], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xa6f]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x18], 0
stosw word es:[edi], ax
push 1
xor esi, esi
stosb byte es:[edi], al
call fcn.00408817
test eax, eax
je 0x40725f
xor eax, eax
cmp dword [ebx + 0x2064], eax
je 0x407224
lea eax, [ebx + 0x2068]
push eax
lea eax, [ebp - 0xa70]
push eax
call fcn.00412860
pop ecx
pop ecx
push 1
pop edi
mov eax, edi
jmp 0x407227
push 1
pop edi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xa70]
push eax
push dword [0x41d5b0]
call fcn.00408ac5
test eax, eax
je 0x4074de
cmp dword [ebp - 0x20], 2
mov dword [ebp - 0x18], edi
jne 0x407262
cmp dword [ebp - 0x14], 0
je 0x407262
mov esi, edi
jmp 0x407262
push 1
pop edi
cmp dword [ebp - 0x34], 0
je 0x40727b
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1878]
push eax
call fcn.004086dd
cmp dword [ebp - 0x28], 0
je 0x4072bb
push 0x426180
lea eax, [ebp - 0x54]
push 0x400
push eax
push 0x4253a0
push dword [0x41d574]
push dword [0x41d570]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x54], 0x79
je 0x4072b7
cmp byte [ebp - 0x54], 0x59
je 0x4072b7
mov dword [ebp - 0x24], edi
jmp 0x4072bb
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x28], 2
jne 0x4072eb
cmp dword [ebp - 0x24], 0
jne 0x4072eb
lea eax, [ebx + 0x1018]
push str._ISSCHEDULEREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push str.ISSCHEDULEREBOOT1
push 0x421144
mov ecx, ebx
call fcn.0040bfed
cmp dword [ebp - 0x18], 0
je 0x407458
cmp dword [ebp - 0x24], 0
jne 0x407458
lea eax, [ebp - 0xa70]
push 0x4253a4
push eax
lea ecx, [ebp - 0xe70]
call fcn.0040361e
lea eax, [ebp - 0xa70]
lea ecx, [ebp - 0xe70]
push eax
mov dword [ebp - 4], edi
call fcn.00403698
test eax, eax
je 0x407348
call fcn.004058f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe70]
call fcn.00403682
jmp 0x4074e3
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
je 0x4073b6
and byte [ebp - 0x670], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x66f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x10]
stosb byte es:[edi], al
lea eax, [ebp - 0x670]
push eax
push dword [0x41d5b0]
call fcn.00408f6f
test eax, eax
je 0x407334
lea eax, [ebp - 0x670]
push 0x4253a0
push eax
call esi
test eax, eax
je 0x4073b6
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x670]
push 1
push eax
lea eax, [ebp - 0xa70]
push eax
call fcn.00409007
test eax, eax
je 0x40732f
cmp dword [ebp - 0x2c], 0
je 0x407421
and byte [ebp - 0x670], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x66f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x10]
stosb byte es:[edi], al
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x30]
call fcn.00408f6f
test eax, eax
je 0x407334
lea eax, [ebp - 0x670]
push 0x4253a0
push eax
call esi
test eax, eax
je 0x407421
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x670]
push 1
push eax
lea eax, [ebp - 0xa70]
push eax
call fcn.00409007
test eax, eax
je 0x40732f
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xa70]
push eax
call fcn.004089f0
test eax, eax
je 0x407334
cmp dword [ebp - 0x34], 0
je 0x407449
mov dword [ebp - 0x24], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe70]
call fcn.00403682
mov esi, dword [ebp - 0x24]
mov ecx, ebx
push esi
call fcn.0040b5c8
cmp dword [ebp - 0x38], 3
je 0x4074c4
test esi, esi
jne 0x4074e7
lea eax, [ebp - 0x1270]
push 0x4253a4
push eax
lea ecx, [ebp - 0x1d7c]
call fcn.0040361e
lea eax, [ebp - 0x1270]
lea ecx, [ebp - 0x1d7c]
push eax
mov dword [ebp - 4], 2
call fcn.00403698
test eax, eax
je 0x4074b5
call fcn.004058f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d7c]
jmp 0x40733e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d7c]
call fcn.00403682
test esi, esi
jne 0x4074e7
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1270]
push eax
push dword [ebp - 0x30]
call fcn.00409287
test eax, eax
jne 0x4074e7
call fcn.004058f3
xor eax, eax
jmp 0x4074fa
mov ecx, dword [ebp - 0x10]
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x1270]
push eax
call fcn.00407547
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret