Function at 0x40293b
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create process on windows
Delete file
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get installed programs
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3854
call fcn.0042bb20
mov eax, dword [0x4431c0]
xor eax, esp
mov dword [esp + 0x3850], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esp + 0xa4], eax
xor eax, eax
push edi
mov word [esp + 0x1b8], ax
mov word [esp + 0x228], ax
mov word [esp + 0x244], ax
mov word [esp + 0x20c], ax
mov word [esp + 0x260], ax
mov eax, 0x54f
push 7
pop esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x88], eax
xor edi, edi
inc edi
lea eax, [esp + 0xbc]
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x68], edi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x48], edi
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x240], esi
mov dword [esp + 0x23c], ebx
mov dword [esp + 0x25c], esi
mov dword [esp + 0x258], ebx
mov dword [esp + 0x224], esi
mov dword [esp + 0x220], ebx
mov dword [esp + 0x278], esi
mov dword [esp + 0x274], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0xbc], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0xbc], ebx
mov dword [esp + 0x94], eax
mov dword [esp + 0x28], ebx
jle 0x402da2
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x94]
lea eax, [eax + ecx*4]
push str._tbr
push dword [eax]
mov dword [esp + 0x18], eax
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402add
mov dword [esp + 0x5c], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push 0x439ba4
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402afc
mov dword [esp + 0x3c], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._hpr
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402b1b
mov dword [esp + 0x4c], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._nowzup
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402b3a
mov dword [esp + 0x2c], ebx
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._supg
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402b5d
mov dword [esp + 0x70], edi
mov dword [esp + 0x2c], ebx
jmp 0x402bf5
mov eax, dword [esp + 0x10]
push str._rep
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402b7c
mov dword [esp + 0x6c], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push 0x439be0
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402b9e
mov dword [esp + 0x90], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._s3all
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402bc0
mov dword [esp + 0x8c], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._testoi
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402bdf
mov dword [esp + 0x64], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._nooi
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402bfe
mov dword [esp + 0x64], ebx
jmp 0x402d77
mov eax, dword [esp + 0x10]
push 8
push str.toolbar
push dword [eax]
call fcn.0041a83a
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x402c29
mov eax, dword [eax]
add eax, 0x10
mov dword [esp + 0x30], eax
jmp 0x402d77
push 2
push 0x439b78
push dword [eax]
call fcn.0041a83a
add esp, 0xc
test eax, eax
jne 0x402c69
mov eax, dword [esp + 0x10]
push 0xb
push str._verysilent
push dword [eax]
call fcn.0041a83a
add esp, 0xc
test eax, eax
je 0x402c69
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
add eax, 4
mov dword [esp + 0x54], eax
jmp 0x402d77
mov eax, dword [esp + 0x10]
push esi
push str.macros
push dword [eax]
call fcn.0041a83a
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x402c96
mov eax, dword [eax]
add eax, 0xe
mov dword [esp + 0xac], eax
jmp 0x402d77
push 0x439c14
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402cb1
mov dword [esp + 0x40], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push 0x439c1c
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402cd3
mov dword [esp + 0x98], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._web
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402cf2
mov dword [esp + 0x68], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push str._uninstall
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
je 0x402f91
mov eax, dword [esp + 0x10]
push esi
push str.driver
push dword [eax]
call fcn.0041a83a
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x402d36
mov eax, dword [eax]
add eax, 0xe
mov dword [esp + 0xa4], eax
jmp 0x402d77
push str._gui
push dword [eax]
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402d4e
mov dword [esp + 0x58], edi
jmp 0x402d77
mov eax, dword [esp + 0x10]
push 5
push 0x439b6c
push dword [eax]
call fcn.0041a83a
add esp, 0xc
test eax, eax
jne 0x402d77
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
add eax, 0xa
mov dword [esp + 0x84], eax
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0xbc]
jl 0x402ab0
cmp dword [esp + 0x5c], ebx
jne 0x402da2
cmp dword [esp + 0x3c], ebx
jne 0x402da2
cmp dword [esp + 0x4c], ebx
je 0x402da2
mov dword [esp + 0x74], edi
lea esi, [esp + 0x27c]
call fcn.004056c3
lea esi, [esp + 0x298]
call fcn.004056c3
lea eax, [esp + 0x2b4]
push eax
call fcn.00408dc8
lea eax, [esp + 0x278]
push eax
mov byte [esp + 0x27c], bl
call fcn.004086e2
push edi
push dword [esp + 0xac]
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
lea ebx, [esp + 0xdb8]
call fcn.004116a2
test eax, eax
je 0x402e12
push 1
mov eax, ebx
push eax
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
mov eax, dword [esp + 0x30]
xor edi, edi
xor ebx, ebx
inc edi
cmp eax, ebx
je 0x4054c1
cmp word [eax], bx
je 0x4054c1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x60]
push eax
push edi
push ebx
push str.CLSIDD4027C7F_154A_4066_A1AD_4243D8127440
push SysReAllocString
mov byte [esp + 0x37], bl
call esi
test eax, eax
jne 0x402e73
lea eax, [esp + 0x38]
push eax
push edi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall86D4B82A_ABED_442A_BE86_96357B70F4FE
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x402e69
mov byte [esp + 0x23], 1
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x23], bl
je 0x402e9c
push 2
push str.Detected_a_corrupted_install__calling_CleanCorruptedInstall__
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
call fcn.00407736
call fcn.004075ca
mov dword [esp + 0x38], 0xf003f
call fcn.00411341
test eax, eax
je 0x402eba
mov dword [esp + 0x38], 0xf013f
lea eax, [esp + 0x9c]
push eax
push dword [esp + 0x3c]
push ebx
push str.InstallerProductsA28B4D68DEBAA244EB686953B7074FEFSourceList
push SysReAllocString
call esi
test eax, eax
jne 0x402f5f
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x3bc]
push eax
push ebx
push ebx
mov esi, 0x439910
push esi
push dword [esp + 0xb0]
mov dword [esp + 0x50], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402f52
lea eax, [esp + 0x3b8]
push str.Ask.com_Toolbar.msi
push eax
call fcn.00419889
pop ecx
pop ecx
test eax, eax
jne 0x402f52
push 0x20
pop eax
push eax
push str.Ask_Toolbar.msi
push edi
push ebx
push esi
push dword [esp + 0xb0]
mov dword [esp + 0x50], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 2
push str.Detected_a_mismatch_in_MSI_package_names._The_mismatch_has_been_rectified
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push dword [esp + 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401fe0
call fcn.00407913
mov dword [esp + 0x38], eax
call fcn.0040789e
mov dword [esp + 0x60], eax
call fcn.00407829
mov dword [esp + 0x10], eax
cmp dword [esp + 0x38], ebx
jne 0x402ff0
cmp dword [esp + 0x60], ebx
je 0x403020
jmp 0x403003
call fcn.0040e9aa
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push edi
lea esi, [esp + 0x264]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x210]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x248]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x22c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1bc]
call fcn.00405f67
xor eax, eax
jmp 0x4055d7
push edi
push str.int_toolbar_is_already_installed__do_not_launch_the_installer.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
cmp dword [esp + 0x60], ebx
je 0x40301c
push edi
push str.cp_toolbar_is_already_installed__do_not_launch_the_installer.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
mov dword [esp + 0x44], ebx
cmp dword [esp + 0x10], ebx
je 0x40305b
push edi
push str.v5_toolbar_is_already_installed.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], ebx
call fcn.004109db
pop ecx
test eax, eax
je 0x403057
test byte [esp + 0x28], 1
mov dword [esp + 0x1c], edi
jne 0x40305b
mov dword [esp + 0x1c], ebx
call fcn.00407988
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc4]
mov esi, vtable.CBasicMacro.0
push eax
mov dword [esp + 0xc4], esi
call fcn.0040cd50
lea eax, [esp + 0xe8]
push eax
mov dword [esp + 0xc4], vtable.CInstallerPropertiesMacro.0
mov dword [esp + 0xe8], esi
call fcn.0040cd50
mov dword [esp + 0xe4], vtable.CInstallerCustomMacro.0
cmp dword [0x4459c4], ebx
jne 0x4030db
push 0x44
call fcn.0041ab4e
mov esi, eax
pop ecx
cmp esi, ebx
je 0x4030d3
call fcn.0040bedc
lea eax, [esi + 0x24]
push eax
mov dword [esi], vtable.CMacro.0
call fcn.0040cd50
jmp 0x4030d5
xor esi, esi
mov dword [0x4459c4], esi
mov ecx, dword [0x4459c4]
mov dword [esp + 0x18], ecx
cmp ecx, ebx
jne 0x40310d
push edi
push str.Macro_object_initialization_failed.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
mov dword [esp + 0x64], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x48], ebx
jmp 0x403776
push dword [esp + 0x10]
push dword [esp + 0x64]
push dword [esp + 0x40]
call fcn.0040c485
cmp dword [esp + 0x70], ebx
je 0x403205
cmp dword [esp + 0x28], ebx
je 0x403205
cmp dword [esp + 0x1c], ebx
je 0x403142
cmp dword [esp + 0x64], ebx
jne 0x403205
push str.inguid
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, esi
push eax
mov eax, dword [esp + 0x1c]
lea ebx, [esp + 0x180]
call fcn.0040bf44
push 0xffffffffffffffff
xor edi, edi
push edi
lea ecx, [esp + 0x210]
call fcn.00405a9f
push edi
push 1
mov esi, ebx
call fcn.00405f67
push edi
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
cmp dword [esp + 0x21c], edi
je 0x4031c0
push str.repguid
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x208]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push edi
jmp 0x4031ed
lea ebx, [esp + 0x208]
call fcn.00410a64
push str.repguid
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push 0
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
xor edi, edi
xor ebx, ebx
inc edi
jmp 0x403728
lea ecx, [esp + 0x144]
call fcn.0040dfe6
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x264]
call fcn.00405a9f
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
call fcn.0040e268
mov dword [esp + 0xb0], eax
call fcn.0040e374
push 0x43a068
lea esi, [esp + 0x148]
mov dword [esp + 0x28], eax
call fcn.004056d6
lea eax, [esp + 0x25c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
push str.ielu
lea esi, [esp + 0x148]
call fcn.004056d6
push dword [esp + 0xb0]
lea ecx, [esp + 0x180]
call fcn.00414462
pop ecx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push str.fflu
lea esi, [esp + 0x148]
call fcn.004056d6
push dword [esp + 0x24]
lea ecx, [esp + 0x180]
call fcn.00414462
pop ecx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
mov eax, 0x43a088
cmp dword [esp + 0x1c], ebx
jne 0x403315
mov eax, 0x43a08c
push eax
lea esi, [esp + 0x180]
call fcn.004056d6
push 0x43a090
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
mov eax, 0x43a088
cmp dword [esp + 0x4c], ebx
jne 0x40336b
mov eax, 0x43a08c
push eax
lea esi, [esp + 0x180]
call fcn.004056d6
push 0x43a09c
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push str.5.11.3.15590
lea esi, [esp + 0x180]
call fcn.004056d6
push 0x43a0c0
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
cmp dword [esp + 0x70], ebx
jne 0x4034df
cmp dword [esp + 0x28], ebx
jne 0x4034df
cmp dword [esp + 0x5c], ebx
je 0x403477
lea ebx, [esp + 0x224]
call fcn.00410a64
mov edi, str.guid
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esp + 0x3c], ebx
je 0x4034df
lea ebx, [esp + 0x240]
call fcn.00410a64
mov edi, str.saguid
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esp + 0x238], ebx
je 0x403500
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x22c]
lea ecx, [esp + 0x210]
call fcn.00405a9f
jmp 0x403511
lea ebx, [esp + 0x208]
call fcn.00410a64
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esp + 0x84], ebx
je 0x403559
push dword [esp + 0x84]
lea esi, [esp + 0x180]
call fcn.004056d6
push str.dtid
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
mov dword [esp + 0x1c], 3
call fcn.0040bf1c
test byte [esp + 0x14], 2
je 0x403573
and dword [esp + 0x14], 0xfffffffd
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
test byte [esp + 0x14], 1
je 0x40358d
and dword [esp + 0x14], 0xfffffffe
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push dword [esp + 0x30]
lea esi, [esp + 0x180]
call fcn.004056d6
or dword [esp + 0x14], 4
push 0x439a88
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], 8
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test byte [esp + 0x14], 8
je 0x4035de
and dword [esp + 0x14], 0xfffffff7
push ebx
push edi
call fcn.00405f67
test byte [esp + 0x14], 4
je 0x4035f8
and dword [esp + 0x14], 0xfffffffb
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push str.client
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
call fcn.0040fdfd
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push str.1.11.3.15590
lea esi, [esp + 0x180]
call fcn.004056d6
push str.clientv
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
cmp dword [esp + 0x21c], ebx
je 0x4036bb
push str.repguid
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x208]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
mov esi, dword [esp + 0xa8]
call fcn.00402890
test al, al
lea eax, [esp + 0xe4]
push eax
je 0x4036ee
lea eax, [esp + 0xc4]
push eax
push dword [esp + 0x20]
call fcn.0040246f
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
jmp 0x403728
push dword [esp + 0x1c]
lea ecx, [esp + 0xc8]
call fcn.0040ff12
pop ecx
pop ecx
test eax, eax
push edi
lea eax, [esp + 0x27c]
je 0x40371d
push str.Install_Call_was_successful
push eax
call fcn.004088fe
mov dword [esp + 0x78], edi
jmp 0x403728
push str.Install_Call_failed
push eax
call fcn.004088fe
push str.param
lea esi, [esp + 0x148]
call fcn.004056d6
xor eax, eax
cmp dword [esp + 0x78], ebx
lea ecx, [esp + 0x17c]
sete al
call fcn.0040fef9
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
cmp dword [esp + 0x10], ebx
je 0x403d6f
push dword [esp + 0x18]
push dword [esp + 0x34]
call fcn.004023b3
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4037e9
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push str.5.11.3.15590
call fcn.004056d6
call fcn.004022fd
add esp, 0x1c
test eax, eax
je 0x4037e9
xor esi, esi
inc esi
push esi
push str.Product_already_installed_for_the_same_partner__exit_installer
lea eax, [esp + 0x280]
push eax
mov dword [esp + 0x50], ebx
call fcn.004088fe
cmp dword [esp + 0x1c], ebx
je 0x403d6f
call fcn.0040e13a
mov dword [esp + 0x80], esi
jmp 0x403d6f
cmp dword [esp + 0x70], ebx
je 0x403816
mov dword [esp + 0x44], edi
cmp edi, ebx
mov eax, str.Same_partner_id__run_the_update_installation.
jne 0x403801
mov eax, str.Partner_Id_mismatch._Terminate_installation.
push 1
push eax
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
jmp 0x403d6f
cmp dword [esp + 0x1c], ebx
je 0x403e3a
cmp dword [esp + 0x64], ebx
je 0x403e31
xor esi, esi
inc esi
push esi
push str.v5_toolbar_is_disabled.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push esi
push str.Over_install_mode_activated_
lea eax, [esp + 0x280]
push eax
mov dword [esp + 0x5c], esi
call fcn.004088fe
cmp dword [esp + 0x78], ebx
je 0x4039b8
push 0x43a360
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, esi
push eax
mov eax, dword [esp + 0x1c]
lea ebx, [esp + 0x180]
call fcn.0040bf44
push 0xffffffffffffffff
xor edi, edi
push edi
lea ecx, [esp + 0x1bc]
call fcn.00405a9f
xor ebx, ebx
push edi
inc ebx
push ebx
lea esi, [esp + 0x184]
call fcn.00405f67
push edi
push ebx
lea esi, [esp + 0x14c]
call fcn.00405f67
push str.Over_install:_Server_response_oi_
lea esi, [esp + 0x19c]
call fcn.004056d6
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x1bc]
mov ecx, esi
call fcn.00406291
cmp dword [esp + 0x1b0], 8
mov eax, dword [esp + 0x19c]
jae 0x4038ef
lea eax, [esp + 0x19c]
push ebx
push eax
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push edi
push ebx
lea esi, [esp + 0x1a0]
call fcn.00405f67
push 0x43a3b0
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x40393d
push 0x43a3b8
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x40393d
and dword [esp + 0x50], 0
xor ebx, ebx
cmp dword [esp + 0x2c], ebx
je 0x403955
cmp dword [esp + 0x28], ebx
je 0x403955
cmp dword [esp + 0x50], ebx
jne 0x40395f
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x50], ebx
je 0x403e31
push 1
push str.Over_install:_Call_EnableSuperToolbar__.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push 0x43a0c0
lea esi, [esp + 0x180]
call fcn.004056d6
push str.inversion
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
mov eax, dword [esp + 0x1c]
lea ebx, [esp + 0x19c]
call fcn.0040bf44
cmp dword [eax + 0x18], 8
jb 0x4039d4
mov esi, dword [eax + 4]
jmp 0x4039d7
push esi
push str.Over_install:_Server_call_failed._Do_NOT_Allow_Overinstall_
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
mov dword [esp + 0x50], ebx
jmp 0x40393f
lea esi, [eax + 4]
lea eax, [esp + 0x144]
push eax
mov eax, dword [esp + 0x1c]
lea ebx, [esp + 0x1f0]
call fcn.0040bf44
cmp dword [eax + 0x18], 8
jb 0x4039fa
mov eax, dword [eax + 4]
jmp 0x4039fd
add eax, 4
cmp dword [esp + 0x1cc], 8
mov ecx, dword [esp + 0x1b8]
jae 0x403a15
lea ecx, [esp + 0x1b8]
push esi
push ecx
mov ecx, eax
call fcn.0040e041
pop ecx
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x1f4]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1a0]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push 0x43a3b0
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x403a8f
cmp dword [esp + 0x74], ebx
je 0x403aa7
push 0x43a3b8
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
je 0x403aa7
push edi
push str.Over_install:_Uninstall_the_incumbent_Toolbar.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
call fcn.0040e9aa
push 0x43a3b8
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
je 0x403c84
lea edi, [esp + 0xc4]
call fcn.0040ce92
lea edi, [esp + 0xe8]
call fcn.0040ce92
cmp dword [esp + 0x5c], ebx
je 0x403b97
xor eax, eax
push str.inguid
lea esi, [esp + 0x148]
mov dword [esp + 0x1ec], 7
mov dword [esp + 0x1e8], ebx
mov word [esp + 0x1d8], ax
call fcn.004056d6
mov eax, esi
push eax
mov eax, dword [esp + 0x1c]
lea ebx, [esp + 0x180]
call fcn.0040bf44
push 0xffffffffffffffff
xor edi, edi
push edi
lea ecx, [esp + 0x1d8]
call fcn.00405a9f
xor ebx, ebx
push edi
inc ebx
push ebx
lea esi, [esp + 0x184]
call fcn.00405f67
push edi
push ebx
lea esi, [esp + 0x14c]
call fcn.00405f67
cmp dword [esp + 0x1e4], edi
je 0x403b87
push str.guid
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x1d0]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push edi
push ebx
call fcn.00405f67
push edi
push ebx
lea esi, [esp + 0x1d8]
call fcn.00405f67
xor ebx, ebx
cmp dword [esp + 0x3c], ebx
je 0x403c84
xor eax, eax
push str.insaguid
lea esi, [esp + 0x148]
mov dword [esp + 0x1ec], 7
mov dword [esp + 0x1e8], ebx
mov word [esp + 0x1d8], ax
call fcn.004056d6
mov eax, esi
push eax
mov eax, dword [esp + 0x1c]
lea ebx, [esp + 0x180]
call fcn.0040bf44
push 0xffffffffffffffff
xor edi, edi
push edi
lea ecx, [esp + 0x1d8]
call fcn.00405a9f
push edi
push 1
mov esi, ebx
call fcn.00405f67
push edi
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
cmp dword [esp + 0x1e4], edi
jne 0x403c49
lea ebx, [esp + 0x240]
call fcn.00410a64
push str.saguid
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push edi
push 1
call fcn.00405f67
jmp 0x403c75
push str.saguid
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x1d0]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push edi
push 1
call fcn.00405f67
push edi
push 1
lea esi, [esp + 0x1d8]
call fcn.00405f67
push 0x43a3b0
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
je 0x403d6d
cmp dword [esp + 0x5c], 0
je 0x403d09
cmp dword [esp + 0x7c], 0
jne 0x403d09
lea ebx, [esp + 0x224]
call fcn.00410a64
mov edi, str.guid
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
cmp dword [esp + 0x3c], 0
je 0x403d6d
lea ebx, [esp + 0x240]
call fcn.00410a64
mov edi, str.saguid
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
push edi
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, ebx
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, esi
call fcn.0040bf1c
push 0
push 1
call fcn.00405f67
xor ebx, ebx
cmp dword [esp + 0x6c], ebx
jne 0x403d87
cmp dword [esp + 0x8c], ebx
jne 0x403d87
cmp dword [esp + 0x90], ebx
je 0x403d9c
push str.report
push str.SoftwareAsk.com
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [esp + 0xa8]
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea esi, [edi + 0x400]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
mov dword [esp + 0x1c], esi
neg ecx
or ecx, eax
push ecx
call fcn.0041874e
pop ecx
mov dword [esp + 0x10], eax
cmp edi, ebx
je 0x405049
cmp dword [esp + 0x40], ebx
je 0x403df6
cmp dword [esp + 0x98], ebx
je 0x403df6
mov dword [esp + 0x98], ebx
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x30]
cmp word [eax], bx
je 0x405049
cmp dword [esp + 0x58], ebx
je 0x403e94
cmp dword [esp + 0x3c], ebx
jne 0x403e54
cmp dword [esp + 0x4c], ebx
jne 0x403e5a
mov edi, dword [esp + 0x10]
push eax
push str._v_PARTNER_s_GUIYES
mov ecx, esi
call fcn.00401164
pop ecx
pop ecx
jmp 0x403f31
mov dword [esp + 0x44], ebx
jmp 0x403d6f
push dword [esp + 0x18]
push dword [esp + 0x34]
call fcn.004023b3
pop ecx
pop ecx
mov dword [esp + 0x44], eax
cmp eax, ebx
jmp 0x4037f5
cmp dword [esp + 0x4c], ebx
je 0x403e61
mov ecx, str.HPR1
jmp 0x403e66
mov ecx, str.HPR0
mov eax, str.SAYES
cmp dword [esp + 0x3c], ebx
jne 0x403e76
mov eax, str.SANO
mov edi, dword [esp + 0x10]
push ecx
push eax
push dword [esp + 0x38]
mov ecx, esi
push str._v_PARTNER_s_GUIYES__s_s
call fcn.00401164
add esp, 0x10
jmp 0x403f31
mov eax, 0x43910c
mov edi, str.WEBINSTALLYES
cmp dword [esp + 0x68], ebx
jne 0x403ea6
mov edi, eax
mov dword [esp + 0x68], str.BROWSERFF
cmp dword [esp + 0x98], ebx
jne 0x403ebb
mov dword [esp + 0x68], eax
mov dword [esp + 0x7c], str.BROWSERIE
cmp dword [esp + 0x40], ebx
jne 0x403ecd
mov dword [esp + 0x7c], eax
mov edx, str.HPR1
cmp dword [esp + 0x4c], ebx
jne 0x403edd
mov edx, str.HPR0
mov ecx, str.SAYES
cmp dword [esp + 0x3c], ebx
jne 0x403eed
mov ecx, str.SANO
cmp dword [esp + 0x5c], ebx
je 0x403f06
cmp dword [esp + 0x3c], ebx
jne 0x403f0b
cmp dword [esp + 0x4c], ebx
jne 0x403f0b
mov eax, str.TBRYES
jmp 0x403f0b
mov eax, str.TBRNO
push edi
push dword [esp + 0x6c]
mov edi, dword [esp + 0x18]
push dword [esp + 0x84]
push edx
push ecx
push eax
push dword [esp + 0x48]
mov ecx, esi
push str._s__v__qn_REBOOTReallySuppress_PARTNER_s__s_s_s_s_s_s
call fcn.00401164
add esp, 0x20
cmp dword [esp + 0xa4], ebx
je 0x403f6f
push str.DRIVER
push dword [esp + 0x14]
mov ecx, esi
call fcn.004010b3
push dword [esp + 0xa4]
mov ecx, esi
push dword [esp + 0x14]
call fcn.004010b3
mov edi, 0x43a6e8
push edi
push dword [esp + 0x14]
mov ecx, esi
call fcn.004010b3
jmp 0x403f74
mov edi, 0x43a6e8
push str.dtid
lea esi, [esp + 0x148]
call fcn.004056d6
mov eax, esi
push eax
lea ebx, [esp + 0x1d4]
lea eax, [esp + 0xc4]
call fcn.0040bf44
push 0
push 1
call fcn.00405f67
cmp dword [esp + 0x1e4], 0
mov ebx, 0x43a3b8
jne 0x403fed
cmp dword [esp + 0x84], 0
je 0x404033
push ebx
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x403fe3
push dword [esp + 0x84]
lea eax, [esp + 0x1d4]
push eax
call fcn.00405b2b
cmp dword [esp + 0x1e4], 0
je 0x404033
mov ecx, dword [esp + 0x1c]
push 0x43a6ec
push dword [esp + 0x14]
call fcn.004010b3
cmp dword [esp + 0x1e8], 8
mov eax, dword [esp + 0x1d4]
jae 0x404017
lea eax, [esp + 0x1d4]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
mov ecx, dword [esp + 0x1c]
push edi
push dword [esp + 0x14]
call fcn.004010b3
xor esi, esi
cmp dword [esp + 0x70], esi
je 0x404042
push str.IFsu
jmp 0x4040b6
cmp dword [esp + 0x50], esi
je 0x4040ab
push 0x43a3b0
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x404070
push ebx
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
je 0x4040ab
mov ecx, dword [esp + 0x1c]
push 0x43a708
push dword [esp + 0x14]
call fcn.004010b3
cmp dword [esp + 0x1cc], 8
mov eax, dword [esp + 0x1b8]
jae 0x40409a
lea eax, [esp + 0x1b8]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
push edi
jmp 0x4040b6
cmp dword [esp + 0x28], esi
jne 0x4040c3
push str.IFfirst
push dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
call fcn.004010b3
push ebx
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x404127
lea edx, [esp + 0x198]
lea ecx, [esp + 0xc0]
call fcn.0040ca08
cmp dword [esp + 0x1ac], esi
je 0x404117
cmp dword [esp + 0x1b0], 8
mov eax, dword [esp + 0x19c]
jae 0x404109
lea eax, [esp + 0x19c]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
push 0
push 1
lea esi, [esp + 0x1a0]
call fcn.00405f67
cmp dword [esp + 0x50], 0
je 0x40419c
push 0x43a3b0
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
jne 0x404156
push ebx
lea ecx, [esp + 0x1b8]
call fcn.004066f9
pop ecx
test al, al
je 0x40419c
mov ecx, dword [esp + 0x1c]
push 0x43a724
push dword [esp + 0x14]
call fcn.004010b3
cmp dword [esp + 0x1cc], 8
mov eax, dword [esp + 0x1b8]
jae 0x404180
lea eax, [esp + 0x1b8]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
mov ecx, dword [esp + 0x1c]
push edi
push dword [esp + 0x14]
call fcn.004010b3
cmp dword [esp + 0xac], 0
je 0x40430f
mov ecx, dword [esp + 0x1c]
push str.MACROS
push dword [esp + 0x14]
call fcn.004010b3
push dword [esp + 0xac]
lea esi, [esp + 0x164]
call fcn.004056d6
lea ecx, [esp + 0x144]
lea ebx, [esp + 0xe4]
call fcn.0040cc23
xor ebx, ebx
cmp dword [esp + 0x174], ebx
je 0x40424a
push 1
push 0x43a73c
mov eax, esi
call fcn.00405e7d
mov esi, eax
push 1
xor eax, eax
push 0x43a740
lea edi, [esi - 1]
inc eax
lea ecx, [esp + 0x168]
call fcn.00405f0b
test eax, eax
je 0x40422a
push 1
mov eax, esi
lea ecx, [esp + 0x164]
call fcn.00405c98
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x14c]
push eax
inc esi
push esi
lea ebx, [esp + 0x170]
call fcn.00405b50
xor ebx, ebx
mov edi, 0x43a6e8
push 0x43a744
push edi
lea eax, [esp + 0x184]
push eax
lea edi, [esp + 0x16c]
call fcn.004106e6
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.00405a9f
push ebx
push 1
lea esi, [esp + 0x184]
call fcn.00405f67
push 0x43a74c
lea eax, [esp + 0x180]
push 0x43a754
push eax
call fcn.004106e6
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.00405a9f
push ebx
push 1
lea esi, [esp + 0x184]
call fcn.00405f67
cmp dword [esp + 0x178], 8
mov eax, dword [esp + 0x164]
jae 0x4042cb
lea eax, [esp + 0x164]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
mov ecx, dword [esp + 0x1c]
push 0x43a6e8
push dword [esp + 0x14]
call fcn.004010b3
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x168]
call fcn.00405f67
jmp 0x40441c
lea ecx, [esp + 0x160]
lea ebx, [esp + 0xe4]
call fcn.0040cc23
xor ebx, ebx
cmp dword [esp + 0x174], ebx
je 0x404408
mov ecx, dword [esp + 0x1c]
push str.MACROS
push dword [esp + 0x14]
call fcn.004010b3
mov ecx, dword [esp + 0x1c]
push 0x43a758
push dword [esp + 0x14]
call fcn.004010b3
push 0x43a744
push edi
lea eax, [esp + 0x14c]
push eax
lea edi, [esp + 0x16c]
call fcn.004106e6
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.00405a9f
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
push 0x43a74c
lea eax, [esp + 0x180]
push 0x43a754
push eax
call fcn.004106e6
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.00405a9f
push ebx
push 1
lea esi, [esp + 0x184]
call fcn.00405f67
cmp dword [esp + 0x178], 8
mov eax, dword [esp + 0x164]
jae 0x4043d6
lea eax, [esp + 0x164]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
mov ecx, dword [esp + 0x1c]
push 0x43a73c
push dword [esp + 0x14]
call fcn.004010b3
mov ecx, dword [esp + 0x1c]
push 0x43a6e8
push dword [esp + 0x14]
call fcn.004010b3
push ebx
push 1
lea esi, [esp + 0x168]
call fcn.00405f67
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esp + 0x6c], ebx
je 0x404434
mov ecx, dword [esp + 0x1c]
push 0x43a75c
push dword [esp + 0x14]
call fcn.004010b3
cmp dword [esp + 0x54], ebx
je 0x4044b7
push dword [esp + 0x54]
lea esi, [esp + 0x164]
call fcn.004056d6
push 0x43a74c
lea eax, [esp + 0x148]
push 0x43a754
push eax
mov edi, esi
call fcn.004106e6
add esp, 0xc
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00405a9f
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
cmp dword [esp + 0x178], 8
mov eax, dword [esp + 0x164]
jae 0x404497
lea eax, [esp + 0x164]
mov ecx, dword [esp + 0x1c]
push eax
push dword [esp + 0x14]
call fcn.004010b3
push ebx
push 1
lea esi, [esp + 0x168]
call fcn.00405f67
xor edi, edi
inc edi
mov ecx, dword [esp + 0x1c]
push 0x43a754
push dword [esp + 0x14]
call fcn.004010b3
push edi
push str.cmdline_input_to_installer
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
cmp dword [esp + 0x2c], ebx
je 0x40460d
cmp dword [esp + 0x28], ebx
je 0x40450e
cmp dword [esp + 0x50], ebx
jne 0x40450e
cmp dword [esp + 0x78], ebx
jne 0x40450e
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x2c], ebx
je 0x40460d
push str.wr_tbr
lea esi, [esp + 0x148]
call fcn.004056d6
xor eax, eax
cmp dword [esp + 0x5c], ebx
lea ecx, [esp + 0x198]
sete al
call fcn.0040fee0
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x1a0]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push str.wr_sa
lea esi, [esp + 0x180]
call fcn.004056d6
xor eax, eax
cmp dword [esp + 0x3c], ebx
lea ecx, [esp + 0x144]
sete al
call fcn.0040fee0
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push str.wr_hpr
lea esi, [esp + 0x1f0]
call fcn.004056d6
xor eax, eax
cmp dword [esp + 0x4c], ebx
lea ecx, [esp + 0x144]
sete al
call fcn.0040fee0
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1f4]
call fcn.00405f67
mov ecx, dword [esp + 0x18]
push edi
call fcn.004105f8
pop ecx
lea eax, [esp + 0x2408]
push eax
mov esi, 0xa28
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xfb8]
push eax
push ebx
push 0x43a7e0
lea eax, [esp + 0x2414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x43a7e8
lea eax, [esp + 0xfbc]
push eax
mov ecx, esi
call fcn.004010b3
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [esp + 0xfd0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0x43a7f4
push 0xc8
push dword [esp + 0xa8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x54], eax
cmp esi, 0xffffffff
je 0x405039
cmp eax, ebx
je 0x405039
push eax
push dword [esp + 0xa4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [esp + 0x54]
mov dword [esp + 0x28], eax
push dword [esp + 0xa4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
lea ecx, [esp + 0x6c]
push ecx
push eax
push dword [esp + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push str.Extracted_the_core_installer_to_the_location:
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push edi
lea eax, [esp + 0xfbc]
push eax
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push 0x3c
pop esi
push esi
lea eax, [esp + 0x10c]
push ebx
push eax
call fcn.0041c7e0
lea eax, [esp + 0xfc4]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x128], eax
mov dword [esp + 0x114], esi
mov esi, dword [esp + 0x64]
add esp, 0xc
mov eax, esi
neg eax
sbb eax, eax
and eax, 5
mov dword [esp + 0x10c], 0x40
mov dword [esp + 0x124], eax
mov dword [esp + 0x88], ebx
cmp byte [esp + 0x23], bl
je 0x4047d8
lea eax, [esp + 0x40]
push eax
push edi
push ebx
push str.CLSIDD4027C7F_154A_4066_A1AD_4243D8127440InprocServer32
push SysReAllocString
mov dword [esp + 0x54], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [esp + 0x40], ebx
je 0x4047d8
push 0x410
call fcn.0041874e
pop ecx
mov esi, eax
lea eax, [esp + 0x24]
push eax
push esi
push ebx
push ebx
push ebx
push dword [esp + 0x54]
mov dword [esp + 0x3c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4047b8
push esi
call fcn.0041a129
pop ecx
xor esi, esi
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4047d4
push esi
call fcn.0041137a
pop ecx
push esi
call fcn.0041a129
pop ecx
mov esi, dword [esp + 0x58]
push 7
pop eax
mov dword [esp + 0x1b0], eax
xor ecx, ecx
mov dword [esp + 0x194], eax
xor eax, eax
mov dword [esp + 0x1ac], ebx
mov word [esp + 0x19c], cx
mov dword [esp + 0x190], ebx
mov word [esp + 0x180], ax
cmp dword [esp + 0x6c], ebx
jne 0x40481b
cmp dword [esp + 0x2c], ebx
je 0x404e42
call fcn.00411341
test eax, eax
mov eax, 0x43a8d8
jne 0x40482e
mov eax, 0x43a8e0
push eax
lea eax, [esp + 0x19c]
push eax
call fcn.00405b2b
cmp dword [esp + 0x48], ebx
je 0x40486b
push str.harch
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], 0x10
lea eax, [esp + 0x198]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test byte [esp + 0x14], 0x10
je 0x404885
and dword [esp + 0x14], 0xffffffef
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
call fcn.00410fcb
mov esi, eax
xor eax, eax
push 0x3e
mov word [esp + 0x33c], ax
lea eax, [esp + 0x33e]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
push esi
push 0x4396f4
push 0x20
pop ecx
lea edi, [esp + 0x340]
call fcn.00401164
pop ecx
mov eax, edi
pop ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x4048c5
sub eax, ecx
sar eax, 1
lea ecx, [esp + 0x338]
lea edx, [esp + 0x17c]
call fcn.00406338
cmp dword [esp + 0x48], ebx
je 0x40492e
lea eax, [esp + 0x338]
push eax
lea esi, [esp + 0x1f0]
call fcn.004056d6
or dword [esp + 0x14], 0x20
push 0x43a8f4
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], 0x40
lea eax, [esp + 0x1ec]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test byte [esp + 0x14], 0x40
je 0x404949
and dword [esp + 0x14], 0xffffffbf
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
test byte [esp + 0x14], 0x20
je 0x404964
and dword [esp + 0x14], 0xffffffdf
push ebx
push 1
lea esi, [esp + 0x1f4]
call fcn.00405f67
xor eax, eax
mov word [esp + 0x164], ax
lea eax, [esp + 0x160]
push eax
mov dword [esp + 0x17c], 7
mov dword [esp + 0x178], ebx
call fcn.004115ce
pop ecx
test eax, eax
je 0x4049e2
cmp dword [esp + 0x48], ebx
je 0x4049c4
push 0x43a8fc
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], 0x80
lea eax, [esp + 0x160]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test byte [esp + 0x14], 0x80
je 0x4049e2
and dword [esp + 0x14], 0xffffff7f
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
lea eax, [esp + 0x160]
call fcn.00405797
lea eax, [esp + 0x160]
push eax
call fcn.00411b1a
pop ecx
test eax, eax
je 0x404a50
mov edi, 0x100
cmp dword [esp + 0x48], ebx
je 0x404a33
push 0x43a904
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], edi
lea eax, [esp + 0x160]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test dword [esp + 0x14], edi
je 0x404a50
and dword [esp + 0x14], 0xfffffeff
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
lea eax, [esp + 0x160]
call fcn.00405797
lea eax, [esp + 0x160]
push eax
call fcn.00411b5e
pop ecx
test eax, eax
je 0x404ac1
cmp dword [esp + 0x48], ebx
je 0x404aa0
push 0x43a90c
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], 0x200
lea eax, [esp + 0x160]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test dword [esp + 0x14], 0x200
je 0x404ac1
and dword [esp + 0x14], 0xfffffdff
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
lea eax, [esp + 0x160]
call fcn.00405797
lea eax, [esp + 0x160]
push eax
call fcn.0041139b
movzx eax, ax
pop ecx
mov dword [esp + 0x24], eax
mov edi, 0x400
cmp dword [esp + 0x48], ebx
je 0x404b15
push 0x43a914
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], edi
lea eax, [esp + 0x160]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test dword [esp + 0x14], edi
je 0x404b32
and dword [esp + 0x14], 0xfffffbff
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
lea eax, [esp + 0x160]
call fcn.00405797
lea eax, [esp + 0x160]
push eax
call fcn.0041148e
pop ecx
mov dword [esp + 0xb0], eax
mov edi, 0x800
cmp dword [esp + 0x48], ebx
je 0x404b86
push 0x43a91c
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], edi
lea eax, [esp + 0x160]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test dword [esp + 0x14], edi
je 0x404ba3
and dword [esp + 0x14], 0xfffff7ff
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
lea eax, [esp + 0x160]
call fcn.00405797
lea eax, [esp + 0x160]
push eax
call fcn.004126ae
pop ecx
mov edi, 0x1000
cmp dword [esp + 0x48], ebx
je 0x404bf0
push str.hloc
lea esi, [esp + 0x148]
call fcn.004056d6
or dword [esp + 0x14], edi
lea eax, [esp + 0x160]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
test dword [esp + 0x14], edi
je 0x404c05
push ebx
push 1
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push 1
lea esi, [esp + 0x168]
call fcn.00405f67
cmp dword [esp + 0x6c], ebx
je 0x404e3b
push str.http:__websearch.ask.com_report_install_tb
lea esi, [esp + 0x164]
call fcn.004056d6
push dword [esp + 0x30]
mov eax, esi
push eax
call fcn.0040576e
push 0x4396fc
mov eax, esi
push eax
call fcn.0040576e
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x210]
mov ecx, esi
call fcn.00406291
push str.typepreinstall
mov eax, esi
push eax
call fcn.0040576e
push str.vbs
mov eax, esi
push eax
call fcn.0040576e
push dword [esp + 0x24]
mov eax, esi
call fcn.00405723
mov eax, str.msi1
cmp dword [esp + 0xb0], ebx
jne 0x404c91
mov eax, str.msi0
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
push str.platform
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1a0]
lea ecx, [esp + 0x168]
call fcn.00406291
mov eax, str.interimtb1
cmp dword [esp + 0x38], ebx
jne 0x404cd7
mov eax, str.interimtb0
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
mov eax, str.captb1
cmp dword [esp + 0x60], ebx
jne 0x404cf5
mov eax, str.captb0
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
push str.defbrowser
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x184]
lea ecx, [esp + 0x168]
call fcn.00406291
mov dword [esp + 0x200], ebx
xor eax, eax
lea ebx, [esp + 0x1ec]
mov dword [esp + 0x204], 7
mov word [esp + 0x1f0], ax
call fcn.00411516
xor ebx, ebx
test eax, eax
je 0x404d6f
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1f4]
lea ecx, [esp + 0x168]
call fcn.00406291
mov eax, str.go1
cmp dword [esp + 0x44], ebx
jne 0x404d7f
mov eax, str.go0
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
mov eax, str.err1
cmp byte [esp + 0x23], bl
jne 0x404d9d
mov eax, str.err0
push eax
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
mov edx, dword [esp + 0x164]
xor eax, eax
cmp dword [esp + 0x178], 8
mov dword [esp + 0x15c], 7
mov dword [esp + 0x158], ebx
mov word [esp + 0x148], ax
jae 0x404ddf
lea edx, [esp + 0x164]
push 0x7d0
push ebx
push str.AskInstallHelper
lea ecx, [esp + 0x150]
call fcn.00410bcf
add esp, 0xc
xor edi, edi
inc edi
push edi
push str.First_reporting_call_was_made.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1f4]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x168]
call fcn.00405f67
xor ebx, ebx
mov esi, dword [esp + 0x58]
xor edi, edi
inc edi
push edi
lea eax, [esp + 0x27c]
cmp dword [esp + 0x48], ebx
je 0x404fd0
push str.About_to_execute_the_core_installer.
push eax
call fcn.004088fe
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0x2c], ebx
je 0x404e74
call edi
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [esp + 0x74], eax
cmp dword [esp + 0x140], ebx
je 0x404ed4
neg esi
sbb esi, esi
and esi, 0xfff6d83f
add esi, 0x927c0
push esi
push dword [esp + 0x144]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x404eca
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x144]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.00402197
jmp 0x404edc
mov dword [esp + 0x34], 0x102
jmp 0x404edc
mov dword [esp + 0x34], 6
cmp dword [esp + 0x2c], ebx
je 0x404f72
call edi
mov esi, eax
sub esi, dword [esp + 0xb8]
xor eax, eax
push 0xfe
mov word [esp + 0x3bc], ax
lea eax, [esp + 0x3be]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
push esi
push 0x43aadc
push 0x20
pop ecx
lea edi, [esp + 0x3c0]
call fcn.00401164
pop ecx
pop ecx
mov eax, edi
push eax
lea esi, [esp + 0x1f0]
call fcn.004056d6
push str.itime
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x1ec]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push 1
call fcn.00405f67
push ebx
push 1
lea esi, [esp + 0x1f4]
call fcn.00405f67
xor eax, eax
push 0x7fe
mov word [esp + 0x5bc], ax
lea eax, [esp + 0x5be]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
push dword [esp + 0x34]
mov ecx, 0x3ff
push str.The_core_installer_returned_the_exit_code:__d
lea edi, [esp + 0x5c0]
call fcn.00401164
pop ecx
pop ecx
push 1
mov eax, edi
push eax
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
mov eax, dword [esp + 0x34]
xor edi, edi
mov dword [esp + 0x88], eax
inc edi
jmp 0x404feb
push str.The_LaunchInstaller_flag_was_not_set__do_not_launch_the_core_installer.
push eax
call fcn.004088fe
cmp dword [esp + 0x80], ebx
je 0x404feb
mov dword [esp + 0x88], ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0xfb8]
push eax
call esi
lea eax, [esp + 0xfb8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [esp + eax*2 + 0xfb0], cx
lea eax, [esp + 0xfb8]
push eax
call esi
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1a0]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1d8]
call fcn.00405f67
xor ebx, ebx
mov dword [esp + 0x80], ebx
cmp dword [esp + 0x44], ebx
je 0x40510c
cmp dword [esp + 0x8c], ebx
jne 0x40507a
cmp dword [esp + 0x90], ebx
je 0x40510c
cmp dword [esp + 0x34], ebx
je 0x40510c
lea eax, [esp + 0xfb8]
push eax
mov esi, 0xa28
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.APNLogsci.log
lea eax, [esp + 0xfbc]
push eax
mov ecx, esi
call fcn.004010b3
lea eax, [esp + 0xfb8]
push eax
lea edi, [esp + 0xb4]
call fcn.004011f0
mov edi, dword [eax + 4]
sub esp, 0x1c
lea eax, [esp + 0x224]
mov esi, esp
mov dword [esp + 0x40], esp
push eax
call fcn.004056f5
push dword [esp + 0x4c]
mov ecx, edi
push dword [esp + 0x54]
call fcn.00401d3d
add esp, 0x24
push dword [esp + 0xb0]
mov esi, eax
call fcn.0041a129
pop ecx
push dword [esp + 0xb4]
call fcn.0041a129
pop ecx
cmp esi, ebx
je 0x40510c
mov dword [esp + 0x80], 1
xor eax, eax
push 0x3e
mov word [esp + 0x37c], ax
lea eax, [esp + 0x37e]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
push dword [esp + 0x34]
lea edi, [esp + 0x37c]
push 0x4396f4
push 0x20
pop ecx
call fcn.00401164
pop ecx
pop ecx
cmp dword [esp + 0x2c], ebx
je 0x4051f7
push str.ci_res
lea esi, [esp + 0x148]
call fcn.004056d6
xor eax, eax
cmp dword [esp + 0x34], ebx
lea ecx, [esp + 0x1ec]
setne al
call fcn.0040fef9
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x1f4]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
lea eax, [esp + 0x378]
push eax
lea esi, [esp + 0x180]
call fcn.004056d6
push str.ci_erc
lea esi, [esp + 0x148]
call fcn.004056d6
lea eax, [esp + 0x17c]
push eax
push dword [esp + 0x1c]
mov eax, esi
call fcn.0040bf1c
push ebx
push edi
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x184]
call fcn.00405f67
mov ecx, dword [esp + 0x18]
push 2
call fcn.004105f8
pop ecx
cmp dword [esp + 0x6c], ebx
je 0x4053b3
xor eax, eax
mov word [esp + 0x19c], ax
lea eax, [esp + 0x24]
push eax
push 0x20019
push ebx
push str.SoftwareAsk.com
push SysReAllocString
mov dword [esp + 0x1c4], 7
mov dword [esp + 0x1c0], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405254
lea eax, [esp + 0x198]
push eax
push str.report
lea edi, [esp + 0x2c]
call fcn.0041081f
pop ecx
pop ecx
push str.http:__websearch.ask.com_report_install_tb
lea esi, [esp + 0x164]
call fcn.004056d6
push dword [esp + 0x30]
mov eax, esi
push eax
call fcn.0040576e
push 0x4396fc
mov eax, esi
push eax
call fcn.0040576e
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x210]
mov ecx, esi
call fcn.00406291
push str.typepostinstallretcode
mov eax, esi
push eax
call fcn.0040576e
cmp dword [esp + 0x74], ebx
je 0x4052c2
cmp dword [esp + 0x1ac], ebx
jne 0x4052b8
cmp dword [esp + 0x34], ebx
jne 0x4052b8
push str.1359
jmp 0x4052c7
lea eax, [esp + 0x378]
push eax
jmp 0x4052c7
push str.shlx0
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1a0]
lea ecx, [esp + 0x168]
call fcn.00406291
cmp dword [esp + 0x80], ebx
je 0x4052fa
push str.s3log1
jmp 0x405318
cmp dword [esp + 0x8c], ebx
jne 0x405313
cmp dword [esp + 0x90], ebx
jne 0x405313
push str.s3log_1
jmp 0x405318
push str.s3log0
lea eax, [esp + 0x164]
push eax
call fcn.0040576e
mov edx, dword [esp + 0x164]
xor eax, eax
cmp dword [esp + 0x178], 8
mov dword [esp + 0x15c], 7
mov dword [esp + 0x158], ebx
mov word [esp + 0x148], ax
jae 0x405359
lea edx, [esp + 0x164]
push 0x7d0
push ebx
push str.AskInstallHelper
lea ecx, [esp + 0x150]
call fcn.00410bcf
add esp, 0xc
xor edi, edi
inc edi
push edi
push str.Second_reporting_call_was_made.
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push ebx
push edi
lea esi, [esp + 0x14c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x168]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1a0]
call fcn.00405f67
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x10]
call fcn.0041a129
pop ecx
cmp byte [esp + 0x278], bl
je 0x4053e9
push 1
lea eax, [esp + 0x27c]
push eax
call fcn.0040875e
mov byte [esp + 0x278], bl
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x4053f7
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [esp + 0xe4]
mov dword [esp + 0xe4], vtable.CInstallerCustomMacro.0
call fcn.0040bf0a
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc0], vtable.CInstallerPropertiesMacro.0
call fcn.0040bf0a
cmp byte [esp + 0x278], bl
je 0x405444
push 1
lea eax, [esp + 0x27c]
push eax
call fcn.0040875e
mov byte [esp + 0x278], bl
lea eax, [esp + 0x2b4]
call fcn.00408639
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x2a0]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x284]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x264]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x210]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x248]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x22c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1bc]
call fcn.00405f67
mov eax, dword [esp + 0x88]
jmp 0x4055d7
xor eax, eax
push 0x7fe
mov word [esp + 0x5bc], ax
lea eax, [esp + 0x5be]
push ebx
push eax
call fcn.0041c7e0
add esp, 0xc
push dword [esp + 0x34]
mov ecx, 0x3ff
push str.Partner_ID_was_not_passed._Terminating_installation_with_exit_code:__d
lea edi, [esp + 0x5c0]
call fcn.00401164
pop ecx
pop ecx
push 1
mov eax, edi
push eax
lea eax, [esp + 0x280]
push eax
call fcn.004088fe
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [esp + 0x278], bl
je 0x40553b
push 1
lea eax, [esp + 0x27c]
push eax
call fcn.0040875e
mov byte [esp + 0x278], bl
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
cmp byte [esp + 0x278], bl
je 0x405562
push 1
lea eax, [esp + 0x27c]
push eax
call fcn.0040875e
mov byte [esp + 0x278], bl
lea eax, [esp + 0x2b4]
call fcn.00408639
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x2a0]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x284]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x264]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x210]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x248]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x22c]
call fcn.00405f67
push ebx
push edi
lea esi, [esp + 0x1bc]
call fcn.00405f67
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x385c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004195bf
mov esp, ebp
pop ebp
ret 0x10