Function at 0x40b2e0
Capabilities:
Check for time delay via gettickcount
Delete file
Delete registry key
Get installed programs
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c35d
mov eax, dword fs:[0]
push eax
sub esp, 0x4a4
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push ebx
push str.InstallClient:_index___d
lea eax, [ebp - 0x210]
mov dword [ebp - 0x47c], 0
push 0x100
push eax
call fcn.00405790
mov eax, dword [vtable.CLogImplW.0]
add esp, 0x10
mov ecx, 0x438aac
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x40b3b7
mov eax, dword [vtable.CLogImplW.0]
mov ecx, 0x438aac
mov eax, dword [eax + 0x30]
call eax
test al, al
jne 0x40b3b7
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b363
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push eax
lea eax, [ecx + ecx]
mov ecx, 0x438aac
push eax
mov eax, dword [vtable.CLogImplW.0]
mov eax, dword [eax + 0x3c]
call eax
test al, al
je 0x40b3b7
mov eax, dword [vtable.CLogImplW.0]
mov ecx, 0x438aac
push 0x433f28
push 4
call dword [eax + 0x3c]
cmp byte [0x438ab9], 0
je 0x40b3b7
mov ecx, 0x438ab0
call fcn.004043a0
shr ebx, 0x1f
mov dword [ebp - 0x484], ebx
or ebx, 0xffffffff
cmp byte [ebp - 0x484], 0
je 0x40b4f1
lea eax, [ebp - 0x460]
push eax
push 0x439844
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, ebx
je 0x40b3fe
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x460]
shr eax, 4
test al, 1
jne 0x40b480
push 0x439844
lea ecx, [ebp - 0x478]
call fcn.004031f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x47c], 1
mov ecx, dword [ebp - 0x478]
lea ecx, [ecx - 0x10]
call fcn.00401350
add eax, 0x10
mov dword [ebp - 0x46c], eax
lea ecx, [ebp - 0x46c]
mov dword [ebp - 4], 1
call fcn.00407e40
mov byte [ebp - 4], 0
mov ecx, ebx
mov edx, dword [ebp - 0x46c]
mov byte [ebp - 0x461], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40b475
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x461]
mov byte [ebp - 0x461], 0
test al, al
je 0x40b487
mov byte [ebp - 0x461], 1
mov dword [ebp - 4], 0xffffffff
test byte [ebp - 0x47c], 1
je 0x40b4b4
mov edx, dword [ebp - 0x478]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b4b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov bl, byte [ebp - 0x461]
test bl, bl
je 0x40b502
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40b4d7
test edx, edx
jne 0x40b4f1
push 0xa
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40be55
jmp 0x40b513
mov ecx, 1
call fcn.00408c40
mov al, bl
jmp 0x40b6ae
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x490], edi
mov dword [ebp - 4], 2
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40be5f
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x478], esi
mov byte [ebp - 4], 3
call fcn.00401920
mov ecx, eax
test ecx, ecx
je 0x40be69
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, eax
lea eax, [ebx + 0x10]
mov dword [ebp - 0x480], eax
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 4
call fcn.00401d80
push 0x439844
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 5
call fcn.004031f0
push 0x80000002
push ecx
mov ecx, esp
mov byte [ebp - 4], 6
push 0x439d96
call fcn.004031f0
lea ecx, [ebp - 0x4b0]
call fcn.00401f70
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00402920
cmp byte [ebp - 0x484], 0
mov ecx, eax
mov dword [ebp - 0x470], ecx
je 0x40b6ca
test ecx, ecx
jns 0x40b6d2
lea ecx, [ebp - 0x4b0]
call fcn.00402090
mov edx, dword [ebp - 0x4a4]
xor ecx, ecx
mov eax, dword [ebp - 0x4a8]
sub edx, eax
sar edx, 2
mov dword [ebp - 0x470], ecx
test edx, edx
jle 0x40b621
mov eax, dword [eax + ecx*4]
cmp dword [eax - 0xc], 3
jl 0x40b6ca
mov eax, dword [ebp - 0x4a8]
inc ecx
mov dword [ebp - 0x470], ecx
cmp ecx, edx
jl 0x40b603
mov ecx, 6
call fcn.00408c40
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b64d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x4b0]
call fcn.00401eb0
mov edx, ebx
mov byte [ebp - 4], 3
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b675
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b690
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40b6ac
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f7c4
mov esp, ebp
pop ebp
ret
test ecx, ecx
js 0x40b621
push ecx
push 0x439c92
lea eax, [ebp - 0x490]
push str._s__d
push eax
call fcn.00407c20
add esp, 0x10
push 0
push ecx
mov ecx, esp
push 0x439d14
call fcn.004031f0
mov ebx, dword [ebp - 0x470]
lea ecx, [ebp - 0x46c]
mov edx, ebx
call fcn.00408a10
add esp, 8
push eax
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 7
call fcn.00403180
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov edx, dword [ebp - 0x46c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b743
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, 0x43a5be
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b750
sub ecx, edx
sar ecx, 1
push ecx
push 0x43a5be
lea ecx, [ebp - 0x480]
call fcn.00403530
push 0x4342fc
lea ecx, [ebp - 0x480]
call fcn.00407820
mov edi, dword [ebp - 0x478]
lea ecx, [ebp - 0x480]
push dword [edi - 0xc]
push edi
call fcn.00407b30
push str..lnk
lea ecx, [ebp - 0x480]
call fcn.00407820
cmp byte [ebp - 0x484], 0
je 0x40b7e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40b7c7
test edx, edx
jne 0x40b7e1
push 0xf
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
mov esi, dword [ebp - 0x490]
mov eax, dword [esi - 0xc]
test eax, eax
setg byte [ebp - 0x461]
test eax, eax
jle 0x40be43
push ecx
mov ecx, esp
mov dword [ebp - 0x494], esp
push 0x439d96
mov byte [ebp - 0x461], 0
call fcn.004031f0
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x46c], esp
push 0x439844
call fcn.004031f0
push ecx
mov ecx, esp
mov byte [ebp - 4], 9
push 0x439a4e
call fcn.004031f0
mov cl, byte [ebp - 0x461]
mov byte [ebp - 4], 6
call fcn.00409f10
add esp, 0xc
mov byte [ebp - 0x461], al
test al, al
je 0x40be31
cmp byte [ebp - 0x484], 0
je 0x40b988
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40b883
test edx, edx
jne 0x40b89d
push 0x46
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
push 0x439844
lea ecx, [ebp - 0x468]
call fcn.004031f0
push 0xa
push str.guest.dat
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0xa
call fcn.00407b30
push dword [ebp - 0x468]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
mov ecx, 0x439844
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b8e0
sub ecx, edx
sar ecx, 1
push ecx
push 0x439844
lea ecx, [ebp - 0x468]
call fcn.00403530
push 0xb
push str._addpkg.dat
lea ecx, [ebp - 0x468]
call fcn.00407b30
push dword [ebp - 0x468]
call edi
mov ecx, 0x439844
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b922
sub ecx, edx
sar ecx, 1
push ecx
push 0x439844
lea ecx, [ebp - 0x468]
call fcn.00403530
push 0x43ac5c
lea ecx, [ebp - 0x46c]
call fcn.00407490
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x468]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00407b30
lea ecx, [ebp - 0x46c]
call fcn.00401300
push dword [ebp - 0x468]
call edi
lea ecx, [ebp - 0x468]
call fcn.00401300
xor edi, edi
mov dword [ebp - 0x488], edi
lea ecx, [ebp - 0x470]
call fcn.00401320
push esi
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 0xd
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.00407c20
mov esi, dword [ebp - 0x470]
add esp, 0xc
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x46c]
mov dword [ebp - 0x46c], edi
push eax
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40bd5a
mov edi, dword [ebp - 0x46c]
lea ecx, [ebp - 0x468]
push 0x439844
mov dword [ebp - 0x488], edi
call fcn.004031f0
push 1
push 0x433f24
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0xe
call fcn.00407b30
mov ecx, 0x43a7c8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ba21
sub ecx, edx
sar ecx, 1
push ecx
push 0x43a7c8
lea ecx, [ebp - 0x468]
call fcn.00407b30
lea ecx, [ebp - 0x48c]
call fcn.00401320
mov byte [ebp - 4], 0xf
test ebx, ebx
je 0x40ba73
lea eax, [ebx + 1]
push eax
push 0x439c92
lea eax, [ebp - 0x48c]
push str._s___d_
push eax
call fcn.00407c20
add esp, 0x10
jmp 0x40baa0
mov ecx, 0x439c92
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ba80
sub ecx, edx
sar ecx, 1
push ecx
push 0x439c92
lea ecx, [ebp - 0x48c]
call fcn.00403530
push ecx
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x488]
push str.DisplayName
call fcn.00401a30
lea ecx, [ebp - 0x46c]
call fcn.00401320
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x46c]
push dword [ebp - 0x480]
push dword [ebp - 0x468]
push str.__s___uninstall___s_
push eax
call fcn.00407c20
add esp, 0xc
lea ecx, [ebp - 0x488]
push dword [ebp - 0x46c]
push str.UninstallString
call fcn.00401a30
lea ecx, [ebp - 0x47c]
call fcn.00401320
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x47c]
push dword [ebp - 0x468]
push str.__s__0
push eax
call fcn.00407c20
add esp, 8
lea ecx, [ebp - 0x488]
push dword [ebp - 0x47c]
push str.DisplayIcon
call fcn.00401a30
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x439844
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax*2 + 2]
push eax
push 0x439844
push 1
push 0
push str.InstallLocation
push edi
call esi
push 0x439fa0
call ebx
lea eax, [eax*2 + 2]
push eax
push 0x439fa0
push 1
push 0
push str.HelpLink
push edi
call esi
push 0x43a1aa
call ebx
lea eax, [eax*2 + 2]
push eax
push 0x43a1aa
push 1
push 0
push str.URLInfoAbout
push edi
call esi
push 0x43a3b4
call ebx
lea eax, [eax*2 + 2]
push eax
push 0x43a3b4
push 1
push 0
push str.URLUpdateInfo
push edi
call esi
push 0x439c92
lea ecx, [ebp - 0x494]
call fcn.004031f0
mov byte [ebp - 4], 0x12
mov ecx, 0x439d96
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bbe3
sub ecx, edx
sar ecx, 1
push ecx
push 0x439d96
lea ecx, [ebp - 0x470]
call fcn.00403530
mov eax, dword [ebp - 0x474]
cmp dword [eax - 0xc], 3
jle 0x40bc88
lea ecx, [ebp - 0x4b0]
call fcn.00402090
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00402920
test eax, eax
jns 0x40bc5b
mov edx, dword [ebp - 0x4a4]
push ecx
mov ecx, dword [ebp - 0x4a8]
call fcn.00403950
add esp, 4
cmp eax, dword [ebp - 0x4a4]
je 0x40bc88
lea ecx, [ebp - 0x474]
push ecx
mov ecx, eax
call fcn.00403180
lea ecx, [ebp - 0x4b0]
call fcn.004025f0
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00402920
shr eax, 0x1f
xor al, 1
je 0x40bc88
mov byte [ebp - 0x461], 1
jmp 0x40bc99
mov ecx, 7
mov byte [ebp - 0x461], 0
call fcn.00408c40
mov ebx, dword [ebp - 0x484]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test bl, bl
je 0x40bce1
call esi
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40bcbe
test edx, edx
jne 0x40bce1
mov ebx, dword [sym.imp.USER32.dll_SendNotifyMessageW]
push 0x50
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call ebx
call fcn.0040a150
jmp 0x40bcf0
call fcn.0040a150
test bl, bl
je 0x40bd1b
mov ebx, dword [sym.imp.USER32.dll_SendNotifyMessageW]
call esi
mov edx, dword [0x439830]
mov ecx, eax
sub ecx, edx
cmp ecx, 0x37
ja 0x40bd05
test edx, edx
jne 0x40bd1b
push 0x5f
push 6
push 0x915
push dword [0x43982c]
mov dword [0x439830], eax
call ebx
lea ecx, [ebp - 0x494]
call fcn.00401300
lea ecx, [ebp - 0x47c]
call fcn.00401300
lea ecx, [ebp - 0x46c]
call fcn.00401300
lea ecx, [ebp - 0x48c]
call fcn.00401300
lea ecx, [ebp - 0x468]
call fcn.00401300
mov esi, dword [ebp - 0x470]
jmp 0x40bd6b
mov ecx, 5
mov byte [ebp - 0x461], 0
call fcn.00408c40
or ebx, 0xffffffff
mov byte [ebp - 4], 0xc
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40bd89
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40bd94
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x478]
mov esi, dword [ebp - 0x490]
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40bdc1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x4b0]
call fcn.00401eb0
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x480]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40bded
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40be08
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40be24
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov bl, byte [ebp - 0x461]
mov al, bl
jmp 0x40b6ae
mov ecx, 4
call fcn.00408c40
or ebx, 0xffffffff
jmp 0x40bda0
mov ecx, 3
call fcn.00408c40
or ebx, 0xffffffff
jmp 0x40bda0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
push 0x80004005
call fcn.004016f0
int3