Function at 0x402968
Capabilities:
Accept command line arguments
Check os version
Delete file
Delete registry value
Get common file path
Persist via run registry key
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Set current directory
Set registry value
Shutdown system
Terminate process

Disassembly:
sub esp, 0xf14
push ebx
push ebp
push esi
push edi
push 4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax]
mov dword [esp + 0x38], eax
cmp cl, 0x22
jne 0x4029e3
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
mov dword [esp + 0x38], eax
je 0x4029b2
cmp cl, 0x22
jne 0x4029a1
cmp byte [eax], 0x22
jne 0x4029bc
inc eax
mov dword [esp + 0x38], eax
cmp byte [eax], 0x20
jne 0x4029cb
inc eax
cmp byte [eax], 0x20
je 0x4029c1
mov dword [esp + 0x38], eax
mov cl, byte [eax]
cmp cl, 0x2f
je 0x402a00
mov esi, eax
cmp cl, bl
je 0x4029f6
cmp cl, 0x3d
je 0x4029f6
mov cl, byte [esi + 1]
inc esi
jmp 0x4029d4
cmp cl, bl
je 0x4029bc
cmp cl, 0x20
je 0x4029bc
mov cl, byte [eax + 1]
inc eax
mov dword [esp + 0x38], eax
jmp 0x4029e3
cmp byte [esi], bl
jne 0x402a00
mov eax, esi
mov dword [esp + 0x38], eax
push eax
call fcn.004059c2
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x108]
push 0x100
push ecx
push eax
mov dword [0x4086e0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0xa94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xa90], bl
je 0x402a76
lea eax, [esp + 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0xa90]
lea ecx, [esp + 0xa90]
cmp eax, ecx
jbe 0x402a6e
cmp byte [eax], 0x5c
je 0x402a73
dec eax
jmp 0x402a5b
cmp byte [eax], 0x5c
jne 0x402a74
inc eax
mov byte [eax], bl
lea eax, [esp + 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [0x408438], eax
jge 0x402a9a
push ebx
call fcn.00404b7c
pop ecx
jmp 0x404afe
call fcn.004028b0
push 0x10000
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x4086dc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [0x408438]
mov dword [0x4086c8], eax
call fcn.00404fbd
test eax, eax
pop ecx
jne 0x402a8e
cmp dword [0x4086e8], ebx
mov edi, dword [sym.imp.KERNEL32.dll__lread]
lea eax, [esp + 0xd24]
mov esi, 0x408460
mov dword [0x40866c], eax
mov ebp, str.WiseInstaller
je 0x402f1e
push 0x24
push 0x4086a0
push dword [0x408438]
mov dword [esp + 0x34], 1
call edi
mov eax, dword [0x4086a4]
cmp eax, ebx
jge 0x402b26
neg eax
mov dword [0x4086a4], eax
mov dword [0x40843c], 1
push 1
push 0x408434
push dword [0x408438]
call edi
push 4
push 0x408680
push dword [0x408438]
call edi
movzx eax, byte [0x408680]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [0x408438]
call edi
movzx eax, byte [0x408681]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [0x408438]
call edi
movzx eax, byte [0x408682]
push eax
lea eax, [esp + 0x614]
push eax
push dword [0x408438]
call edi
movzx eax, byte [0x408683]
push eax
lea eax, [esp + 0xb94]
push eax
push dword [0x408438]
call edi
push 0x13
push 0x408680
push dword [0x408438]
call edi
lea eax, [esp + 0x208]
mov dword [0x408424], eax
movzx eax, byte [0x408682]
push eax
push dword [0x40866c]
push dword [0x408438]
call edi
movzx eax, byte [0x408683]
push eax
lea eax, [esp + 0xe28]
push eax
push dword [0x408438]
call edi
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [0x4086ec], eax
movzx eax, byte [0x408684]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x408685]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x408686]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x408687]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x408688]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x408689]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x40868a]
push eax
push esi
push dword [0x408438]
call edi
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x34], eax
movzx eax, byte [0x40868b]
push eax
push esi
push dword [0x408438]
mov dword [esp + 0x54], eax
call edi
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x4c], eax
movzx eax, byte [0x40868c]
push eax
push esi
push dword [0x408438]
mov dword [esp + 0x50], eax
call edi
lea eax, [esp + 0x68]
push 4
push eax
push dword [0x408438]
call edi
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x5c], eax
movzx eax, byte [0x40868d]
push eax
push esi
push dword [0x408438]
mov dword [esp + 0x48], eax
call edi
lea eax, [esp + 0x64]
push 4
push eax
push dword [0x408438]
call edi
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x74], eax
movzx eax, byte [0x40868e]
push eax
push esi
push dword [0x408438]
mov dword [esp + 0x4c], eax
call edi
lea eax, [esp + 0x6c]
push 4
push eax
push dword [0x408438]
call edi
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [esp + 0x40], 1
mov dword [esp + 0x60], eax
movzx eax, byte [0x408691]
mov dword [esp + 0x30], eax
jg 0x402d6c
cmp eax, 1
jle 0x402d76
mov dword [0x40843c], 1
push dword [esp + 0x30]
push esi
push dword [0x408438]
call edi
lea eax, [esp + 0x70]
push 4
push eax
push dword [0x408438]
call edi
cmp byte [0x408692], bl
jne 0x402ef1
movzx eax, byte [0x40868f]
push eax
push esi
push dword [0x408438]
call edi
movzx eax, byte [0x408690]
push eax
push esi
push dword [0x408438]
call edi
cmp dword [0x40842c], ebx
jne 0x404aee
cmp byte [esp + 0x78], bl
je 0x402e0a
lea eax, [esp + 0x14]
push eax
push 0x2001b
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402e0a
push str.WiseStubReboot
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x4086e0]
call fcn.00404b12
test eax, eax
pop ecx
je 0x404afe
push dword [0x4086e0]
call fcn.00404b16
test eax, eax
pop ecx
je 0x404afe
cmp dword [0x4086e8], ebx
je 0x402e89
cmp dword [0x4086a8], ebx
je 0x402e89
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
push 2
push ebx
push dword [0x408438]
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x30]
mov dword [esp + 0x24], eax
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x4086a8]
jne 0x402a8e
lea eax, [esp + 0xc90]
mov dword [esp + 0xc90], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0xca0], 2
push 0x100
push esi
sete al
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + 0x40845f], 0x5c
je 0x402edb
push 0x4079dc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x40843c], ebx
je 0x40353e
push str.MSCOREE.DLL
jmp 0x403543
push ebx
push sym.STUB32.EXE__LanguageDlg_16
push ebx
push 0x6f
push dword [0x4086e0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
jne 0x402dc0
mov dword [0x40842c], 1
jmp 0x402dc0
cmp byte [esp + 0x108], bl
mov dword [esp + 0x28], ebx
mov dword [0x4086b4], ebx
mov dword [0x4086b0], ebx
mov dword [0x4086ac], ebx
mov dword [0x4086a4], ebx
mov byte [0x408680], bl
mov byte [0x408681], 8
mov byte [esp + 0xe24], bl
mov byte [esp + 0xd26], bl
mov byte [esp + 0xd25], bl
mov byte [esp + 0xd24], bl
je 0x402dc0
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x108]
lea ecx, [esp + 0x108]
cmp eax, ecx
jbe 0x402f98
cmp byte [eax], 0x2e
je 0x402fa1
dec eax
jmp 0x402f85
cmp byte [eax], 0x2e
jne 0x402dc0
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeUpdateVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
jne 0x402ff9
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
call fcn.004050b5
shl eax, 0x10
mov dword [0x4086ac], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x7c]
pop ecx
cmp al, bl
je 0x40302c
cmp al, 0x2e
je 0x40302c
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
jmp 0x403018
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x403039
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004050b5
or dword [0x4086ac], eax
pop ecx
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
je 0x40305d
cmp al, 0x2e
je 0x40305d
inc dword [esp + 0x10]
jmp 0x403049
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x40306a
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004050b5
shl eax, 0x10
pop ecx
mov dword [0x4086b0], eax
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
je 0x403090
cmp al, 0x2e
je 0x403090
inc dword [esp + 0x10]
jmp 0x40307c
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x40309d
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004050b5
or dword [0x4086b0], eax
pop ecx
lea eax, [esp + 0x108]
push eax
push 0x100
push dword [0x40866c]
push str.MS_Sans_Serif
push str.CharFont
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push ebx
push str.CharSet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x408680], al
lea eax, [esp + 0x108]
push eax
push 8
push str.CharSize
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x408681], al
lea eax, [esp + 0x108]
push eax
push ebx
push str.WiseInitLangAlwaysPrompt
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x403126
or byte [0x408681], 0x80
push dword [0x40866c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x40866c]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.ProductName
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
lea eax, [ecx + eax + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push str.Initializing
push str.WiseInitPrefix
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4031d3
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x78], 0x20
je 0x4031d3
lea eax, [esp + 0x78]
push 0x407924
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.Wise_Installation
add dword [esp + 0x14], eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push str._Wizard...
push str.WiseInitSuffix
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], 0x5e
jne 0x40323c
mov byte [esp + 0x78], 0x20
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40327e
mov dword [0x4086a4], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeSizeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4032b6
lea eax, [esp + 0x78]
push eax
call fcn.004050b5
pop ecx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.Runtime9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4032e9
mov dword [0x4086b4], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
call fcn.004059c2
pop ecx
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeSize9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40334f
lea eax, [esp + 0x78]
push eax
call fcn.004050b5
pop ecx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x403385
push 1
pop eax
mov dword [0x4086a4], eax
mov dword [0x40843c], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4033b8
mov dword [0x4086b4], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeSizeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4033f0
lea eax, [esp + 0x78]
push eax
call fcn.004050b5
pop ecx
mov dword [esp + 0x40], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.RuntimeSizeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x403428
lea eax, [esp + 0x78]
push eax
call fcn.004050b5
pop ecx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408010
push str.ProductCode
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x614]
push 0x100
push eax
push 0x408010
push str.ProductVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0xb94]
push 0x100
push eax
push 0x408010
push str.TransformMSI
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push ebx
push str.Remove_Previous
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4034b5
mov dword [esp + 0x28], eax
lea eax, [esp + 0x108]
push eax
push ebx
push str.DelayReboot
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [esp + 0x78], bl
mov byte [0x408434], al
je 0x404afe
cmp byte [esp + 0x610], bl
je 0x404afe
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x408010
push str.Language1
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x408460], bl
je 0x402dc0
push ebx
push sym.STUB32.EXE__LanguageDlg_16
push ebx
push 0x6f
push dword [0x4086e0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
jne 0x402dc0
mov dword [0x40842c], 1
jmp 0x404aee
push str.MSI.DLL
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.00404b9a
add esp, 0xc
cmp dword [esp + 0x24], ebx
je 0x403656
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], 1
push eax
push 0x2001b
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403656
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push ebx
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
lea eax, [esp + 0x6a4]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push ebx
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x403642
cmp dword [esp + 0x1c], 2
jne 0x4035d8
cmp dword [esp + 0x10], 1
jbe 0x403608
mov eax, 0x400
inc dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push ebx
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
lea eax, [esp + 0x6a4]
push eax
push dword [esp + 0x2c]
jmp 0x4035bc
lea eax, [esp + 0x690]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403642
push 1
push 0x408010
push 1
lea eax, [esp + 0x69c]
push ebx
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x403642
mov dword [esp + 0x2c], ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x2c], ebx
je 0x403567
mov eax, dword [0x4086ac]
cmp dword [esp + 0x58], eax
jb 0x40368d
jne 0x40367a
mov ecx, dword [esp + 0x54]
mov edx, dword [0x4086b0]
mov eax, 0xffff0000
and ecx, eax
and edx, eax
cmp ecx, edx
jb 0x40368d
cmp dword [0x40843c], ebx
je 0x4036cd
mov eax, dword [0x4086b0]
cmp dword [esp + 0x54], eax
jae 0x4036cd
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4036a9
mov ecx, dword [esp + 0x3c]
mov edx, dword [0x4086a4]
add edx, ecx
test edx, edx
jg 0x403781
cmp dword [0x40843c], ebx
jne 0x403781
cmp eax, ebx
jne 0x4036cd
mov eax, dword [esp + 0x44]
mov ecx, dword [0x4086b4]
add ecx, eax
test ecx, ecx
jg 0x4037e3
cmp dword [0x4086e8], ebx
je 0x4036f1
mov eax, dword [0x4086b4]
mov ecx, dword [0x4086a4]
add eax, ecx
push 1
push eax
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp byte [0x4086c4], bl
jne 0x404ac4
cmp dword [0x4086cc], ebx
jne 0x404ad8
cmp dword [0x4086e8], ebx
je 0x403fa2
cmp byte [0x408683], 1
jbe 0x403fa2
push ebx
push sym.STUB32.EXE__PasswordDlg_16
push ebx
push 0x6d
push dword [0x4086e0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x403f88
push dword [0x408424]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, byte [0x408683]
dec ecx
cmp eax, ecx
jne 0x403722
mov ecx, dword [0x408424]
mov dword [0x4086d0], 0x5bc25a
mov al, byte [ecx]
cmp al, bl
je 0x403f36
cmp al, 0x61
jl 0x40377e
cmp al, 0x7a
jg 0x40377e
sub al, 0x20
mov byte [ecx], al
inc ecx
jmp 0x403768
cmp eax, ebx
je 0x4037e3
push 0xe0000000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
jne 0x4037dc
push 1
lea eax, [esp + 0x10c]
push str.AdminError
push eax
lea eax, [esp + 0x214]
push 5
push eax
call fcn.004050f2
mov eax, dword [0x40866c]
add esp, 0x14
cmp byte [eax], bl
je 0x4037c3
inc eax
jmp 0x4037bc
inc eax
push ebx
push eax
lea eax, [esp + 0x210]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
jmp 0x404aff
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ebx
cmp dword [0x4086e8], ebx
jne 0x40386e
push 1
pop eax
cmp dword [esp + 0x40], eax
jg 0x40386e
cmp dword [esp + 0x24], ebx
je 0x403808
cmp dword [esp + 0x3c], eax
jmp 0x40380c
cmp dword [esp + 0x44], eax
jg 0x40386e
cmp dword [0x40843c], ebx
je 0x403847
cmp dword [esp + 0x18], eax
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x408010
jne 0x403840
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x403ba0
push str.RuntimeDotNet
jmp 0x403834
cmp dword [esp + 0x24], ebx
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x408010
je 0x403867
push str.RuntimeNT
jmp 0x403834
push str.Runtime9X
jmp 0x403834
push esi
call fcn.00404b48
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x4038b1
lea eax, [eax + 0x40845c]
push str..TMP
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4038b1
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..exe
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x402a8e
push 1
pop eax
cmp dword [esp + 0x40], eax
jle 0x4038e4
cmp dword [esp + 0x18], ebx
je 0x40392b
cmp dword [esp + 0x30], eax
jle 0x4038f0
cmp dword [esp + 0x18], eax
je 0x40392b
cmp dword [esp + 0x24], ebx
je 0x403921
cmp dword [esp + 0x3c], eax
jg 0x40392b
cmp dword [0x40843c], ebx
jne 0x403b41
push 1
push dword [0x4086b4]
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x403b41
cmp dword [esp + 0x44], eax
jle 0x403b39
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x4086e8], ebx
je 0x403a12
cmp dword [0x40843c], ebx
je 0x40396c
cmp dword [esp + 0x18], 1
jne 0x40395e
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
jmp 0x40398c
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
jmp 0x40398c
cmp dword [esp + 0x24], ebx
je 0x403980
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
jmp 0x40398c
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 1
push ebx
push dword [0x408438]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x14]
mov dword [esp + 0x24], eax
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x40c]
push dword [esp + 0x20]
push eax
push dword [0x408438]
call edi
push ebx
push dword [esp + 0x20]
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [0x40843c], ebx
je 0x4039fa
cmp dword [esp + 0x18], 1
jne 0x4039f1
mov eax, dword [esp + 0x70]
jmp 0x403aa1
mov eax, dword [esp + 0x6c]
jmp 0x403aa1
cmp dword [esp + 0x24], ebx
je 0x403a09
mov eax, dword [esp + 0x64]
jmp 0x403aa1
mov eax, dword [esp + 0x68]
jmp 0x403aa1
cmp dword [0x40843c], ebx
je 0x403a5f
cmp dword [esp + 0x18], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x410]
push 0x100
push eax
push 0x408010
jne 0x403a4d
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x30]
jmp 0x403aa1
push str.RuntimeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x40]
jmp 0x403aa1
cmp dword [esp + 0x24], ebx
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x410]
push 0x100
push eax
push 0x408010
je 0x403a91
push str.RuntimeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x3c]
jmp 0x403aa1
push str.Runtime9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x44]
mov dword [0x4086f0], eax
call fcn.0040587e
push ebx
push 0xfa
push 0x4d2
push dword [0x408664]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00404e59
lea eax, [esp + 0x308]
mov byte [esp + 0x308], bl
push eax
mov eax, dword [0x4086f0]
push ebx
push ebx
push eax
push eax
push 0x4086d4
lea eax, [esp + 0x424]
push dword [0x408664]
push esi
push eax
push 0x40842c
call sym.STUB32.EXE__t1_40
cmp dword [0x40842c], ebx
jne 0x403e9a
cmp eax, ebx
jl 0x403e9a
cmp dword [0x4086d4], 0xf4240
jl 0x403e9a
cmp dword [0x40843c], ebx
jne 0x403ba0
cmp dword [esp + 0x24], ebx
push 1
je 0x403b8e
push dword [0x4086b4]
jmp 0x403b94
cmp dword [0x40843c], ebx
je 0x403b4d
cmp dword [esp + 0x18], 1
mov eax, dword [0x4086a4]
jne 0x403b52
mov eax, dword [0x4086b4]
push ebx
push eax
push dword [esp + 0x18]
call fcn.00404d4f
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
jne 0x403ee2
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x40842c], ebx
jne 0x403f2a
cmp dword [esp + 0x24], ebx
jne 0x403ba0
cmp dword [0x40843c], ebx
jne 0x403ba0
push 1
push dword [0x4086a4]
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [0x40843c]
mov dword [esp + 0x14], ebx
cmp eax, ebx
mov dword [esp + 0x10], str._q__r:n
je 0x403bcc
cmp dword [esp + 0x18], 1
mov dword [esp + 0x10], str._q:a
je 0x403bcc
mov dword [esp + 0x10], str._q:a__c:_Install__q_
cmp byte [0x408434], bl
je 0x403be0
cmp eax, ebx
jne 0x403be0
mov dword [esp + 0x10], str._c:_msiinst__delayrebootq_
cmp dword [0x4086e8], ebx
jne 0x403c79
cmp eax, ebx
jne 0x403c79
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x514]
push 0x80
push eax
push str._q__r:n
push str.InstMsi_CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x510]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403c38
mov dword [esp + 0x14], 1
cmp byte [0x408434], bl
je 0x403c6e
lea eax, [esp + 0x510]
push str._q__r:n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403c6e
lea eax, [esp + 0x510]
push str._c:_msiinst__delayrebootq_
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x510]
mov dword [esp + 0x10], eax
call fcn.004053e0
cmp dword [0x40843c], ebx
mov dword [esp + 0x1c], eax
je 0x403cea
call fcn.0040587e
mov eax, dword [0x408664]
cmp eax, ebx
je 0x403cea
push 0x3ef
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x403cb0
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x70
push dword [0x408664]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x403ccb
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [0x408664]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x403ce5
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.004058c7
lea eax, [esp + 0x78]
push eax
push 1
push dword [esp + 0x18]
push esi
call fcn.00404c46
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x403d19
call fcn.004053e0
cmp dword [esp + 0x1c], eax
je 0x403d19
mov dword [esp + 0x10], 1
cmp dword [0x40843c], ebx
je 0x403d56
cmp dword [esp + 0x10], 0x661
jne 0x403d56
cmp dword [esp + 0x18], ebx
jne 0x403d8f
call fcn.00404eed
lea eax, [esp + 0x78]
push eax
push 1
push str._q:a
push esi
call fcn.00404c46
add esp, 0x10
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x10], 0x800401fa
jne 0x403d8f
call fcn.00404eed
push str.The_Windows_Installer_2.0_runtime_can_only_be_installed_with_Windows_NT_Service_Pack_6_or_higher._Please_install_Windows_NT_Service_Pack_6_and_rerun_this_installation.
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x40866c]
cmp byte [eax], bl
je 0x403d7d
inc eax
jmp 0x403d76
inc eax
push ebx
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x4086e8], ebx
jne 0x403dd9
mov eax, dword [0x40843c]
cmp eax, ebx
je 0x403dad
cmp dword [esp + 0x40], 1
jle 0x403dad
cmp dword [esp + 0x18], ebx
je 0x403dd9
cmp dword [esp + 0x24], ebx
je 0x403dba
cmp dword [esp + 0x3c], 1
jg 0x403dd9
cmp eax, ebx
je 0x403dcc
cmp dword [esp + 0x30], 1
jle 0x403dcc
cmp dword [esp + 0x18], 1
je 0x403dd9
cmp dword [esp + 0x24], ebx
jne 0x403de0
cmp dword [esp + 0x44], 1
jle 0x403de0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00404e59
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404e59
cmp dword [esp + 0x10], ebx
je 0x403e64
cmp dword [esp + 0x14], ebx
jne 0x403e64
cmp byte [0x408434], bl
je 0x403e13
mov dword [esp + 0x50], 1
jmp 0x403e64
cmp dword [esp + 0x2c], ebx
jne 0x403e64
push 4
lea eax, [esp + 0x10c]
push str.Reboot
push eax
push 9
push esi
mov dword [esp + 0x40], 1
call fcn.004050f2
mov eax, dword [0x40866c]
add esp, 0x14
cmp byte [eax], bl
je 0x403e47
inc eax
jmp 0x403e40
inc eax
push 4
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x403e09
call fcn.00404eed
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x18], ebx
jne 0x4036f1
cmp dword [0x40843c], ebx
je 0x4036f1
cmp dword [0x4086b4], ebx
jne 0x403e8d
cmp dword [esp + 0x30], 1
jle 0x4036f1
mov dword [esp + 0x18], 1
jmp 0x4037eb
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40842c], ebx
jne 0x404afe
push 6
lea eax, [esp + 0x10c]
push str.Internet
push eax
push 0xa
push esi
call fcn.004050f2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
push 0x407924
push esi
call edi
lea eax, [esp + 0x308]
push eax
push esi
call edi
jmp 0x403f24
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x4086e4], ebx
je 0x403f0a
push 2
lea eax, [esp + 0x10c]
push str.CRCError
push eax
push 8
jmp 0x403f1b
push 3
lea eax, [esp + 0x10c]
push str.SpaceError
push eax
push 7
push esi
call fcn.004050f2
add esp, 0x14
push esi
jmp 0x402a8f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404afe
movzx eax, byte [0x408683]
dec eax
push eax
push dword [0x408424]
call fcn.00404f3c
pop ecx
mov eax, dword [0x408424]
pop ecx
movzx ecx, byte [0x408683]
dec ecx
mov dword [esp + 0x14], ecx
je 0x403f76
lea ecx, [esp + 0xe24]
sub ecx, eax
mov dl, byte [eax]
cmp dl, byte [eax + ecx]
jne 0x403f76
inc eax
dec dword [esp + 0x14]
jne 0x403f68
xor eax, eax
cmp dword [esp + 0x14], ebx
sete al
cmp eax, ebx
jne 0x403fa2
jmp 0x403722
mov eax, dword [0x408440]
cmp eax, ebx
je 0x403f98
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.004028ff
jmp 0x404581
cmp byte [esp + 0x78], bl
je 0x404155
cmp byte [esp + 0x610], bl
je 0x404155
cmp dword [esp + 0x28], ebx
je 0x404155
push str.MSI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x404155
push str.MsiGetProductInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MsiConfigureProductA
push dword [esp + 0x24]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esp + 0x14], ebx
mov dword [esp + 0x1c], eax
je 0x40414b
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x100
push eax
lea eax, [esp + 0x694]
push eax
lea eax, [esp + 0x80]
push str.VersionString
push eax
call dword [esp + 0x24]
test eax, eax
jne 0x40414b
cmp byte [esp + 0x690], bl
je 0x40414b
lea eax, [esp + 0x610]
push eax
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40414b
push 5
lea eax, [esp + 0x10c]
push str.ExistError
push eax
lea eax, [esp + 0x418]
push 6
push eax
call fcn.004050f2
add esp, 0x14
cmp dword [0x4086e8], ebx
je 0x40409c
mov eax, dword [0x40866c]
cmp byte [eax], bl
je 0x404095
inc eax
jmp 0x40408e
inc eax
mov dword [esp + 0x2c], eax
jmp 0x4040cd
lea eax, [esp + 0x308]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x30c]
push 0x100
push eax
push 0x408010
push str.ProductName
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x610]
push eax
push ecx
lea ecx, [esp + 0x698]
push eax
push ecx
push eax
lea eax, [esp + 0x420]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x40866c]
add esp, 0x1c
cmp byte [eax], bl
je 0x404102
inc eax
jmp 0x4040fb
inc eax
push 0x104
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x40413c
cmp dword [esp + 0x1c], ebx
je 0x404007
push 2
lea eax, [esp + 0x7c]
push ebx
push eax
call dword [esp + 0x28]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404007
call fcn.004028ff
call fcn.00404eed
jmp 0x404581
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x4086e8], ebx
je 0x404588
cmp dword [esp + 0x48], 1
jle 0x4042d5
push 1
push ebx
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x38]
mov dword [esp + 0x54], eax
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
push dword [esp + 0x48]
push esi
push dword [0x408438]
call edi
push ebx
push dword [esp + 0x50]
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [0x408428]
mov byte [esp + 0x690], bl
cmp eax, ebx
je 0x40468b
push 1
pop ecx
cmp eax, ecx
mov dword [esp + 0x28], ecx
jle 0x4041fe
lea eax, [esp + 0x14]
push 4
push eax
push dword [0x408438]
call edi
push 1
push dword [esp + 0x18]
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__llseek]
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, dword [0x408428]
jl 0x4041cd
lea eax, [esp + 0x14]
push 4
push eax
push dword [0x408438]
call edi
lea eax, [esp + 0x690]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
cmp eax, ebx
jle 0x404244
lea eax, [esp + eax + 0x690]
push str..MST
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x690]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x690]
push 2
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x4044a6
mov al, 1
cmp al, byte [0x408683]
sbb eax, eax
neg eax
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.00404d4f
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
je 0x404561
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x4086e4], ebx
je 0x404533
push 2
lea eax, [esp + 0x10c]
push str.CRCError
push eax
push 8
jmp 0x404544
lea eax, [esp + 0x48]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4043bc
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x100
push eax
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
push str.CommonFilesDir
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4043b2
cmp byte [esp + 0x308], bl
je 0x4043b2
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x307], 0x5c
lea eax, [esp + eax + 0x307]
jne 0x404354
mov byte [eax], bl
lea eax, [esp + 0x308]
push str.Wise_Installation_Wizard_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb90], bl
mov eax, 0x4075d8
jne 0x404390
mov eax, 0x4075d4
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x30c]
sub ecx, 3
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x308]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x108], bl
je 0x404448
cmp byte [0x408460], bl
jne 0x404457
lea eax, [esp + 0x510]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + 0x510], bl
je 0x404448
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x50f], 0x5c
je 0x404423
lea eax, [esp + 0x510]
push 0x4079dc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x510]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0x408460], bl
jne 0x404457
push esi
call fcn.00404b48
pop ecx
push esi
call fcn.0040504d
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [esp + 0x10], 0xffffffff
jne 0x404495
push esi
call fcn.00404b48
push esi
call fcn.0040504d
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jge 0x4044b2
push ebx
call fcn.00404b7c
pop ecx
jmp 0x404581
mov al, 1
cmp al, byte [0x408683]
sbb eax, eax
neg eax
push eax
push dword [0x4086b8]
push dword [esp + 0x18]
call fcn.00404d4f
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
je 0x40451e
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x4086e4], ebx
je 0x404501
push 2
lea eax, [esp + 0x10c]
push str.CRCError
push eax
push 8
jmp 0x404512
push 3
lea eax, [esp + 0x10c]
push str.SpaceError
push eax
push 7
push esi
call fcn.004050f2
add esp, 0x14
push esi
jmp 0x4044a7
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x40842c], ebx
je 0x4041ae
push esi
jmp 0x40457b
push 3
lea eax, [esp + 0x10c]
push str.SpaceError
push eax
push 7
lea eax, [esp + 0x6a0]
push eax
call fcn.004050f2
add esp, 0x14
lea eax, [esp + 0x690]
push eax
jmp 0x4044a7
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x40842c], ebx
je 0x40468b
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
jmp 0x404aff
lea eax, [esp + 0x108]
mov byte [esp + 0x690], bl
push eax
lea eax, [esp + 0x410]
push 0x100
push eax
push 0x408010
push str.ProductFile
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x408428]
cmp eax, ebx
je 0x404637
push eax
push str.LanguageFile_d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x694]
push 0x104
push eax
push 0x408010
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x404637
lea eax, [esp + eax + 0x68c]
push str..mst
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404637
lea eax, [esp + 0x690]
push eax
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esp + 0x690], bl
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.http:__
push esi
mov byte [0x408467], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40467c
lea eax, [esp + 0xa90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40468b
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00404eed
mov eax, dword [esp + 0x38]
mov byte [esp + 0x208], bl
cmp byte [eax], bl
jne 0x404718
cmp dword [0x4086e8], ebx
je 0x4046f2
mov ebp, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push ebx
push dword [0x408438]
call ebp
push ebx
push dword [0x4086ec]
mov dword [esp + 0x3c], eax
push dword [0x408438]
call ebp
movzx eax, byte [0x408684]
push eax
lea eax, [esp + 0x20c]
push eax
push dword [0x408438]
call edi
push ebx
push dword [esp + 0x38]
push dword [0x408438]
call ebp
jmp 0x404718
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x20c]
push 0x100
push eax
push 0x408010
push str.CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x690], bl
je 0x40474d
lea eax, [esp + 0x690]
push eax
lea eax, [esp + 0x20c]
push str._TRANSFORMS__s_
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [esp + 0x38]
mov al, byte [edi]
cmp al, 0x2f
jne 0x404781
cmp byte [edi + 1], 0x2a
jne 0x404781
lea eax, [edi + 2]
cmp byte [eax], 0x20
jne 0x404768
inc eax
jmp 0x404760
lea ecx, [esp + 0x690]
push 0x200
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x4048cf
cmp byte [esp + 0x208], bl
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
je 0x404794
cmp al, bl
je 0x4047bd
cmp al, bl
je 0x4047aa
lea eax, [esp + 0x208]
push 0x200
push eax
push edi
call ebp
jmp 0x4047bd
lea eax, [esp + 0x208]
push 0x407598
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dl, byte [esp + 0x208]
cmp dl, 0x2f
jne 0x4047ff
cmp byte [esp + 0x209], 0x2a
jne 0x4047ff
cmp byte [esp + 0x20a], 0x20
lea eax, [esp + 0x20a]
jne 0x4047ea
inc eax
cmp byte [eax], 0x20
je 0x4047e4
lea ecx, [esp + 0x690]
push 0x200
push ecx
push eax
call ebp
jmp 0x4048cf
cmp dl, bl
lea eax, [esp + 0x208]
je 0x404844
mov cl, dl
cmp cl, 0x2f
jne 0x40483c
mov cl, byte [eax + 1]
cmp cl, 0x49
je 0x404844
cmp cl, 0x69
je 0x404844
cmp cl, 0x4a
je 0x404844
cmp cl, 0x6a
je 0x404844
cmp cl, 0x58
je 0x404844
cmp cl, 0x78
je 0x404844
cmp cl, 0x41
je 0x404844
cmp cl, 0x61
je 0x404844
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x40480c
cmp byte [eax], bl
jne 0x404872
cmp dl, bl
je 0x40485f
lea eax, [esp + 0x208]
push 0x407924
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x208]
push 0x407598
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb90], bl
lea eax, [esp + 0xb90]
jne 0x404884
mov eax, esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x698]
push str._s___s_
push eax
call edi
add esp, 0x10
cmp byte [esp + 0xb90], bl
je 0x4048cf
push esi
lea eax, [esp + 0x694]
push str._TRANSFORMS__s_
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x698]
push eax
call edi
add esp, 0xc
call fcn.00404e59
cmp dword [0x4086cc], ebx
jne 0x404ad8
cmp byte [esp + 0x690], bl
je 0x404ad8
push 0x100
push esi
push dword [0x4086e0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [esp + 0x694]
push str._WISE_SETUP_EXE_PATH__s_
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + eax + 0x698]
push eax
call edi
add esp, 0xc
cmp dword [esp + 0x50], ebx
je 0x4049d2
cmp byte [0x408434], bl
jne 0x4049d2
lea eax, [esp + 0x690]
push eax
push str.MSIEXEC
push str._s__s
push esi
call edi
lea eax, [esp + 0x88]
push esi
push eax
call fcn.0040530c
add esp, 0x18
lea eax, [esp + 0x34]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4049ba
lea eax, [esp + 0xfc]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [esp + 0x100]
push ebx
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x110], 1
mov dword [esp + 0x11c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [0x4086cc], 1
jmp 0x404ad8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x40c]
push str.MSIEXEC
push eax
call esi
cmp dword [esp + 0x50], ebx
je 0x404aa3
cmp byte [0x408434], bl
je 0x404aa3
lea eax, [esp + 0x48]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404a90
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x104
push eax
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
push str.InstallerLocation
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404a86
cmp byte [esp + 0x308], bl
je 0x404a86
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x308]
push eax
lea eax, [esp + 0x410]
push eax
call esi
lea eax, [esp + 0x40c]
push str.MSIEXEC.EXE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x690]
push str._WISEDELAYEDREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x694]
push 1
push eax
lea eax, [esp + 0x418]
push eax
call fcn.00404c46
add esp, 0x10
jmp 0x404ad8
cmp dword [0x4086cc], ebx
jne 0x404ad8
call fcn.00404eed
push ebx
call fcn.00404b7c
pop ecx
call fcn.00404eed
call fcn.004028ff
push dword [0x408438]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x408440]
cmp eax, ebx
je 0x404afe
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]