Function at 0x4039e0
Capabilities:
Accept command line arguments
Check os version
Delete file
Delete registry value
Get common file path
Get file size
Hide graphical window
Persist via run registry key
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Set current directory
Set environment variable
Set registry value
Shutdown system
Terminate process

Disassembly:
sub esp, 0xf20
push esi
push edi
push 4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edi, edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax]
cmp cl, 0x22
mov dword [esp + 0x30], eax
jne 0x403a41
jmp 0x403a1e
cmp cl, 0x22
je 0x403a2e
inc eax
mov cl, byte [eax]
test cl, cl
mov dword [esp + 0x30], eax
jne 0x403a19
cmp cl, 0x22
jne 0x403a45
inc eax
mov dword [esp + 0x30], eax
jmp 0x403a45
cmp cl, 0x20
je 0x403a4a
inc eax
mov cl, byte [eax]
mov dword [esp + 0x30], eax
test cl, cl
jne 0x403a35
cmp byte [eax], 0x20
jne 0x403a54
inc eax
cmp byte [eax], 0x20
je 0x403a4a
mov dword [esp + 0x30], eax
mov dl, byte [eax]
cmp dl, 0x2f
je 0x403a76
mov ecx, eax
jmp 0x403a67
cmp dl, 0x3d
je 0x403a6b
inc ecx
mov dl, byte [ecx]
test dl, dl
jne 0x403a5f
cmp byte [ecx], 0
jne 0x403a76
mov eax, ecx
mov dword [esp + 0x30], eax
push eax
call fcn.00403054
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x100
lea ecx, [esp + 0xf0]
push ecx
push eax
mov dword [0x408810], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0xa98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xa94], 0
je 0x403b1f
lea eax, [esp + 0xa94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xa94]
jmp 0x403ada
cmp byte [esi], 0x5c
je 0x403aea
dec esi
lea eax, [esp + 0xa94]
cmp esi, eax
ja 0x403ad4
cmp byte [esi], 0x5c
jne 0x403b06
and byte [esi], 0
lea eax, [esp + 0xa94]
push eax
push str.WiseSourceDir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [esi], 0x5c
inc esi
jmp 0x403b1c
and byte [esi], 0
lea eax, [esp + 0xa94]
push eax
push str.WiseSourceDir
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
and byte [esi], 0
push edi
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, edi
mov dword [0x408bd8], eax
jl 0x403b6a
call fcn.004028bf
push 0x10000
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x408be0], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [0x408bd8]
mov dword [0x408b44], eax
call fcn.00402b4e
test eax, eax
pop ecx
je 0x403b78
push edi
call fcn.004029ce
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xd28]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll__lread]
mov dword [0x408bd0], eax
xor eax, eax
cmp dword [0x408800], eax
push ebp
mov ebp, 0x408820
mov esi, str.WiseInstaller
je 0x403ec3
push 0x24
push 0x408ba0
push dword [0x408bd8]
xor edi, edi
inc edi
mov dword [esp + 0x2c], edi
call ebx
cmp dword [0x408ba4], 0
jge 0x403bd5
neg dword [0x408ba4]
mov dword [0x408be4], edi
push edi
push 0x408bcc
push dword [0x408bd8]
call ebx
push 4
mov esi, 0x408b60
push esi
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b60]
push eax
lea eax, [esp + 0xf8]
push eax
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b61]
push eax
lea eax, [esp + 0x78]
push eax
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b62]
push eax
lea eax, [esp + 0x620]
push eax
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b63]
push eax
lea eax, [esp + 0xba0]
push eax
push dword [0x408bd8]
call ebx
push 0x14
push esi
push dword [0x408bd8]
call ebx
lea eax, [esp + 0x318]
mov dword [0x408b7c], eax
movzx eax, byte [0x408b62]
push eax
push dword [0x408bd0]
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b63]
push eax
lea eax, [esp + 0xe34]
push eax
push dword [0x408bd8]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll__llseek]
push edi
push 0
push dword [0x408bd8]
call esi
mov dword [0x408b84], eax
movzx eax, byte [0x408b64]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b65]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b66]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b67]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b68]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b69]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b6a]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b73]
push eax
push ebp
push dword [0x408bd8]
call ebx
push edi
push 0
push dword [0x408bd8]
call esi
mov dword [esp + 0x40], eax
movzx eax, byte [0x408b6b]
push eax
push ebp
push dword [0x408bd8]
mov dword [esp + 0x40], eax
call ebx
push edi
push 0
push dword [0x408bd8]
call esi
mov dword [esp + 0x44], eax
movzx eax, byte [0x408b6c]
push eax
push ebp
push dword [0x408bd8]
mov dword [esp + 0x30], eax
call ebx
push 4
lea eax, [esp + 0x6c]
push eax
push dword [0x408bd8]
call ebx
push edi
push 0
push dword [0x408bd8]
call esi
mov dword [esp + 0x70], eax
movzx eax, byte [0x408b6d]
push eax
push ebp
push dword [0x408bd8]
mov dword [esp + 0x3c], eax
call ebx
push 4
lea eax, [esp + 0x64]
push eax
push dword [0x408bd8]
call ebx
push edi
push 0
push dword [0x408bd8]
call esi
mov dword [esp + 0x64], eax
movzx eax, byte [0x408b6e]
push eax
push ebp
push dword [0x408bd8]
mov dword [esp + 0x34], eax
call ebx
push 4
lea eax, [esp + 0x60]
push eax
push dword [0x408bd8]
call ebx
push edi
push 0
push dword [0x408bd8]
call esi
mov dword [esp + 0x6c], eax
movzx eax, byte [0x408b71]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x28], edi
jg 0x403e14
cmp eax, edi
jle 0x403e1a
mov dword [0x408be4], edi
push eax
push ebp
push dword [0x408bd8]
call ebx
push 4
lea eax, [esp + 0x5c]
push eax
push dword [0x408bd8]
call ebx
cmp byte [0x408b72], 0
jne 0x403e9f
movzx eax, byte [0x408b6f]
push eax
push ebp
push dword [0x408bd8]
call ebx
movzx eax, byte [0x408b70]
push eax
push ebp
push dword [0x408bd8]
call ebx
mov eax, dword [0x408bac]
test eax, eax
je 0x403e7a
and eax, 0xffff0000
cmp eax, 0x20000
jge 0x403e7a
and byte [0x408bcc], 0
cmp dword [0x408a2c], 0
je 0x4044ac
mov eax, dword [0x408808]
test eax, eax
je 0x403e97
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push sym.STUB32.EXE__LanguageDlg_16
push 0
push 0x6f
push dword [0x408810]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
jne 0x403e5e
mov dword [0x408a2c], edi
jmp 0x403e5e
and byte [0x408b60], 0
and byte [esp + 0xe30], 0
and byte [esp + 0xd32], 0
and byte [esp + 0xd31], 0
and byte [esp + 0xd30], 0
cmp byte [esp + 0xf4], 0
mov dword [esp + 0x20], eax
mov dword [0x408bb4], eax
mov dword [0x408bb0], eax
mov dword [0x408bac], eax
mov dword [0x408ba4], eax
mov byte [0x408b61], 8
je 0x403e7a
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0xf4]
jmp 0x403f34
cmp byte [eax], 0x2e
je 0x403f48
dec eax
lea ecx, [esp + 0xf4]
cmp eax, ecx
ja 0x403f2e
cmp byte [eax], 0x2e
jne 0x403e5e
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeUpdateVersion
push esi
call edi
cmp byte [esp + 0x74], 0
jne 0x403f99
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeVersion
push esi
call edi
lea eax, [esp + 0x74]
push eax
call fcn.00402bfc
shl eax, 0x10
mov dword [0x408bac], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x78]
pop ecx
jmp 0x403fc8
cmp al, 0x2e
je 0x403fd5
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
test al, al
jne 0x403fba
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x403fd9
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00402bfc
or dword [0x408bac], eax
pop ecx
jmp 0x403ff3
cmp al, 0x2e
je 0x404006
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
test al, al
jne 0x403feb
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x40400a
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00402bfc
shl eax, 0x10
pop ecx
mov dword [0x408bb0], eax
jmp 0x404026
cmp al, 0x2e
je 0x404039
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
test al, al
jne 0x40401e
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x40403d
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00402bfc
or dword [0x408bb0], eax
pop ecx
lea eax, [esp + 0xf4]
push eax
push 0x100
push dword [0x408bd0]
push str.MS_Sans_Serif
push str.CharFont
push esi
call edi
lea eax, [esp + 0xf4]
push eax
push 0
push str.CharSet
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x408b60], al
lea eax, [esp + 0xf4]
push eax
push 8
push str.CharSize
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x408b61], al
lea eax, [esp + 0xf4]
push eax
push 0
push str.WiseInitLangAlwaysPrompt
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4040c4
or byte [0x408b61], 0x80
push dword [0x408bd0]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x408bd0]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.ProductName
push esi
call edi
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
lea eax, [ecx + eax + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push str.Initializing
push str.WiseInitPrefix
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x40416a
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x74], 0x20
je 0x40416a
push 0x406c60
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [esp + 0x10], eax
push str.Wise_Installation
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [esp + 0x10], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push str._Wizard...
push str.WiseInitSuffix
push esi
call edi
cmp byte [esp + 0x74], 0x5e
jne 0x4041cf
mov byte [esp + 0x74], 0x20
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeNT
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x40420e
mov dword [0x408ba4], 1
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeSizeNT
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x404243
lea eax, [esp + 0x74]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x30], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.Runtime9X
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x404273
mov dword [0x408bb4], 1
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.CmdLine
push esi
call edi
lea eax, [esp + 0x74]
push eax
call fcn.00403054
pop ecx
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeSize9X
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x4042d2
lea eax, [esp + 0x74]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeDotNet
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x404305
xor eax, eax
inc eax
mov dword [0x408ba4], eax
mov dword [0x408be4], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeDotNetUpdate
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x404335
mov dword [0x408bb4], 1
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeSizeDotNet
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x40436a
lea eax, [esp + 0x74]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.RuntimeSizeDotNetUpdate
push esi
call edi
cmp byte [esp + 0x74], 0
je 0x40439f
lea eax, [esp + 0x74]
push eax
call fcn.00402bfc
pop ecx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x7c]
push eax
push 0x40645d
push str.ProductCode
push esi
call edi
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x624]
push eax
push 0x40645d
push str.ProductVersion
push esi
call edi
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0xba4]
push eax
push 0x40645d
push str.TransformMSI
push esi
call edi
lea eax, [esp + 0xf4]
push eax
push 0
push str.Remove_Previous
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x404421
mov dword [esp + 0x20], eax
lea eax, [esp + 0xf4]
push eax
push 0
push str.DelayReboot
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [esp + 0x74], 0
mov byte [0x408bcc], al
je 0x4044a4
cmp byte [esp + 0x61c], 0
je 0x4044a4
lea eax, [esp + 0xf4]
push eax
push 0x100
push ebp
push 0x40645d
push str.Language1
push esi
call edi
cmp byte [0x408820], 0
je 0x403e5e
push 0
push sym.STUB32.EXE__LanguageDlg_16
push 0
push 0x6f
push dword [0x408810]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
jne 0x403e5e
mov dword [0x408a2c], 1
jmp 0x403e5e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
cmp byte [esp + 0x74], 0
je 0x4044ed
lea eax, [esp + 0x18]
push eax
push 0x2001b
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4044ed
push str.WiseStubReboot
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x408810]
push ecx
call fcn.0040296d
add esp, 4
test eax, eax
jne 0x404507
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
call fcn.00403105
test eax, eax
pop ecx
jne 0x404519
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x408800], esi
je 0x404575
cmp dword [0x408ba8], esi
je 0x404575
mov esi, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push 0
push dword [0x408bd8]
call esi
push 2
push 0
push dword [0x408bd8]
mov dword [esp + 0x28], eax
call esi
push 0
push dword [esp + 0x20]
mov edi, eax
push dword [0x408bd8]
call esi
cmp edi, dword [0x408ba8]
je 0x404573
push 0
call fcn.004029ce
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
lea eax, [esp + 0xc9c]
push eax
mov dword [esp + 0xca0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0xcac], 2
push 0x100
sete al
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, ebp
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x4045c7
push 0x406680
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x408be4], esi
je 0x404776
lea eax, [esp + 0x1f4]
push eax
push dword [0x408bb0]
mov dword [0x408be4], esi
push dword [0x408bac]
call fcn.004030de
add esp, 0xc
cmp dword [0x408bac], 0x10000
jne 0x404613
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_v1.0
jmp 0x40465c
push 0xb
pop ecx
push 0x15
mov esi, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_
lea edi, [esp + 0x520]
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
lea edi, [esp + 0x548]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1f4]
push eax
lea eax, [esp + 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea eax, [esp + 0x528]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404677
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404681
mov dword [0x408be4], 1
xor esi, esi
cmp dword [0x408be4], esi
jne 0x404795
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoft.NETFramework
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404795
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push str.InstallRoot
push dword [esp + 0x28]
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40476a
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x214]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x404713
push 0x406680
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1f4]
push eax
lea eax, [esp + 0x218]
push eax
call esi
push str.mscorlib.dll
lea eax, [esp + 0x218]
push eax
call esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x21c]
push eax
call fcn.004029ec
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, dword [0x408bb0]
jae 0x40476a
mov dword [0x408be4], 1
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404795
push str.MSI.DLL
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
push eax
push ebp
call fcn.004029ec
add esp, 0xc
cmp dword [esp + 0x10], 0
je 0x404877
mov edi, 0x400
lea eax, [esp + 0x14]
push eax
push 0x2001b
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push closesocket
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404877
lea eax, [esp + 0x4c]
push eax
xor esi, esi
push esi
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x58], esi
push esi
jmp 0x404806
cmp dword [esp + 0x3c], 2
jne 0x4047f3
cmp dword [esp + 0x4c], 1
jbe 0x404828
lea eax, [esp + 0x4c]
push eax
push 0
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x58], edi
inc esi
push 0
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x6b0]
push eax
push esi
push dword [esp + 0x30]
mov dword [esp + 0x74], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4047e5
jmp 0x404862
lea eax, [esp + 0x69c]
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x404862
push 1
push 0x40645d
push 1
push eax
lea eax, [esp + 0x6ac]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x404862
and dword [esp + 0x1c], eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x1c], 0
je 0x4047a5
cmp dword [0x408be4], 0
mov esi, 0x40645d
jne 0x4048c9
mov edx, dword [0x408bac]
cmp dword [esp + 0x50], edx
mov eax, dword [0x408bb4]
mov ecx, dword [0x408ba4]
jb 0x4048b8
jne 0x404918
mov edx, dword [esp + 0x18]
mov edi, dword [0x408bb0]
and edx, 0xffff0000
and edi, 0xffff0000
cmp edx, edi
jae 0x404918
cmp dword [esp + 0x10], 0
je 0x40490e
mov edx, dword [esp + 0x30]
add edx, ecx
test edx, edx
jle 0x404918
xor edi, edi
cmp dword [esp + 0x10], edi
je 0x404963
push 0xe0000000
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
jne 0x40495c
push 1
push str.AdminError
lea eax, [esp + 0xfc]
push eax
lea eax, [esp + 0x324]
push 5
push eax
call fcn.00402c39
mov eax, dword [0x408bd0]
add esp, 0x14
jmp 0x40493d
mov edx, dword [esp + 0x24]
add edx, eax
test edx, edx
jg 0x404963
xor esi, esi
cmp dword [0x408800], esi
je 0x405101
push 1
add eax, ecx
push eax
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x405101
inc eax
cmp byte [eax], 0
jne 0x40493c
push edi
inc eax
push eax
lea eax, [esp + 0x320]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
and dword [esp + 0x1c], 0
and dword [esp + 0x14], 0
xor ecx, ecx
cmp dword [0x408800], ecx
mov edi, 0x100
jne 0x4049eb
xor eax, eax
inc eax
cmp dword [esp + 0x28], eax
jg 0x4049eb
cmp dword [esp + 0x10], ecx
je 0x404991
cmp dword [esp + 0x30], eax
jmp 0x404995
cmp dword [esp + 0x24], eax
jg 0x4049eb
cmp dword [0x408be4], ecx
je 0x4049cc
cmp dword [esp + 0x14], eax
lea eax, [esp + 0xf4]
push eax
push edi
push ebp
push esi
jne 0x4049c5
push str.RuntimeDotNetUpdate
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x404d3b
push str.RuntimeDotNet
jmp 0x4049b5
cmp dword [esp + 0x10], ecx
lea eax, [esp + 0xf4]
push eax
push edi
push ebp
push esi
je 0x4049e4
push str.RuntimeNT
jmp 0x4049b5
push str.Runtime9X
jmp 0x4049b5
push ebp
call fcn.0040299a
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x404a27
lea esi, [eax + 0x40881c]
push str..TMP
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404a27
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
test esi, esi
jl 0x404fda
xor eax, eax
inc eax
cmp dword [esp + 0x28], eax
jle 0x404a5a
cmp dword [esp + 0x14], 0
je 0x404aa3
cmp dword [esp + 0x2c], eax
jle 0x404a66
cmp dword [esp + 0x14], eax
je 0x404aa3
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x404a99
cmp dword [esp + 0x30], eax
jg 0x404aa3
cmp dword [0x408be4], ecx
jne 0x404ce0
push 1
push dword [0x408bb4]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x404ce0
cmp dword [esp + 0x24], eax
jle 0x404cd8
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408800], 0
je 0x404b73
cmp dword [0x408be4], 0
je 0x404adb
cmp dword [esp + 0x14], 1
jne 0x404ad1
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x2c]
jmp 0x404af4
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x28]
jmp 0x404af4
cmp dword [esp + 0x10], 0
je 0x404aec
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x30]
jmp 0x404af4
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x24]
push 1
push 0
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
push 0
push esi
push dword [0x408bd8]
mov esi, dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x48], eax
call esi
push edi
lea eax, [esp + 0x41c]
push eax
push dword [0x408bd8]
call ebx
push 0
push dword [esp + 0x40]
push dword [0x408bd8]
call esi
cmp dword [0x408be4], 0
je 0x404b5a
cmp dword [esp + 0x14], 1
jne 0x404b51
mov eax, dword [esp + 0x58]
jmp 0x404bf6
mov eax, dword [esp + 0x5c]
jmp 0x404bf6
cmp dword [esp + 0x10], 0
je 0x404b6a
mov eax, dword [esp + 0x60]
jmp 0x404bf6
mov eax, dword [esp + 0x68]
jmp 0x404bf6
cmp dword [0x408be4], 0
lea eax, [esp + 0xf4]
push eax
push edi
lea eax, [esp + 0x420]
push eax
push 0x40645d
je 0x404bc5
cmp dword [esp + 0x24], 1
jne 0x404baf
push str.RuntimeDotNetUpdate
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x2c]
jmp 0x404bf6
push str.RuntimeDotNet
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x28]
jmp 0x404bf6
cmp dword [esp + 0x20], 0
je 0x404be2
push str.RuntimeNT
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x30]
jmp 0x404bf6
push str.Runtime9X
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x24]
mov dword [0x408a28], eax
call fcn.004037d9
xor esi, esi
push esi
push 0xfa
push 0x4d2
push dword [0x408bdc]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00402a98
and byte [esp + 0x214], 0
lea eax, [esp + 0x214]
push eax
mov eax, dword [0x408a28]
push esi
push esi
push eax
push eax
push 0x408b74
push dword [0x408bdc]
lea eax, [esp + 0x434]
push ebp
push eax
push 0x408a2c
call sym.STUB32.EXE__t1_40
mov edi, eax
mov eax, dword [0x408b74]
cmp eax, dword [0x408a28]
jne 0x404c9a
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push closesocket
push ebp
mov dword [0x408b74], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404c9a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [0x408b74], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp dword [0x408a2c], esi
jne 0x404fea
cmp edi, esi
jl 0x404fea
cmp dword [0x408b74], 0xf4240
jl 0x404fea
cmp dword [0x408be4], esi
jne 0x404d3b
cmp dword [esp + 0x10], esi
push 1
je 0x404d29
push dword [0x408bb4]
jmp 0x404d2f
cmp dword [0x408be4], ecx
je 0x404cec
cmp dword [esp + 0x14], 1
mov eax, dword [0x408ba4]
jne 0x404cf1
mov eax, dword [0x408bb4]
xor edi, edi
push edi
push eax
push esi
call fcn.004038d7
add esp, 0xc
test eax, eax
push esi
jne 0x40503b
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408a2c], edi
jne 0x405084
cmp dword [esp + 0x10], edi
jne 0x404d3b
cmp dword [0x408be4], edi
jne 0x404d3b
push 1
push dword [0x408ba4]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
mov edx, dword [0x408be4]
xor ecx, ecx
cmp edx, ecx
mov edi, str._q__r:n
mov dword [esp + 0x18], ecx
mov esi, edi
je 0x404d8d
mov eax, 0xffff
test dword [0x408bb0], eax
je 0x404d88
mov esi, dword [0x408bac]
and esi, eax
cmp esi, 1
je 0x404d88
cmp dword [esp + 0x14], ecx
jne 0x404d81
cmp dword [0x408bb4], ecx
jne 0x404d88
cmp dword [esp + 0x2c], 1
jg 0x404d88
mov esi, str._q:a
jmp 0x404d8d
mov esi, str._q:a__c:_Install__q_
cmp byte [0x408bcc], 0
je 0x404d9f
cmp edx, ecx
jne 0x404d9f
mov esi, str._c:_msiinst__delayrebootq_
cmp dword [0x408800], ecx
jne 0x404e24
cmp edx, ecx
jne 0x404e24
lea eax, [esp + 0xf4]
push eax
push 0x80
lea eax, [esp + 0x524]
push eax
push edi
push str.InstMsi_CmdLine
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x51c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call esi
test eax, eax
je 0x404dee
mov dword [esp + 0x18], 1
cmp byte [0x408bcc], 0
je 0x404e1d
push edi
lea eax, [esp + 0x520]
push eax
call esi
test eax, eax
jne 0x404e1d
and dword [esp + 0x18], eax
push str._c:_msiinst__delayrebootq_
lea eax, [esp + 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea esi, [esp + 0x51c]
call fcn.004032a9
cmp dword [0x408be4], 0
mov dword [esp + 0x3c], eax
je 0x404e92
call fcn.004037d9
mov eax, dword [0x408bdc]
test eax, eax
je 0x404e92
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ef
push eax
call edi
test eax, eax
je 0x404e5f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x70
push dword [0x408bdc]
call edi
test eax, eax
je 0x404e76
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [0x408bdc]
call edi
test eax, eax
je 0x404e8d
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.00402f55
lea eax, [esp + 0x74]
push eax
xor edi, edi
inc edi
push edi
push esi
push ebp
call fcn.0040310e
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x404eb8
call fcn.004032a9
cmp dword [esp + 0x3c], eax
je 0x404eb8
mov esi, edi
mov eax, dword [0x408be4]
xor ecx, ecx
cmp eax, ecx
je 0x404ed5
cmp esi, 0x661
jne 0x404ed5
cmp dword [esp + 0x14], ecx
je 0x405092
cmp esi, 0x800401fa
je 0x4050b3
cmp dword [0x408800], ecx
jne 0x404f21
cmp eax, ecx
je 0x404ef9
cmp dword [esp + 0x28], edi
jle 0x404ef9
cmp dword [esp + 0x14], ecx
je 0x404f21
cmp dword [esp + 0x10], ecx
je 0x404f05
cmp dword [esp + 0x30], edi
jg 0x404f21
cmp eax, ecx
je 0x404f15
cmp dword [esp + 0x2c], edi
jle 0x404f15
cmp dword [esp + 0x14], edi
je 0x404f21
cmp dword [esp + 0x10], ecx
jne 0x404f28
cmp dword [esp + 0x24], edi
jle 0x404f28
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00402a98
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402a98
test esi, esi
je 0x404f9e
xor esi, esi
cmp dword [esp + 0x18], esi
jne 0x404fa0
cmp byte [0x408bcc], 0
jne 0x404f98
cmp dword [esp + 0x1c], esi
jne 0x404fa0
push 4
push str.Reboot
lea eax, [esp + 0xfc]
push eax
push 9
push ebp
mov dword [esp + 0x30], edi
call fcn.00402c39
mov eax, dword [0x408bd0]
add esp, 0x14
jmp 0x404f7e
inc eax
cmp byte [eax], 0
jne 0x404f7d
push 4
inc eax
push eax
push ebp
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4050f3
mov dword [esp + 0x48], edi
jmp 0x404fa0
xor esi, esi
cmp dword [esp + 0x14], esi
jne 0x4050ff
cmp dword [0x408be4], esi
je 0x4050ff
cmp dword [0x408bb4], esi
jne 0x404fc8
cmp dword [esp + 0x2c], edi
jle 0x4050ff
mov dword [esp + 0x14], 1
mov esi, 0x40645d
jmp 0x40496d
push 0
call fcn.004029ce
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x408a2c], esi
jne 0x405033
push 6
push str.Internet
lea eax, [esp + 0xfc]
push eax
push 0xa
push ebp
call fcn.00402c39
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
push 0x406c60
push ebp
call esi
lea eax, [esp + 0x214]
push eax
push ebp
call esi
push ebp
call fcn.004029ce
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll__lclose]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40880c], edi
lea eax, [esp + 0xf4]
je 0x405063
push 2
push str.CRCError
push eax
push 8
jmp 0x40506d
push 3
push str.SpaceError
push eax
push 7
push ebp
call fcn.00402c39
add esp, 0x14
push ebp
call fcn.004029ce
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402ad5
lea eax, [esp + 0x74]
push eax
push edi
push str._q:a
push ebp
call fcn.0040310e
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402ad5
push 0x13
push str.MinVerMessage
lea eax, [esp + 0xfc]
push eax
push 0x13
push ebp
call fcn.00402c39
mov eax, dword [0x408bd0]
add esp, 0x14
jmp 0x4050da
inc eax
cmp byte [eax], 0
jne 0x4050d9
xor esi, esi
push esi
inc eax
push eax
push ebp
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402ad5
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
cmp byte [0x408bc4], 0
jne 0x405d0b
cmp dword [0x408b80], esi
jne 0x405d1f
cmp dword [0x408800], esi
je 0x4051dc
cmp byte [0x408b63], 1
jbe 0x4051dc
push 0
push sym.STUB32.EXE__PasswordDlg_16
push 0
push 0x6d
push dword [0x408810]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x40524c
push dword [0x408b7c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, byte [0x408b63]
dec ecx
cmp eax, ecx
jne 0x405133
mov ecx, dword [0x408b7c]
mov dword [0x408b78], 0x5bc25a
jmp 0x40518c
mov al, byte [ecx]
cmp al, 0x61
jl 0x40518b
cmp al, 0x7a
jg 0x40518b
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x40517d
movzx eax, byte [0x408b63]
dec eax
push eax
push dword [0x408b7c]
call fcn.00403219
movzx eax, byte [0x408b63]
dec eax
mov esi, dword [0x408b7c]
pop ecx
pop ecx
je 0x4051cb
lea edi, [esp + 0xe30]
sub edi, esi
mov cl, byte [esi]
cmp cl, byte [edi + esi]
jne 0x4051cb
inc esi
dec eax
jne 0x4051c0
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
je 0x405133
cmp byte [esp + 0x74], 0
je 0x405397
cmp byte [esp + 0x61c], 0
je 0x405397
cmp dword [esp + 0x20], 0
je 0x405397
push str.MSI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x44], edi
je 0x405397
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MsiGetProductInfoA
push edi
call esi
push str.MsiConfigureProductA
push edi
mov dword [esp + 0x20], eax
call esi
cmp dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
je 0x40538d
mov edi, 0x100
jmp 0x405366
mov eax, dword [0x408808]
test eax, eax
je 0x40525c
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.0040290e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [esp + 0x69c], 0
je 0x40538d
lea eax, [esp + 0x61c]
push eax
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40538d
push 5
push str.ExistError
lea eax, [esp + 0xfc]
push eax
lea eax, [esp + 0x424]
push 6
push eax
call fcn.00402c39
add esp, 0x14
cmp dword [0x408800], 0
je 0x4052d0
mov esi, dword [0x408bd0]
jmp 0x4052c8
inc esi
cmp byte [esi], 0
jne 0x4052c7
inc esi
jmp 0x4052fd
lea eax, [esp + 0xf4]
push eax
push edi
lea eax, [esp + 0x21c]
push eax
push 0x40645d
push str.ProductName
push str.WiseInstaller
lea esi, [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea eax, [esp + 0x620]
push eax
push esi
lea eax, [esp + 0x6a8]
push eax
push esi
lea eax, [esp + 0x42c]
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x408bd0]
add esp, 0x1c
jmp 0x40532a
inc eax
cmp byte [eax], 0
jne 0x405329
push 0x104
inc eax
push eax
push ebp
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x4053ea
cmp dword [esp + 0x1c], esi
je 0x405366
push 2
push esi
lea eax, [esp + 0x7c]
push eax
call dword [esp + 0x28]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x6a0]
push eax
lea eax, [esp + 0x7c]
push str.VersionString
push eax
mov dword [esp + 0x30], edi
call dword [esp + 0x28]
test eax, eax
je 0x405269
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
cmp dword [0x408800], esi
je 0x4057ca
cmp dword [esp + 0x34], 1
jle 0x4053fc
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push esi
push dword [0x408bd8]
call edi
push 0
push dword [esp + 0x44]
mov esi, eax
push dword [0x408bd8]
call edi
push dword [esp + 0x34]
push ebp
push dword [0x408bd8]
call ebx
push 0
push esi
push dword [0x408bd8]
call edi
jmp 0x405663
call fcn.0040290e
call fcn.00402ad5
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x34]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054df
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x4c]
push eax
push esi
push str.CommonFilesDir
push dword [esp + 0x48]
mov dword [esp + 0x58], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054d5
cmp byte [esp + 0x214], al
je 0x4054d5
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x214]
push eax
call esi
lea ecx, [esp + 0x214]
dec ecx
add eax, ecx
cmp byte [eax], 0x5c
jne 0x40547c
and byte [eax], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Wise_Installation_Wizard_
lea eax, [esp + 0x218]
push eax
call edi
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x218]
push eax
call edi
cmp byte [esp + 0xb9c], 0
mov eax, 0x406918
jne 0x4054b7
mov eax, 0x406914
push eax
lea eax, [esp + 0x218]
push eax
call esi
lea ecx, [esp + 0x218]
sub ecx, 3
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x214]
push eax
push ebp
call esi
cmp byte [esp + 0xf4], 0
je 0x405570
cmp byte [0x408820], 0
jne 0x405580
lea eax, [esp + 0x51c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + 0x51c], 0
je 0x405570
lea eax, [esp + 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x51c]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x40554f
push 0x406680
lea eax, [esp + 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x51c]
push eax
push ebp
call esi
cmp byte [0x408820], 0
jne 0x405580
push ebp
call fcn.0040299a
pop ecx
push ebp
call fcn.00403261
pop ecx
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
mov edi, dword [sym.imp.KERNEL32.dll__lclose]
mov esi, eax
push esi
call edi
cmp esi, 0xffffffff
jne 0x4055ba
push ebp
call fcn.0040299a
push ebp
call fcn.00403261
pop ecx
pop ecx
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call edi
push 2
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
test esi, esi
jge 0x4055d9
push 0
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov al, 1
cmp al, byte [0x408b63]
sbb eax, eax
neg eax
push eax
push dword [0x408bb8]
push esi
call fcn.004038d7
add esp, 0xc
test eax, eax
push esi
je 0x405643
call edi
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40880c], 0
lea eax, [esp + 0xf4]
je 0x405621
push 2
push str.CRCError
push eax
push 8
jmp 0x40562b
push 3
push str.SpaceError
push eax
push 7
push ebp
call fcn.00402c39
add esp, 0x14
push ebp
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call edi
cmp dword [0x408a2c], 0
je 0x40565d
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [0x408bd4]
and byte [esp + 0x69c], 0
test eax, eax
je 0x4058cd
xor esi, esi
inc esi
cmp eax, esi
jle 0x4056a5
push 4
lea eax, [esp + 0x24]
push eax
push dword [0x408bd8]
call ebx
push 1
push dword [esp + 0x24]
push dword [0x408bd8]
call edi
inc esi
cmp esi, dword [0x408bd4]
jl 0x40567f
push 4
lea eax, [esp + 0x24]
push eax
push dword [0x408bd8]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
lea eax, [esp + 0x6a0]
push eax
call esi
lea eax, [esp + 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
test eax, eax
jle 0x4056e9
push str..MST
lea eax, [esp + eax + 0x6a0]
push eax
call esi
push 0
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov edi, dword [sym.imp.KERNEL32.dll__lclose]
push eax
call edi
push 2
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
test esi, esi
jge 0x405728
push 0
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov al, 1
cmp al, byte [0x408b63]
sbb eax, eax
neg eax
push eax
push dword [esp + 0x24]
push esi
call fcn.004038d7
add esp, 0xc
test eax, eax
push esi
je 0x4057a5
call edi
lea eax, [esp + 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40880c], 0
lea eax, [esp + 0xf4]
je 0x405775
push 2
push str.CRCError
push eax
push 8
jmp 0x40577f
push 3
push str.SpaceError
push eax
push 7
lea eax, [esp + 0x6ac]
push eax
call fcn.00402c39
lea eax, [esp + 0x6b0]
add esp, 0x14
push eax
call fcn.004029ce
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call edi
cmp dword [0x408a2c], 0
je 0x4058cd
lea eax, [esp + 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
and byte [esp + 0x69c], 0
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x420]
push eax
mov edi, 0x40645d
push edi
push str.ProductFile
push str.WiseInstaller
call esi
mov eax, dword [0x408bd4]
test eax, eax
je 0x40587e
push eax
push str.LanguageFile_d
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0xf4]
push eax
push 0x104
lea eax, [esp + 0x6a4]
push eax
push edi
push ebp
push str.WiseInstaller
call esi
lea eax, [esp + 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x40587e
push str..mst
lea eax, [esp + eax + 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40587e
lea eax, [esp + 0x69c]
push eax
lea eax, [esp + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
and byte [esp + 0x69c], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x418]
push eax
push ebp
call esi
and byte [0x408827], 0
push str.http:__
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4058c2
lea eax, [esp + 0xa9c]
push eax
push ebp
call esi
lea eax, [esp + 0x418]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4058cd
lea eax, [esp + 0x418]
push eax
push ebp
call esi
call fcn.00402ad5
mov edi, dword [esp + 0x38]
and byte [esp + 0x318], 0
cmp byte [edi], 0
jne 0x405969
cmp dword [0x408800], 0
je 0x40593f
push 1
push 0
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
push 0
push dword [0x408b84]
mov esi, eax
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
movzx eax, byte [0x408b64]
push eax
lea eax, [esp + 0x31c]
push eax
push dword [0x408bd8]
call ebx
push 0
push esi
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x405969
lea eax, [esp + 0xf4]
push eax
push 0x100
lea eax, [esp + 0x320]
push eax
push 0x40645d
push str.CmdLine
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x69c], 0
je 0x40599f
lea eax, [esp + 0x69c]
push eax
push str._TRANSFORMS__s_
lea eax, [esp + 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x320]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, byte [edi]
cmp al, 0x2f
jne 0x4059cf
cmp byte [edi + 1], 0x2a
jne 0x4059cf
lea eax, [edi + 2]
jmp 0x4059b1
inc eax
cmp byte [eax], 0x20
je 0x4059b0
push 0x200
lea ecx, [esp + 0x6a0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x405b10
cmp byte [esp + 0x318], 0
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, 0x200
je 0x4059e8
test al, al
je 0x405a06
test al, al
lea eax, [esp + 0x318]
je 0x4059fa
push ebx
push eax
push edi
call esi
jmp 0x405a06
push 0x4068d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov cl, byte [esp + 0x318]
cmp cl, 0x2f
jne 0x405a44
cmp byte [esp + 0x319], 0x2a
jne 0x405a44
cmp byte [esp + 0x31a], 0x20
lea eax, [esp + 0x31a]
jne 0x405a33
inc eax
cmp byte [eax], 0x20
je 0x405a2d
push ebx
lea ecx, [esp + 0x6a0]
push ecx
push eax
call esi
jmp 0x405b10
test cl, cl
lea eax, [esp + 0x318]
je 0x405a9e
cmp cl, 0x2f
jne 0x405a7f
mov cl, byte [eax + 1]
cmp cl, 0x49
je 0x405a86
cmp cl, 0x69
je 0x405a86
cmp cl, 0x4a
je 0x405a86
cmp cl, 0x6a
je 0x405a86
cmp cl, 0x58
je 0x405a86
cmp cl, 0x78
je 0x405a86
cmp cl, 0x41
je 0x405a86
cmp cl, 0x61
je 0x405a86
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x405a4f
cmp byte [eax], 0
jne 0x405ab1
push 0x406c60
lea eax, [esp + 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4068d0
lea eax, [esp + 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb9c], 0
lea eax, [esp + 0xb9c]
jne 0x405ac4
mov eax, ebp
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x31c]
push eax
lea eax, [esp + 0x6a4]
push str._s___s_
push eax
call esi
add esp, 0x10
cmp byte [esp + 0xb9c], 0
je 0x405b10
push ebp
push str._TRANSFORMS__s_
lea eax, [esp + 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x6a4]
push eax
call esi
add esp, 0xc
call fcn.00402a98
cmp dword [0x408b80], 0
jne 0x405d1f
cmp byte [esp + 0x69c], 0
je 0x405d1f
push 0x100
push ebp
push dword [0x408810]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
push str._WISE_SETUP_EXE_PATH__s_
lea eax, [esp + 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + eax + 0x6a4]
push eax
call esi
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x48], edi
je 0x405c18
cmp byte [0x408bcc], 0
jne 0x405c18
lea eax, [esp + 0x69c]
push eax
push str.MSIEXEC
push str._s__s
push ebp
call esi
lea eax, [esp + 0x84]
push ebp
push eax
call fcn.00402e3d
add esp, 0x18
lea eax, [esp + 0x40]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405c00
lea eax, [esp + 0x1f8]
push eax
push str.SeShutdownPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push edi
push edi
push edi
lea eax, [esp + 0x200]
push eax
push edi
push dword [esp + 0x54]
mov dword [esp + 0x20c], 1
mov dword [esp + 0x218], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [0x408b80], 1
jmp 0x405d1f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.MSIEXEC
lea eax, [esp + 0x41c]
push eax
call esi
cmp dword [esp + 0x48], edi
je 0x405cea
cmp byte [0x408bcc], 0
je 0x405cea
lea eax, [esp + 0x34]
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405cd7
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x4c]
push eax
push edi
push str.InstallerLocation
push dword [esp + 0x48]
mov dword [esp + 0x58], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405ccd
cmp byte [esp + 0x214], al
je 0x405ccd
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x214]
push eax
lea eax, [esp + 0x41c]
push eax
call esi
push str.MSIEXEC.EXE
lea eax, [esp + 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._WISEDELAYEDREBOOT1
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x74]
push eax
push 1
lea eax, [esp + 0x6a4]
push eax
lea eax, [esp + 0x424]
push eax
call fcn.0040310e
add esp, 0x10
jmp 0x405d1f
cmp dword [0x408b80], esi
jne 0x405d1f
call fcn.00402ad5
push esi
call fcn.004029ce
pop ecx
call fcn.00402ad5
call fcn.0040290e
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x408808]
test eax, eax
je 0x405d45
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]