Function at 0x419d4f
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x47f5d8], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], edi
jle 0x41a5a0
push dword [ebp - 0x1c]
mov ecx, 0x47f5cc
call fcn.0041f2e9
mov ebx, eax
mov dword [ebp - 0xc], ebx
push dword [ebx + 0x2c]
call fcn.004134e1
test al, al
pop ecx
je 0x41a567
lea ecx, [ebp - 0x18]
call fcn.0041c7ab
mov eax, dword [ebx]
mov byte [ebp - 1], 1
cmp eax, 1
jne 0x419dd6
call fcn.0042060a
push 1
push 0x42dfcc
lea ecx, [ebx + 8]
mov edi, eax
xor esi, esi
call fcn.0041cbe0
test al, al
je 0x419dc4
push 1
pop esi
cmp edi, esi
jge 0x419dcc
and byte [ebp - 1], 0
push 0x42dfbc
jmp 0x41a249
cmp eax, 2
jne 0x419e3c
lea ecx, [ebp - 0x9c]
call fcn.0041c7ab
lea eax, [ebp - 0x9c]
push eax
call fcn.00421532
cmp dword [ebp - 0x9c], edi
pop ecx
je 0x419e1b
lea ecx, [ebp - 0x9c]
call fcn.0041d704
push eax
lea ecx, [ebx + 8]
call fcn.0041d704
push eax
call fcn.00425540
pop ecx
test eax, eax
pop ecx
jle 0x419e1f
and byte [ebp - 1], 0
push str.Java
lea ecx, [ebp - 0x18]
call fcn.0041c8f8
lea ecx, [ebp - 0x9c]
call fcn.0041c8e1
jmp 0x41a253
cmp eax, 3
jne 0x41a061
push 0x47f110
lea ecx, [ebp - 0xa8]
call fcn.0041c87f
xor edi, edi
lea ecx, [ebp - 0xa8]
push edi
push str.hhctrl.ocx
call fcn.0041ca2d
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x40], edi
call fcn.0041d704
push eax
call fcn.0040e12a
mov eax, dword [ebp - 0xc]
add esp, 0xc
xor ebx, ebx
lea esi, [eax + 8]
push 1
push 0x42dfa4
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419eb3
mov edi, 0x40048
mov ebx, 0x1c7a0000
jmp 0x41a00d
push 1
push 0x42dfcc
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419ed4
mov edi, 0x40048
mov ebx, 0x1c9b0000
jmp 0x41a00d
push 1
push str.1.1a
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419ef5
mov edi, 0x40048
mov ebx, 0x1c9d0000
jmp 0x41a00d
push 1
push str.1.1b
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419f16
mov edi, 0x40048
mov ebx, 0x1fe40000
jmp 0x41a00d
push 1
push 0x42df90
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419f37
mov edi, 0x40049
mov ebx, 0x203c0000
jmp 0x41a00d
push 1
push str.1.21
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419f58
mov edi, 0x40049
mov ebx, 0x20dc0000
jmp 0x41a00d
push 1
push str.1.21a
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419f79
mov edi, 0x40049
mov ebx, 0x211a0000
jmp 0x41a00d
push 1
push str.1.22
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419f97
mov edi, 0x40049
mov ebx, 0x21710000
jmp 0x41a00d
push 1
push 0x42df74
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419fb5
mov edi, 0x4004a
mov ebx, 0x21fe0000
jmp 0x41a00d
push 1
push str.1.31
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419fd3
mov edi, 0x4004a
mov ebx, 0x22590000
jmp 0x41a00d
push 1
push str.1.32
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x419ff1
mov edi, 0x4004a
mov ebx, 0x22ab0000
jmp 0x41a00d
push 1
push str.1.33
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a00d
mov edi, 0x4004a
mov ebx, 0x24390000
mov ecx, dword [ebp - 0x20]
mov eax, edi
shr eax, 0x10
shr ecx, 0x10
cmp cx, ax
jb 0x41a03d
jne 0x41a025
cmp word [ebp - 0x20], di
jb 0x41a03d
cmp cx, ax
jne 0x41a041
cmp word [ebp - 0x20], di
jne 0x41a041
mov eax, dword [ebp - 0x40]
shr ebx, 0x10
shr eax, 0x10
cmp eax, ebx
jae 0x41a041
and byte [ebp - 1], 0
push str.HTML_Help_Viewer
lea ecx, [ebp - 0x18]
call fcn.0041c8f8
lea ecx, [ebp - 0xa8]
call fcn.0041c8e1
mov ebx, dword [ebp - 0xc]
jmp 0x41a251
cmp eax, 4
jne 0x41a1a0
push 0x42f138
lea ecx, [ebp - 0x58]
call fcn.0041c81b
lea esi, [ebx + 8]
push 1
push 0x42df44
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a093
push str.2.50.4403.12
jmp 0x41a0dc
push 1
push 0x42df30
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a0ac
push str.2.60.6526.3
jmp 0x41a0dc
push 1
push 0x42df20
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a0c5
push str.2.70.9001.0
jmp 0x41a0dc
push 1
push 0x42df10
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a0e4
push str.2.80.1022.3
lea ecx, [ebp - 0x58]
call fcn.0041c8f8
lea ecx, [ebp - 0x78]
call fcn.0041c7ab
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], edi
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftDataAccess
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a15d
and byte [ebp - 0xe8], al
push 0xc
pop ecx
lea edi, [ebp - 0xe7]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x32
push eax
lea eax, [ebp - 0xe8]
push eax
push 0
push 0
push str.FullInstallVer
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xe8]
lea ecx, [ebp - 0x78]
push eax
call fcn.0041c8f8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x78], edi
je 0x41a17f
lea ecx, [ebp - 0x78]
call fcn.0041d704
push eax
lea ecx, [ebp - 0x58]
call fcn.0041d704
push eax
call fcn.00425540
pop ecx
test eax, eax
pop ecx
jle 0x41a183
and byte [ebp - 1], 0
push str.Microsoft_Data_Access_Components
lea ecx, [ebp - 0x18]
call fcn.0041c8f8
lea ecx, [ebp - 0x78]
call fcn.0041c8e1
lea ecx, [ebp - 0x58]
jmp 0x419e32
cmp eax, 5
jne 0x41a55f
mov eax, dword [0x47f764]
cmp eax, 0xffffffff
jne 0x41a1bd
call fcn.00420982
mov dword [0x47f764], eax
mov dword [ebp - 0x68], eax
lea esi, [ebx + 8]
shr eax, 0x10
xor edi, edi
push 1
push 0x42deac
mov ecx, esi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xc], edi
call fcn.0041cbe0
test al, al
je 0x41a1e4
push 7
jmp 0x41a22c
push 1
push 0x42dea8
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a1fa
push 8
jmp 0x41a22c
push 1
push 0x42dea4
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a218
push 8
mov dword [ebp - 0xc], 1
pop edi
jmp 0x41a22d
push 1
push 0x42dea0
mov ecx, esi
call fcn.0041cbe0
test al, al
je 0x41a22d
push 9
pop edi
movzx eax, word [ebp - 0x68]
cmp eax, edi
jl 0x41a240
jne 0x41a244
movzx eax, word [ebp - 0x6c]
cmp eax, dword [ebp - 0xc]
jge 0x41a244
and byte [ebp - 1], 0
push str.DirectX
lea ecx, [ebp - 0x18]
call fcn.0041c8f8
xor edi, edi
cmp byte [ebp - 1], 0
jne 0x41a55f
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0041c87f
lea eax, [ebx + 0x14]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0041caab
lea eax, [ebx + 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.0041caab
cmp dword [0x47f20c], edi
je 0x41a301
call fcn.0041ee78
test al, al
jne 0x41a301
lea ecx, [ebp - 0x90]
call fcn.0041c7ab
lea ecx, [ebp - 0x18]
call fcn.0041d704
push eax
mov ecx, 0x480174
call fcn.0041d704
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0041ce4d
add esp, 0xc
lea ecx, [ebp - 0x90]
push 3
push edi
call fcn.0041d704
mov ecx, dword [ebp - 8]
push eax
push edi
call fcn.0041bcab
cmp eax, 7
jne 0x41a2e8
lea ecx, [ebp - 0x90]
jmp 0x41a552
cmp eax, 2
jne 0x41a2f9
push 1
mov ecx, 0x47f028
call fcn.0041ab77
lea ecx, [ebp - 0x90]
jmp 0x41a356
lea ecx, [ebp - 0x84]
call fcn.0041c7ab
lea ecx, [ebp - 0x18]
call fcn.0041d704
push eax
mov ecx, 0x480168
call fcn.0041d704
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0041ce4d
add esp, 0xc
lea ecx, [ebp - 0x84]
push 4
push edi
call fcn.0041d704
mov ecx, dword [ebp - 8]
push eax
push edi
call fcn.0041bcab
cmp eax, 7
je 0x41a57b
lea ecx, [ebp - 0x84]
call fcn.0041c8e1
mov ecx, dword [ebp - 8]
lea esi, [ebx + 0x20]
push esi
call fcn.00416e92
mov ecx, dword [ebp - 8]
push esi
call fcn.0041b21e
mov ecx, dword [ebp - 8]
push 0x7fffffff
push esi
call fcn.0041bd98
lea ecx, [ebp - 0x64]
call fcn.0041c7ab
mov eax, dword [ebx]
cmp eax, 3
jne 0x41a394
push str.__r:n__q:a
jmp 0x41a39e
cmp eax, 4
jne 0x41a3a6
push str.__q:a__c:_dasetup.exe__q__n_
lea ecx, [ebp - 0x64]
call fcn.0041c8f8
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x41a3ff
lea ecx, [ebp - 0xb4]
call fcn.0041c7ab
lea ecx, [ebp - 0x64]
call fcn.0041d704
push eax
mov ecx, esi
call fcn.0041d704
push eax
lea eax, [ebp - 0xb4]
push 0x42de64
push eax
call fcn.0041ce4d
add esp, 0x10
lea ecx, [ebp - 0xb4]
push edi
call fcn.0041d704
push eax
mov ecx, 0x47f8f0
call fcn.00411dc2
lea ecx, [ebp - 0xb4]
jmp 0x41a537
cmp eax, 1
jne 0x41a53c
lea ecx, [ebp - 0x3c]
call fcn.0041c7ab
lea ecx, [ebp - 0x30]
call fcn.0041c7ab
lea ecx, [ebp - 0x18]
call fcn.0041d704
push eax
lea eax, [ebp - 0x30]
push str._ResourceDir_3rd_party_s.exe
push eax
call fcn.0041ce4d
mov ecx, dword [ebp - 8]
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call fcn.0041b21e
lea ecx, [ebp - 0x4c]
call fcn.0041d704
push eax
mov ecx, esi
call fcn.0041d704
push eax
lea ecx, [ebp - 0x30]
call fcn.0041d704
push eax
lea eax, [ebp - 0x3c]
push str.__ResourceDir_3rd_partyDownloader.exe___download__local___s___url___s___program___s_
push eax
call fcn.0041ce4d
mov ecx, dword [ebp - 8]
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
call fcn.0041b21e
push edi
lea ecx, [ebp - 0x3c]
call fcn.0041d704
push eax
mov ecx, 0x47f8f0
call fcn.00411dc2
lea ecx, [ebp - 0x30]
call fcn.0041d704
push eax
call fcn.0040e7f9
test al, al
pop ecx
jne 0x41a4d9
push 4
push edi
mov ecx, 0x480180
call fcn.0041d704
mov ecx, dword [ebp - 8]
push eax
push edi
call fcn.0041bcab
cmp eax, 6
jne 0x41a4cd
lea ecx, [ebp - 0x30]
call fcn.0041c8e1
lea ecx, [ebp - 0x3c]
call fcn.0041c8e1
jmp 0x41a54f
push 1
mov ecx, 0x47f028
call fcn.0041ab77
push 0x42f138
lea ecx, [ebp - 0x3c]
call fcn.0041c8f8
lea ecx, [ebp - 0x64]
call fcn.0041d704
push eax
lea ecx, [ebp - 0x30]
call fcn.0041d704
push eax
lea eax, [ebp - 0x3c]
push 0x42de64
push eax
call fcn.0041ce4d
add esp, 0x10
lea ecx, [ebp - 0x3c]
push edi
call fcn.0041d704
push eax
mov ecx, 0x47f8f0
call fcn.00411dc2
lea ecx, [ebp - 0x30]
call fcn.0041d704
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x30]
call fcn.0041c8e1
lea ecx, [ebp - 0x3c]
call fcn.0041c8e1
cmp dword [ebx], 4
jne 0x41a54f
mov eax, dword [0x47f200]
and al, 0xf3
or al, 2
mov dword [0x47f200], eax
lea ecx, [ebp - 0x64]
call fcn.0041c8e1
lea ecx, [ebp - 0x4c]
call fcn.0041c8e1
lea ecx, [ebp - 0x18]
call fcn.0041c8e1
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [0x47f5d8]
jl 0x419d6f
jmp 0x41a5a0
mov ecx, dword [ebp - 8]
push 1
call fcn.0041ab77
lea ecx, [ebp - 0x84]
call fcn.0041c8e1
lea ecx, [ebp - 0x4c]
call fcn.0041c8e1
lea ecx, [ebp - 0x18]
call fcn.0041c8e1
pop edi
pop esi
pop ebx
leave
ret