Function at 0x40470c
Capabilities:
Acquire debug privileges
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f1aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3bc
push edi
mov dword [ebp - 0x24], 1
fld dword [ebp + 8]
fcomp dword [0x421658]
fnstsw ax
test ah, 1
jne 0x404769
push 0x428d90
call fcn.004014e0
add esp, 4
push 0x428da4
call fcn.004014e0
add esp, 4
push 0x428db8
call fcn.004014e0
add esp, 4
mov byte [ebp - 0x128], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x14], 0
push 0x42ccc4
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
push 0x42ccc8
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
push 0x42cccc
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 2
push 0x42ccd0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 3
push 0x42ccd4
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 4
push 0x42ccd8
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 5
push 0x42ccdc
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 6
push 0x42cce0
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 7
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_2
push 0x428dcc
lea ecx, [ebp - 0x134]
call fcn.0041e2a8
push ecx
mov ecx, esp
mov dword [ebp - 0x344], esp
lea eax, [ebp - 0x134]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x378], eax
call fcn.00401345
add esp, 4
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x404f08
mov byte [ebp - 0x340], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x33f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x208
lea ecx, [ebp - 0x340]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x340]
push edx
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::operator_2
push 0x5c
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
mov dword [ebp - 0x384], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x384]
push edx
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x348]
call sub.MFC42.DLL_CString::CString
push 0x428dd4
lea ecx, [ebp - 0x130]
call fcn.0041e2a8
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_1
push 0x428ddc
lea ecx, [ebp - 0x18]
call fcn.0041e2a8
push 0x5c
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea ecx, [ebp - 0x34c]
push ecx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x388], eax
mov edx, dword [ebp - 0x388]
mov dword [ebp - 0x38c], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34c]
call sub.MFC42.DLL_CString::CString
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x350], esp
lea edx, [ebp - 0x12c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x394], eax
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x354], esp
lea edx, [ebp - 0x18]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x398], eax
mov byte [ebp - 4], 7
call fcn.0040440f
add esp, 0xc
push 3
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x39c], eax
mov ecx, dword [ebp - 0x39c]
mov dword [ebp - 0x3a0], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3a0]
push edx
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::CString
push 0x428df0
lea ecx, [ebp - 0x138]
call fcn.0041e2a8
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_1
push 0x428e04
lea ecx, [ebp - 0x18]
call fcn.0041e2a8
push ecx
mov ecx, esp
mov dword [ebp - 0x35c], esp
lea edx, [ebp - 0x138]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3a4], eax
call fcn.00401345
add esp, 4
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
je 0x404b37
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::operator_1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x360], esp
lea edx, [ebp - 0x12c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x364], esp
lea edx, [ebp - 0x18]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3b4], eax
mov byte [ebp - 4], 7
call fcn.0040440f
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
push str.OCR_INSTALL_64WIN7.REG
lea ecx, [ebp - 0x10]
call fcn.0041e2a8
jmp 0x404c11
push 3
lea ecx, [ebp - 0x368]
push ecx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x3b8], eax
mov edx, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x368]
call sub.MFC42.DLL_CString::CString
push 0x428e2c
lea ecx, [ebp - 0x138]
call fcn.0041e2a8
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::operator_1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x36c], esp
lea edx, [ebp - 0x12c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c4], eax
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x370], esp
lea edx, [ebp - 0x18]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3c8], eax
mov byte [ebp - 4], 7
call fcn.0040440f
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
push str.OCR_INSTALL.REG
lea ecx, [ebp - 0x10]
call fcn.0041e2a8
mov ecx, dword [ebp - 0x10]
push ecx
push 0x428e4c
push 0x428e54
lea edx, [ebp - 0x130]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x130]
call fcn.0040d320
push eax
push 0x428e5c
push 0x428e68
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x138]
push eax
push str._sCommon_Filesmicrosoft_sharedMODI11.0_
lea ecx, [ebp - 0x130]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov edx, dword [ebp - 0x130]
push edx
push str._C_regsvr32__s___sMDIVWCTL.DLL_
lea eax, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.0040d320
push eax
push 0x428ebc
push 0x428ec4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x130]
push ecx
push str._C_regsvr32__s___sMSPCORE.DLL_
lea edx, [ebp - 0x1c]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.0040d320
push eax
push 0x428eec
push 0x428ef4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKCRInstallerComponents61BA386016BD0C340BBEAC273D84FD5F__v_2052__t_REG_MULTI_SZ__d_vUpAVS.X_______MKKSkOCR_2052____F_NUL
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x428f84
push 0x428f8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push str._C_reg_add_HKCRInstallerFeatures00002109F10040800000000000F01FEC__v_OCR_2052__t_REG_SZ__d__F_NUL
push 0x428ff8
push 0x429000
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products00002109F10040800000000000F01FECFeatures__v_OCR_2052__t_REG_SZ__d__mEMae_7q9DXdU_EPi___F_NUL
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x4290c8
push 0x4290d0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components3F745FF6A76FF2F4797DB74FC7B3FD8B__v_00002109710000000000000000F01FEC__t_REG_SZ__d__
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041e2cc
push str.XPAGE3C.DLL____F_NUL
lea ecx, [ebp - 0x20]
call fcn.0041e2a8
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x4291a8
push 0x4291b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components4080B9FA1A0BBF34FB7813E87159FC64__v_00002109F10040800000000000F01FEC__t_REG_SZ__d__
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0041e2cc
push str.SCCODE.UNI____F_NUL
lea ecx, [ebp - 0x20]
call fcn.0041e2a8
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x429284
push 0x42928c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components48AD0082D02B3D24C9A56FA50728CCAB__v_00002109710000000000000000F01FEC__t_REG_SZ__d__
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0x20]
call fcn.0041e2cc
push str.MSPCORE.DLL____F_NUL
lea ecx, [ebp - 0x20]
call fcn.0041e2a8
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x429364
push 0x42936c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x138]
push eax
push str._sCommon_Filesmicrosoft_sharedOFFICE11_
lea ecx, [ebp - 0x130]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push str._C_reg_add_HKLMSOFTWAREMicrosoftOffice11.0CommonFilesPaths__v_mso.dll__t_REG_SZ__d__
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0x20]
call fcn.0041e2cc
push 0x4293fc
lea ecx, [ebp - 0x20]
call fcn.0041e2a8
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x429410
push 0x429418
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18ComponentsD94C8360B8BB1DC41B1950E0F8237563__v_00002109110000000000000000F01FEC__t_REG_SZ__d__
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041e2cc
push str.MSO.DLL____F_NUL
lea ecx, [ebp - 0x20]
call fcn.0041e2a8
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x4294ec
push 0x4294f4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str._C_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products00002109710000000000000000F01FECInstallProperties__v_WindowsInstaller__t_REG_SZ__d__
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator_2
push str.dword:00000001____F_NUL
lea ecx, [ebp - 0x20]
call fcn.0041e2a8
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.0040d320
push eax
push 0x4295cc
push 0x4295d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x374], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret