Function at 0x40765c
Capabilities:
Query or enumerate registry value
Read .ini file
Set current directory

Disassembly:
mov eax, 0x41eea2
call fcn.00414b54
mov eax, 0x1f7c
call fcn.00414d30
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00401046
xor edi, edi
mov ecx, esi
mov ebx, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], edi
call fcn.0040105f
push edi
mov ecx, ebx
call fcn.0040d0d6
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040a8c1
cmp eax, edi
mov dword [ebp - 0x1c], eax
je 0x407a07
push 0x42a448
lea eax, [ebp - 0x6c]
push 0x14
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x428770
push dword [0x4205c0]
push dword [0x420574]
call edi
cmp byte [ebp - 0x6c], 0x79
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x4076ed
cmp byte [ebp - 0x6c], 0x59
jne 0x4077f0
cmp dword [0x42b318], 0
je 0x407735
push 0x42a448
lea eax, [ebp - 0x58]
push 0x14
push eax
push 0x428770
push dword [0x4205c4]
push dword [0x420574]
call edi
cmp byte [ebp - 0x58], 0x79
je 0x407729
cmp byte [ebp - 0x58], 0x59
je 0x407729
and dword [ebp - 0x1c], 0
jmp 0x407a07
mov dword [ebp - 0x1c], 1
jmp 0x4077fa
lea eax, [ebp - 0x58]
push eax
push 0
call fcn.00410188
and byte [ebp - 0x674], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x673]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x674]
push 0x400
push eax
push 0x66e
call fcn.0040f191
add esp, 0x14
lea eax, [ebx + 0x478]
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x170]
push eax
call esi
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x401
push dword [0x42a438]
call edi
lea eax, [ebp - 0x58]
push 0x24
push eax
lea eax, [ebp - 0x170]
push eax
push dword [0x42a438]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4077df
and dword [ebp - 0x1c], 0
push 0x3ea
push dword [0x42a438]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0xf
push eax
call edi
push 0
push 0
push 0x401
push dword [0x42a438]
call edi
cmp dword [ebp - 0x1c], 0
je 0x407a07
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push 1
push eax
lea eax, [ebp - 0x274]
push 0
push eax
push str.dotnetfx.exe
mov ecx, edi
call fcn.004099f5
test eax, eax
je 0x407ebf
cmp dword [ebp - 0x28], 1
jne 0x40788c
lea eax, [ebp - 0x170]
mov ecx, edi
push eax
push str.dotnetredist.exe
push dword [ebp - 0x38]
call fcn.0040aa7b
lea eax, [ebp - 0x1a84]
mov ecx, edi
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.00409b69
test eax, eax
je 0x407ebf
lea eax, [ebp - 0x1580]
mov ecx, edi
push eax
push str.dotnetredistSp1.exe
push dword [ebp - 0x38]
call fcn.0040aa7b
lea eax, [ebp - 0x1b88]
mov ecx, edi
push eax
lea eax, [ebp - 0x1580]
push eax
call fcn.00409b69
test eax, eax
je 0x407ebf
cmp dword [ebp - 0x40], 0
je 0x4078a4
lea eax, [ebp - 0x274]
push str.__q:a__c:_install__q_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
and byte [ebp - 0x58], 0
xor eax, eax
lea edi, [ebp - 0x57]
push 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.004144d0
add esp, 0xc
lea eax, [ebp - 0x58]
push dword [ebp - 0x38]
push str.__l_d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x107c]
push 0x104
push eax
push 0x452
call fcn.0040f191
add esp, 0xc
lea eax, [ebp - 0x107c]
push str.Microsoft_R__.NET_Framework
push eax
lea eax, [ebp - 0xf78]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xf78]
mov ecx, ebx
push eax
call fcn.0040d90e
xor eax, eax
push ebx
cmp dword [0x42b318], eax
sete al
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.004101eb
cmp eax, 0x2000
je 0x40796e
cmp eax, 0xbc2
je 0x40796e
test eax, eax
je 0x407a07
cmp eax, 0x1008
je 0x407a07
mov dword [0x42b314], 0x66d
jmp 0x407ebf
call fcn.0040fcc0
test eax, eax
je 0x407982
push 1
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
jmp 0x407989
mov dword [ebp - 0x24], 2
xor esi, esi
mov dword [ebp - 0x20], esi
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
call fcn.00405bae
test eax, eax
jne 0x4079f5
and byte [ebp - 0x170], al
push 0x40
pop ecx
lea edi, [ebp - 0x16f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x104
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push str.InstallerLocation
mov dword [ebp - 0x34], esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], esi
je 0x407a07
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x1c], edi
mov dword [ebp - 0x30], edi
jne 0x407b11
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + 0x78]
push eax
call fcn.0040941c
cmp eax, edi
jne 0x407b06
mov ecx, ebx
call fcn.0040d0bc
test eax, eax
je 0x407b0c
push 1
mov ecx, ebx
pop esi
mov dword [ebp - 0x30], esi
call fcn.0040cff0
mov eax, dword [eax]
dec eax
je 0x407a88
dec eax
jne 0x407ad8
cmp dword [ebx + 0x18c4], edi
je 0x407a71
lea eax, [ebx + 0x18c8]
push eax
lea eax, [ebp - 0x1980]
push eax
call fcn.004145c0
pop ecx
mov dword [ebp - 0x14], esi
pop ecx
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x1980]
push dword [ebp - 0x14]
push eax
push dword [0x424f50]
jmp 0x407abd
cmp dword [ebx + 0x14c0], edi
je 0x407aa8
lea eax, [ebx + 0x14c4]
push eax
lea eax, [ebp - 0x1980]
push eax
call fcn.004145c0
pop ecx
mov dword [ebp - 0x14], esi
pop ecx
lea eax, [ebp - 0x28]
push esi
push eax
lea eax, [ebp - 0x1980]
push dword [ebp - 0x14]
push eax
push dword [0x424f4c]
mov ecx, dword [ebp - 0x10]
call fcn.004099f5
test eax, eax
jne 0x407ad8
mov dword [0x42b314], 0x482
jmp 0x407ebf
lea eax, [ebp - 0x1980]
push eax
call fcn.0040f959
test eax, eax
jne 0x407b14
lea ecx, [ebp - 0x1980]
mov eax, 0x482
push ecx
push eax
mov dword [0x42b314], eax
call fcn.0040f0b1
pop ecx
pop ecx
jmp 0x407ec4
jg 0x407ec4
mov dword [ebp - 0x14], edi
jmp 0x407b17
push 1
pop esi
mov dword [ebp - 0x14], esi
and byte [ebp - 0x147c], 0
mov esi, 0xff
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x147b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebx + 0x1cc8], eax
je 0x407b54
lea eax, [ebx + 0x1ccc]
push eax
lea eax, [ebp - 0x147c]
push eax
call fcn.004145c0
pop ecx
pop ecx
push 1
pop eax
xor edi, edi
xor ecx, ecx
cmp dword [ebp - 0x14], edi
lea edx, [ebp - 0x3c]
sete cl
mov dword [ebp - 0x20], ecx
push dword [ebp - 0x20]
lea ecx, [ebx + 0x878]
push edx
push eax
lea eax, [ebp - 0x147c]
mov dword [ebp - 0x2c], ecx
push eax
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004099f5
test eax, eax
je 0x407ebf
cmp dword [ebp - 0x3c], 2
mov dword [ebp - 0x34], edi
jne 0x407b9f
cmp dword [ebp - 0x14], edi
je 0x407b9f
mov dword [ebp - 0x34], 1
and byte [ebp - 0xe74], 0
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xe73]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x1c], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
xor edi, edi
call fcn.0040974d
test eax, eax
je 0x407c2a
xor eax, eax
cmp dword [ebx + 0x20cc], eax
je 0x407bef
lea eax, [ebx + 0x20d0]
push eax
lea eax, [ebp - 0xe74]
push eax
call fcn.004145c0
pop ecx
pop ecx
push 1
pop esi
mov eax, esi
jmp 0x407bf2
push 1
pop esi
push dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xe74]
push eax
push dword [0x4205b4]
call fcn.004099f5
test eax, eax
je 0x407ebf
cmp dword [ebp - 0x28], 2
mov dword [ebp - 0x1c], esi
jne 0x407c2d
cmp dword [ebp - 0x14], 0
je 0x407c2d
mov edi, esi
jmp 0x407c2d
push 1
pop esi
cmp dword [ebp - 0x30], 0
je 0x407c51
cmp dword [ebp - 0x18], 0
je 0x407c3e
cmp dword [ebp - 0x24], esi
je 0x407c51
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1980]
push eax
call fcn.00409613
cmp dword [ebp - 0x24], 0
je 0x407c97
cmp dword [ebp - 0x18], 0
jne 0x407c97
push 0x42a448
lea eax, [ebp - 0x6c]
push 0x400
push eax
push 0x428770
push dword [0x420578]
push dword [0x420574]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x6c], 0x79
je 0x407c93
cmp byte [ebp - 0x6c], 0x59
je 0x407c93
mov dword [ebp - 0x18], esi
jmp 0x407c97
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x24], 2
jne 0x407cc7
cmp dword [ebp - 0x18], 0
jne 0x407cc7
lea eax, [ebx + 0x1080]
push str._ISSCHEDULEREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
push str.ISSCHEDULEREBOOT1
push 0x424144
mov ecx, ebx
call fcn.0040dd5f
cmp dword [ebp - 0x1c], 0
je 0x407e39
cmp dword [ebp - 0x18], 0
je 0x407ce0
cmp dword [ebp - 0x24], esi
je 0x407e39
lea eax, [ebp - 0xe74]
push 0x428774
push eax
lea ecx, [ebp - 0xa74]
call fcn.004035ff
lea eax, [ebp - 0xe74]
lea ecx, [ebp - 0xa74]
push eax
mov dword [ebp - 4], esi
call fcn.00403679
test eax, eax
je 0x407d29
call fcn.00405c97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa74]
call fcn.00403663
jmp 0x407ec4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
test edi, edi
je 0x407d97
and byte [ebp - 0x674], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x673]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x10]
stosb byte es:[edi], al
lea eax, [ebp - 0x674]
push eax
push dword [0x4205b4]
call fcn.00409ecf
test eax, eax
je 0x407d15
lea eax, [ebp - 0x674]
push 0x428770
push eax
call esi
test eax, eax
je 0x407d97
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x674]
push 1
push eax
lea eax, [ebp - 0xe74]
push eax
call fcn.00409f67
test eax, eax
je 0x407d10
cmp dword [ebp - 0x34], 0
je 0x407e02
and byte [ebp - 0x674], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x673]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x10]
stosb byte es:[edi], al
lea eax, [ebp - 0x674]
push eax
push dword [ebp - 0x2c]
call fcn.00409ecf
test eax, eax
je 0x407d15
lea eax, [ebp - 0x674]
push 0x428770
push eax
call esi
test eax, eax
je 0x407e02
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x674]
push 1
push eax
lea eax, [ebp - 0xe74]
push eax
call fcn.00409f67
test eax, eax
je 0x407d10
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xe74]
push eax
call fcn.00409920
test eax, eax
je 0x407d15
cmp dword [ebp - 0x30], 0
je 0x407e2a
mov dword [ebp - 0x18], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa74]
call fcn.00403663
mov esi, dword [ebp - 0x18]
mov ecx, ebx
push esi
call fcn.0040d0d6
cmp dword [ebp - 0x3c], 3
je 0x407ea5
test esi, esi
jne 0x407ec8
lea eax, [ebp - 0x147c]
push 0x428774
push eax
lea ecx, [ebp - 0x1f88]
call fcn.004035ff
lea eax, [ebp - 0x147c]
lea ecx, [ebp - 0x1f88]
push eax
mov dword [ebp - 4], 2
call fcn.00403679
test eax, eax
je 0x407e96
call fcn.00405c97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f88]
jmp 0x407d1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f88]
call fcn.00403663
test esi, esi
jne 0x407ec8
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x147c]
push eax
push dword [ebp - 0x2c]
call fcn.0040a1e7
test eax, eax
jne 0x407ec8
call fcn.00405c97
xor eax, eax
jmp 0x407edb
mov ecx, dword [ebp - 0x10]
push esi
push dword [ebp - 0x28]
lea eax, [ebp - 0x147c]
push eax
call fcn.00407eea
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret