Function at 0x4179d0
Capabilities:
Check os version
Delete registry key
Delete registry value
Get system information on windows
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468d82
mov eax, dword fs:[0]
push eax
sub esp, 0x5fc
mov eax, dword [0x4a5590]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x17
xor eax, eax
push str.SoftwareAVGAWLSetup_
lea ecx, [ebp - 0x460]
mov byte [edi + 0x504], 0
mov dword [ebp - 0x44c], 7
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
call fcn.0040a110
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x404], 7
mov dword [ebp - 0x408], 0
mov word [ebp - 0x418], ax
push 0x11
push str.SoftwareAVGAWL_
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.004092c0
xor eax, eax
mov dword [ebp - 0x3d4], 7
mov dword [ebp - 0x3d8], 0
mov word [ebp - 0x3e8], ax
push 0x15
push str.SoftwareAVGAWL2015_
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 2
call fcn.004092c0
push 0x11c
lea eax, [ebp - 0x580]
push 0
push eax
call fcn.00450d40
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x580]
push eax
mov dword [ebp - 0x580], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x417ff9
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x57c]
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417b3a
xor ecx, ecx
jmp 0x417b52
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417b43
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x18]
push eax
mov ecx, esi
call fcn.004092c0
push 1
push 0x47bc14
mov ecx, esi
call fcn.004092c0
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x578]
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417b9c
xor ecx, ecx
jmp 0x417bb4
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417ba5
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004092c0
push 1
push 0x47bc14
mov ecx, esi
call fcn.004092c0
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x574]
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417bfb
xor ecx, ecx
jmp 0x417c13
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417c04
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004092c0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
cmp esi, ebx
je 0x417c60
cmp dword [esi + 0x14], 8
jb 0x417c45
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x417c77
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
movzx eax, word [ebp - 0x46c]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417ca3
xor ecx, ecx
jmp 0x417cbf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417cb0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x78]
push eax
mov ecx, esi
call fcn.004092c0
push 1
push 0x47bc14
mov ecx, esi
call fcn.004092c0
movzx eax, word [ebp - 0x46a]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417d0b
xor ecx, ecx
jmp 0x417d23
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417d14
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004092c0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
cmp esi, ebx
je 0x417d70
cmp dword [esi + 0x14], 8
jb 0x417d55
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x417d87
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
cmp dword [ebp - 0x57c], 5
jbe 0x417e3f
push str.GetProductInfo
push str.kernel32.dll
mov dword [ebp - 0x5d0], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417f49
lea ecx, [ebp - 0x5d0]
push ecx
movzx ecx, word [ebp - 0x46a]
push ecx
movzx ecx, word [ebp - 0x46c]
push ecx
push dword [ebp - 0x578]
push dword [ebp - 0x57c]
call eax
test eax, eax
je 0x417f49
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x5d0]
call fcn.0044e1c1
add esp, 0x10
lea eax, [ebp - 0x218]
lea esi, [edi + 0xa8]
push eax
mov ecx, esi
call fcn.004093f0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
push eax
mov ecx, esi
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
jmp 0x417f49
xor eax, eax
cmp byte [ebp - 0x466], 1
jne 0x417e9a
lea esi, [eax + 4]
mov eax, dword [ebp - 0x468]
test eax, 0x200
je 0x417e61
mov esi, 1
jmp 0x417e6a
test al, 0x40
je 0x417e6a
mov esi, 8
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x57
call ebx
test eax, eax
je 0x417e7f
mov eax, 9
jmp 0x417e9a
push 0x56
call ebx
test eax, eax
je 0x417e8e
mov eax, 7
jmp 0x417e9a
push 0x58
call ebx
neg eax
sbb eax, eax
not eax
and eax, esi
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417ebf
xor ecx, ecx
jmp 0x417edf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x417ed0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417ed0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0xa8]
push eax
mov ecx, esi
call fcn.004092c0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
cmp esi, ebx
je 0x417f32
cmp dword [esi + 0x14], 8
jb 0x417f17
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x417f49
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
movzx eax, word [ebp - 0x468]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0044e1c1
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x417f75
xor ecx, ecx
jmp 0x417f8f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417f80
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0xd8]
push eax
mov ecx, esi
call fcn.004092c0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
cmp esi, ebx
je 0x417fe2
cmp dword [esi + 0x14], 8
jb 0x417fc7
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x417ff9
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x604], 9
mov edx, 0x47bcf4
je 0x41801a
mov edx, 0x47b7b8
xor eax, eax
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
cmp word [edx], ax
jne 0x418040
xor ecx, ecx
jmp 0x418054
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418045
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3b8]
call fcn.0040a110
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x3d0]
push eax
mov byte [ebp - 4], 3
call fcn.00415a60
mov ebx, eax
lea esi, [edi + 0x48]
cmp esi, ebx
je 0x4180ac
cmp dword [esi + 0x14], 8
jb 0x418091
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3bc], 8
jb 0x4180c3
push dword [ebp - 0x3d0]
call fcn.0044d639
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3a4], 8
mov dword [ebp - 0x3bc], 7
mov dword [ebp - 0x3c0], 0
mov word [ebp - 0x3d0], ax
jb 0x4180f7
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [ebp - 0x434], 7
mov dword [ebp - 0x438], 0
mov word [ebp - 0x448], ax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.00415960
test al, al
je 0x41819c
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
lea esi, [edi + 0x108]
cmp esi, ebx
je 0x418185
cmp dword [esi + 0x14], 8
jb 0x41816a
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x41819c
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.00415960
test al, al
je 0x418220
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
lea esi, [edi + 0x138]
cmp esi, ebx
je 0x418209
cmp dword [esi + 0x14], 8
jb 0x4181ee
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x418220
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
lea eax, [ebp - 0x3d0]
push eax
call fcn.004158a0
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 5
call fcn.00415a60
mov ebx, eax
lea esi, [edi + 0x168]
cmp esi, ebx
je 0x418274
cmp dword [esi + 0x14], 8
jb 0x418259
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x41828b
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
xor eax, eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x4182c3
push dword [ebp - 0x3d0]
call fcn.0044d639
add esp, 4
push 0xd
lea ebx, [edi + 0x538]
push 0x47bcf8
mov ecx, ebx
call fcn.0040a110
push ebx
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
lea esi, [edi + 0x198]
cmp esi, ebx
je 0x41831b
cmp dword [esi + 0x14], 8
jb 0x418300
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x418332
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor bl, bl
cmp dword [edi + 0x560], 0
mov byte [ebp - 0x5c5], bl
jne 0x4185e6
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418362
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4184a0
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5d0]
push eax
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41848c
cmp dword [ebp - 0x5d0], 1
jne 0x418457
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x418451
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call eax
push esi
lea ecx, [ebp - 0x3b8]
call fcn.0040a210
push eax
lea ecx, [edi + 0x550]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push esi
call fcn.0044d60a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
mov bl, byte [ebp - 0x5c5]
cmp dword [edi + 0x560], 0
je 0x41848c
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
push eax
lea ecx, [edi + 0x1f8]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
mov bl, 1
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x41861c
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x4184b5
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
jne 0x41861c
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5d0]
push eax
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x4185d8
cmp dword [ebp - 0x5d0], 1
jne 0x4185a5
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x4185a5
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call eax
push esi
lea ecx, [ebp - 0x3b8]
call fcn.0040a210
push eax
lea ecx, [edi + 0x550]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push esi
call fcn.0044d60a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
cmp dword [edi + 0x560], 0
je 0x4185d8
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
push eax
lea ecx, [edi + 0x1f8]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41861c
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
push eax
lea ecx, [edi + 0x1f8]
call fcn.00409230
cmp dword [ebp - 0x3a4], 8
jb 0x41861c
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
cmp dword [ebp - 0x44c], 8
mov eax, dword [ebp - 0x460]
jae 0x418631
lea eax, [ebp - 0x460]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x2001b
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x418aa9
push 0x47abfc
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 0x5c5], al
call fcn.0040a210
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0
mov byte [ebp - 4], 6
push 0x47abfc
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5d0], 0x80
call esi
test eax, eax
jne 0x4186fc
cmp dword [ebp - 0x5e0], 1
jne 0x4186fc
mov eax, dword [ebp - 0x5d0]
test eax, eax
je 0x4186fc
shr eax, 1
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x2a0]
push 0x41
push eax
call fcn.0044ec00
add esp, 0x10
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
setns bl
mov byte [ebp - 0x5c5], bl
test bl, bl
jne 0x418a09
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.TUU2011
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x41880d
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5d4], eax
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5d4]
push eax
push 0
push 0x47abfc
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x41896b
cmp dword [ebp - 0x5d4], 1
jne 0x41896b
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41896b
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47abfc
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x418962
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0
push ebx
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5cc], 0x80
call esi
test eax, eax
jne 0x418962
cmp dword [ebp - 0x5d8], 1
jne 0x418962
mov eax, dword [ebp - 0x5cc]
jmp 0x418911
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.TUU2010
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x418977
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0x47abfc
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x41896b
cmp dword [ebp - 0x5cc], 1
jne 0x41896b
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41896b
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47abfc
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x418962
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0
push ebx
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5d4], 0x80
call esi
test eax, eax
jne 0x418962
cmp dword [ebp - 0x5d8], 1
jne 0x418962
mov eax, dword [ebp - 0x5d4]
test eax, eax
je 0x418962
shr eax, 1
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x2a0]
push 0x41
push eax
call fcn.0044ec00
add esp, 0x10
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2a0]
push eax
mov eax, dword [sym.imp.ole32.dll_IIDFromString]
call eax
test eax, eax
js 0x418962
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 0x5c5], 1
call fcn.00409270
push ebx
call fcn.0044d60a
add esp, 4
push dword [ebp - 0x5c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3a8], 0
je 0x4189fc
mov esi, dword [ebp - 0x3a4]
mov edx, dword [ebp - 0x3b8]
mov ecx, edx
cmp esi, 8
jae 0x41899d
lea ecx, [ebp - 0x3b8]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4189a0
sub ecx, ebx
sar ecx, 1
cmp esi, 8
jae 0x4189ba
lea edx, [ebp - 0x3b8]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x47abfc
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4189fc
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.TUU2011
push dword [ebp - 0x5bc]
call esi
push str.TUU2010
push dword [ebp - 0x5bc]
call esi
cmp byte [ebp - 0x5c5], 0
je 0x418a82
rol word [ebp - 0x3f4], 8
mov ecx, dword [ebp - 0x3f8]
mov edx, ecx
rol word [ebp - 0x3f2], 8
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebp - 0x3f8], edx
push 0x10
lea edx, [ebp - 0x3f8]
lea ecx, [ebp - 0x3d0]
call fcn.00415ba0
add esp, 4
lea ecx, [edi + 0x258]
push eax
call fcn.00409230
cmp dword [ebp - 0x3bc], 8
jb 0x418a82
push dword [ebp - 0x3d0]
call fcn.0044d639
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3a4], 8
jb 0x418aa9
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
push str.AWL2015
lea ecx, [ebp - 0x3b8]
call fcn.0040a210
mov ebx, eax
lea esi, [edi + 0x288]
cmp esi, ebx
je 0x418af0
cmp dword [esi + 0x14], 8
jb 0x418ad5
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x418b07
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
mov ecx, esi
call fcn.00413870
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
mov ebx, eax
cmp esi, ebx
je 0x418b4c
cmp dword [esi + 0x14], 8
jb 0x418b31
push dword [esi]
call fcn.0044d639
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.00409c20
cmp dword [ebp - 0x3a4], 8
jb 0x418b63
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
lea eax, [ebp - 0x3d0]
push eax
call fcn.004164b0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x3bc], 8
mov eax, dword [ebp - 0x3d0]
jae 0x418b88
lea eax, [ebp - 0x3d0]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x47abfc
push str.TUAppMode
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x418c2c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x400]
call fcn.0040a210
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 8
call fcn.00415a60
push eax
lea ecx, [edi + 0x2b8]
call fcn.00409230
cmp dword [ebp - 0x3a4], 8
jb 0x418bf8
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3ec], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x418c2c
push dword [ebp - 0x400]
call fcn.0044d639
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
jb 0x418c47
push dword [ebp - 0x3d0]
call fcn.0044d639
add esp, 4
cmp dword [edi + 0x530], 0
jne 0x418fae
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418c69
lea eax, [ebp - 0x3e8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x418df3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x418d22
cmp dword [ebp - 0x5c4], 1
jne 0x418de1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x418de1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.CurSID
jmp 0x418da4
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push 0x47bd88
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x418de1
cmp dword [ebp - 0x5c4], 1
jne 0x418de1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x418de1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push 0x47bd88
push dword [ebp - 0x5bc]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call eax
test eax, eax
jne 0x418dd8
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.0040a210
push eax
lea ecx, [edi + 0x520]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push ebx
call fcn.0044d60a
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [edi + 0x530], 0
jne 0x418fae
lea eax, [ebp - 0x5bc]
push eax
push 0x2001f
push 0
push str.SoftwareAVGAWL_
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x418fae
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418ef0
cmp dword [ebp - 0x5cc], 1
jne 0x418ef0
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x418ef0
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418ee7
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.0040a210
push eax
lea ecx, [edi + 0x520]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push ebx
call fcn.0044d60a
add esp, 4
cmp dword [edi + 0x530], 0
je 0x418f91
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x418f12
lea eax, [ebp - 0x3e8]
push 0
lea ecx, [ebp - 0x5d4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x418f91
cmp dword [edi + 0x534], 8
lea edx, [edi + 0x520]
jb 0x418f4b
mov ecx, dword [edx]
jmp 0x418f4d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418f50
sub ecx, esi
sar ecx, 1
cmp dword [edx + 0x14], 8
jb 0x418f67
mov edx, dword [edx]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.CurSID
push dword [ebp - 0x5d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3d0]
call fcn.0040a210
lea ecx, [edi + 0x520]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 9
call fcn.00409ad0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418fe1
mov eax, dword [eax]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
sete bl
cmp dword [ebp - 0x3a4], 8
jb 0x419018
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
xor eax, eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x419050
push dword [ebp - 0x3d0]
call fcn.0044d639
add esp, 4
test bl, bl
je 0x419479
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.Download
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41914e
cmp dword [ebp - 0x5c0], 1
jne 0x41914e
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41914e
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.Download
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419145
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040a210
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xa
call fcn.00415a60
push eax
lea ecx, [edi + 0x3a8]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.0040a2d0
push ebx
call fcn.0044d60a
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push 0x47b804
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419244
cmp dword [ebp - 0x5c0], 1
jne 0x419244
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x419244
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47b804
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41923b
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040a210
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xb
call fcn.00415a60
push eax
lea ecx, [edi + 0x378]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.0040a2d0
push ebx
call fcn.0044d60a
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.tbar
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419377
cmp dword [ebp - 0x5c0], 1
jne 0x419377
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x419377
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.tbar
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41936e
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.0040a210
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x3a8], 0
je 0x41935f
lea edx, [ebp - 0x3b8]
lea ecx, [ebp - 0x400]
call fcn.004138c0
mov byte [ebp - 4], 0xd
push dword [ebp - 0x3a8]
mov ecx, eax
call fcn.00406910
mov edx, eax
lea ecx, [ebp - 0x3d0]
call fcn.00415ba0
add esp, 4
lea ecx, [edi + 0x438]
push eax
call fcn.00409230
lea ecx, [ebp - 0x3d0]
call fcn.0040a2d0
lea ecx, [ebp - 0x400]
call fcn.004068e0
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 4
call fcn.0040a2d0
push ebx
call fcn.0044d60a
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push 0x47b828
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41946d
cmp dword [ebp - 0x5c0], 1
jne 0x41946d
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41946d
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x47b828
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419464
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040a210
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xe
call fcn.00415a60
push eax
lea ecx, [edi + 0x498]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.0040a2d0
push ebx
call fcn.0044d60a
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x404], 8
mov eax, dword [ebp - 0x418]
jae 0x41948e
lea eax, [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x4194e1
cmp dword [ebp - 0x404], 8
mov eax, dword [ebp - 0x418]
jae 0x4194c3
lea eax, [ebp - 0x418]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x419632
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.RegistrationMail
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419626
cmp dword [ebp - 0x5cc], 1
jne 0x419626
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x419620
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
mov dword [ebp - 0x5d0], esi
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push esi
push 0
push 0
push str.RegistrationMail
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419617
push eax
push eax
push eax
push eax
push ebx
push esi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x5d4], eax
test eax, eax
jle 0x419617
push eax
call fcn.0044bdc0
add esp, 4
mov esi, eax
push 0
push 0
push dword [ebp - 0x5d4]
push esi
push ebx
push dword [ebp - 0x5d0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x5d4]
mov edx, esi
lea ecx, [ebp - 0x3b8]
call fcn.00415ba0
add esp, 4
lea ecx, [edi + 0x3d8]
push eax
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push esi
call fcn.0044d60a
mov esi, dword [ebp - 0x5d0]
add esp, 4
push esi
call fcn.0044d60a
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419647
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x4196a5
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419676
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x4196a5
push 0x47abfc
lea ecx, [edi + 0x568]
call fcn.00409270
jmp 0x4197a4
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.ProductKey
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419798
cmp dword [ebp - 0x5cc], 1
jne 0x419798
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x419798
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.ProductKey
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419789
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.0040a210
lea eax, [ebp - 0x3b8]
push eax
call fcn.00416010
push eax
lea ecx, [edi + 0x228]
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
push ebx
lea ecx, [edi + 0x568]
call fcn.00409270
push ebx
call fcn.0044d60a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
lea esi, [edi + 0x2e8]
push 0x47bdc0
mov ecx, esi
call fcn.0040a110
push 7
push str.AWL2015
mov ecx, esi
call fcn.004092c0
mov ecx, esi
call fcn.00413870
push 0x47bdc8
lea ecx, [ebp - 0x430]
call fcn.0040a210
mov byte [ebp - 4], 0xf
cmp byte [edi + 0x5b0], 0
je 0x419801
push 2
push 0x47bdd0
lea ecx, [ebp - 0x430]
call fcn.0040a110
jmp 0x419977
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419816
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x419874
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x419845
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x419874
push 0x47bdc8
lea ecx, [ebp - 0x430]
call fcn.00409270
jmp 0x419977
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.PKStatus
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41994b
cmp dword [ebp - 0x5cc], 1
jne 0x41996b
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x41996b
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x5d8], eax
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.PKStatus
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419940
push ebx
lea ecx, [ebp - 0x430]
call fcn.00409270
push 0x47bdec
lea ecx, [ebp - 0x430]
call fcn.004093f0
push ebx
call fcn.0044d60a
add esp, 4
jmp 0x41996b
cmp dword [edi + 0x578], 0
lea ecx, [ebp - 0x430]
je 0x419961
push 0x47bdf0
jmp 0x419966
push 0x47bdf8
call fcn.00409270
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00409570
cmp dword [edi + 0x560], 0
je 0x4199f9
cmp dword [edi + 0x564], 8
lea ebx, [edi + 0x550]
jb 0x4199a5
mov eax, dword [ebx]
jmp 0x4199a7
mov eax, ebx
mov ecx, str.silent
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4199d6
test dx, dx
je 0x4199d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4199d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4199b0
xor eax, eax
jmp 0x4199db
sbb eax, eax
or eax, 1
test eax, eax
je 0x4199f9
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00409570
push 0x47bdec
mov ecx, esi
call fcn.004093f0
jmp 0x419a07
push 6
push str.xx_xx_
mov ecx, esi
call fcn.004092c0
push 0xffffffffffffffff
push 0
lea ebx, [edi + 0x520]
push ebx
mov ecx, esi
call fcn.00409570
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3d0]
call fcn.0040a210
push ebx
mov edx, eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x10
call fcn.00409ad0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x419a46
mov eax, dword [eax]
lea ecx, [ebp - 0x5bc]
push ecx
push 0xf003f
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
sete bl
cmp dword [ebp - 0x3a4], 8
jb 0x419a7d
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x419ab5
push dword [ebp - 0x3d0]
call fcn.0044d639
add esp, 4
test bl, bl
je 0x419b15
cmp dword [esi + 0x14], 8
jb 0x419ac3
mov ecx, dword [esi]
jmp 0x419ac5
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x419ad0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419ad0
sub ecx, edx
sar ecx, 1
cmp dword [esi + 0x14], 8
jb 0x419ae9
mov edx, dword [esi]
jmp 0x419aeb
mov edx, esi
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.x_sid
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00413870
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
push eax
mov ecx, esi
call fcn.00409230
cmp dword [ebp - 0x3a4], 8
jb 0x419b48
push dword [ebp - 0x3b8]
call fcn.0044d639
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5bc]
push eax
push 0x20019
push 0
push str.SoftwareAVGAWLSIDData_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x419ea6
xor ebx, ebx
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], 0x104
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], ebx
mov word [ebp - 0x3b8], ax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
mov byte [ebp - 4], 0x11
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x419e28
jmp 0x419bd0
push 0x19
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3b8]
call fcn.0040a110
cmp word [ebp - 0x218], 0
jne 0x419bf0
xor ecx, ecx
jmp 0x419c0f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419c00
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.004092c0
cmp dword [ebp - 0x3a4], 8
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
jae 0x419c4b
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x5c4]
push ecx
push 0xf003f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x419dd6
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.x_sid
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d2f
cmp dword [ebp - 0x5cc], 1
jne 0x419dc4
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x419dc4
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044bdc0
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.x_sid
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419d1b
push ebx
lea ecx, [edi + 0x348]
call fcn.004093f0
push 0x47be20
lea ecx, [edi + 0x348]
call fcn.004093f0
push ebx
call fcn.0044d60a
mov ebx, dword [ebp - 0x5d4]
add esp, 4
jmp 0x419dc4
cmp eax, 2
jne 0x419dc4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3d0]
call fcn.0040a210
push 0
push 0x47be24
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x12
call fcn.0041a440
cmp eax, 0xffffffff
je 0x419d8b
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3d0]
push eax
lea ecx, [edi + 0x348]
call fcn.00409570
push 0x47be20
lea ecx, [edi + 0x348]
call fcn.004093f0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x3bc]
cmp eax, 8
jb 0x419dad
inc eax
push eax
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x5c5]
call fcn.0040a270
push 0
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x3bc], 7
call fcn.0040a2a0
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x208
lea eax, [ebp - 0x218]
push 0
inc ebx
push eax
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], 0x104
call fcn.00450d40
add esp, 0xc
lea eax, [ebp - 0x5d0]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x419bd0
lea esi, [edi + 0x348]
mov ecx, esi
call fcn.00409510
test al, al
jne 0x419e85
lea eax, [ebp - 0x5d8]
push eax
mov ecx, esi
call fcn.00409bc0
mov ecx, eax
call fcn.0041a490
push dword [eax]
lea eax, [ebp - 0x5e0]
push eax
mov ecx, esi
call fcn.0041a400
mov ecx, esi
call fcn.00413870
push esi
lea eax, [ebp - 0x3d0]
push eax
call fcn.00415a60
push eax
mov ecx, esi
call fcn.00409230
lea ecx, [ebp - 0x3d0]
call fcn.0040a2d0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0xf
call fcn.0040a2d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x47abfc
push 0x47abfc
push 0
push ecx
lea ecx, [edi + 0x598]
call fcn.00409bf0
push eax
lea ecx, [edi + 0x538]
call fcn.00409bf0
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00408900
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x13
call fcn.00408e10
lea ebx, [edi + 0x468]
push eax
mov ecx, ebx
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
mov ecx, ebx
call fcn.00409510
test al, al
jne 0x419fcb
mov edx, ebx
lea ecx, [ebp - 0x3d0]
call fcn.004138c0
mov esi, eax
mov ecx, ebx
mov byte [ebp - 4], 0x14
call fcn.00409500
push eax
mov ecx, esi
call fcn.00406910
mov edx, eax
lea ecx, [ebp - 0x3b8]
call fcn.00415ba0
add esp, 4
mov ecx, ebx
push eax
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x13
call fcn.004068e0
lea eax, [ebp - 0x5bc]
push eax
push 0x2001b
push 0
lea ecx, [ebp - 0x3e8]
call fcn.00409bf0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x419fcb
mov ecx, ebx
call fcn.00409500
lea eax, [eax*2 + 2]
push eax
mov ecx, ebx
call fcn.00409bf0
push eax
push 1
push 0
push 0x47be3c
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5bc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x3e8]
call fcn.00409bf0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41a17b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push str.CurRIT
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41a0d4
cmp dword [ebp - 0x5c4], 4
jne 0x41a0d4
cmp dword [ebp - 0x5c0], eax
jbe 0x41a0d4
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0
push str.CurRIT
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 4
call esi
test eax, eax
jne 0x41a0d4
push ecx
mov ecx, dword [ebp - 0x5cc]
lea edx, [ebp - 0x3cc]
call fcn.0041ab30
add esp, 4
lea esi, [edi + 0x408]
push str.tcp2_
mov ecx, esi
call fcn.004093f0
lea eax, [ebp - 0x3cc]
push eax
mov ecx, esi
call fcn.004093f0
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.00415a60
push eax
mov ecx, esi
call fcn.00409230
lea ecx, [ebp - 0x3b8]
call fcn.0040a2d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, ebx
call fcn.00409510
test al, al
je 0x41a16f
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push 0x47be3c
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41a16f
cmp dword [ebp - 0x5c4], 1
jne 0x41a16f
mov eax, dword [ebp - 0x5c0]
test eax, eax
je 0x41a16f
push eax
lea ecx, [ebp - 0x5dc]
call fcn.0041a540
push ecx
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x15
call fcn.0041a5a0
mov esi, eax
lea eax, [ebp - 0x5c0]
push eax
push esi
push 0
push 0
push 0x47be3c
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a160
push esi
mov ecx, ebx
call fcn.00409270
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x13
call fcn.0041a570
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.00416a40
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0xf
call fcn.004089a0
lea ecx, [ebp - 0x430]
call fcn.0040a2d0
lea ecx, [ebp - 0x448]
call fcn.0040a2d0
lea ecx, [ebp - 0x3e8]
call fcn.0040a2d0
lea ecx, [ebp - 0x418]
call fcn.0040a2d0
lea ecx, [ebp - 0x460]
call fcn.0040a2d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044c32d
mov esp, ebp
pop ebp
ret