Function at 0x420060
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry value
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x13c8]
mov eax, 0x13c8
call fcn.0061ea30
push 0xffffffffffffffff
push 0x641634
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x755898]
xor eax, ebp
mov dword [ebp + 0x13c4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044a680
call fcn.00448bb0
mov ecx, ebx
call fcn.00418d90
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], edi
push 0x75aa08
call fcn.00415dd0
mov eax, dword [0x75aa08]
push eax
push 0x675ea0
push 0x75aa0c
call fcn.00402f70
add esp, 0x10
mov dword [ebp - 0xc8], 0x400
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp + 0xf84]
push edx
push edi
push edi
push str.szCustomUserAgent
mov eax, dword [0x75abd8]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x420136
lea ecx, [ebp + 0xf84]
push ecx
push 0x675ea0
push 0x75aa08
call fcn.00402f70
add esp, 0xc
mov ecx, ebx
call fcn.0041cda0
mov ecx, ebx
call fcn.004102d0
cmp dword [0x75abc8], edi
jne 0x420208
mov dword [ebp - 0x30], 0x40
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp + 0x1384]
push eax
push 0
push 0
push str.idmvers
mov ecx, dword [0x75abd8]
push ecx
call esi
test eax, eax
jne 0x4201fe
mov edx, dword [0x75ad94]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420187
sub eax, esi
push eax
push edx
lea edx, [ebp + 0x1384]
push edx
call fcn.0061ea5b
add esp, 0xc
test eax, eax
je 0x4201be
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4201be
cmp byte [eax + 0x51], 0
jne 0x4201be
mov dword [0x75abc8], 1
push 8
push str.v6.35b09
lea eax, [ebp + 0x1384]
push eax
call fcn.00621d6d
add esp, 0xc
test eax, eax
je 0x4201f2
push 8
push str.v6.35b10
lea ecx, [ebp + 0x1384]
push ecx
call fcn.00621d6d
add esp, 0xc
test eax, eax
jne 0x420208
mov dword [0x75abcc], 1
jmp 0x420208
mov dword [0x75abc8], 1
cmp dword [0x75abb0], edi
je 0x420231
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420227
cmp byte [eax + 0x51], 0
jne 0x420227
cmp dword [0x75abc8], edi
je 0x420231
call fcn.00414800
call fcn.00410460
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420248
cmp byte [eax + 0x51], 0
jne 0x420248
cmp dword [0x75abc8], edi
je 0x420259
push 1
call fcn.0046ca60
push 0
call fcn.00472d10
add esp, 8
call fcn.0041bac0
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp + 0xec0], 0x94
lea edx, [ebp + 0xec0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4202c0
cmp dword [ebp + 0xed0], 2
jne 0x4202c0
mov esi, 1
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0xec4], 6
jb 0x4202c0
mov dword [ebp - 0x28], esi
push 0x80000001
call fcn.00412b50
push 0x80000002
call fcn.00412b50
add esp, 8
mov dword [ebp - 0x40], 4
test esi, esi
je 0x42040d
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.EnableDriver
mov edx, dword [0x75abd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4202fa
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov esi, 1
mov dword [ebp - 0xb4], esi
lea edx, [ebp - 0x1c]
push edx
push 0x20019
push 0
push 0x675e10
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420363
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.AdvIntDriverEnabled2
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420359
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xb4], esi
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], esi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
jne 0x4203c2
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.bVistaAdvInt
mov edx, dword [0x75abd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x4203bf
mov eax, 1
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0x4c], eax
push 4
lea edx, [ebp - 0x4c]
push edx
push 4
push 0
push str.bVistaAdvInt
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4203c2
mov dword [ecx + 0x1c], esi
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
je 0x42040d
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
call fcn.00410630
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x38], edi
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
sete bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], 1
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push 0
push str.EnableDriver
mov edx, dword [0x75abd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x42042c
cmp byte [eax + 0x51], 0
jne 0x42043b
cmp dword [0x75abc8], 0
je 0x4204bd
cmp byte [eax + 0x51], 0
jne 0x42043b
cmp dword [0x75abc8], 0
je 0x420475
lea ecx, [ebp - 0x18]
call fcn.004ff780
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004ff7e0
test eax, eax
je 0x420469
lea ecx, [ebp - 0x18]
call fcn.004ff7a0
test eax, eax
jne 0x420469
push 1
lea ecx, [ebp - 0x18]
call fcn.004ffdb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004ff790
mov dword [ebp - 0x2c], 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.DebugFlags
mov edx, dword [0x75abd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4204bd
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push str.DebugFlags
mov ecx, dword [0x75abd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x4206e8
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x18]
call fcn.004ff780
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004ff7e0
test eax, eax
jne 0x420658
xor edi, edi
cmp dword [0x75abc0], edi
jne 0x42050b
push edi
lea ecx, [ebp - 0x18]
call fcn.004ffdb0
lea ecx, [ebp - 0x18]
call fcn.004ff920
lea ecx, [ebp - 0x18]
call fcn.004ff8d0
mov dword [ebp - 0x20], edi
mov dword [ebp + 0xf54], edi
mov dword [ebp + 0xf5c], edi
xor edx, edx
mov word [ebp + 0xf58], dx
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041ee70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0xf54]
push ecx
mov ecx, esi
call fcn.004177b0
test eax, eax
je 0x4205eb
mov ebx, dword [ebp - 0x20]
cmp ebx, 1
je 0x4205eb
xor esi, esi
mov dword [ebp - 0xc0], esi
mov edx, dword [ebp - 0x14]
cmp esi, dword [edx + 0x28]
jge 0x4205eb
mov edi, edx
add edi, 0x20
push esi
mov ecx, edi
call fcn.004114c0
mov eax, dword [eax]
cmp ebx, dword [eax + 8]
jne 0x420652
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
push esi
mov ecx, edi
call fcn.004114c0
mov eax, dword [eax]
add eax, 0x14
cmp ebx, dword [eax + 8]
jge 0x4205eb
mov eax, dword [ebp + 0xf54]
test eax, eax
je 0x4205a9
mov dword [ebp - 0x1c], eax
jmp 0x4205b2
lea ecx, [ebp + 0xf58]
mov dword [ebp - 0x1c], ecx
push esi
mov ecx, edi
call fcn.004114c0
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d110
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
push eax
call fcn.0062280a
add esp, 8
test eax, eax
jne 0x42064c
push esi
mov ecx, edi
call fcn.004114c0
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d110
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], eax
jne 0x42061e
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0xbc], eax
push 4
lea edx, [ebp - 0xbc]
push edx
push 4
push eax
push str.AdvancedIntegration
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0041f970
mov dword [0x75aa04], 1
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xf54]
call fcn.00401210
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x70]
jmp 0x4206d9
inc ebx
jmp 0x420582
inc esi
jmp 0x420556
cmp dword [ebp - 0x28], 0
je 0x4206dc
call fcn.00515cd0
mov esi, eax
test esi, esi
je 0x4206d9
mov dword [ebp - 0xc4], 4
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push str.StEnableBFEMsg
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4206cf
mov dword [ebp - 0x3c], 1
push 4
lea ecx, [ebp - 0x3c]
push ecx
push 4
push 0
push str.StEnableBFEMsg
mov edx, dword [0x75abd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
push 0
push esi
push 0x411730
call fcn.005fcc94
jmp 0x4206d9
xor ebx, ebx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004ff790
cmp dword [esi + 0x1c], 0
je 0x420aa8
test ebx, ebx
je 0x420a88
xor esi, esi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x34], esi
je 0x420a52
push esi
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041be80
cmp dword [ebp - 0x28], esi
jne 0x420754
push 1
mov ecx, ebx
call fcn.0041aaf0
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [0x75aa00], 1
mov ecx, ebx
test edi, edi
je 0x420745
call fcn.00416bc0
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x420a4e
call fcn.00410570
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x420a4e
mov dword [ebp + 0xf78], esi
mov dword [ebp + 0xf80], esi
xor eax, eax
mov word [ebp + 0xf7c], ax
mov byte [ebp - 4], 4
mov eax, dword [0x75ac4c]
cmp eax, esi
jne 0x42077b
mov eax, 0x75ac50
push esi
push str.Uninstall.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xf78]
call fcn.00402320
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420874
cmp dword [0x75abc8], esi
jne 0x420874
cmp byte [eax + 0x29], 0
je 0x420874
mov edi, 1
mov dword [ebx + 0x4c], edi
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebx + 4]
call fcn.0040dba0
test eax, eax
je 0x420a37
push 0x3c
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.0061d9e0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
cmp eax, esi
je 0x420817
mov dword [ebp - 0xa0], eax
jmp 0x420823
lea ecx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42086c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], edi
jmp 0x420a37
push 0x3c
push esi
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0061d9e0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
cmp eax, esi
je 0x4208b6
mov dword [ebp - 0xa0], eax
jmp 0x4208c2
lea edx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._instdriv
mov eax, dword [ebp + 0xf78]
cmp eax, esi
jne 0x420900
lea eax, [ebp + 0xf7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420a37
mov eax, dword [ebp + 0xf78]
cmp eax, esi
jne 0x420920
lea eax, [ebp + 0xf7c]
push esi
push eax
mov ecx, ebx
call fcn.00416980
test al, al
je 0x420a37
lea eax, [ebp - 0xb0]
push eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call esi
test eax, eax
je 0x420a31
mov dword [ebp - 0x54], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x420975
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], ecx
mov dword [0x75aa00], 1
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040dba0
test eax, eax
je 0x420a37
push 0x3c
push 0
lea ecx, [ebp - 0xb0]
push ecx
call fcn.0061d9e0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
test eax, eax
je 0x4209dd
mov dword [ebp - 0xa0], eax
jmp 0x4209e9
lea edx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], edx
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], eax
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea eax, [ebp - 0xb0]
push eax
call esi
test eax, eax
je 0x420a28
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
call ebx
mov dword [ebp - 0x44], 1
jmp 0x420a37
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x38], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf78]
call fcn.00401210
mov esi, dword [ebp - 0x54]
test esi, esi
jne 0x420a59
mov dword [ebp - 0x24], 0
xor edx, edx
test esi, esi
setne dl
mov dword [ebp - 0xcc], edx
push 4
lea eax, [ebp - 0xcc]
push eax
push 4
push 0
push str.lastintres
mov ecx, dword [0x75abd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x34], 0
je 0x420aa8
test edi, edi
je 0x420a9b
mov ecx, esi
call fcn.00416bc0
jmp 0x420aa8
cmp dword [ebp - 0x28], 0
jne 0x420aa8
mov ecx, esi
call fcn.00410570
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420ac0
cmp byte [eax + 0x51], 0
jne 0x420ac0
cmp dword [0x75abc8], 0
je 0x420ac7
mov ecx, esi
call fcn.0041d330
cmp dword [ebp - 0x34], 0
je 0x420ad6
mov dword [ebp - 0x24], 0
jmp 0x420adc
cmp dword [ebp - 0x24], 0
jne 0x420b29
mov dword [ebp - 0x74], 4
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push str.NeedChAfRb
mov ecx, dword [0x75abd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420d47
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], esi
push str.NeedChAfRb
mov edx, dword [0x75abd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420d47
push str.NeedChAfRb
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x20]
push edx
push ebx
push ebx
push str.ClChIDMRes
mov eax, dword [0x75abd8]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x420b6f
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push str.ClChIERes
mov eax, dword [0x75abd8]
push eax
call edi
test eax, eax
jne 0x420b9b
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x420ba4
cmp ebx, 1
jne 0x420d47
mov edi, 1
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x30]
call fcn.004ff780
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x30]
call fcn.004ffa00
cmp esi, edi
jne 0x420bd9
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420bd9
xor edi, edi
mov dword [ebp - 0x48], edi
cmp ebx, 1
jne 0x420bed
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420bed
mov dword [ebp - 0x48], 0
jmp 0x420bf5
test edi, edi
jne 0x420ce7
push 0x50030
mov eax, dword [0x75bff8]
push eax
mov ecx, dword [0x75c008]
push ecx
push 0
call fcn.00472580
add esp, 0x10
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 4]
call fcn.0040ef90
mov dword [ebp - 0x18], 0
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.AdvancedIntegration
mov eax, dword [0x75abd8]
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov dword [edi + 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.004ff780
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x4c]
call fcn.004ffa00
mov eax, 1
mov dword [ebp - 0x48], eax
cmp esi, eax
jne 0x420c7c
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420c7c
xor eax, eax
mov dword [ebp - 0x48], eax
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x420c95
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420c95
mov dword [ebp - 0x48], 0
jmp 0x420c99
test eax, eax
jne 0x420cd6
mov dword [ebp - 0x18], esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.NeedSnRpAfRb
mov ecx, dword [0x75abd8]
push ecx
call ebx
push 0x50030
mov edx, dword [0x75bff8]
push edx
mov eax, dword [0x75c00c]
push eax
push 0
call fcn.00472580
add esp, 0x10
push esi
call fcn.00411660
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.004ff790
jmp 0x420d3b
push 0x50000
cmp dword [ebp - 0x2c], 1
jne 0x420d02
mov ecx, dword [0x75bff8]
push ecx
mov edx, dword [0x75c038]
push edx
jmp 0x420d0f
mov eax, dword [0x75bff8]
push eax
mov ecx, dword [0x75c010]
push ecx
push 0
call fcn.00472580
add esp, 0x10
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.AdvancedIntegration
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004ff790
cmp dword [ebp - 0x60], 0
jne 0x420d91
mov dword [ebp - 0x5c], 4
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x74]
push edx
push 0
push 0
push str.NeedSnRpAfRb
mov eax, dword [0x75abd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420db3
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
push str.NeedSnRpAfRb
mov ecx, dword [0x75abd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420db3
push 0
lea ecx, [ebp]
call fcn.0052c220
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.005f3511
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00415350
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.00410790
push 1
mov ecx, edi
call fcn.0041be80
mov ecx, edi
call fcn.00410560
xor ebx, ebx
test eax, eax
jne 0x420df5
push ebx
push ebx
call fcn.00417470
push ebx
push ebx
mov ecx, edi
call fcn.00417510
push ebx
push ebx
mov ecx, edi
call fcn.0041d2c0
push ebx
push ebx
mov ecx, edi
call fcn.004174d0
mov ecx, edi
cmp dword [edi + 0x1c], ebx
je 0x420e05
push 1
call fcn.004151f0
jmp 0x420e16
call fcn.00410e90
test eax, eax
jne 0x420e16
push ebx
mov ecx, edi
call fcn.0041f970
cmp dword [0x75abc8], ebx
je 0x420e25
mov ecx, edi
call fcn.0041f420
cmp dword [ebp - 0x34], ebx
je 0x421119
lea esi, [edi + 4]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.0040dba0
test eax, eax
je 0x420f87
cmp dword [ebp - 0x28], ebx
jne 0x420e60
mov ecx, esi
call fcn.0040ef90
mov dword [ebp - 0x44], 1
jmp 0x42111e
mov dword [ebp + 0xf6c], ebx
mov dword [ebp + 0xf74], ebx
xor ecx, ecx
mov word [ebp + 0xf70], cx
mov byte [ebp - 4], 8
mov eax, dword [0x75ac4c]
cmp eax, ebx
jne 0x420e87
mov eax, 0x75ac50
push ebx
push str.Uninstall.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xf6c]
call fcn.00402320
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420eae
lea eax, [ebp + 0xf70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420f78
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420ece
lea eax, [ebp + 0xf70]
push ebx
push eax
mov ecx, edi
call fcn.00416980
test al, al
je 0x420f78
push 0x3c
push ebx
lea edx, [ebp - 0x108]
push edx
call fcn.0061d9e0
add esp, 0xc
mov dword [ebp - 0x108], 0x3c
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420f1f
lea eax, [ebp + 0xf70]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], str._uninstlsp
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420f71
push 0xffffffffffffffff
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf6c]
call fcn.00401210
cmp dword [ebp - 0x28], ebx
je 0x421119
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x420fb5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420ff0
call fcn.004476c0
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
lea ecx, [ebp - 0x5c]
push ecx
push eax
push ebx
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x421119
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xf60], ebx
mov dword [ebp + 0xf68], ebx
xor eax, eax
mov word [ebp + 0xf64], ax
mov byte [ebp - 4], 9
mov eax, dword [0x75ac4c]
cmp eax, ebx
jne 0x421017
mov eax, 0x75ac50
push ebx
push str.Uninstall.exe
push eax
push 0x675de0
lea ecx, [ebp + 0xf60]
call fcn.00402320
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
jne 0x42103e
lea eax, [ebp + 0xf64]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42110a
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
jne 0x42105e
lea eax, [ebp + 0xf64]
push 1
push eax
mov ecx, edi
call fcn.00416980
test al, al
je 0x42110a
push 0x3c
push ebx
lea ecx, [ebp + 0x1388]
push ecx
call fcn.0061d9e0
add esp, 0xc
mov dword [ebp + 0x1388], 0x3c
mov dword [ebp + 0x138c], 0x40
mov dword [ebp + 0x1394], str.open
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
je 0x4210b2
mov dword [ebp + 0x1398], eax
jmp 0x4210be
lea edx, [ebp + 0xf64]
mov dword [ebp + 0x1398], edx
mov dword [ebp + 0x13a0], ebx
mov dword [ebp + 0x13a4], 3
mov dword [ebp + 0x13a8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp + 0x1390], eax
mov dword [ebp + 0x139c], str._uninsttdi
lea eax, [ebp + 0x1388]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42110a
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x13c0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf60]
call fcn.00401210
cmp dword [ebp - 0x44], ebx
je 0x421139
push 0x50030
mov edx, dword [0x75bfdc]
push edx
mov eax, dword [0x75c030]
push eax
push ebx
call fcn.00472580
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x13c4]
xor ecx, ebp
call fcn.0061d2ff
add ebp, 0x13c8
mov esp, ebp
pop ebp
ret