Function at 0x407d82
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
or dword [0x42d3d4], 0xffffffff
push ebx
xor ebx, ebx
push 0x18
push ebx
push 0x42d3e0
mov dword [0x42d374], eax
mov dword [0x42d3fc], ebx
mov dword [0x42d528], ebx
mov byte [0x42d100], bl
mov dword [0x42d368], ebx
mov dword [0x42d388], ebx
mov byte [0x42d9a0], bl
mov dword [0x42d6c0], ebx
mov dword [0x42d800], ebx
call fcn.0040e8e0
push 0x30
push ebx
push 0x42d3a0
call fcn.0040e8e0
add esp, 0x18
push 0x42d384
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, 0x80004005
jne 0x407dfe
or eax, 0xffffffff
jmp 0x40806f
mov eax, dword [ebp + 0x10]
push esi
push edi
cmp byte [eax], bl
je 0x407f4d
xor eax, eax
inc eax
mov dword [ebp + 8], eax
cmp dword [0x42c47c], eax
jle 0x407f4d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov eax, dword [0x42c480]
mov ecx, dword [ebp + 8]
mov esi, dword [eax + ecx*4]
mov al, byte [esi]
cmp al, 0x2d
je 0x407e38
cmp al, 0x2f
jne 0x407e39
inc esi
push str.silent
push esi
call edi
test eax, eax
jne 0x407e54
mov dword [0x42d3fc], 1
jmp 0x407f3b
push 6
push str.sernum
push esi
call fcn.0041ea02
add esp, 0xc
test eax, eax
jne 0x407e92
mov al, byte [esi + 6]
cmp al, 0x3d
je 0x407e77
cmp al, 0x3a
jne 0x407f3b
add esi, 7
cmp byte [esi], bl
je 0x407f3b
push esi
call fcn.0040ecd7
mov dword [0x42d528], eax
jmp 0x407f3a
push 8
push str.instpath
push esi
call fcn.0041ea02
add esp, 0xc
test eax, eax
jne 0x407ec4
mov al, byte [esi + 8]
cmp al, 0x3d
je 0x407eb5
cmp al, 0x3a
jne 0x407f3b
add esi, 9
cmp byte [esi], bl
je 0x407f3b
push esi
push 0x42d100
jmp 0x407f34
push str.uninstall
push esi
call edi
test eax, eax
jne 0x407ed8
mov dword [0x42d3d4], ebx
jmp 0x407f3b
push str.uninstallnr
push esi
call edi
test eax, eax
jne 0x407ef0
mov dword [0x42d3d4], 1
jmp 0x407f3b
push str.allusers
push esi
call edi
test eax, eax
jne 0x407f08
mov dword [0x42d388], 1
jmp 0x407f3b
push 0xa
push str.components
push esi
call fcn.0041ea02
add esp, 0xc
test eax, eax
jne 0x407f3b
mov al, byte [esi + 0xa]
cmp al, 0x3d
je 0x407f27
cmp al, 0x3a
jne 0x407f3b
add esi, 0xb
cmp byte [esi], bl
je 0x407f3b
push esi
push 0x42d9a0
call fcn.0040e750
pop ecx
pop ecx
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [0x42c47c]
jl 0x407e23
call fcn.00407bc3
test eax, eax
jne 0x407fba
push 4
push 0x423338
push ebx
call fcn.00406fca
add esp, 0xc
cmp eax, 6
jne 0x407fba
cmp dword [0x42d3fc], ebx
je 0x40806d
mov edi, str.You_do_not_have_administrator_rights._There_can_be_problems_when_installing.
push edi
call fcn.0040e850
pop ecx
lea esi, [eax + 1]
mov eax, dword [0x42c480]
push dword [eax]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push edi
push ebx
push esi
push ebx
push ebx
push 0x659
push 0xf
push 1
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40806d
push ebx
cmp dword [0x42d3d4], ebx
jl 0x40800f
push 0x42d3e0
call fcn.004047e7
pop ecx
pop ecx
test eax, eax
je 0x407fdd
mov dword [0x42d23c], 2
push dword [0x42d3d4]
call fcn.00409579
pop ecx
cmp eax, 0xffffffff
je 0x408056
cmp eax, ebx
mov eax, 0x423278
jne 0x407ffc
mov eax, 0x423258
push ebx
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00406fca
add esp, 0xc
jmp 0x408056
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x407666
call esi
mov edi, dword [sym.imp.USER32.dll_DialogBoxParamA]
push eax
push 0x65
push dword [0x42d374]
call edi
test eax, eax
je 0x408056
push ebx
push 0x4078ad
call esi
push eax
push 0x67
push dword [0x42d374]
call edi
cmp dword [0x42d3c4], ebx
je 0x408051
call fcn.004083af
call fcn.00407267
mov eax, dword [0x42d384]
cmp eax, ebx
je 0x40806b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x42d384], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10