Function at 0x43a370
Capabilities:
Check if file exists
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7ee7
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x61d4d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x484], esi
call fcn.004085b0
mov ecx, eax
test ecx, ecx
je 0x43af0e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x490], edi
mov dword [ebp - 4], 0
mov dword [ebp - method.mf_bind_t_class_CInstaller__class_CInstaller___void_.virtual_0], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0x46c], 0x4399e0
mov dword [ebp - 0x468], esi
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 1
push eax
call fcn.00430490
add esp, 4
mov byte [ebp - 4], 0
call fcn.004325e0
mov esi, eax
call fcn.00432660
mov ecx, eax
call fcn.004327d0
mov ecx, dword [esi]
push dword [eax]
push esi
call dword [ecx + 0x24]
push eax
push str.install_type:_d__install_version:_s
call fcn.00435940
mov esi, dword [ebp - 0x484]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 0
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 2
push eax
call fcn.00430490
add esp, 0x10
mov byte [ebp - 4], 0
lea eax, [esi + 4]
mov dword [ebp - 0x480], eax
push eax
call fcn.00432660
mov ecx, eax
call fcn.004327e0
push eax
call fcn.004463c0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 2
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 3
push eax
call fcn.00430490
mov esi, dword [esi + 4]
lea ecx, [ebp - 0x474]
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.00446af0
push esi
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 4
call fcn.004470d0
lea ecx, [ebp - 0x474]
call fcn.004473e0
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 0
call fcn.00446c00
push str.remove_all_pending_files
call fcn.00435940
mov esi, dword [ebp - 0x484]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 3
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 5
push eax
call fcn.00430490
push str..tmp
push dword [esi + 4]
mov byte [ebp - 4], 0
call fcn.00408a80
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 4
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 6
push eax
call fcn.00430490
push dword [esi + 4]
mov byte [ebp - 4], 0
push str.remove_all_.tmp_files_in__s
call fcn.00435940
push str.update
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x48c]
push eax
call fcn.004210a0
push dword [eax]
mov byte [ebp - 4], 7
call fcn.00408130
mov edx, dword [ebp - 0x48c]
add esp, 0x2c
mov byte [ebp - 4], 0
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a5d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.update
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x48c]
push eax
call fcn.004210a0
push dword [eax]
mov byte [ebp - 4], 8
push str.Delete_directory_recursively:__s
call fcn.00435940
mov edx, dword [ebp - 0x48c]
add esp, 0x14
mov byte [ebp - 4], 0
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a61c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 5
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 9
push eax
call fcn.00430490
add esp, 4
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00438cb0
and eax, 1
mov dword [ebp - 0x48c], eax
jne 0x43a681
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0x490]
call fcn.00414760
mov edi, dword [ebp - 0x490]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 0x5d
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 0xa
push eax
call fcn.00430490
push dword [esi + 4]
mov byte [ebp - 4], 0
call fcn.00448420
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 0x60
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 0xb
push eax
call fcn.00430490
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.004325e0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x60]
call eax
test al, 1
je 0x43a728
call fcn.0041baf0
mov ecx, eax
call fcn.00419240
mov dword [ebp - 0x47c], 1
test eax, eax
je 0x43a732
mov dword [ebp - 0x47c], 0
call fcn.004325e0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x60]
call eax
test al, 2
je 0x43a759
call fcn.0041baf0
mov ecx, eax
call fcn.00419420
test eax, eax
jne 0x43a759
lea esi, [eax + 1]
jmp 0x43a75b
xor esi, esi
push 0
call fcn.0041baf0
mov ecx, eax
call fcn.00419700
neg eax
sbb eax, eax
inc eax
push eax
call fcn.0041baf0
mov ecx, eax
call fcn.00419520
neg eax
sbb eax, eax
inc eax
push eax
push esi
push dword [ebp - 0x47c]
push ecx
mov esi, esp
mov dword [ebp - 0x468], esi
mov eax, dword [ebp - 0x480]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00407ac0
add esp, 4
lea ecx, [ebp - 0x4a8]
add eax, 0x10
mov dword [esi], eax
call fcn.00433770
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 0xc
call fcn.00434320
mov esi, dword [ebp - 0x484]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 0x61
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 0xd
push eax
call fcn.00430490
add esp, 4
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x4a8]
call fcn.00433950
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 0x62
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 0xe
push eax
call fcn.00430490
add esp, 4
mov byte [ebp - 4], 0xc
mov ecx, esi
call fcn.004389c0
push 0x210
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.004fba30
add esp, 0xc
call fcn.004085b0
mov ecx, eax
test ecx, ecx
je 0x43af18
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x47c], eax
cmp dword [0x61ad24], 0
mov byte [ebp - 4], 0xf
je 0x43a981
push str.GetNativeSystemInfo
push 0x5ba340
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43a977
xorps xmm0, xmm0
mov dword [ebp - 0x444], 0
lea ecx, [ebp - 0x464]
push ecx
movups xmmword [ebp - 0x464], xmm0
movups xmmword [ebp - 0x454], xmm0
call eax
mov ax, word [ebp - 0x464]
cmp ax, 9
je 0x43a96d
cmp ax, 6
je 0x43a96d
cmp ax, 0xc
je 0x43a96d
push str.IsWow64Process2
push 0x5bafe4
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x488], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x468], eax
test eax, eax
je 0x43a964
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x468]
test eax, eax
je 0x43a964
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x488], cx
sete al
mov dword [0x622958], eax
jmp 0x43a977
xor eax, eax
mov dword [0x622958], eax
jmp 0x43a977
mov dword [0x622958], 1
mov dword [0x61ad24], 0
cmp dword [0x622958], 0
lea eax, [ebp - 0x428]
je 0x43a9a8
push str.UtilsTabXSDrv_x64.sys
push dword [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 8
push str.Pdrv_x64
jmp 0x43a9be
push str.UtilsTabXSDrv.sys
push dword [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 8
push str.Pdrv_x86
lea ecx, [ebp - 0x47c]
call fcn.00408d70
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43aaa2
push str.Create_Drivers
call fcn.00435940
add esp, 4
lea eax, [ebp - 0x428]
push 1
push eax
push str.TabXSDrvsfert
call fcn.00444de0
push str.TabXSDrvsfert
call fcn.00444e80
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x470], 0x4399f0
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x468], 0x63
lea eax, [ebp - 0x474]
mov byte [ebp - 4], 0x10
push eax
call fcn.00430490
add esp, 4
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.ldsComputerZ.set
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [ebp - 0x47c]
cmp dword [esi - 4], 1
jle 0x43aa88
push dword [esi - 0xc]
lea ecx, [ebp - 0x47c]
call fcn.00408500
mov esi, dword [ebp - 0x47c]
lea eax, [ebp - 0x218]
push eax
push str.TabXDrv
push str.TabX
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x43aaa8
mov esi, dword [ebp - 0x47c]
mov byte [ebp - 4], 0xc
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43aac4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x484]
mov ecx, esi
call fcn.0043b670
cmp dword [0x61b2f0], 0
je 0x43ab99
push str.ntdll.dll
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x488], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x468], eax
test eax, eax
je 0x43ab8f
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43ab59
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x47c]
push ecx
call eax
movzx eax, word [ebp - 0x484]
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x488], 1
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x488], 0
je 0x43ab8f
cmp dword [ebp - 0x47c], 6
jne 0x43ab8f
mov eax, dword [0x625488]
mov ecx, 1
cmp dword [ebp - 0x480], ecx
cmove eax, ecx
mov dword [0x625488], eax
mov dword [0x61b2f0], 0
cmp dword [0x625488], 0
je 0x43abe4
push 4
lea eax, [ebp - 0x468]
mov dword [ebp - 0x468], 0
push eax
push 4
push str.CertificateRevocation
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x43abd7
push str.Ban_Check_Certificate_suc
jmp 0x43abdc
push str.Ban_Check_Certificate_fail
call fcn.00435940
add esp, 4
push str.IsWow64Process2
push str.kernelbase.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x488], eax
test eax, eax
je 0x43ad18
lea eax, [ebp - 0x480]
mov dword [ebp - 0x468], 0
push eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x480], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x488]
test eax, eax
je 0x43ad18
mov eax, dword [ebp - 0x480]
mov ecx, 0xaa64
cmp ax, cx
je 0x43ac68
mov ecx, 0x1c0
cmp ax, cx
je 0x43ac68
mov ecx, 0x1c4
cmp ax, cx
jne 0x43ad18
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004fba30
add esp, 0xc
mov dword [ebp - 0x430], 0
xor eax, eax
mov dword [ebp - 0x42c], 7
lea ecx, [ebp - 0x440]
mov word [ebp - 0x440], ax
push 0xc
push str.TabXExplorer
call fcn.00413550
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.004108b0
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x43accf
mov eax, dword [eax]
push str.config.ini
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x458]
call fcn.0040f8f0
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 0xc
call fcn.0040f8f0
lea eax, [ebp - 0x218]
push eax
push 0x5c3824
push 0x5c3828
push str.settings
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.0041baf0
mov eax, dword [eax + 0x40]
sub eax, 0x10
push eax
call fcn.00407ac0
add esp, 4
add eax, 0x10
mov dword [ebp - 0x468], eax
mov ecx, str.__fromnewinstall
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43ad6e
test dx, dx
je 0x43ad62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43ad6e
add eax, 4
add ecx, 4
test dx, dx
jne 0x43ad40
mov dword [ebp - 0x480], 0
jmp 0x43ad79
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x480], ecx
mov edx, dword [ebp - 0x468]
or eax, 0xffffffff
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ad9b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x480], 0
jne 0x43ae07
call fcn.0041baf0
mov ecx, eax
call fcn.00419950
test al, al
je 0x43ae07
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004fba30
add esp, 0xc
lea eax, [ebp - 0x218]
push str.UtilsTabXHelper.exe
push dword [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.run_helper
call fcn.00435940
add esp, 4
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push 0
push 0
push 1
push 1
push 0x5ba374
push eax
call fcn.00431860
mov ecx, esi
call fcn.0043af90
test eax, eax
jne 0x43ae30
push 0x14
push str.write_path_reg_fail
lea ecx, [ebp - 0x490]
mov dword [ebp - 0x48c], eax
call fcn.00414760
mov edi, dword [ebp - 0x490]
push str.install_end.
call fcn.00435940
mov eax, dword [ebp - 0x48c]
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x474], 0x4399c0
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], edi
lea eax, [ebp - 0x478]
mov byte [ebp - 4], 0x13
push eax
call fcn.00430490
push str.real_install_end.
mov byte [ebp - 4], 0xc
call fcn.00435940
lea ecx, [esi + 0x78]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
add esp, 0xc
mov dword [ebp - 0x468], ecx
test ecx, ecx
je 0x43aea3
mov eax, dword [ecx]
push ecx
call dword [eax]
mov ecx, dword [esi + 0x68]
mov byte [ebp - 4], 0x14
test ecx, ecx
je 0x43aeb4
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0x15
test ecx, ecx
je 0x43aec5
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
lea ecx, [ebp - 0x4a8]
call fcn.00433900
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x43aeef
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f038
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00407960
push 0x80004005
call fcn.00407960
int3