Function at 0x40c820
Capabilities:
Get common file path
Get disk size
Get program files directory
Get session user name
Get token membership
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a8e2
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x5e3fe4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004172b0
push dword [edi + 0x18d0]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [edi + 0x20]
call ebx
push dword [edi + 0x18d0]
push 0
push 0x80
push dword [edi + 0x20]
call ebx
push 0x104
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea eax, [ebp - 0x230]
push eax
push 0
push 0xf003f
push 1
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40c8f3
push 4
lea eax, [ebp - 0x228]
push eax
push 4
push 0
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x14
call fcn.00414c96
add esp, 4
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x40c917
mov ecx, eax
call fcn.00424a74
jmp 0x40c919
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 0x1894]
mov dword [edi + 0x1894], eax
test ecx, ecx
je 0x40c937
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x14
call fcn.00414c96
add esp, 4
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x40c95b
mov ecx, eax
call fcn.00424a74
jmp 0x40c95d
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 0x1898]
mov dword [edi + 0x1898], eax
test ecx, ecx
je 0x40c97b
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x308
call fcn.00414c96
mov esi, eax
add esp, 4
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x40c9ac
push 0x100
lea ecx, [esi + 0x208]
push 0
push ecx
call fcn.005515b0
add esp, 0xc
jmp 0x40c9ae
xor esi, esi
mov eax, dword [edi + 0xd4]
mov dword [edi + 0xd4], esi
test eax, eax
je 0x40c9c4
push eax
call fcn.0040c030
push 0x1a14
call fcn.00414c96
mov ebx, eax
add esp, 4
mov dword [ebp - 0x22c], ebx
test ebx, ebx
je 0x40cb11
mov eax, dword [0x5ed3e8]
mov ecx, dword [edi + 0x20]
mov dword [ebp - 0x22c], eax
mov eax, 0x400
mov dword [ebx], ecx
lea ecx, [ebx + 0x1214]
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x40ca00
push 0x1000
push eax
lea esi, [ebx + 0x20c]
push esi
call fcn.005515b0
lea eax, [ebx + 0xf0c]
mov edx, str.companyID
push 0x80
push eax
mov ecx, 0x5c5a30
call fcn.00402650
lea eax, [ebx + 0x30c]
mov edx, str.queryURL
push 0x200
push eax
mov ecx, 0x5c5a30
call fcn.00402650
lea eax, [ebx + 0xb0c]
mov edx, str.samlURL
push 0x200
push eax
mov ecx, 0x5c5a30
call fcn.00402650
push 0x80
push esi
mov edx, str.serverName
mov ecx, 0x5c5a30
call fcn.00402650
lea eax, [ebx + 0x70c]
mov edx, str.securityURL
push 0x200
push eax
mov ecx, 0x5c5a30
call fcn.00402650
lea eax, [ebx + 0x100c]
mov edx, str.timeOut
push 0x80
push eax
mov ecx, 0x5c5a30
call fcn.00402650
lea eax, [ebx + 0x110c]
mov edx, str.overwrite
push 0x80
push eax
mov ecx, 0x5c5a30
call fcn.00402650
mov ecx, dword [ebp - 0x22c]
add esp, 0x44
mov eax, 0x23
test cl, 1
je 0x40caf5
and cl, 3
mov edx, 2
cmp cl, 3
cmovne eax, edx
push 0
push eax
call dword [sym.imp.msi.dll_MsiSetPropertyW]
push ebx
push 0x87
push 0x413f30
call dword [sym.imp.msi.dll_MsiSetInternalUI]
jmp 0x40cb13
xor ebx, ebx
mov eax, dword [edi + 0xd0]
mov dword [edi + 0xd0], ebx
test eax, eax
je 0x40cb31
push 0x1a14
push eax
call fcn.0054e5df
add esp, 8
push 8
call fcn.00414c96
mov esi, eax
add esp, 4
mov dword [ebp - 0x238], esi
test esi, esi
je 0x40cb56
mov dword [esi + 4], 0
mov dword [esi], vtable.CFont.0
jmp 0x40cb58
xor esi, esi
push 0
push str.Arial_Bold
push 0x60
mov ecx, esi
call fcn.00424faf
mov ecx, dword [edi + 0xdc]
mov dword [edi + 0xdc], esi
test ecx, ecx
je 0x40cb7f
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 8
call fcn.00414c96
mov esi, eax
add esp, 4
mov dword [ebp - 0x238], esi
test esi, esi
je 0x40cba4
mov dword [esi + 4], 0
mov dword [esi], vtable.CFont.0
jmp 0x40cba6
xor esi, esi
push 0
push str.Arial
push 0x56
mov ecx, esi
call fcn.00424faf
mov ecx, dword [edi + 0xe0]
mov dword [edi + 0xe0], esi
test ecx, ecx
je 0x40cbcd
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, edi
call fcn.0040ff00
mov ecx, edi
call fcn.00410450
lea eax, [edi + 0xedc]
xor edx, edx
lea ecx, [edi + 0xee0]
mov dword [eax], 0
mov word [ecx], dx
push dword [edi + 0x1898]
push eax
push ecx
push dword [edi + 0x1894]
push dword [edi + 0xed8]
call fcn.00414480
push 0x200
lea eax, [edi + 0xcd8]
mov dword [ebp - 0x224], 0
push 0
push eax
mov word [ebp - 0x220], 0x500
call fcn.005515b0
add esp, 0xc
mov dword [edi + 0xed8], 2
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40cd69
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x228]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x40cc9b
cmp dword [ebp - 0x230], 0
je 0x40cc9b
mov dword [edi + 0xed8], 1
push dword [ebp - 0x228]
mov ebx, dword [sym.imp.ADVAPI32.dll_FreeSid]
call ebx
test byte [edi + 0xed8], 1
je 0x40ccd0
push 0
push 0
push ecx
push 0
push 0
mov ecx, edi
call fcn.004112f0
push 1
mov ecx, edi
call fcn.0040e1a0
jmp 0x40cd69
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x80
push eax
lea esi, [edi + 0xdd8]
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
nop
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [esi - 0x102], ax
test ax, ax
jne 0x40ccf0
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40cd69
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x228]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x40cd51
cmp dword [ebp - 0x230], 0
jne 0x40cd61
or dword [edi + 0xed8], 0x10
mov ecx, edi
push 2
call fcn.0040e1a0
push dword [ebp - 0x228]
call ebx
mov ecx, edi
call fcn.0040d920
mov eax, dword [edi + 0xd0]
xor ecx, ecx
push str.Welcome_to_ZEMA_DataDirect_Excel_Add_in__V__T
mov word [eax + 0x1214], cx
mov ecx, edi
call fcn.00410860
mov esi, eax
call fcn.0041678c
mov ecx, eax
test ecx, ecx
je 0x40d38a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
push esi
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 2
call fcn.00406f80
test al, al
jne 0x40cdec
test esi, esi
jne 0x40cdc9
xor ecx, ecx
jmp 0x40cddf
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cdd0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x228]
call fcn.00407390
push 0x5c3120
push 0x5c48a0
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 3
call fcn.00412cb0
mov eax, dword [ebp - 0x228]
cmp dword [eax - 4], 1
jle 0x40ce28
push dword [eax - 0xc]
lea ecx, [ebp - 0x228]
call fcn.004070d0
mov eax, dword [ebp - 0x228]
lea esi, [edi + 0x1010]
mov edx, eax
mov ebx, esi
sub ebx, eax
movzx ecx, word [edx]
lea edx, [edx + 2]
mov word [edx + ebx - 2], cx
test cx, cx
jne 0x40ce34
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ce63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [esi - 0x3fa], ax
test ax, ax
jne 0x40ce63
push 0xa0
call fcn.00414c96
add esp, 4
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x40ce9e
mov ecx, eax
call fcn.00425566
mov ecx, eax
jmp 0x40cea0
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x18cc], ecx
mov eax, dword [ecx]
push 0
push edi
call dword [eax + 0x164]
test eax, eax
je 0x40cf96
push 0
push 0
push str.Show_release_notes
push 0x3ec
mov ecx, edi
call fcn.004245ad
mov ecx, dword [edi + 0x18cc]
push eax
call fcn.0042569a
push 0
push 0
push str.Curve_Validation_API
push 0x3ef
mov ecx, edi
call fcn.004245ad
mov ecx, dword [edi + 0x18cc]
push eax
call fcn.0042569a
push 0
push 0
push str.Ribbon.
push 0x3f0
mov ecx, edi
call fcn.004245ad
mov ecx, dword [edi + 0x18cc]
push eax
call fcn.0042569a
push 0
push 0
push str.Formulas
push 0x3fe
mov ecx, edi
call fcn.004245ad
mov ecx, dword [edi + 0x18cc]
push eax
call fcn.0042569a
push 0
push 0
push str.The_installation_fails_with_error_1602_etc
push 0x402
mov ecx, edi
call fcn.004245ad
mov ecx, dword [edi + 0x18cc]
push eax
call fcn.0042569a
mov eax, dword [edi + 0x18cc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x401
push dword [eax + 0x20]
call esi
mov eax, dword [edi + 0x18cc]
push 0
push 0xccccff
push 0x413
push dword [eax + 0x20]
call esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [edi + 0x18ac]
push eax
push dword [edi + 0x20]
mov byte [edi + 0x18a8], 0
call esi
push 0x3ec
mov ecx, edi
call fcn.004245ad
lea ecx, [edi + 0x18bc]
push ecx
push dword [eax + 0x20]
call esi
mov ecx, edi
call fcn.00410990
mov ecx, edi
mov byte [edi + 0x18a8], 1
call fcn.00410a70
mov esi, eax
test esi, esi
je 0x40d004
push esi
push 0x3ed
mov ecx, edi
call fcn.004245ad
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push esi
call fcn.0054e5df
add esp, 8
push 1
push 0x5c4908
mov ecx, edi
call fcn.00410860
push eax
mov ecx, edi
call fcn.0040e880
mov ecx, edi
call fcn.0040e250
push 0
push 0x82
push 0x404
mov ecx, edi
call fcn.0040e0a0
push 0
push 0x81
push 2
mov ecx, edi
call fcn.0040e0a0
push 0
push 0x83
push 3
mov ecx, edi
call fcn.0040e0a0
push 1
push 0x84
push 0x405
mov ecx, edi
call fcn.0040e0a0
push 1
push 0x84
push 0x406
mov ecx, edi
call fcn.0040e0a0
push 1
push 0x84
push 0x407
mov ecx, edi
call fcn.0040e0a0
mov eax, dword [0x5ed3e8]
mov ecx, edi
and eax, 0x10
or eax, 8
shr eax, 3
push eax
call fcn.00412430
mov ecx, edi
call fcn.00411a90
xor eax, eax
mov ecx, edi
cmp byte [edi + 0x18a8], al
push 1
sete al
add eax, 0x86
push eax
push 0x3ec
call fcn.0040e0a0
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push edi
push 0x3ec
push 0x3ec
mov ecx, edi
mov dword [edi + 0xe4], eax
call fcn.004245ad
mov ecx, eax
call fcn.00422463
push edi
push 0x405
push 0x405
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.00422463
push edi
push 0x406
push 0x406
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.00422463
push edi
push 0x407
push 0x407
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.00422463
call fcn.00407b70
test al, al
je 0x40d2d1
cmp word [0x5ed3b8], 0
je 0x40d2d1
mov al, byte [edi + 0xed8]
mov ecx, 0x2a
and al, 1
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
mov eax, 0x1c
cmovne eax, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40d2d1
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40d2d1
push 0
push 0x400
push dword [ebp - 0x23c]
push dword [ebp - 0x240]
call fcn.0054eae0
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], edx
test edx, edx
jl 0x40d2d1
jg 0x40d1ef
cmp eax, 0x6978
jbe 0x40d2d1
test byte [edi + 0xedc], 0x20
je 0x40d23a
test byte [edi + 0xed8], 2
jne 0x40d23a
push 0
push 0x404
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
push 0
push 3
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
push 0
push 2
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
cmp word [edi + 0xee0], 0
jne 0x40d256
push 0
push 3
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
test byte [0x5ed3e8], 1
je 0x40d276
push 0
push 0
push 0x402
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40d36c
mov edx, dword [edi + 0xed8]
test dl, 0x10
jne 0x40d2ae
mov esi, dword [edi + 0xedc]
xor ecx, ecx
cmp esi, 2
mov eax, edx
sete cl
shr eax, 1
and eax, 1
cmp eax, ecx
je 0x40d29f
cmp esi, 0x20
jne 0x40d2ae
xor eax, eax
cmp esi, 1
sete al
and edx, 1
cmp eax, edx
je 0x40d2c0
push 0
push 0
push 0x403
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, edi
call fcn.0040d3a0
mov eax, 1
jmp 0x40d36e
test byte [0x5ed3e8], 1
push 0
je 0x40d2f1
push 1
push 0x402
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40d36c
push 0x404
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
push 0
push 3
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
push 0
push 2
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.0042453f
push 0
push 0x3ea
mov ecx, edi
call fcn.004245ad
mov ecx, eax
call fcn.00424a1d
call fcn.00407b70
test al, al
jne 0x40d34d
mov eax, str..Net_Framework_4.6_32_bit_not_found.
jmp 0x40d362
cmp word [0x5ed3b8], 0
mov eax, str.Excel_not_found.
mov ecx, str.Not_enough_free_disk_space.
cmovne eax, ecx
push 2
push eax
mov ecx, edi
call fcn.0040e880
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054e183
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407340
int3