Function at 0x409b50
Capabilities:
Create directory
Delete registry key
Get common file path
Get installed programs
Get program files directory
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4404f5
mov eax, dword fs:[0]
push eax
mov eax, 0x2330
call fcn.00429d90
mov eax, dword [0x45593c]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22f8], ecx
mov dword [ebp - 0x1854], 0
jmp 0x409ba0
mov eax, dword [ebp - 0x1854]
add eax, 1
mov dword [ebp - 0x1854], eax
cmp dword [ebp - 0x1854], 0x989680
jge 0x409baf
nop
jmp 0x409b91
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, dword [ebp - 0x22f8]
call fcn.004175c5
push 0
call fcn.0041867e
add esp, 4
mov ecx, dword [ebp - 0x22f8]
mov dword [ecx + 0xac], 0
lea edx, [ebp - 0x1c]
push edx
push 0xf003f
push 0
push str.SOFTWAREToolKitServiceOptions
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x240], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x238], 0
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push str.UILanguage
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0x64c], 0
push 0x1fc
push 0
lea edx, [ebp - 0x64a]
push edx
call fcn.00428e00
add esp, 0xc
mov word [ebp - 0x104c], 0
push 0x1fc
push 0
lea eax, [ebp - 0x104a]
push eax
call fcn.00428e00
add esp, 0xc
mov ecx, dword [0x456d80]
mov dword [ebp - 0x22fc], ecx
mov edx, dword [ebp - 0x22fc]
add edx, 2
mov dword [ebp - 0x2300], edx
mov eax, dword [ebp - 0x22fc]
mov cx, word [eax]
mov word [ebp - 0x2302], cx
add dword [ebp - 0x22fc], 2
cmp word [ebp - 0x2302], 0
jne 0x409c96
mov edx, dword [ebp - 0x22fc]
sub edx, dword [ebp - 0x2300]
sar edx, 1
mov dword [ebp - 0x2308], edx
cmp dword [ebp - 0x2308], 2
jbe 0x409ee8
lea ecx, [ebp - 0x1860]
call fcn.00409860
mov dword [ebp - 4], 0
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x64c]
push ecx
push 0x445454
mov edx, dword [0x456d80]
push edx
call fcn.004092b0
add esp, 0x10
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x2144]
call fcn.004047d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2144]
push ecx
lea ecx, [ebp - 0x1860]
call fcn.00409b10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2144]
call fcn.00402ec0
lea edx, [ebp - 0x104c]
mov dword [ebp - 0x230c], edx
mov eax, dword [ebp - 0x230c]
add eax, 2
mov dword [ebp - 0x2310], eax
mov ecx, dword [ebp - 0x230c]
mov dx, word [ecx]
mov word [ebp - 0x2312], dx
add dword [ebp - 0x230c], 2
cmp word [ebp - 0x2312], 0
jne 0x409d5e
mov eax, dword [ebp - 0x230c]
sub eax, dword [ebp - 0x2310]
sar eax, 1
mov dword [ebp - 0x2318], eax
cmp dword [ebp - 0x2318], 2
jbe 0x409dfa
lea ecx, [ebp - 0x104c]
push ecx
lea edx, [ebp - 0x64c]
push edx
push 0x445454
lea eax, [ebp - 0x104c]
push eax
call fcn.004092b0
add esp, 0x10
lea ecx, [ebp - 0x64c]
push ecx
lea ecx, [ebp - 0x2148]
call fcn.004047d0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2148]
push edx
lea ecx, [ebp - 0x1860]
call fcn.00409b10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2148]
call fcn.00402ec0
jmp 0x409d43
lea eax, [ebp - 0x2150]
push eax
lea ecx, [ebp - 0x1860]
call fcn.00409830
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1868], ecx
mov dword [ebp - 0x1864], edx
jmp 0x409e33
push 0
lea eax, [ebp - 0x2158]
push eax
lea ecx, [ebp - 0x1868]
call fcn.00409790
lea ecx, [ebp - 0x2160]
push ecx
lea ecx, [ebp - 0x1860]
call fcn.00409850
push eax
lea ecx, [ebp - 0x1868]
call fcn.004097d0
movzx edx, al
test edx, edx
je 0x409ed6
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x64c]
push ecx
push 0x4438fc
lea ecx, [ebp - 0x1868]
call fcn.00409760
mov ecx, eax
call fcn.00401180
push eax
call fcn.004092b0
add esp, 0x10
lea edx, [ebp - 0x64c]
push edx
lea ecx, [ebp - 0x2164]
call fcn.004047d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebp - 0x2164]
push ecx
mov ecx, dword [ebp - 0x22f8]
add ecx, 0x8b0
call fcn.00408510
mov ecx, eax
call fcn.00404060
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2164]
call fcn.00402ec0
jmp 0x409e1f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1860]
call fcn.00409af0
cmp dword [ebp - 0x238], 0
jne 0x409f88
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx edx, ax
and edx, 0x3ff
mov dword [ebp - 0x231c], edx
mov eax, dword [ebp - 0x231c]
sub eax, 7
mov dword [ebp - 0x231c], eax
cmp dword [ebp - 0x231c], 0x12
ja case.0x409f2f.1
mov ecx, dword [ebp - 0x231c]
movzx edx, byte [ecx + 0x40a5dc]
jmp dword [edx*4 + 0x40a5c0]
mov dword [ebp - 0x238], 6
jmp 0x409f88
mov dword [ebp - 0x238], 5
jmp 0x409f88
mov dword [ebp - 0x238], 4
jmp 0x409f88
mov dword [ebp - 0x238], 3
jmp 0x409f88
mov dword [ebp - 0x238], 2
jmp 0x409f88
mov dword [ebp - 0x238], 1
jmp 0x409f88
mov dword [ebp - 0x238], 0
push str.lang
lea ecx, [ebp - 0x216c]
call fcn.004047d0
mov dword [ebp - 4], 4
lea eax, [ebp - 0x216c]
push eax
mov ecx, dword [ebp - 0x22f8]
add ecx, 0x8b0
call fcn.00408510
mov ecx, eax
call fcn.00409800
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x2165], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x216c]
call fcn.00402ec0
movzx edx, byte [ebp - 0x2165]
test edx, edx
je 0x40a042
push str.lang
lea ecx, [ebp - 0x2170]
call fcn.004047d0
mov dword [ebp - 4], 5
lea eax, [ebp - 0x2170]
push eax
mov ecx, dword [ebp - 0x22f8]
add ecx, 0x8b0
call fcn.00408510
mov ecx, eax
call fcn.00401180
push eax
call fcn.0042a73d
add esp, 4
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2170]
call fcn.00402ec0
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x22f8]
call fcn.004095c0
call fcn.00401dd0
mov dword [ebp - 0x448], eax
push 0x445440
mov edx, dword [0x456d80]
push edx
call fcn.00401cf0
add esp, 8
test eax, eax
je 0x40a1d4
lea ecx, [ebp - 0x186c]
call fcn.00401680
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x1870]
call fcn.00401680
mov byte [ebp - 4], 7
push 0x197
lea ecx, [ebp - 0x186c]
call fcn.00403990
push 0x24
push 0x444e90
lea ecx, [ebp - 0x186c]
call fcn.00401180
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40a19e
lea ecx, [ebp - 0x1875]
call fcn.0040b5e0
mov byte [ebp - 4], 8
push 0
lea ecx, [ebp - 0x1875]
call fcn.0040b8e0
mov dword [ebp - 0x1874], eax
cmp dword [ebp - 0x1874], 1
jne 0x40a154
push 0x10
push 0x444e90
push str.WARNING__neToolKit_was_installed_by_another_user._nPlease_change_the_user_to_uninstall_this_software.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x2174], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1875]
call fcn.00401070
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1870]
call fcn.00402ec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x186c]
call fcn.00402ec0
mov eax, dword [ebp - 0x2174]
jmp 0x40a5a5
push 0x198
lea ecx, [ebp - 0x1870]
call fcn.00403990
push 0x40
push 0x444e90
lea ecx, [ebp - 0x1870]
call fcn.00401180
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalleToolKit
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1875]
call fcn.00401070
mov dword [ebp - 0x2178], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1870]
call fcn.00402ec0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x186c]
call fcn.00402ec0
mov eax, dword [ebp - 0x2178]
jmp 0x40a5a5
mov eax, dword [ebp - 0x22f8]
mov dword [eax + 0x20], 0
push 0
push 0x26
lea ecx, [ebp - 0x444]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0x444]
push edx
push str._sToolKitService
lea eax, [ebp - 0x184c]
push eax
call fcn.004299c4
add esp, 0xc
lea ecx, [ebp - 0x184c]
mov dword [ebp - 0x2320], ecx
lea edx, [ebp - 0xe4c]
mov dword [ebp - 0x2324], edx
mov eax, dword [ebp - 0x2324]
mov dword [ebp - 0x2328], eax
mov ecx, dword [ebp - 0x2320]
mov dx, word [ecx]
mov word [ebp - 0x232a], dx
mov eax, dword [ebp - 0x2324]
mov cx, word [ebp - 0x232a]
mov word [eax], cx
mov edx, dword [ebp - 0x2320]
add edx, 2
mov dword [ebp - 0x2320], edx
mov eax, dword [ebp - 0x2324]
add eax, 2
mov dword [ebp - 0x2324], eax
cmp word [ebp - 0x232a], 0
jne 0x40a233
push 0
lea ecx, [ebp - 0x184c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0xe4c]
push edx
push str._sinstall_log.txt
lea eax, [ebp - 0x234]
push eax
call fcn.004299c4
add esp, 0xc
lea ecx, [ebp - 0x234]
push ecx
call fcn.00409990
add esp, 4
push 0
push str.eToolKit_Installer_lauched_n
call fcn.004028d0
add esp, 8
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 1
push str.setstartpage
lea ecx, [ebp - 0x2180]
call fcn.004047d0
mov dword [ebp - 4], 9
lea edx, [ebp - 0x2180]
push edx
mov ecx, dword [ebp - 0x22f8]
add ecx, 0x8b0
call fcn.00408510
mov ecx, eax
call fcn.00409800
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x2179], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2180]
call fcn.00402ec0
movzx ecx, byte [ebp - 0x2179]
test ecx, ecx
je 0x40a38a
push str.setstartpage
lea ecx, [ebp - 0x2184]
call fcn.004047d0
mov dword [ebp - 4], 0xa
push 0x4448fc
lea edx, [ebp - 0x2184]
push edx
mov ecx, dword [ebp - 0x22f8]
add ecx, 0x8b0
call fcn.00408510
mov ecx, eax
call fcn.00402ce0
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2184]
call fcn.00402ec0
push str.setstartpage
lea ecx, [ebp - 0x218c]
call fcn.004047d0
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x218c]
push eax
mov ecx, dword [ebp - 0x22f8]
add ecx, 0x8b0
call fcn.00408510
mov ecx, eax
call fcn.00409800
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x2185], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218c]
call fcn.00402ec0
movzx edx, byte [ebp - 0x2185]
test edx, edx
je 0x40a3f6
mov dword [ebp - 0x20], 4
jmp 0x40a3fd
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0
je 0x40a51e
cmp dword [ebp - 0x20], 1
jne 0x40a4cd
push 0
lea ecx, [ebp - 0x1da4]
call fcn.0040a7d0
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x184c]
mov dword [ebp - 0x2330], eax
lea ecx, [ebp - 0x1a84]
mov dword [ebp - 0x2334], ecx
mov edx, dword [ebp - 0x2334]
mov dword [ebp - 0x2338], edx
mov eax, dword [ebp - 0x2330]
mov cx, word [eax]
mov word [ebp - 0x233a], cx
mov edx, dword [ebp - 0x2334]
mov ax, word [ebp - 0x233a]
mov word [edx], ax
mov ecx, dword [ebp - 0x2330]
add ecx, 2
mov dword [ebp - 0x2330], ecx
mov edx, dword [ebp - 0x2334]
add edx, 2
mov dword [ebp - 0x2334], edx
cmp word [ebp - 0x233a], 0
jne 0x40a449
lea ecx, [ebp - 0x1da4]
call fcn.004142ad
mov dword [ebp - 0x20], eax
movzx eax, byte [ebp - 0x1d2c]
mov dword [ebp - 0x24], eax
movzx ecx, byte [ebp - 0x1d2b]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x20], 0x63
je 0x40a491
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1da4]
call fcn.00409680
jmp 0x40a519
cmp dword [ebp - 0x20], 4
jne 0x40a519
push 0
lea ecx, [ebp - 0x213c]
call fcn.004029a0
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1f58], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1f54], eax
lea ecx, [ebp - 0x213c]
call fcn.004142ad
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x213c]
call fcn.00402b10
jmp 0x40a3fd
mov ecx, dword [ebp - 0x22f8]
add ecx, 0xa8
call fcn.004014e0
cmp eax, 3
jle 0x40a58f
lea ecx, [ebp - 0x2140]
call fcn.00401680
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x22f8]
mov edx, dword [ecx + 0xa8]
push edx
push str.Installation_was_aborted__Reason:__s_n
lea eax, [ebp - 0x2140]
push eax
call fcn.00403a40
add esp, 0xc
push 0
lea ecx, [ebp - 0x2140]
call fcn.00401180
push eax
call fcn.004028d0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2140]
call fcn.00402ec0
call fcn.00404a60
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.0042a6a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00428dec
mov esp, ebp
pop ebp
ret