Function at 0x425fe0
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get installed programs
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54cdd4
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x60c9c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0xe4bc]
xor esi, esi
mov edi, 1
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebx + 0xc], edi
cmp eax, esi
je 0x426035
cmp eax, 5
jne 0x426038
mov dword [ebx + 0xc], esi
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [ebx + 0xd870], ecx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0xd86c], eax
mov dword [ebx + 0x12c], esi
mov dword [ebx + 0x130], esi
mov dword [ebx + 0x134], esi
mov dword [ebx + 0x14c], esi
mov dword [ebx + 0x144], esi
mov dword [ebx + 0x148], esi
mov dword [ebx + 0x154], esi
mov dword [ebx + 0x150], esi
mov dword [ebx + 0x140], esi
mov dword [ebx + 0x138], esi
cmp ecx, esi
jne 0x4260ac
mov ecx, ebx
call fcn.0041b570
cmp eax, 0xbc2
je 0x4269f2
cmp eax, esi
je 0x4269f8
jmp 0x427b25
cmp ecx, 2
jne 0x4269d1
jmp 0x4260c0
mov ebx, dword [ebp - 0x224]
lea ecx, [ebx + 0x158]
call fcn.004098a0
test eax, eax
je 0x4263e5
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebx + 0x158]
call fcn.004162d0
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 4], 1
mov dword [ebp - 4], 0
jle 0x426107
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, esi
call fcn.00402d60
mov esi, dword [esi]
push esi
lea ecx, [ebx + 0x158]
call fcn.0040a1e0
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42613e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42737c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebx + 0x158]
mov dword [ebp - 4], 1
call fcn.0040e680
mov edx, dword [ebp - 0x230]
cmp dword [edx - 0xc], 0
mov byte [ebp - 4], 2
jne 0x4261cb
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebx + 0x158]
call fcn.0040c520
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call fcn.004034d0
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x426219
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebx + 0x158]
call fcn.0040c520
mov edx, dword [ebp - 0x230]
mov eax, dword [eax]
push edx
push eax
lea ecx, [ebp - 0x21c]
push 0x55d250
push ecx
mov byte [ebp - 4], 4
call fcn.004047a0
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
add esp, 0x10
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426225
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebx + 0x148], 0
jne 0x426260
push 0xb8
call fcn.00432a1f
add esp, 4
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x426254
push 0
mov ecx, eax
call fcn.00404960
jmp 0x426256
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebx + 0x148], eax
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebx + 0x158]
call fcn.0040deb0
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebx + 0x158]
mov byte [ebp - 4], 6
call fcn.0041af60
mov eax, dword [ebp - 0x228]
push 0
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x24c], esp
mov esi, esp
push eax
mov byte [ebp - 4], 7
call fcn.00402f60
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
mov dword [ebp - 0x234], esp
mov esi, esp
push eax
mov byte [ebp - 4], 8
call fcn.00402f60
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
mov dword [ebp - 0x258], esp
mov esi, esp
push eax
mov byte [ebp - 4], 9
call fcn.00402f60
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebx + 0x148]
add esp, 4
call fcn.00404c10
test eax, eax
jne 0x42683d
mov ecx, dword [ebx + 0x148]
mov eax, dword [ecx]
mov edx, dword [eax + 0x170]
call edx
cmp eax, 2
je 0x426898
lea ecx, [ebp - 0x230]
call fcn.00402e90
lea ecx, [ebp - 0x21c]
call fcn.00402e90
lea ecx, [ebp - 0x228]
call fcn.00402e90
lea ecx, [ebp - 0x228]
call fcn.00402e90
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426370
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426396
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4263bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4263e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebx + 0x158]
call fcn.0040b240
test eax, eax
je 0x4269ab
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42737c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0xa
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42737c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x26c]
push ecx
lea ecx, [ebx + 0x158]
mov byte [ebp - 4], 0xb
call fcn.00411fc0
mov ecx, dword [eax]
mov esi, dword [ebp - 0x21c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 0xc
cmp eax, esi
je 0x4264cc
cmp dword [esi + 0xc], 0
jl 0x4264bc
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4264bc
push eax
call fcn.00402f60
mov dword [ebp - 0x24c], eax
add esp, 4
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4264ab
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x24c]
add ecx, 0x10
mov dword [ebp - 0x21c], ecx
jmp 0x4264cc
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00403290
mov eax, dword [ebp - 0x26c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4264f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x21c]
cmp dword [esi - 0xc], 0
jne 0x42653c
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebx + 0x158]
call fcn.0040c520
push eax
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0xd
call fcn.004034d0
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x426584
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebx + 0x158]
call fcn.0040c520
mov edx, dword [eax]
push esi
push edx
lea eax, [ebp - 0x234]
push 0x55d250
push eax
mov byte [ebp - 4], 0xe
call fcn.004047a0
mov eax, dword [ebp - 0x254]
add eax, 0xfffffff0
add esp, 0x10
mov byte [ebp - 4], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426590
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebx + 0x14c], 0
jne 0x4265cb
push 0xb8
call fcn.00432a1f
add esp, 4
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4265bf
push 0
mov ecx, eax
call fcn.00404960
jmp 0x4265c1
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebx + 0x14c], eax
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebx + 0x158]
call fcn.0040deb0
push 0x409
mov byte [ebp - 4], 0x10
call fcn.004084e0
add esp, 4
push eax
lea ecx, [ebp - 0x244]
call fcn.00405b90
mov esi, dword [ebp - 0x244]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x258], esp
mov ebx, esp
call eax
cmp dword [esi - 4], 0
lea edx, [esi - 4]
jl 0x426633
cmp eax, dword [esi - 0x10]
jne 0x426633
lea edi, [esi - 0x10]
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x42666b
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4268ce
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.00532e6b
add esp, 0x10
add edi, 0x10
mov dword [ebx], edi
mov edi, dword [ebp - 0x234]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x240], esp
mov ebx, esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4266aa
cmp eax, dword [edi]
jne 0x4266aa
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x4266e5
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x4268ce
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [edi + 0x10]
push edx
lea eax, [eax + eax + 2]
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.00532e6b
add esp, 0x10
add esi, 0x10
mov dword [ebx], esi
mov esi, dword [ebp - 0x220]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x24c], esp
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x24c], esp
call eax
cmp dword [esi - 4], 0
lea edx, [esi - 4]
jl 0x426727
cmp eax, dword [esi - 0x10]
jne 0x426727
lea ebx, [esi - 0x10]
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x42675f
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x4268ce
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.00532e6b
add esp, 0x10
mov ecx, dword [ebp - 0x24c]
mov esi, dword [ebp - 0x224]
add ebx, 0x10
mov dword [ecx], ebx
mov byte [ebp - 4], 0x11
mov ecx, dword [esi + 0x14c]
call fcn.00404ec0
test eax, eax
jne 0x4268d3
mov ecx, dword [esi + 0x14c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x170]
call eax
cmp eax, 0x7d6
jne 0x426924
mov eax, dword [ebp - 0x244]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4267c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4267ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xa
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42680b
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4260c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4260c0
push 0
push 0
push 8
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push ecx
lea ecx, [ebx + 0x158]
call fcn.0040deb0
push 0
call fcn.004196e0
add esp, 0x14
lea ecx, [ebp - 0x228]
call fcn.00402e70
lea ecx, [ebp - 0x22c]
call fcn.00402e70
lea ecx, [ebp - 0x230]
call fcn.00402e70
lea ecx, [ebp - 0x21c]
call fcn.00402e70
mov eax, 0x643
jmp 0x427b25
lea ecx, [ebp - 0x228]
call fcn.00402e70
lea ecx, [ebp - 0x22c]
call fcn.00402e70
lea ecx, [ebp - 0x230]
call fcn.00402e70
lea ecx, [ebp - 0x21c]
call fcn.00402e70
mov eax, 0x642
jmp 0x427b25
call fcn.00402d50
mov eax, dword [ebp - 0x220]
push 0
push 0
push 8
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x240], esp
mov esi, esp
push eax
call fcn.00402f60
add esp, 4
add eax, 0x10
push 0
mov dword [esi], eax
call fcn.004196e0
add esp, 0x14
lea ecx, [ebp - 0x244]
call fcn.00402e70
lea ecx, [ebp - 0x220]
call fcn.00402e70
lea ecx, [ebp - 0x234]
jmp 0x42687e
cmp eax, 2
jne 0x42694a
lea ecx, [ebp - 0x244]
call fcn.00402e70
lea ecx, [ebp - 0x220]
call fcn.00402e70
lea ecx, [ebp - 0x234]
jmp 0x4268b4
lea ecx, [ebp - 0x21c]
call fcn.00402e90
lea ecx, [ebp - 0x234]
call fcn.00402e90
lea ecx, [ebp - 0x244]
call fcn.00402e90
lea ecx, [ebp - 0x244]
call fcn.00402e90
lea ecx, [ebp - 0x244]
call fcn.00402e70
lea ecx, [ebp - 0x220]
call fcn.00402e70
lea ecx, [ebp - 0x234]
call fcn.00402e70
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
call fcn.00402e70
mov ebx, esi
mov edx, dword [0x60dfe0]
push 1
push edx
mov ecx, ebx
call fcn.0041b250
cmp eax, 9
je 0x42688e
cmp eax, 1
jne 0x4269f8
mov dword [ebp - 0x23c], eax
jmp 0x4269f8
cmp eax, esi
je 0x4269f8
mov eax, dword [0x60dfe0]
push 0
push eax
mov ecx, ebx
call fcn.0041b250
cmp eax, 9
je 0x42688e
cmp eax, 1
jne 0x4269f8
mov dword [ebp - 0x23c], edi
lea ecx, [ebp - 0x238]
lea edi, [ebx + 0x158]
push ecx
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x21c], edi
call fcn.00409520
mov dword [ebp - 0x230], eax
mov eax, dword [ebx + 0xe4bc]
cmp eax, 1
jne 0x426a6a
mov edx, dword [ebp - 0x238]
push edx
mov ecx, edi
call fcn.00409880
cmp dword [ebx + 8], esi
jne 0x427b23
push esi
push esi
push 6
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
mov ecx, edi
call fcn.0040deb0
push esi
call fcn.004196e0
add esp, 0x14
mov eax, 0x8c
jmp 0x427b25
cmp eax, 2
je 0x426a78
cmp eax, 3
jne 0x426bba
cmp dword [ebx + 8], esi
je 0x426a8a
cmp dword [ebx + 0xe4b0], 1
je 0x426bba
cmp dword [ebp + 8], 3
je 0x426bba
cmp dword [ebx + 0x140], esi
jne 0x426bba
push 0x184
call fcn.00432a1f
add esp, 4
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 0x14
cmp eax, esi
je 0x426ac8
push esi
mov ecx, eax
call fcn.004290c0
jmp 0x426aca
xor eax, eax
mov dword [ebx + 0x140], eax
mov edx, dword [eax]
push esi
mov ecx, eax
mov eax, dword [edx + 0x160]
push 0x6b
mov dword [ebp - 4], 0xffffffff
call eax
mov ecx, dword [ebx + 0x140]
push 5
call fcn.0043c911
mov eax, dword [ebx + 0x140]
cmp eax, esi
jne 0x426b01
xor eax, eax
jmp 0x426b04
mov eax, dword [eax + 0x20]
push esi
push 0x404
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x140]
cmp eax, esi
jne 0x426b26
xor eax, eax
jmp 0x426b29
mov eax, dword [eax + 0x20]
lea ecx, [ebp - 0x220]
mov dword [ebx + 0xe4c8], eax
call fcn.00403010
push 0x407
mov dword [ebp - 4], 0x15
call fcn.0043e213
cmp eax, esi
je 0x426b64
push 0x407
push eax
lea ecx, [ebp - 0x220]
call fcn.00403150
cmp eax, esi
jne 0x426b79
lea ecx, [ebp - 0x220]
call fcn.00402e70
mov eax, 0x643
jmp 0x427b25
mov eax, dword [ebx + 0x140]
cmp eax, esi
jne 0x426b87
xor eax, eax
jmp 0x426b8a
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 0x220]
push ecx
push 0x405
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea ecx, [ebp - 0x220]
call fcn.00402e90
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
call fcn.00402e70
mov dword [ebp - 0x228], esi
cmp dword [ebp - 0x230], esi
jbe 0x426dcb
mov dword [ebp - 0x224], esi
mov edx, dword [ebp - 0x238]
add edx, dword [ebp - 0x224]
lea ecx, [ebp - 0x220]
push edx
push 0
push ecx
mov ecx, ebx
call fcn.0041f550
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x254]
push edx
sub esp, 0x114
mov edi, esp
mov ecx, 0x45
lea esi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x254], 0
call fcn.00420390
test eax, eax
je 0x426c3e
mov ecx, dword [ebp - 0x21c]
call fcn.00408ab0
test eax, eax
je 0x426e3c
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x42737c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x238]
mov edi, dword [ebp - 0x224]
lea edx, [ecx + edi + 0x208]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea eax, [ebp - 0x22c]
push 0x55d250
push eax
mov byte [ebp - 4], 0x18
call fcn.004047a0
mov esi, dword [ebp - 0x22c]
add esp, 0x10
lea ecx, [ebp - 0x234]
push ecx
push 1
push 0
push esi
push 0x80000002
mov dword [ebp - 0x234], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x426cd9
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x16
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x426d6d
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x426d48
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x238]
cmp dword [eax + edi + 0xe40], 0
je 0x426d48
push 0
push 0
push 0x15
push 0
push ecx
lea edx, [eax + edi + 0xe44]
mov ecx, esp
mov dword [ebp - 0x240], esp
push edx
call fcn.00405b90
push ecx
mov ecx, dword [ebp - 0x21c]
mov eax, esp
mov dword [ebp - 0x258], esp
push eax
mov byte [ebp - 4], 0x19
call fcn.0040deb0
push 0
mov byte [ebp - 4], 0x18
call fcn.00417730
add esp, 0x1c
cmp eax, 2
je 0x426ed6
lea ecx, [ebp - 0x22c]
call fcn.00402e90
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x16
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426d79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [ebp - 4], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426d9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x228]
inc eax
add edi, 0x1248
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], edi
cmp eax, dword [ebp - 0x230]
jb 0x426bd2
mov edi, dword [ebp - 0x21c]
xor esi, esi
mov ecx, edi
call fcn.0040b770
test eax, eax
je 0x426f41
lea ecx, [ebp - 0x224]
push ecx
mov ecx, edi
mov dword [ebp - 0x224], 0
call fcn.0040b7e0
mov edx, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x230]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.00422b70
mov edx, dword [ebp - 0x224]
push edx
mov ecx, edi
mov esi, eax
call fcn.00409880
test esi, esi
je 0x426f3f
mov eax, dword [ebp - 0x238]
push eax
mov ecx, edi
call fcn.00409880
mov eax, esi
jmp 0x427b25
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x238]
imul eax, eax, 0x1248
push 0
push 0
push 7
push 0
push ecx
lea edx, [eax + ecx + 0x410]
mov ecx, esp
mov dword [ebp - 0x240], esp
push edx
call fcn.00405b90
mov esi, dword [ebp - 0x21c]
push ecx
mov eax, esp
mov dword [ebp - 0x258], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 0x17
call fcn.0040deb0
push 0
mov byte [ebp - 4], 0x16
call fcn.00417730
mov ecx, dword [ebp - 0x238]
add esp, 0x1c
push ecx
mov ecx, esi
call fcn.00409880
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426ecc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x652
jmp 0x427b25
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00409880
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x16
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426f08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4268c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x642
jmp 0x427b25
xor esi, esi
push esi
push str._InstallBeginCall_
lea ecx, [ebp - 0x260]
push ecx
mov ecx, edi
mov dword [ebp - 0x260], esi
call fcn.004131e0
cmp eax, esi
jbe 0x426f83
mov edx, dword [ebx + 4]
mov ecx, dword [ebp - 0x260]
push edx
push 1
push esi
push ecx
push eax
mov ecx, ebx
call fcn.0041a200
mov edx, dword [ebp - 0x260]
push edx
mov ecx, edi
call fcn.00409880
xor edi, edi
cmp dword [ebp - 0x230], edi
jbe 0x426fcb
xor esi, esi
nop
mov eax, dword [ebp - 0x238]
lea ecx, [eax + esi + 0x208]
push ecx
mov ecx, ebx
call fcn.0041f7c0
cmp eax, 0x642
je 0x427009
cmp eax, 0xffffffff
je 0x427025
test eax, eax
jne 0x426fbc
mov dword [ebx + 0xc], 1
inc edi
add esi, 0x1248
cmp edi, dword [ebp - 0x230]
jb 0x426f90
cmp dword [ebx + 8], 0
jne 0x427041
mov ecx, ebx
call fcn.00422150
test eax, eax
jne 0x427041
push eax
push eax
push 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x240], esp
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040deb0
push 0
call fcn.004196e0
add esp, 0x14
mov eax, 0x27
jmp 0x427b25
mov edx, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x21c]
push edx
call fcn.00409880
mov eax, 0x642
jmp 0x427b25
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x21c]
push eax
call fcn.00409880
mov eax, 0x642
jmp 0x427b25
mov ecx, ebx
call fcn.00420db0
cmp eax, 0xbc2
jne 0x42705b
mov dword [ebp - 0x23c], 1
jmp 0x427063
test eax, eax
jne 0x42688e
mov esi, dword [ebp - 0x21c]
lea edx, [ebp - 0x230]
push edx
mov ecx, esi
call fcn.0040be40
lea eax, [ebp - 0x234]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x1a
call fcn.00416300
mov edi, dword [ebp - 0x234]
mov edx, dword [ebp - 0x230]
push edi
lea ecx, [ebx + 0xd9b8]
push edx
mov byte [ebp - 4], 0x1b
call fcn.0042d6a0
mov ecx, ebx
call fcn.00416590
mov ecx, ebx
call fcn.00414ce0
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
call fcn.00425d10
mov esi, eax
test esi, esi
je 0x427131
cmp esi, 0xbc2
je 0x427127
mov ecx, ebx
call fcn.004171e0
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0x1a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4270f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427120
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x427b25
mov dword [ebp - 0x23c], 1
xor eax, eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x228], eax
cmp dword [ebx + 4], eax
je 0x427150
mov ecx, dword [ebx + 0xe22c]
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x250]
push edx
call fcn.0040b410
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x427573
mov edi, dword [ebp - 0x21c]
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x42735a
mov ecx, edi
call fcn.0040b390
cmp eax, 1
jne 0x427288
cmp dword [ebx + 0x138], esi
jne 0x4271ca
push 0x128
call fcn.00432a1f
add esp, 4
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0x1c
cmp eax, esi
je 0x4271be
push esi
mov ecx, eax
call fcn.00407770
jmp 0x4271c0
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebx + 0x138], eax
push ecx
mov eax, esp
mov dword [ebp - 0x240], esp
push eax
mov ecx, edi
call fcn.0040deb0
mov ecx, dword [ebx + 0x138]
call fcn.00407900
mov ecx, dword [ebx + 0x138]
mov edx, dword [ecx]
mov eax, dword [edx + 0x170]
call eax
cmp eax, 0x7d5
je 0x42725a
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427223
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42688e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x643
jmp 0x427b25
mov ecx, dword [ebx + 0x138]
mov edx, dword [ecx + 0x94]
mov dword [ebp - 0x228], edx
cmp ecx, esi
je 0x42735a
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [ebx + 0x138], esi
jmp 0x42735a
cmp dword [ebx + 0x13c], esi
jne 0x4272c1
push 0x10c
call fcn.00432a1f
add esp, 4
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0x1d
cmp eax, esi
je 0x4272b5
push esi
mov ecx, eax
call fcn.00407020
jmp 0x4272b7
xor eax, eax
mov byte [ebp - 4], 0x1b
mov dword [ebx + 0x13c], eax
mov ecx, dword [ebx + 0x13c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x170]
call edx
cmp eax, 0x7d5
je 0x427335
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4272fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42688e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x643
jmp 0x427b25
mov ecx, dword [ebx + 0x13c]
mov edx, dword [ecx + 0x108]
mov dword [ebp - 0x228], edx
cmp ecx, esi
je 0x42735a
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [ebx + 0x13c], esi
lea eax, [ebp - 0x248]
push eax
mov ecx, edi
call fcn.0040be40
mov byte [ebp - 4], 0x1e
call fcn.0043e2f8
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x427386
push 0x80004005
call fcn.00402a80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x244], edi
mov byte [ebp - 4], 0x1f
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4273b6
push 0x80004005
call fcn.00402a80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x25c], esi
push 1
mov byte [ebp - 4], 0x20
call fcn.00432a1f
add esp, 4
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x4273f3
mov ecx, eax
call fcn.0042b120
mov dword [ebp - 0x220], eax
jmp 0x4273fd
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0x20
jbe 0x4274ea
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp - 0x250]
mov esi, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x248]
lea eax, [edx + esi + 0xc8]
push eax
push ecx
lea edx, [ebp - 0x244]
push 0x55d250
push edx
call fcn.004047a0
mov ecx, dword [ebp - 0x250]
add esp, 0x10
add ecx, esi
jne 0x427461
xor eax, eax
jmp 0x427475
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x427466
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x25c]
call fcn.00403290
cmp dword [ebp - 0x228], 1
mov edi, dword [ebp - 0x244]
mov esi, dword [ebp - 0x25c]
jne 0x4274be
mov ecx, dword [ebp - 0x220]
push 0
push 0x55be6c
push esi
push edi
call fcn.00401610
test eax, eax
jne 0x4274d4
push esi
push edi
lea ecx, [ebx + 0xd9b8]
call fcn.0042cf40
jmp 0x4274d4
cmp dword [ebp - 0x228], 2
jne 0x4274d4
mov ecx, dword [ebp - 0x220]
push esi
push edi
call fcn.00401490
add dword [ebp - 0x224], 0x2d0
dec dword [ebp - 0x22c]
jne 0x427424
cmp dword [ebp - 0x220], 0
je 0x42750d
mov ecx, dword [ebp - 0x220]
call fcn.00401000
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.00432a4e
add esp, 4
add esi, 0xfffffff0
mov byte [ebp - 4], 0x1f
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x42752d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add edi, 0xfffffff0
mov byte [ebp - 4], 0x1e
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42754d
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov eax, dword [ebp - 0x248]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427573
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x250]
mov edi, dword [ebp - 0x21c]
push ecx
mov ecx, edi
call fcn.00409880
mov ecx, edi
mov dword [ebp - 0x250], 0
call fcn.00408910
mov ecx, edi
mov esi, eax
call fcn.004089a0
xor ecx, ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x228], ecx
cmp dword [ebp + 8], ecx
jne 0x427618
cmp esi, 2
jne 0x4275ed
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x248]
push ecx
lea edx, [ebp - 0x220]
push edx
push eax
mov eax, dword [ebp - 0x23c]
push 1
push eax
mov ecx, ebx
call fcn.00416640
mov eax, dword [ebp - 0x248]
jmp 0x42763b
lea ecx, [ebp - 0x228]
push ecx
push 0
lea edx, [ebp - 0x220]
push edx
push eax
mov eax, dword [ebp - 0x23c]
push 0
push eax
mov ecx, ebx
call fcn.00416640
cmp esi, 1
je 0x427643
jmp 0x427792
test esi, esi
je 0x42762d
cmp dword [ebx + 4], ecx
je 0x427626
cmp esi, 2
je 0x42762d
mov eax, 1
jmp 0x42762f
xor eax, eax
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x220], ecx
test eax, eax
je 0x427788
mov ecx, dword [ebp - 0x21c]
xor esi, esi
push esi
lea edx, [ebp - 0x22c]
push edx
mov dword [ebp - 0x22c], esi
call fcn.004104e0
mov edi, eax
cmp edi, esi
jbe 0x427788
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x218], ax
call fcn.00531fb0
add esp, 0xc
push esi
push 0x19
lea edx, [ebp - 0x218]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x427704
lea eax, [ebp - 0x224]
push eax
push 1
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
mov dword [ebp - 0x224], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x427704
lea ecx, [ebp - 0x254]
push ecx
mov ecx, dword [ebp - 0x224]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x264]
push eax
push esi
push str.Common_Desktop
push ecx
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x254], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x22c]
test edi, edi
je 0x427728
mov edi, edi
push esi
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.00414f00
add esi, 0xa30
dec edi
jne 0x427710
mov ecx, dword [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00409880
push 0
lea edx, [ebp - 0x218]
push edx
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [ebp - 0x2e4]
call fcn.00437204
mov byte [ebp - 4], 0x22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.004380c5
mov eax, dword [eax + 0x20]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x1b
call fcn.0043944f
cmp dword [ebp + 8], 0
jne 0x42795c
cmp dword [ebp - 0x228], 0
je 0x42783c
movzx edx, word [ebx + 0xe4b8]
xor eax, eax
test dx, dx
je 0x4277e0
mov cx, word [0x5dcf88]
test cx, cx
je 0x4277db
movzx ecx, cx
lea esp, [esp]
cmp cx, dx
je 0x427869
inc eax
mov ecx, eax
imul ecx, ecx, 0x66
movzx ecx, word [ecx + 0x5dcf88]
test cx, cx
jne 0x4277c0
mov eax, 0x5dcf8a
push eax
lea ecx, [ebp - 0x224]
call fcn.00405b90
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42781a
mov eax, dword [ebp - 0x224]
push 1
push 0
push eax
push str.notepad
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42783c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040b690
test eax, eax
je 0x42795c
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x427876
push 0x80004005
call fcn.00402a80
imul eax, eax, 0x66
add eax, 0x5dcf8a
jmp 0x4277e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 0x23
call fcn.0043e2f8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4278a6
push 0x80004005
call fcn.00402a80
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x228]
push edx
mov byte [ebp - 4], 0x24
call fcn.00410060
mov eax, dword [ebp - 0x228]
cmp dword [eax - 0xc], 0
je 0x427910
mov ecx, dword [ebp - 0x22c]
cmp dword [ecx - 0xc], 0
je 0x427910
call fcn.00433e4b
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x228]
push eax
mov eax, dword [ebp - 0x22c]
push 0
push edx
push eax
push 0
call fcn.00414c70
add esp, 0x14
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x23
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427936
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42795c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x21c]
xor edi, edi
push edi
push str._InstallEndCall_
lea ecx, [ebp - 0x268]
push ecx
mov ecx, esi
mov dword [ebp - 0x268], edi
call fcn.004131e0
cmp eax, edi
jbe 0x4279a6
mov edx, dword [ebx + 4]
mov ecx, dword [ebp - 0x268]
push edx
push 1
push edi
push ecx
push eax
mov ecx, ebx
call fcn.0041a200
mov edx, dword [ebp - 0x268]
push edx
mov ecx, esi
call fcn.00409880
cmp dword [ebp - 0x220], edi
jne 0x427a44
cmp dword [ebx + 8], edi
jne 0x427a44
push str._InstallEndCall_
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov dword [ebp - 0x224], edi
call fcn.00409b70
cmp eax, edi
je 0x4279ef
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x224]
push ecx
push 1
push edi
push edx
push 1
mov ecx, ebx
call fcn.0041a200
mov eax, dword [ebp - 0x224]
push eax
mov ecx, esi
call fcn.00409880
cmp dword [ebx + 8], edi
jne 0x427a44
push str._InstallEndCall_
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, esi
mov dword [ebp - 0x23c], edi
call fcn.00409d90
cmp eax, edi
je 0x427a36
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 0x23c]
push edx
push 1
push edi
push eax
push 1
mov ecx, ebx
call fcn.0041a200
mov ecx, dword [ebp - 0x23c]
push ecx
mov ecx, esi
call fcn.00409880
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [ebx + 0xd9b8]
call fcn.0042d100
push 1
lea ecx, [ebx + 0xd9b8]
call fcn.0042d520
mov ecx, dword [ebp - 0x21c]
call fcn.0040a590
test eax, eax
je 0x427a83
mov ecx, ebx
call fcn.00417490
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x220], edi
je 0x427ae1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427ab1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427ada
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0xbc2
jmp 0x427b25
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427afa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427b23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531f97
mov esp, ebp
pop ebp
ret 4