Function at 0x403f2c
Capabilities:
Check if file exists
Create directory
Delete file
Delete registry value
Get common file path
Get file attributes
Query or enumerate registry key
Query or enumerate registry value
Set current directory
Terminate process

Disassembly:
sub esp, 0x870
lea eax, [esp + 0x468]
push ebx
push ebp
push esi
push edi
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x478]
mov ebp, 0x406880
xor ebx, ebx
push ebp
push ebx
push 0x405120
push eax
call esi
test eax, eax
jne 0x403f8c
push edi
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebp
push ebx
push 0x405120
lea eax, [esp + 0x484]
push eax
call esi
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x405128
push ebp
call fcn.00404d58
lea eax, [esp + 0x278]
push ebp
push eax
call fcn.00404de4
lea eax, [esp + 0x280]
push 0x40512c
push eax
call fcn.00404d58
add esp, 0x18
push 0x406678
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xa
pop ecx
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x403f26
mov esi, str.Unpack
push eax
mov dword [esp + 0x68], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
push eax
call edi
mov eax, dword [esp + 0x3c]
push ebx
push dword [esp + 0x888]
add eax, 0xffffffd8
push ebx
push ebx
cdq
push 0x28
sub eax, edx
push 0xc8
sar eax, 1
push eax
mov eax, dword [esp + 0x54]
add eax, 0xffffff38
cdq
sub eax, edx
sar eax, 1
push eax
push 0xc00000
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
call esi
mov dword [0x406468], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea eax, [esp + 0x30]
push eax
push dword [0x406468]
call edi
push ebx
push dword [esp + 0x888]
push ebx
push dword [0x406468]
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push ebx
push ebx
push 0x40000000
push 0x405150
push str.msctls_progress32
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
mov dword [0x40646c], eax
call esi
push 1
push dword [0x406468]
call esi
push dword [0x406468]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x104
mov esi, 0x406470
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebp
push esi
call fcn.004012d4
pop ecx
pop ecx
push dword [0x406468]
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.00403ced
call fcn.00403d27
push eax
call fcn.00404bee
mov edi, eax
mov dword [esp], 0x405178
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40423d
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x404173
push str.IsWow64Process
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x404173
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
test eax, eax
je 0x404173
cmp dword [esp + 0x10], ebx
je 0x404173
push 0x4051b8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x404173
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404173
lea ecx, [esp + 0x20]
push ecx
call eax
push 0x103
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x404191
push 0x80004005
call fcn.00403e09
push edi
call fcn.00404e02
mov esi, eax
lea eax, [esp + 0x6c]
push eax
call fcn.00404e02
add esi, 0x100
xor ecx, ecx
push 2
add eax, esi
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404b55
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x68]
push str.msiexec.exe__i
push eax
push esi
call fcn.00404de4
pop ecx
pop ecx
push eax
call fcn.00404d58
mov eax, str.setup_64.msi
pop ecx
pop ecx
test bl, bl
jne 0x4041ec
mov eax, str.setup.msi
push eax
push esi
call fcn.00404d58
push 0x40524c
push edi
call fcn.00404e46
mov ebx, eax
add esp, 0x10
mov ebp, 0x200020
test ebx, ebx
je 0x404226
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._qr
push esi
mov dword [ebx], ebp
call fcn.00404d58
pop ecx
pop ecx
push 0x405260
push edi
call fcn.00404e46
pop ecx
xor ebx, ebx
pop ecx
test eax, eax
je 0x40427e
mov dword [eax], ebp
jmp 0x40427e
push edi
call fcn.00404e02
mov esi, eax
lea eax, [esp + 0x274]
push eax
call fcn.00404e02
add esi, 2
xor ecx, ecx
push 2
add eax, esi
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404b55
mov esi, eax
lea eax, [esp + 0x27c]
push eax
push esi
call fcn.00404de4
add esp, 0x14
push edi
push 0x405268
push esi
call fcn.00404d58
pop ecx
pop ecx
push eax
call fcn.00404d58
push esi
call fcn.00403e61
push esi
call fcn.00404b5a
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x28]
add esp, 0x10
push eax
push 0x2000000
push ebx
push str.SoftwareMicrosoftInstallerProducts
push 0x80000001
call edi
test eax, eax
jne 0x4043c8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4043c8
mov esi, ebx
cmp dword [esp + 0x10], eax
jbe 0x4043c8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0xff
push eax
lea eax, [esp + 0x694]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4043aa
lea eax, [esp + 0x1c]
push eax
push 0x2000000
push ebp
lea eax, [esp + 0x68c]
push eax
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x4043aa
lea eax, [esp + 0x14]
push eax
push 0x2000000
push ebp
push str.SourceList
push dword [esp + 0x2c]
call edi
test eax, eax
jne 0x4043a4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x1fe
push eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x2c]
push eax
push ebp
push str.LastUsedSource
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40439e
lea eax, [esp + 0x68]
push 0x406880
push eax
call fcn.00404e46
pop ecx
pop ecx
test eax, eax
jne 0x4043b7
push dword [esp + 0x14]
call ebx
push dword [esp + 0x1c]
call ebx
inc esi
cmp esi, dword [esp + 0x10]
jb 0x4042fb
jmp 0x4043c6
push str.LastUsedSource
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ebx, ebx
push 0x406678
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x406880
lea ecx, [esp + 0x28]
call fcn.0040465a
lea eax, [esp + 0x24]
push 1
push eax
call fcn.00404a3d
pop ecx
pop ecx
lea ecx, [esp + 0x24]
call fcn.004046ce
push dword [esp + 0x884]
push str.Unpack
call dword [sym.imp.USER32.dll_UnregisterClassW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]