Function at 0x4011c0
Capabilities:
Check os version
Create directory
Create process on windows
Delete file
Get common file path
Get comspec environment variable
Persist via app paths registry key
Persist via default file association registry key
Query environment variable
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
sub esp, 0x6c4
push esi
push edi
mov esi, str.C:WINDOWS
lea edi, [esp + 0x5c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x3e
xor eax, eax
pop ecx
lea edi, [esp + 0x5cf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, str.COMMAND.COM
lea edi, [esp + 0x4bc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3e
xor eax, eax
pop ecx
lea edi, [esp + 0x4c8]
or dword [esp + 0x14], 0xffffffff
push 1
rep stosd dword es:[edi], eax
pop esi
push 0x4bba20
mov dword [esp + 0x1c], esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x4bba30]
sub eax, 0
je 0x40124f
dec eax
je 0x40123a
dec eax
jne 0x401255
mov dword [0x4bc980], 8
jmp 0x401255
mov eax, dword [0x4bba28]
neg eax
sbb eax, eax
and eax, 4
inc eax
inc eax
mov dword [0x4bc980], eax
jmp 0x401255
mov dword [0x4bc980], esi
push ebx
mov esi, 0x104
push ebp
lea eax, [esp + 0x5cc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x4c4]
push esi
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x4bc984
push str.SOFTWARE
push 0x80000002
call edi
test eax, eax
mov ebx, 0x4bb808
mov ebp, 0x4bb80c
jne 0x40139e
push 0x4bc988
push str.Microsoft
push dword [0x4bc984]
call edi
test eax, eax
jne 0x40139e
push 0x4bc98c
push str.Windows
push dword [0x4bc988]
call edi
test eax, eax
jne 0x40139e
push 0x4bc990
push str.CurrentVersion
push dword [0x4bc98c]
call edi
test eax, eax
jne 0x40139e
push 0x4bc994
push 0xf003f
push eax
push str.App_Paths
push dword [0x4bc990]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40139e
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.00402410
lea eax, [esp + 0x2c]
push str..EXE
push eax
call fcn.00402420
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
push dword [0x4bc994]
call edi
test eax, eax
jne 0x40137c
mov dword [0x4bb9d0], esi
push 0x4bb9d0
lea eax, [esp + 0x24]
push ebp
xor esi, esi
push eax
push esi
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40137e
xor esi, esi
push str.C:Dzongkha
push ebp
call fcn.00406710
pop ecx
test eax, eax
pop ecx
jne 0x4013a0
push str.C:Tibetan
push ebp
call fcn.00402410
pop ecx
pop ecx
jmp 0x4013a0
xor esi, esi
push ebx
push 0x401f4e
push esi
push str.SETUP_PATH
push dword [esp + 0x6e8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x401ef3
cmp byte [0x4bb80d], 0x3a
jne 0x40141c
cmp byte [0x4bb80e], 0x5c
jne 0x40141c
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4013f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4013f5
push esi
push ebp
push str.Error:_Unable_to_create_directory.__Does_parent_directory_exist___If_not__create_it_manually.
jmp 0x401423
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x4bbf74
push str.SETUP_2.EXE
call fcn.004023fd
mov edi, eax
pop ecx
cmp edi, esi
pop ecx
jne 0x40142f
push esi
push ebp
push str.Unable_to_create_SETUP_2.EXE_in_this_directory.
jmp 0x401423
push esi
push esi
push str.Path_must_start_with_a_drive_letter_followed_by_a_colon___:___followed_by_a_backslash_____.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4013a0
push edi
push 1
push 0xb2da1
push 0x408030
call fcn.004022d3
add esp, 0x10
cmp eax, 1
je 0x401456
push esi
push str.Unable_to_write_SETUP_2.EXE
push str.Do_you_have_enough_free_disk_space_
jmp 0x4014b3
push edi
call fcn.0040227d
lea eax, [esp + 0x4c8]
push eax
lea eax, [esp + 0x1b4]
push eax
call fcn.00402410
lea eax, [esp + 0x1b8]
push str.__c_SETUP_2.EXE__o
push eax
call fcn.00402420
add esp, 0x14
lea eax, [esp + 0x1ac]
push 0x4bc998
push 0x4bb9d8
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4014bf
push esi
lea eax, [esp + 0x1b0]
push esi
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401ef3
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x18]
push eax
push dword [0x4bc998]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4014e6
cmp dword [esp + 0x18], 0x103
je 0x4014bf
push str.SETUP_2.EXE
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea eax, [esp + 0x2b8]
push str._s.UNI
push eax
call fcn.00402172
lea eax, [esp + 0x2c0]
push 0x4bbe78
push eax
call fcn.004023fd
mov esi, eax
push ebx
push 0x4bb80c
lea eax, [esp + 0x2d0]
push str._s_s.EXE
push eax
call fcn.00402172
lea eax, [esp + 0x48]
push ebx
push eax
call fcn.00402410
lea eax, [esp + 0x50]
push str..EXE
push eax
call fcn.00402420
add esp, 0x34
lea eax, [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push eax
lea eax, [esp + 0x28]
push eax
push dword [0x4bc994]
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x401604
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401590
push ebx
push str.R_tHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionApp_Paths_s.EXE_n
push esi
call fcn.0040224b
add esp, 0xc
lea eax, [esp + 0x2b4]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x2b8]
push eax
lea eax, [esp + 0x2c]
push 1
push eax
push dword [0x4bc994]
call ebp
lea eax, [esp + 0x14]
push eax
push 0xf003f
lea eax, [esp + 0x2c]
push 0
push eax
push dword [0x4bc994]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401604
mov ebx, 0x4bb80c
push ebx
call fcn.004021d0
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2b4]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00402410
lea eax, [esp + 0x2c]
push str.___1_
push eax
call fcn.00402420
add esp, 0x10
lea eax, [esp + 0x10]
mov ebx, 0x80000000
push eax
push str..dct
push ebx
call edi
test eax, eax
jne 0x40171b
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401663
push str..dct
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0xc
push str.dct_auto_file
call fcn.004021d0
pop ecx
inc eax
push eax
push str.dct_auto_file
push 1
push str..dct
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push str.dct_auto_file
push ebx
call edi
test eax, eax
jne 0x40171b
test esi, esi
je 0x4016db
push str.dct_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopencommand_n
push esi
call fcn.0040224b
push str.dct_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopen_n
push esi
call fcn.0040224b
push str.dct_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shell_n
push esi
call fcn.0040224b
push str.dct_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push str.shellopencommand
push dword [esp + 0x18]
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x28]
push eax
push 1
push 0
push dword [esp + 0x24]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push str..dcp
push ebx
call edi
test eax, eax
jne 0x401809
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401751
push str..dcp
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0xc
push str.dcp_auto_file
call fcn.004021d0
pop ecx
inc eax
push eax
push str.dcp_auto_file
push 1
push str..dcp
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push str.dcp_auto_file
push ebx
call edi
test eax, eax
jne 0x401809
test esi, esi
je 0x4017c9
push str.dcp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopencommand_n
push esi
call fcn.0040224b
push str.dcp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopen_n
push esi
call fcn.0040224b
push str.dcp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shell_n
push esi
call fcn.0040224b
push str.dcp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push str.shellopencommand
push dword [esp + 0x18]
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x28]
push eax
push 1
push 0
push dword [esp + 0x24]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push str..dbt
push ebx
call edi
test eax, eax
jne 0x4018f7
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40183f
push str..dbt
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0xc
push str.dbt_auto_file
call fcn.004021d0
pop ecx
inc eax
push eax
push str.dbt_auto_file
push 1
push str..dbt
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push str.dbt_auto_file
push ebx
call edi
test eax, eax
jne 0x4018f7
test esi, esi
je 0x4018b7
push str.dbt_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopencommand_n
push esi
call fcn.0040224b
push str.dbt_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopen_n
push esi
call fcn.0040224b
push str.dbt_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shell_n
push esi
call fcn.0040224b
push str.dbt_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push str.shellopencommand
push dword [esp + 0x18]
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x28]
push eax
push 1
push 0
push dword [esp + 0x24]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push str..dbp
push ebx
call edi
test eax, eax
jne 0x4019e5
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40192d
push str..dbp
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0xc
push str.dbp_auto_file
call fcn.004021d0
pop ecx
inc eax
push eax
push str.dbp_auto_file
push 1
push str..dbp
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push str.dbp_auto_file
push ebx
call edi
test eax, eax
jne 0x4019e5
test esi, esi
je 0x4019a5
push str.dbp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopencommand_n
push esi
call fcn.0040224b
push str.dbp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopen_n
push esi
call fcn.0040224b
push str.dbp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shell_n
push esi
call fcn.0040224b
push str.dbp_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push str.shellopencommand
push dword [esp + 0x18]
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x28]
push eax
push 1
push 0
push dword [esp + 0x24]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push str..dc7
push ebx
call edi
test eax, eax
jne 0x401ad3
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401a1b
push str..dc7
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0xc
push str.dc7_auto_file
call fcn.004021d0
pop ecx
inc eax
push eax
push str.dc7_auto_file
push 1
push str..dc7
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push str.dc7_auto_file
push ebx
call edi
test eax, eax
jne 0x401ad3
test esi, esi
je 0x401a93
push str.dc7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopencommand_n
push esi
call fcn.0040224b
push str.dc7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopen_n
push esi
call fcn.0040224b
push str.dc7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shell_n
push esi
call fcn.0040224b
push str.dc7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push str.shellopencommand
push dword [esp + 0x18]
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x28]
push eax
push 1
push 0
push dword [esp + 0x24]
call ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push str..db7
push ebx
call edi
test eax, eax
jne 0x401bc2
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401b09
push str..db7
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0xc
push str.db7_auto_file
call fcn.004021d0
pop ecx
inc eax
push eax
push str.db7_auto_file
push 1
push str..db7
push ebx
call ebp
lea eax, [esp + 0x10]
push eax
push str.db7_auto_file
push ebx
call edi
test eax, eax
jne 0x401bc2
xor ebx, ebx
cmp esi, ebx
je 0x401b83
push str.db7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopencommand_n
push esi
call fcn.0040224b
push str.db7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shellopen_n
push esi
call fcn.0040224b
push str.db7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_shell_n
push esi
call fcn.0040224b
push str.db7_auto_file
push str.R_tHKEY_CLASSES_ROOT_s_n
push esi
call fcn.0040224b
add esp, 0x30
lea eax, [esp + 0x14]
push eax
push str.shellopencommand
push dword [esp + 0x18]
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004021d0
pop ecx
inc eax
push eax
lea eax, [esp + 0x28]
push eax
push 1
push ebx
push dword [esp + 0x24]
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x14]
call edi
push dword [esp + 0x10]
call edi
jmp 0x401bc4
xor ebx, ebx
lea eax, [esp + 0x3bc]
push 0x104
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x401bf7
lea eax, [esp + 0x5cc]
push eax
lea eax, [esp + 0x3c0]
push eax
call fcn.00402410
pop ecx
pop ecx
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, 0x4bb808
push 0x24
push edi
push str.Do_you_want_to_create_an_icon_on_the_Desktop_
push ebx
call ebp
cmp eax, 6
jne 0x401c6c
lea eax, [esp + 0x3bc]
push edi
push eax
lea eax, [esp + 0x2c]
push str._sDesktop_s.lnk
push eax
call fcn.00402172
lea eax, [esp + 0x34]
push eax
push edi
push 0x4bb80c
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x2e0]
push ebx
push eax
call section..text
add esp, 0x34
cmp eax, ebx
je 0x401c55
push ebx
push ebx
push eax
push ebx
call ebp
cmp esi, ebx
je 0x401c6c
lea eax, [esp + 0x24]
push eax
push str.F_t_s_n
push esi
call fcn.0040224b
add esp, 0xc
lea eax, [esp + 0x3bc]
push eax
lea eax, [esp + 0x28]
push str._sStart_MenuProgramsTibetan
push eax
call fcn.00402172
add esp, 0xc
lea eax, [esp + 0x24]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, ebx
je 0x401ca9
lea eax, [esp + 0x24]
push eax
push str.D_t_s_n
push esi
call fcn.0040224b
add esp, 0xc
push edi
lea eax, [esp + 0x28]
push str._s.lnk
push eax
call fcn.004021d0
pop ecx
lea eax, [esp + eax + 0x2c]
push eax
call fcn.00402172
lea eax, [esp + 0x30]
push eax
push edi
push 0x4bb80c
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x2dc]
push ebx
push eax
call section..text
add esp, 0x30
cmp eax, ebx
je 0x401cef
push ebx
push ebx
push eax
push ebx
call ebp
cmp esi, ebx
je 0x401d06
lea eax, [esp + 0x24]
push eax
push str.F_t_s_n
push esi
call fcn.0040224b
add esp, 0xc
push 0x4bb80c
lea eax, [esp + 0x2b8]
push str._sUnSetUp.EXE
push eax
call fcn.00402172
lea eax, [esp + 0x138]
push edi
push eax
call fcn.00402410
lea eax, [esp + 0x140]
push str..uni
push eax
call fcn.00402420
lea eax, [esp + 0x3d8]
push eax
lea eax, [esp + 0x44]
push str._sStart_MenuProgramsTibetan
push eax
call fcn.00402172
add esp, 0x28
lea eax, [esp + 0x24]
push edi
push str.Uninstall__s.lnk
push eax
call fcn.004021d0
pop ecx
lea eax, [esp + eax + 0x2c]
push eax
call fcn.00402172
lea eax, [esp + 0x178]
push str.Uninstall
push eax
call fcn.00402410
lea eax, [esp + 0x180]
push edi
push eax
call fcn.00402420
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x18c]
push eax
push 0x4bb80c
push 1
push ebx
push ebx
lea eax, [esp + 0x160]
push ebx
push eax
lea eax, [esp + 0x2f0]
push eax
call section..text
add esp, 0x40
cmp eax, ebx
je 0x401dcb
push ebx
push ebx
push eax
push ebx
call ebp
cmp esi, ebx
je 0x401de2
lea eax, [esp + 0x24]
push eax
push str.F_t_s_n
push esi
call fcn.0040224b
add esp, 0xc
push 0x40
push edi
push str.Tibetan_program_group_created_under_Start_Programs_and_modified_to_contain_program_and_uninstall_icons.
push ebx
call ebp
cmp esi, ebx
je 0x401df8
push esi
call fcn.0040227d
pop ecx
lea eax, [esp + 0x4c4]
push eax
lea eax, [esp + 0x1b0]
push eax
call fcn.00402410
lea eax, [esp + 0x1b4]
push str.__c_SETUP_3.BAT
push eax
call fcn.00402420
lea eax, [esp + 0x5dc]
push eax
lea eax, [esp + 0x1c0]
push eax
call fcn.00402420
add esp, 0x18
cmp dword [0x4bc980], 8
mov eax, 0x4bbba4
je 0x401e4a
mov eax, 0x4bbba0
push eax
lea eax, [esp + 0x1b0]
push eax
call fcn.00402420
pop ecx
lea eax, [esp + 0x1b0]
pop ecx
push 0x4bc998
push 0x4bb9d8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401e8c
push ebx
lea eax, [esp + 0x1b0]
push ebx
push eax
push ebx
call ebp
jmp 0x401ef1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
lea eax, [esp + 0x18]
push eax
push dword [0x4bc998]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401eb5
cmp dword [esp + 0x18], 0x103
je 0x401e92
push 0xc8
call esi
push 0x24
push edi
push str.Install_completed._n_nDo_you_want_to_run_the_program_
push ebx
call ebp
cmp eax, 6
jne 0x401eed
push 0x4bc998
push 0x4bb9d8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
mov word [0x4bba08], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x1c], ebx
xor esi, esi
mov eax, dword [0x4bc994]
pop ebp
cmp eax, esi
pop ebx
je 0x401f09
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
jmp 0x401f0f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4bc990]
cmp eax, esi
je 0x401f1b
push eax
call edi
mov eax, dword [0x4bc98c]
cmp eax, esi
je 0x401f27
push eax
call edi
mov eax, dword [0x4bc988]
cmp eax, esi
je 0x401f33
push eax
call edi
mov eax, dword [0x4bc984]
cmp eax, esi
je 0x401f3f
push eax
call edi
mov eax, dword [esp + 0x14]
pop edi
pop esi
add esp, 0x6c4
ret 0x10