Function at 0x4027d0
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41570d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1bd8
call fcn.0040c7a0
push ebx
push esi
push edi
lea ecx, [ebp - 0x66c]
mov dword [ebp - 0x10], esp
call fcn.00406ed0
lea ecx, [ebp - 0xd4]
mov dword [ebp - 4], 0
call fcn.00404c60
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x66c]
push esi
mov byte [ebp - 4], 2
call fcn.004073e0
mov ecx, dword [str.ClnExtor.ini]
lea eax, [ebp - 0xcd0]
push eax
push ecx
push esi
mov dword [ebp - 4], 1
call fcn.00404d60
mov eax, dword [str.DebugMode]
mov ecx, dword [str.Common]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0xc
lea edx, [ebp - 0xcd0]
push edx
push 0
push eax
push ecx
call edi
test eax, eax
je 0x40289b
lea edx, [ebp - 0x9c0]
push 4
push edx
call fcn.00404cc0
push 0
lea eax, [ebp - 0x9c0]
push str.ClnExtor.log
push eax
call fcn.00404d60
lea ecx, [ebp - 0x9c0]
push ecx
push 2
call fcn.00404fa0
add esp, 0x1c
mov eax, dword [str.ClnExtor.ini]
lea edx, [ebp - 0x3e8]
push edx
push eax
push esi
call fcn.00404d60
add esp, 0xc
lea ecx, [ebp - 0x3e8]
push ecx
push str.ClnExtor.ini_path_:__s_n
push 0x43c
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov eax, dword [str.PackAll]
mov ecx, dword [str.Common]
add esp, 0x10
lea edx, [ebp - 0x3e8]
push edx
push 0
push eax
push ecx
call edi
mov esi, eax
push esi
push str.bPackAll_:__d_n
push 0x442
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
mov dword [ebp - 0x1c], esi
call fcn.00404e10
add esp, 0x10
mov eax, 1
test esi, esi
mov dword [ebp - 0x24], eax
je 0x40292a
mov ecx, dword [str.Common]
lea edx, [ebp - 0x3e8]
push edx
push eax
mov eax, dword [str.DeleteTemp]
push eax
push ecx
call edi
mov dword [ebp - 0x24], eax
push eax
push str.bDelTemp_:__d_n
push 0x447
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov eax, dword [str.Platform]
mov ecx, dword [str.Common]
add esp, 0x10
lea edx, [ebp - 0x3e8]
push edx
push 0
push eax
push ecx
call edi
mov esi, eax
push esi
push str.nPlatform_:__d_n
push 0x44c
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
mov dword [ebp - 0x20], esi
call fcn.00404e10
mov eax, dword [str.EnableSilent]
mov ecx, dword [str.Common]
add esp, 0x10
lea edx, [ebp - 0x3e8]
push edx
push 0
push eax
push ecx
call edi
mov ebx, eax
push ebx
push str.bSilent_:__d_n
push 0x44f
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
mov dword [ebp - 0x38], ebx
call fcn.00404e10
mov eax, dword [str.MsiPack]
mov ecx, dword [str.Common]
add esp, 0x10
lea edx, [ebp - 0x3e8]
push edx
push 1
push eax
push ecx
call edi
push ebx
push str.bMsiPack_:__d_n
push 0x452
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
mov dword [ebp - 0x14], eax
call fcn.00404e10
mov eax, dword [str.UpdateAgnet]
mov ecx, dword [str.Common]
add esp, 0x10
lea edx, [ebp - 0x3e8]
push edx
push 0
push eax
push ecx
call edi
push eax
push str.bUpdateAgent_:__d_n
push 0x455
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
mov dword [ebp - 0x18], eax
call fcn.00404e10
add esp, 0x10
test esi, esi
jne 0x402af6
cmp dword [ebp - 0xc0], 1
je 0x402bcd
mov ecx, dword [str.9X_package]
lea edx, [ebp - 0x3e8]
push edx
mov edx, dword [str.Message]
lea eax, [ebp - 0x10d0]
push 0x400
push eax
push str.This_package_is_for_ME_98_95_client
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test ebx, ebx
je 0x402a77
lea eax, [ebp - 0x10d0]
push eax
push str.DoExtract__Wrong_Platform__:__s_n
push 0x465
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
jmp 0x402a8d
push 0x10
lea ecx, [ebp - 0x10d0]
push str.ClnExtor_Error
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x402ac4
lea ecx, [ebp - 0x168]
call fcn.004058e0
test ebx, ebx
setne dl
push edx
push 0x41f068
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 5
call fcn.00406440
lea ecx, [ebp - 0x168]
call fcn.00406510
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0
call fcn.00404cb0
lea ecx, [ebp - 0x66c]
mov dword [ebp - 4], 0xffffffff
call fcn.00406f40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc0]
cmp esi, 1
jne 0x402bb7
cmp eax, 2
jne 0x402b17
call fcn.00401080
test eax, eax
je 0x402bcd
mov edx, dword [str.NT_package]
lea eax, [ebp - 0x3e8]
push eax
mov eax, dword [str.Message]
lea ecx, [ebp - 0x10d0]
push 0x400
push ecx
push str.This_package_is_for_2003_XP_2000_NT_client
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test ebx, ebx
je 0x402b66
lea ecx, [ebp - 0x10d0]
push ecx
push str.DoExtract__Wrong_Platform__:__s_n
push 0x486
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
jmp 0x402b7c
push 0x10
lea edx, [ebp - 0x10d0]
push str.ClnExtor_Error
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x402ac4
lea ecx, [ebp - 0x168]
call fcn.004058e0
test ebx, ebx
setne al
push eax
push 0x41f068
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 6
call fcn.00406440
lea ecx, [ebp - 0x168]
jmp 0x402abf
cmp eax, 2
jne 0x404210
call fcn.00401080
test eax, eax
je 0x404210
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x402c90
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x2e0]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [str.Check95]
test esi, esi
je 0x402bf6
mov eax, dword [str.CheckNT]
lea ecx, [ebp - 0x3e8]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
lea edx, [ebp - 0x2e0]
push 0x104
push edx
push 0x41f194
push eax
mov eax, dword [str.Common]
push eax
call edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x774]
lea edx, [ebp - 0x2e0]
push ecx
push edx
push esi
call fcn.00404d60
mov edx, dword [str.Update]
add esp, 0xc
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x2e0]
push eax
mov eax, dword [str.Common]
push 0x104
push ecx
push 0x41f194
push edx
push eax
call edi
lea edi, [ebp - 0x2e0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402ac4
lea ecx, [ebp - 0x12d8]
lea edx, [ebp - 0x2e0]
push ecx
push edx
push esi
call fcn.00404d60
add esp, 0xc
jmp 0x402dc1
mov eax, dword [ebp - 0xc0]
mov byte [ebp - 4], 8
cmp eax, 2
mov eax, str.SoftwareTrendMicroPC_cillinNTCorpCurrentVersion
je 0x402ca9
mov eax, str.SoftwareTrendMicroOfficeScanCorpCurrentVersion
lea ecx, [ebp - 0x14]
push ecx
push 0x2001f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402d4a
mov ecx, dword [str.Update_package]
lea edx, [ebp - 0x3e8]
push edx
mov edx, dword [str.Message]
lea eax, [ebp - 0x10d0]
push 0x400
push eax
push str.This_package_is_for_client_upgrade.
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test ebx, ebx
je 0x402d25
lea eax, [ebp - 0x10d0]
push eax
push str.DoExtract__This_package_is_for_client_upgrade.__:__s_n
push 0x4f8
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp - 0x14]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402ac4
push 0x10
lea ecx, [ebp - 0x10d0]
push str.ClnExtor_Error
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402ac4
mov edx, dword [str.Update]
lea eax, [ebp - 0x3e8]
push eax
mov eax, dword [str.Common]
lea ecx, [ebp - 0x2e0]
push 0x104
push ecx
push 0x41f194
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x2e0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x402d96
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402ac4
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x12d8]
lea eax, [ebp - 0x2e0]
push edx
push eax
push ecx
call fcn.00404d60
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov byte [ebp - 4], 1
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x8b8]
call fcn.00407d50
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 9
call fcn.00406be0
mov ecx, dword [str.OfcZip.Zip]
lea eax, [ebp - 0x2e0]
push eax
push ecx
push esi
mov byte [ebp - 4], 0xb
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x2e0]
push edx
push str.Zip_path___s_n
push 0x510
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea eax, [ebp - 0x2e0]
lea ecx, [ebp - 0x8b8]
push eax
call fcn.00407d90
push eax
push str.unZip_Open__nZipRtn___d__n
push 0x513
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push esi
push str.Zip_extract_to___s_n
push 0x514
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp + 8]
add esp, 0x10
push 0
push 0
push 1
push 1
push ecx
lea ecx, [ebp - 0x8b8]
call fcn.00407e60
mov esi, eax
push esi
push str.unZip_Extract__nZipRtn___d__n
push 0x517
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
test esi, esi
je 0x402edb
test ebx, ebx
je 0x402eb7
push esi
push str.DoExtract__unzip_failed__nZipRtn___d_n
push 0x51f
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea ecx, [ebp - 0x8b8]
call fcn.00407e40
jmp 0x404190
push 0x10
push str.ClnExtor_Error
push str.UnZip_failed__please_run_this_pack_again.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x8b8]
call fcn.00407e40
jmp 0x404190
lea ecx, [ebp - 0x8b8]
call fcn.00407e40
push str.Do_we_need_uninstall_msi..._n
push 0x419404
push 0x52f
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp + 8]
add esp, 0x10
push edx
call fcn.00401480
add esp, 4
test eax, eax
jne 0x402f44
push str.Do_uninstall_msi..._n
push 0x419404
push 0x532
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
call fcn.00401920
mov eax, dword [ebp + 8]
push eax
call fcn.00405140
add esp, 4
jmp 0x404190
push str.No_need_to_uninstall_msi..._n
push 0x419404
push 0x537
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [str.EnableSilent]
mov eax, dword [str.Common]
add esp, 0x10
lea ecx, [ebp - 0x3e8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xac4]
push ecx
push str.Autopcc.cfgAUTOPCC.INI
push edx
mov ebx, eax
call fcn.00404d60
add esp, 0xc
lea eax, [ebp - 0xac4]
push eax
push str.Autopcc_ini_file_path___s_n
push 0x53f
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
mov eax, 0x419ee0
test ebx, ebx
jne 0x402fc2
mov eax, 0x419edc
mov edx, dword [str.SilentInstall]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0xac4]
push ecx
push eax
push edx
push str.Install
call esi
mov ecx, dword [str.EnableNoPrescan]
mov edx, dword [str.Common]
lea eax, [ebp - 0x3e8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
mov eax, 0x419ee0
jne 0x403009
mov eax, 0x419edc
mov edx, dword [str.NoPrescan]
lea ecx, [ebp - 0xac4]
push ecx
push eax
push edx
push str.Install
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1d8]
push eax
push str.ADMIN_tmdbg20.dll
push ecx
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x1d8]
push edx
push str.szSourcePath___s_n
push 0x553
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x548]
push eax
push str.tmdbg20.dll
push ecx
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x548]
push edx
push str.szDestPath___s_n
push 0x558
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x1d8]
push 0
push eax
push ecx
call fcn.00405480
mov eax, dword [str.ForceOverwrite]
mov ecx, dword [str.Common]
add esp, 0xc
lea edx, [ebp - 0x3e8]
push edx
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4030f3
mov edi, 0x419e88
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x12d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x12d8]
push eax
push str.szCommand___s_n
push 0x562
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebp - 0xcd0]
push ecx
push str.Autopccp.exe
push edx
call fcn.00404d60
add esp, 0xc
lea eax, [ebp - 0xcd0]
push 0
push eax
call fcn.0040c7cf
add esp, 8
cmp eax, 0xffffffff
jne 0x403170
test ebx, ebx
je 0x403157
push str.DoExtract_____Autopccp.exe_not_found___n
push 0x419404
push 0x56d
jmp 0x404183
push 0x10
push str.ClnExtor_Error
push str.Autopccp.exe_not_found___please_run_this_pack_again.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404190
push str.begin_run_autopccp..._n
push 0x419404
push 0x578
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea ecx, [ebp - 0x12d8]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8000000
push ecx
lea ecx, [ebp - 0x444]
call fcn.00406c70
push 0xffffffffffffffff
lea ecx, [ebp - 0x444]
call fcn.00406d30
push str.end_run_autopccp..._n
push 0x419404
push 0x57e
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov eax, dword [ebp - 0x1c]
xor esi, esi
add esp, 0x10
cmp eax, esi
je 0x40346d
cmp dword [ebp - 0x24], esi
je 0x403354
mov ecx, dword [ebp - 0xc0]
xor edx, edx
cmp ecx, 2
mov dword [ebp - 0x1c], esi
sete dl
mov edi, edx
push edi
push str.bIsNT___d_n
push 0x587
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00401ed0
add esp, 8
test eax, eax
jne 0x40346d
cmp dword [ebp - 0x1c], 1
jne 0x40324e
xor esi, esi
push esi
push str.Reset_counter___d_n
push 0x58e
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x12c
jne 0x403219
mov edx, dword [str.RetryDeleteTemp]
mov eax, dword [str.Common]
lea ecx, [ebp - 0x3e8]
xor esi, esi
push ecx
push 0x168
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
mov edi, 0x4161f0
lea ecx, [ebp - 0x774]
push 0
push ecx
call fcn.0040c7cf
add esp, 8
cmp eax, 0xffffffff
je 0x4032bc
cmp esi, ebx
jb 0x4032d8
push esi
push str.dwWaitTimes:__u__max:_180__n
push 0x5a2
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
cmp esi, ebx
jb 0x40346d
push str.Timeout___n
push 0x419404
push 0x5c6
jmp 0x404183
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0xc0]
mov byte [ebp - 4], 0xc
cmp eax, 1
jne 0x403315
lea edx, [ebp - 0x774]
push edx
call fcn.00401350
add esp, 4
test eax, eax
je 0x40330e
lea eax, [ebp - 0x774]
push eax
call fcn.004055e0
add esp, 4
jmp 0x40333c
push str.9x_still_running
jmp 0x403334
lea ecx, [ebp - 0x774]
push ecx
call fcn.004055e0
add esp, 4
test eax, eax
jne 0x40332f
push str.NT_finish_running
jmp 0x403334
push str.NT_still_running
lea ecx, [ebp - 0x14]
call fcn.00402220
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x14], edi
jmp 0x40328a
mov eax, dword [ebp - 0xc0]
mov ebx, 0x60
cmp eax, 1
jne 0x4033be
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp esi, ebx
jge 0x40338c
lea edx, [ebp - 0x14]
push edx
push 0
call fcn.00401ed0
add esp, 8
test eax, eax
jne 0x40338c
push 0x1388
call edi
inc esi
jmp 0x40336c
push 0x1388
call edi
xor esi, esi
cmp esi, ebx
jge 0x40346d
lea eax, [ebp - 0x774]
push eax
call fcn.00401350
add esp, 4
test eax, eax
jne 0x40346d
push 0x1388
call edi
inc esi
jmp 0x403395
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp esi, ebx
jge 0x4033e6
lea ecx, [ebp - 0x14]
push ecx
push 1
call fcn.00401ed0
add esp, 8
test eax, eax
jne 0x4033e6
push 0x1388
call edi
inc esi
jmp 0x4033c6
push 0x1388
call edi
lea edx, [ebp - 0x9c0]
push edx
push 0
push str.ClnPack
push 0x419d48
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x9c0]
push 0
lea ecx, [ebp - 0x774]
push eax
push ecx
call fcn.00405480
add esp, 0xc
xor esi, esi
cmp esi, ebx
jge 0x403444
lea edx, [ebp - 0x774]
push edx
call fcn.004055e0
add esp, 4
cmp eax, 5
jne 0x403442
push 0x1388
call edi
inc esi
jmp 0x403420
cmp esi, ebx
je 0x40345e
lea eax, [ebp - 0x774]
push 0
lea ecx, [ebp - 0x9c0]
push eax
push ecx
call fcn.00405480
add esp, 0xc
lea edx, [ebp - 0x9c0]
push edx
call fcn.004055e0
add esp, 4
mov ecx, dword [str.UpdatePFWPolicy]
mov edx, dword [str.Common]
lea eax, [ebp - 0x3e8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x403788
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x403788
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1d8]
push eax
push str.DownloadOfcPfw.dat
push ecx
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
call fcn.00401d30
add esp, 4
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0xd
test eax, eax
jne 0x4034d1
mov eax, 0x4161e8
lea ecx, [ebp - 0x548]
push ecx
push str.OfcPfw.dat
push eax
call fcn.00404d60
mov ecx, dword [ebp - 0x30]
add esp, 0xc
test ecx, ecx
mov byte [ebp - 4], 0xb
je 0x40350c
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x403503
cmp al, 0xff
je 0x403503
dec al
mov byte [ecx], al
jmp 0x40350c
push ecx
call fcn.0040c226
add esp, 4
lea edx, [ebp - 0x548]
push 0
lea eax, [ebp - 0x1d8]
push edx
push eax
call fcn.00405480
add esp, 0xc
lea ecx, [ebp - 0x1d8]
mov esi, eax
push ecx
push str.CopyFile__OfcPfw.dat__Source_:__s_n
push 0x64e
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea edx, [ebp - 0x548]
push edx
push str.CopyFile__OfcPfw.dat__Dest.__:__s_n
push 0x64f
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push esi
push str.CopyFile_nRtn_:__d_n
push 0x650
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x1d8]
push eax
push str.Engine_tmCfwApi.dll
push ecx
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
call fcn.00401d30
add esp, 4
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x4035ae
mov eax, 0x4161e8
lea ecx, [ebp - 0x548]
push ecx
push str.TempPFW_tmCfwApi.dll
push eax
call fcn.00404d60
mov ecx, dword [ebp - 0x30]
add esp, 0xc
test ecx, ecx
mov byte [ebp - 4], 0xb
je 0x4035e9
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4035e0
cmp al, 0xff
je 0x4035e0
dec al
mov byte [ecx], al
jmp 0x4035e9
push ecx
call fcn.0040c226
add esp, 4
lea edx, [ebp - 0x548]
push 0
lea eax, [ebp - 0x1d8]
push edx
push eax
call fcn.00405480
add esp, 0xc
lea ecx, [ebp - 0x1d8]
mov esi, eax
push ecx
push str.CopyFile__tmCfwApi.dll__Source_:__s_n
push 0x65a
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea edx, [ebp - 0x548]
push edx
push str.CopyFile__tmCfwApi.dll__Dest.__:__s_n
push 0x65b
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push esi
push str.CopyFile_nRtn_:__d_n
push 0x65c
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x1d8]
push eax
push str.PCCNTDRVTM_CFW.sys
push ecx
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
call fcn.00401d30
add esp, 4
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0xf
test eax, eax
jne 0x40368b
mov eax, 0x4161e8
lea ecx, [ebp - 0x548]
push ecx
push str.TempPFWTM_CFW.sys
push eax
call fcn.00404d60
mov ecx, dword [ebp - 0x30]
add esp, 0xc
test ecx, ecx
mov byte [ebp - 4], 0xb
je 0x4036c6
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4036bd
cmp al, 0xff
je 0x4036bd
dec al
mov byte [ecx], al
jmp 0x4036c6
push ecx
call fcn.0040c226
add esp, 4
lea edx, [ebp - 0x548]
push 0
lea eax, [ebp - 0x1d8]
push edx
push eax
call fcn.00405480
add esp, 0xc
lea ecx, [ebp - 0x1d8]
mov esi, eax
push ecx
push str.CopyFile__TM_CFW.sys__Source_:__s_n
push 0x665
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea edx, [ebp - 0x548]
push edx
push str.CopyFile__TM_CFW.sys__Dest.__:__s_n
push 0x666
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push esi
push str.CopyFile_nRtn_:__d_n
push 0x667
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push str.OfcPfwSvc
call fcn.00402150
add esp, 4
push eax
push str.OfcPfwSvc
push str.StopOSCEService__s___d__n
push 0x66b
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x14
push str.OfcPfwSvc
call fcn.004020c0
add esp, 4
push eax
push str.OfcPfwSvc
push str.StartOSCEService__s___d__n
push 0x66d
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x14
mov ecx, dword [str.ous.ini]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x1d8]
push eax
push ecx
push edx
call fcn.00404d60
add esp, 0xc
lea eax, [ebp - 0x1d8]
push eax
push str.CopyFile__ous.ini__Source_:__s_n
push 0x673
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea ecx, [ebp - 0x1d8]
push 0
push ecx
call fcn.0040c7cf
add esp, 8
cmp eax, 0xffffffff
je 0x403883
lea edx, [ebp - 0x34]
push edx
call fcn.00401d30
add esp, 4
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0x10
test eax, eax
jne 0x4037f6
mov eax, 0x4161e8
mov edx, dword [str.ous.ini]
lea ecx, [ebp - 0x548]
push ecx
push edx
push eax
call fcn.00404d60
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 0xb
je 0x403835
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40382c
cmp al, 0xff
je 0x40382c
dec al
mov byte [ecx], al
jmp 0x403835
push ecx
call fcn.0040c226
add esp, 4
lea eax, [ebp - 0x548]
push eax
push str.CopyFile__ous.ini__Dest.__:__s_n
push 0x679
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea ecx, [ebp - 0x548]
lea edx, [ebp - 0x1d8]
push 0
push ecx
push edx
call fcn.00405480
add esp, 0xc
push eax
push str.CopyFile_nRtn_:__d_n
push 0x67c
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
mov edx, dword [str.POP3MailScan]
lea eax, [ebp - 0x3e8]
push eax
mov eax, dword [str.Unpack]
lea ecx, [ebp - 0x2e0]
push 0x104
push ecx
push 0x41f194
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x2e0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40399c
push str._POP3_install_update__n
push 0x419404
push 0x688
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x11
push ecx
push 0x2001f
push 0
push str.SoftwareTrendMicroPC_cillinMailScan
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40391e
lea edx, [ebp - 0x20]
push 4
push edx
push 4
mov dword [ebp - 0x20], eax
push eax
mov eax, dword [ebp - 0x14]
push str.OnOff
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.begin_run_pop3_installer..._n
push 0x419404
push 0x691
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebp - 0x2e0]
push 0x8000000
push ecx
push edx
call fcn.00401a60
add esp, 0xc
push str.end_run_pop3_installer..._n
push 0x419404
push 0x695
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp - 0x14]
add esp, 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 1
push 4
push eax
push 4
push 0
push str.OnOff
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.OutlookMailScan]
lea eax, [ebp - 0x3e8]
push eax
mov eax, dword [str.Unpack]
lea ecx, [ebp - 0x2e0]
push 0x104
push ecx
push 0x41f194
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x2e0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403a76
push str._Outlook_install_update__n
push 0x419404
push 0x6a1
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push str.OfficeScan_Outlook_Mail_Scan
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x403a26
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x12
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push str.begin_run_outlook_installer..._n
push 0x419404
push 0x6aa
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebp - 0x2e0]
push 0x8000000
push ecx
push edx
call fcn.00401a60
add esp, 0xc
push str.end_run_outlook_installer..._n
push 0x419404
push 0x6ae
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
mov edx, dword [str.SecureClinet]
lea eax, [ebp - 0x3e8]
push eax
mov eax, dword [str.Unpack]
lea ecx, [ebp - 0x2e0]
push 0x104
push ecx
push 0x41f194
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x2e0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403c3e
cmp dword [ebp - 0xc0], 2
jne 0x403c3e
push str._SecureClient_install__n
push 0x419404
push 0x6bb
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebp - 0x2e0]
mov esi, 1
push 0x8000000
push ecx
push edx
call fcn.00401a60
add esp, 0xc
test eax, eax
je 0x403c2a
lea eax, [ebp - 0x34]
push eax
call fcn.00401d30
add esp, 4
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0x12
test eax, eax
jne 0x403b21
mov eax, 0x4161e8
lea ecx, [ebp - 0xbc8]
push ecx
push 0x41f194
push eax
call fcn.00404d60
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 0xb
je 0x403b5e
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x403b55
cmp al, 0xff
je 0x403b55
dec al
mov byte [ecx], al
jmp 0x403b5e
push ecx
call fcn.0040c226
add esp, 4
push 0x8000000
lea edx, [ebp - 0xbc8]
push str.pireg.exe__d_ofcescv.dll
push edx
call fcn.00401a60
add esp, 0xc
lea eax, [ebp - 0xbc8]
push 0x8000000
push str.pireg.exe_ofcescv.dll
push eax
call fcn.00401a60
add esp, 0xc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x13
push ecx
push 0x2001f
push 0
push str.SOFTWARECheckPointSecuRemoteSCVPluginsOfceScv6.7
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403c16
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x9c0]
push edx
push eax
push 0
push 0
push str.IMAGEPATH
push ecx
mov dword [ebp - 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403c16
lea edx, [ebp - 0x13e0]
lea eax, [ebp - 0xbc8]
push edx
push str.ofcescv.dll
push eax
call fcn.00404d60
add esp, 0xc
lea ecx, [ebp - 0x9c0]
lea edx, [ebp - 0x13e0]
push 0x105
push ecx
push edx
call fcn.0040d082
add esp, 0xc
test eax, eax
je 0x403c18
xor esi, esi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x403c3e
push 0x10
push str.Error
push str.OfficeScan_did_not_detect_the_Check_Point_SecureClient_application_on_your_computer._nPlease_install_Check_Point_SecureClient_and_try_again.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str._For_all_msi_use__n
push 0x419404
push 0x706
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [str.Number]
mov eax, dword [0x4190dc]
add esp, 0x10
lea ecx, [ebp - 0x3e8]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
mov esi, 1
cmp esi, ebx
jg 0x403d3c
mov ecx, dword [str.File]
push esi
push ecx
push str._s_d
lea edx, [ebp - 0x7a8]
push 0x32
push edx
call fcn.0040d031
add esp, 0x14
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x2e0]
lea edx, [ebp - 0x7a8]
push eax
mov eax, dword [0x4190dc]
push 0x104
push ecx
push 0x41f194
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x2e0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403d36
lea ecx, [ebp - 0x2e0]
push ecx
push esi
push str.begin_run_msi__d__:__s_n
push 0x719
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov eax, dword [ebp + 8]
add esp, 0x14
lea edx, [ebp - 0x2e0]
push 0x8000000
push edx
push eax
call fcn.00401a60
add esp, 0xc
lea ecx, [ebp - 0x2e0]
push ecx
push esi
push str.end_run_msi__d__:__s_n
push 0x71e
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x14
inc esi
jmp 0x403c7d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4040c3
push str.need_to_enable_UpdateAgent_n
push 0x419404
push 0x729
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
push edx
push 0x2001f
push 0
push str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionMisc.
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403e8e
push str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionMisc.
push str.set_key_value_in:__s_n
push 0x72e
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0
push str.UpdateAgent
push ecx
mov dword [ebp - 0x18], 1
call esi
push str.UpdateAgent
push str.set_key:__s_to_1_n
push 0x730
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov eax, dword [ebp - 0x14]
add esp, 0x10
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push 4
push edx
push 4
push 0
push str.RemoteUpdateAgent
push eax
call esi
push str.RemoteUpdateAgent
push str.set_key:__s_to_1_n
push 0x732
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp - 0x14]
add esp, 0x10
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push 4
push ecx
push 4
push 0
push str.AllowUpdateFromTMAU
push edx
call esi
push str.AllowUpdateFromTMAU
push str.set_key:__s_to_1_n
push 0x734
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp - 0x14]
add esp, 0x10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push 4
push eax
push 4
push 0
push str.AllowUpdateFromOtherAU
push ecx
call esi
push str.AllowUpdateFromOtherAU
push str.set_key:__s_to_1_n
push 0x736
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
jmp 0x403e94
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x1c]
mov bl, 0x15
push edx
push 0x2001f
push 0
push str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionSchedule_Update
push 0x80000002
mov byte [ebp - 4], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403fb8
push str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionSchedule_Update
push str.set_key_value_in:__s_n
push 0x73d
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push 4
push eax
push 4
push 0
push str.AllowScheduleUpdate
push ecx
call esi
push str.AllowScheduleUpdate
push str.set_key:__s_to_1_n
push 0x73f
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov eax, dword [ebp - 0x1c]
add esp, 0x10
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push 4
push edx
push 4
push 0
push str.EnableDisable
push eax
call esi
push str.EnableDisable
push str.set_key:__s_to_1_n
push 0x741
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov edx, dword [ebp - 0x1c]
add esp, 0x10
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x15180
push 4
push ecx
push 4
push 0
push str.ScheduleUpdateInterval
push edx
call esi
push str.ScheduleUpdateInterval
push str.set_key:__s_to_86400_n
push 0x743
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xe10
push 4
push eax
push 4
push 0
push str.ScheduleUpdateCompletePeriod
push ecx
call esi
push str.ScheduleUpdateCompletePeriod
push str.set_key:__s_to_3600_n
push 0x745
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
mov eax, dword [str.SUCTool.exe]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1d8]
push edx
push eax
push ecx
call fcn.00404d60
add esp, 0xc
lea edx, [ebp - 0x1d8]
push edx
push str.CopyFile__tool__Source_:__s_n
push 0x74a
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0040c7cf
add esp, 8
cmp eax, 0xffffffff
je 0x4040b1
lea ecx, [ebp - 0x34]
push ecx
call fcn.00401d30
add esp, 4
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0x16
test eax, eax
jne 0x404025
mov eax, 0x4161e8
mov ecx, dword [str.SUCTool.exe]
lea edx, [ebp - 0x548]
push edx
push ecx
push eax
call fcn.00404d60
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], bl
je 0x404063
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40405a
cmp al, 0xff
je 0x40405a
dec al
mov byte [ecx], al
jmp 0x404063
push ecx
call fcn.0040c226
add esp, 4
lea edx, [ebp - 0x548]
push edx
push str.CopyFile__tool__Dest.__:__s_n
push 0x750
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea eax, [ebp - 0x548]
lea ecx, [ebp - 0x1d8]
push 0
push eax
push ecx
call fcn.00405480
add esp, 0xc
push eax
push str.CopyFile_nRtn_:__d_n
push 0x753
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
mov edx, dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x14]
push eax
call esi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40416d
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x24], 0x4161f0
lea ecx, [ebp - 0x774]
push 0
push ecx
mov byte [ebp - 4], 0x17
call fcn.0040c7cf
add esp, 8
cmp eax, 0xffffffff
je 0x404139
cmp dword [ebp - 0xc0], 1
jne 0x40411f
lea edx, [ebp - 0x774]
push edx
call fcn.00401350
add esp, 4
test eax, eax
jne 0x404139
cmp dword [ebp - 0xc0], 1
je 0x404132
lea eax, [ebp - 0x774]
push eax
call fcn.004055e0
add esp, 4
test eax, eax
je 0x404139
push str.Skip_to_delete_temp_folder
jmp 0x40414a
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405140
add esp, 4
push str.delete_temp_folder_...
lea ecx, [ebp - 0x24]
call fcn.00402220
mov edx, dword [ebp + 8]
push edx
push str.Delete_Temp_Directory_:__s_n
push 0x76d
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
push str.Leave_DoExtract___n
push 0x419404
mov dword [ebp - 4], 0xa
push 0x780
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 9
call fcn.00406c40
lea ecx, [ebp - 0x8b8]
mov byte [ebp - 4], 1
call fcn.00407d80
jmp 0x402ac4
mov ecx, dword [str.IA64_package]
lea edx, [ebp - 0x3e8]
push edx
mov edx, dword [str.Message]
lea eax, [ebp - 0x10d0]
push 0x400
push eax
push str.This_package_is_for_XP_Server_2003_on_IA64
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test ebx, ebx
je 0x404260
lea eax, [ebp - 0x10d0]
push eax
push str.DoExtract__Wrong_Platform__:__s_n
push 0x4a6
push str.D:OfficeScan_srcUtilityClientPackagerClientExtractorcp_ClientExtractor.cpp
call fcn.00404e10
add esp, 0x10
jmp 0x404276
push 0x10
lea ecx, [ebp - 0x10d0]
push str.ClnExtor_Error
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x402ac4
lea ecx, [ebp - 0x168]
call fcn.004058e0
test ebx, ebx
setne dl
push edx
push 0x41f068
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 7
call fcn.00406440
lea ecx, [ebp - 0x168]
jmp 0x402abf