Function at 0x4a9de0
Capabilities:
Get file size
Get installed programs
Query or enumerate registry key
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28c0
call fcn.004f23a0
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x48c
mov dword [ebp - 0x28a0], eax
xor edi, edi
lea eax, [ebp - 0xc42]
xor edx, edx
push edi
push eax
mov dword [ebp - 0x289c], ecx
mov word [ebp - 0xc44], dx
call fcn.004e8ba0
mov esi, 0x200
add esp, 0xc
mov dword [ebp - 0x2898], esi
call fcn.004bc0d0
test eax, eax
je 0x4a9e48
mov esi, 0x100
mov dword [ebp - 0x2898], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x286c]
push ecx
or esi, 8
push esi
push edi
push str.SoftwareClassesInstallerProducts_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x286c], edi
call ebx
test eax, eax
jne 0x4aa57a
push 0x3fe
lea eax, [ebp - 0x204a]
xor edx, edx
push edi
push eax
mov dword [ebp - 0x2870], edi
mov word [ebp - 0x204c], dx
call fcn.004e8ba0
push 0x400
lea ecx, [ebp - 0x124c]
push edi
push ecx
mov dword [ebp - 0x2868], edi
call fcn.004e8ba0
mov eax, dword [ebp - 0x286c]
add esp, 0x18
push 0x400
lea edx, [ebp - 0x124c]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4aa57a
mov eax, dword [ebp - 0x2898]
or eax, 1
mov dword [ebp - 0x2890], eax
push 0x400
lea ecx, [ebp - 0x204c]
push edi
push ecx
call fcn.004e8ba0
lea edx, [ebp - 0x124c]
push edx
lea eax, [ebp - 0x204c]
push str.SoftwareClassesInstallerProducts_sPatches
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x2890]
add esp, 0x18
lea ecx, [ebp - 0x2878]
push ecx
push edx
push edi
lea eax, [ebp - 0x204c]
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2878], edi
call ebx
test eax, eax
jne 0x4aa537
mov edx, dword [ebp - 0x2878]
lea ecx, [ebp - 0x2868]
push ecx
push edi
push edi
push edi
push str.Patches
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x2868]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e5420
mov esi, eax
mov eax, dword [ebp - 0x2868]
lea ecx, [eax + eax]
push ecx
push edi
push esi
mov dword [ebp - 0x2894], esi
call fcn.004e8ba0
mov eax, dword [ebp - 0x2878]
add esp, 0x10
lea edx, [ebp - 0x2868]
push edx
push esi
push edi
push edi
push str.Patches
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x3fe
lea edx, [ebp - 0x164a]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x164c], cx
call fcn.004e8ba0
lea eax, [ebp - 0x124c]
push eax
lea ecx, [ebp - 0x164c]
push str.SoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products_sInstallProperties
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x2890]
add esp, 0x18
lea edx, [ebp - 0x2874]
push edx
push eax
push edi
lea ecx, [ebp - 0x164c]
push ecx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2874], edi
call ebx
test eax, eax
jne 0x4aa506
mov ecx, dword [ebp - 0x2874]
lea edx, [ebp - 0x2864]
push edx
lea eax, [ebp - 0x288c]
push eax
push edi
push edi
push str.SystemComponent
push ecx
mov dword [ebp - 0x288c], edi
mov dword [ebp - 0x2864], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4aa098
cmp dword [ebp - 0x288c], 1
jne 0x4aa098
mov eax, dword [ebp - 0x2868]
cmp eax, edi
jbe 0x4aa069
lea edx, [eax + eax]
push edx
push edi
push esi
call fcn.004e8ba0
push esi
call fcn.004e577a
add esp, 0x10
mov eax, dword [ebp - 0x2874]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x2870]
push eax
call esi
mov ecx, dword [ebp - 0x2878]
push ecx
mov dword [ebp - 0x2874], edi
call esi
mov dword [ebp - 0x2878], edi
jmp 0x4aa53d
mov edx, dword [ebp - 0x2868]
add edx, 0xfffffffe
mov dword [ebp - 0x2880], edi
je 0x4aa4e7
lea ecx, [ecx]
push 0
push esi
call fcn.004e53f9
mov ebx, eax
sub ebx, esi
mov dword [ebp - 0x287c], eax
sar ebx, 1
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e5420
mov edi, eax
lea eax, [ebx + ebx + 2]
push eax
push 0
push edi
mov dword [ebp - 0x28a4], edi
call fcn.004e8ba0
push ebx
push esi
push edi
call fcn.004e5481
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x1c4a]
push ecx
mov word [ebp - 0x1c4c], ax
call fcn.004e8ba0
push edi
lea edx, [ebp - 0x124c]
push edx
lea eax, [ebp - 0x1c4c]
push str.SoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products_sPatches_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x2890]
add esp, 0x40
lea ecx, [ebp - 0x2860]
push ecx
push edx
push 0
lea eax, [ebp - 0x1c4c]
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2860], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aa4a1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x2864]
push ecx
lea edx, [ebp - 0x2888]
push edx
push eax
push eax
mov dword [ebp - 0x2888], eax
mov eax, dword [ebp - 0x2860]
push 0x52557c
push eax
mov dword [ebp - 0x2864], 4
call esi
test eax, eax
jne 0x4aa1f2
cmp dword [ebp - 0x2888], 2
jne 0x4aa1f2
lea eax, [ebx + ebx + 2]
push eax
push 0
push edi
call fcn.004e8ba0
push edi
call fcn.004e577a
mov ecx, dword [ebp - 0x2880]
mov edx, dword [ebp - 0x2860]
mov esi, dword [ebp - 0x287c]
add esp, 0x10
lea ebx, [ecx + ebx*2 + 4]
push edx
mov dword [ebp - 0x2880], ebx
add esi, 2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2860], 0
jmp 0x4aa4d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
push 0xfe
push eax
lea ecx, [ebp - 0x1aa]
push ecx
mov word [ebp - 0x1ac], ax
call fcn.004e8ba0
mov ecx, dword [ebp - 0x2860]
add esp, 0xc
lea edx, [ebp - 0x2864]
push edx
lea eax, [ebp - 0x1ac]
push eax
push 0
push 0
push str.DisplayName
push ecx
mov dword [ebp - 0x2864], 0x100
call esi
lea eax, [ebp - 0x1ac]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa250
sub eax, edx
sar eax, 1
jne 0x4aa2ac
lea eax, [ebx + ebx + 2]
push eax
push 0
push edi
call fcn.004e8ba0
push edi
call fcn.004e577a
mov edx, dword [ebp - 0x2880]
mov eax, dword [ebp - 0x2860]
mov esi, dword [ebp - 0x287c]
add esp, 0x10
lea ebx, [edx + ebx*2 + 4]
push eax
mov dword [ebp - 0x2880], ebx
add esi, 2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2860], 0
jmp 0x4aa4d0
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x6b2]
push edx
mov word [ebp - 0x6b4], cx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2860]
add esp, 0xc
lea eax, [ebp - 0x2864]
push eax
lea ecx, [ebp - 0x6b4]
push ecx
push 0
push 0
push str.MoreInfoURL
push edx
mov dword [ebp - 0x2864], 0x200
call esi
xor eax, eax
lea ecx, [ebp - 0x2864]
push ecx
lea edx, [ebp - 0x28]
push edx
push eax
push eax
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov eax, dword [ebp - 0x2860]
push str.Installed
push eax
mov dword [ebp - 0x2864], 0x20
call esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x4b2]
push edx
mov word [ebp - 0x4b4], cx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2874]
add esp, 0xc
lea eax, [ebp - 0x2864]
push eax
lea ecx, [ebp - 0x4b4]
push ecx
push 0
push 0
push str.DisplayName
push edx
mov dword [ebp - 0x2864], 0x208
call esi
lea eax, [ebp - 0x4b4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa390
sub eax, edx
sar eax, 1
jne 0x4aa3c7
xor eax, eax
jmp 0x4aa3b0
movzx ecx, word [eax + str.g_ac]
mov word [ebp + eax - 0x4b4], cx
add eax, 2
test cx, cx
jne 0x4aa3b0
push 0x48e
lea eax, [ebp - 0xc44]
push 0
push eax
call fcn.004e8ba0
lea ecx, [ebp - 0x6b4]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0xc44]
push str._s_t_t_s_t_t_t_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xc44]
add esp, 0x20
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa410
sub eax, edx
sar eax, 1
mov edx, 1
mov word [ebp + eax*2 - 0xc44], dx
mov eax, dword [ebp - 0x289c]
cmp dword [eax], 0x400
jae 0x4aa488
lea eax, [ebp - 0xc44]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa442
mov edi, dword [ebp - 0x28a0]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4aa460
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4aa460
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x289c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x28a4]
inc dword [eax]
mov eax, dword [ebp - 0x2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2860], 0
lea eax, [ebx + ebx + 2]
push eax
push 0
push edi
call fcn.004e8ba0
push edi
call fcn.004e577a
mov ecx, dword [ebp - 0x2880]
mov esi, dword [ebp - 0x287c]
lea ebx, [ecx + ebx*2 + 2]
add esp, 0x10
mov dword [ebp - 0x2880], ebx
add esi, 2
mov edx, dword [ebp - 0x2868]
add edx, 0xfffffffe
cmp ebx, edx
jb 0x4aa0b0
mov esi, dword [ebp - 0x2894]
mov eax, dword [ebp - 0x2874]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2874], 0
xor edi, edi
mov eax, dword [ebp - 0x2868]
cmp eax, edi
jbe 0x4aa524
lea ecx, [eax + eax]
push ecx
push edi
push esi
call fcn.004e8ba0
push esi
call fcn.004e577a
add esp, 0x10
mov edx, dword [ebp - 0x2878]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2878], edi
inc dword [ebp - 0x2870]
push 0x400
lea eax, [ebp - 0x124c]
push edi
push eax
call fcn.004e8ba0
mov edx, dword [ebp - 0x2870]
mov eax, dword [ebp - 0x286c]
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x124c]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4a9ee1
mov ecx, dword [ebp - 0x286c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x286c]
push edx
push 0x208
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x286c], edi
call ebx
test eax, eax
jne 0x4aac7b
push 0x400
mov dword [ebp - 0x2868], edi
call fcn.004e5420
mov esi, eax
push 0x800
mov dword [ebp - 0x2890], esi
call fcn.004e5420
push 0x208
mov dword [ebp - 0x2870], eax
mov dword [ebp - 0x2860], edi
call fcn.004e5420
push 0x400
mov ebx, eax
push edi
push esi
mov dword [ebp - 0x288c], ebx
call fcn.004e8ba0
mov eax, dword [ebp - 0x286c]
add esp, 0x18
push 0x400
push esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4aac35
mov edi, dword [ebp - 0x2870]
sub edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov dword [ebp - 0x2894], edi
jmp 0x4aa63c
mov esi, dword [ebp - 0x2890]
mov edi, dword [ebp - 0x2894]
mov ecx, dword [ebp - 0x2870]
push 0x800
push 0
push ecx
call fcn.004e8ba0
add esp, 0xc
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
jmp 0x4aa660
movzx ecx, word [eax]
mov word [eax + edi], cx
add eax, 2
test cx, cx
jne 0x4aa660
mov eax, esi
mov edx, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa673
mov edi, dword [ebp - 0x2870]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4aa690
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x2864]
push edx
push 0x201
mov ecx, eax
mov eax, dword [ebp - 0x2870]
push 0
push eax
and ecx, 3
push reloc.WS2_32.dll_bind
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2864], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aabf7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x2860]
push ecx
lea edx, [ebp - 0x2888]
push edx
push eax
push eax
mov dword [ebp - 0x2888], eax
mov eax, dword [ebp - 0x2864]
push str.SystemComponent
push eax
mov dword [ebp - 0x2860], 4
call esi
test eax, eax
jne 0x4aa73b
mov eax, 1
cmp dword [ebp - 0x2888], eax
jne 0x4aa73b
mov ecx, dword [ebp - 0x2864]
add dword [ebp - 0x2868], eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aabfd
mov edi, 0x208
push edi
push 0
push ebx
mov dword [ebp - 0x2860], edi
call fcn.004e8ba0
mov eax, dword [ebp - 0x2864]
add esp, 0xc
lea edx, [ebp - 0x2860]
push edx
push ebx
push 0
push 0
push str.ParentKeyName
push eax
call esi
test eax, eax
jne 0x4aad2b
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa780
sub eax, edx
sar eax, 1
je 0x4aad2b
push edi
push 0
push ebx
mov dword [ebp - 0x2860], edi
call fcn.004e8ba0
mov edx, dword [ebp - 0x2864]
add esp, 0xc
lea ecx, [ebp - 0x2860]
push ecx
push ebx
push 0
push 0
push str.UninstallString
push edx
call esi
test eax, eax
jne 0x4aa8c1
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa7d0
sub eax, edx
sar eax, 1
je 0x4aa8c1
push edi
push 0
push ebx
mov dword [ebp - 0x2860], edi
call fcn.004e8ba0
mov ecx, dword [ebp - 0x2864]
add esp, 0xc
lea eax, [ebp - 0x2860]
push eax
push ebx
push 0
push 0
push str.ParentDisplayName
push ecx
call esi
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x4b2]
push eax
mov word [ebp - 0x4b4], dx
call fcn.004e8ba0
lea edx, [ebp - 0x4b4]
add esp, 0xc
mov eax, ebx
sub edx, ebx
lea esp, [esp]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x4aa840
push edi
push 0
push ebx
call fcn.004e8ba0
xor ecx, ecx
push 0xfe
push ecx
lea edx, [ebp - 0x1aa]
push edx
mov word [ebp - 0x1ac], cx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2864]
add esp, 0x18
lea eax, [ebp - 0x2860]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
push 0
push 0
push str.DisplayName
push edx
mov dword [ebp - 0x2860], 0x100
call esi
lea eax, [ebp - 0x1ac]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa8b0
sub eax, edx
sar eax, 1
jne 0x4aa8d9
mov eax, dword [ebp - 0x2864]
inc dword [ebp - 0x2868]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aabfd
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x6b2]
push edx
mov word [ebp - 0x6b4], cx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2864]
add esp, 0xc
lea eax, [ebp - 0x2860]
push eax
lea ecx, [ebp - 0x6b4]
push ecx
push 0
push 0
push str.HelpLink
push edx
mov dword [ebp - 0x2860], 0x200
call esi
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0xaa]
push ecx
mov word [ebp - 0xac], ax
call fcn.004e8ba0
mov ecx, dword [ebp - 0x2864]
add esp, 0xc
lea edx, [ebp - 0x2860]
push edx
lea eax, [ebp - 0xac]
push eax
push 0
push 0
push str.DisplayVersion
mov edi, 0x40
push ecx
mov dword [ebp - 0x2860], edi
call esi
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x6a]
push eax
mov word [ebp - 0x6c], dx
call fcn.004e8ba0
mov eax, dword [ebp - 0x2864]
add esp, 0xc
lea ecx, [ebp - 0x2860]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push str.Publisher
push eax
mov dword [ebp - 0x2860], edi
call esi
xor eax, eax
lea edx, [ebp - 0x2860]
push edx
xor ecx, ecx
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
mov word [ebp - 0x28], cx
mov ecx, dword [ebp - 0x2864]
push str.InstallDate
mov edi, 0x20
push ecx
mov dword [ebp - 0x2860], edi
call esi
cmp eax, 2
jne 0x4aaa94
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0xe4a]
push eax
mov word [ebp - 0xe4c], dx
call fcn.004e8ba0
mov eax, dword [ebp - 0x2864]
add esp, 0xc
lea ecx, [ebp - 0x2860]
push ecx
lea edx, [ebp - 0xe4c]
push edx
push 0
push 0
push str.RegistryLocation
push eax
mov dword [ebp - 0x2860], 0x208
call esi
test eax, eax
jne 0x4aaa94
lea ecx, [ebp - 0x287c]
push ecx
push 0x201
push eax
lea edx, [ebp - 0xe26]
push edx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x287c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4aaa94
mov edx, dword [ebp - 0x287c]
lea eax, [ebp - 0x2860]
push eax
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push str.InstalledDate
push edx
mov dword [ebp - 0x2860], edi
call esi
mov eax, dword [ebp - 0x287c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x4b4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aaaa0
sub eax, edx
sar eax, 1
jne 0x4aaad7
xor eax, eax
jmp 0x4aaac0
movzx ecx, word [eax + str.g_ac]
mov word [ebp + eax - 0x4b4], cx
add eax, 2
test cx, cx
jne 0x4aaac0
push 0x48e
lea ecx, [ebp - 0xc44]
push 0
push ecx
call fcn.004e8ba0
lea edx, [ebp - 0x28]
push 0x525578
push edx
call fcn.004e571a
add esp, 0x14
test eax, eax
jne 0x4aab47
lea eax, [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aab05
sub eax, edx
sar eax, 1
je 0x4aab47
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
lea edx, [ebp - 0xc44]
push str._s_t_t_.4s__.2s__.2s_t_t_t_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
jmp 0x4aab6e
lea eax, [ebp - 0x6b4]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1ac]
push edx
lea eax, [ebp - 0xc44]
push str._s_t_t_s_t_t_t_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0xc44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aab77
mov ebx, dword [ebp - 0x289c]
sub eax, edx
sar eax, 1
cmp dword [ebx], 0x400
mov ecx, 1
mov word [ebp + eax*2 - 0xc44], cx
jae 0x4aabe2
lea eax, [ebp - 0xc44]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aabb0
mov edi, dword [ebp - 0x28a0]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4aabc6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x2864]
inc dword [ebx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x288c]
inc dword [ebp - 0x2868]
mov esi, dword [ebp - 0x2890]
push 0x400
push 0
push esi
call fcn.004e8ba0
mov edx, dword [ebp - 0x2868]
mov eax, dword [ebp - 0x286c]
add esp, 0xc
push 0x400
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4aa630
mov ecx, dword [ebp - 0x286c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x2890]
push edx
mov dword [ebp - 0x286c], 0
call fcn.004e577a
mov eax, dword [ebp - 0x2870]
push eax
call fcn.004e577a
mov ecx, dword [ebp - 0x288c]
push ecx
call fcn.004e577a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
xor edi, edi
cmp dword [ebp - 0x2898], 0x100
jne 0x4ab2d6
lea edx, [ebp - 0x286c]
push edx
push 0x108
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x4ab2d6
push 0x400
mov dword [ebp - 0x2868], edi
call fcn.004e5420
mov esi, eax
push 0x800
mov dword [ebp - 0x287c], esi
call fcn.004e5420
push 0x208
mov dword [ebp - 0x2870], eax
mov dword [ebp - 0x2864], edi
call fcn.004e5420
push 0x400
mov ebx, eax
push edi
push esi
mov dword [ebp - 0x288c], ebx
call fcn.004e8ba0
mov eax, dword [ebp - 0x286c]
add esp, 0x18
push 0x400
push esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4ab290
mov edi, dword [ebp - 0x2870]
sub edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov dword [ebp - 0x2894], edi
jmp 0x4aad4f
mov ecx, dword [ebp - 0x2864]
inc dword [ebp - 0x2868]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aabfd
mov esi, dword [ebp - 0x287c]
mov edi, dword [ebp - 0x2894]
mov ecx, dword [ebp - 0x2870]
push 0x800
push 0
push ecx
call fcn.004e8ba0
add esp, 0xc
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [eax + edi], cx
add eax, 2
test cx, cx
jne 0x4aad70
mov eax, esi
mov edx, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aad83
mov edi, dword [ebp - 0x2870]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4aada0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x2860]
push edx
push 0x101
mov ecx, eax
mov eax, dword [ebp - 0x2870]
push 0
push eax
and ecx, 3
push reloc.WS2_32.dll_bind
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ab251
mov eax, dword [ebp - 0x2860]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x2864]
push ecx
lea edx, [ebp - 0x2888]
push edx
xor edi, edi
push edi
push edi
push str.SystemComponent
push eax
mov dword [ebp - 0x2888], edi
mov dword [ebp - 0x2864], 4
call esi
test eax, eax
jne 0x4aae45
cmp dword [ebp - 0x2888], 1
jne 0x4aae45
mov ecx, dword [ebp - 0x2860]
inc dword [ebp - 0x2868]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2860], edi
jmp 0x4ab259
push 0x208
push edi
push ebx
mov dword [ebp - 0x2864], 0x208
call fcn.004e8ba0
mov eax, dword [ebp - 0x2860]
add esp, 0xc
lea edx, [ebp - 0x2864]
push edx
push ebx
push edi
push edi
push str.ParentKeyName
push eax
call esi
test eax, eax
jne 0x4ab4f5
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4aae83
sub eax, edx
sar eax, 1
je 0x4ab4f5
push 0x208
push edi
push ebx
mov dword [ebp - 0x2864], 0x208
call fcn.004e8ba0
mov edx, dword [ebp - 0x2860]
add esp, 0xc
lea ecx, [ebp - 0x2864]
push ecx
push ebx
push edi
push edi
push str.UninstallString
push edx
call esi
test eax, eax
jne 0x4aae27
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4aaed6
sub eax, edx
sar eax, 1
je 0x4aae27
push 0x208
push edi
push ebx
mov dword [ebp - 0x2864], 0x208
call fcn.004e8ba0
mov ecx, dword [ebp - 0x2860]
add esp, 0xc
lea eax, [ebp - 0x2864]
push eax
push ebx
push edi
push edi
push str.ParentDisplayName
push ecx
call esi
push 0x206
lea eax, [ebp - 0x4b2]
xor edx, edx
push edi
push eax
mov word [ebp - 0x4b4], dx
call fcn.004e8ba0
lea edx, [ebp - 0x4b4]
add esp, 0xc
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, di
jne 0x4aaf44
push 0x208
push edi
push ebx
call fcn.004e8ba0
push 0xfe
lea edx, [ebp - 0x1aa]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x1ac], cx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2860]
add esp, 0x18
lea eax, [ebp - 0x2864]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
push edi
push edi
push str.DisplayName
push edx
mov dword [ebp - 0x2864], 0x100
call esi
lea eax, [ebp - 0x1ac]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4aafb0
sub eax, edx
sar eax, 1
jne 0x4aafdf
mov eax, dword [ebp - 0x2860]
inc dword [ebp - 0x2868]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2860], edi
jmp 0x4ab259
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x6b2]
push edx
mov word [ebp - 0x6b4], cx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2860]
add esp, 0xc
lea eax, [ebp - 0x2864]
push eax
lea ecx, [ebp - 0x6b4]
push ecx
push 0
push 0
push str.HelpLink
push edx
mov dword [ebp - 0x2864], 0x200
call esi
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0xaa]
push ecx
mov word [ebp - 0xac], ax
call fcn.004e8ba0
mov ecx, dword [ebp - 0x2860]
add esp, 0xc
lea edx, [ebp - 0x2864]
push edx
lea eax, [ebp - 0xac]
push eax
push 0
push 0
push str.DisplayVersion
mov edi, 0x40
push ecx
mov dword [ebp - 0x2864], edi
call esi
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x6a]
push eax
mov word [ebp - 0x6c], dx
call fcn.004e8ba0
mov eax, dword [ebp - 0x2860]
add esp, 0xc
lea ecx, [ebp - 0x2864]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push str.Publisher
push eax
mov dword [ebp - 0x2864], edi
call esi
xor eax, eax
lea edx, [ebp - 0x2864]
push edx
xor ecx, ecx
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
mov word [ebp - 0x28], cx
mov ecx, dword [ebp - 0x2860]
push str.InstallDate
push ecx
mov dword [ebp - 0x2864], 0x20
call esi
lea eax, [ebp - 0x4b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ab0f4
sub eax, edx
sar eax, 1
jne 0x4ab127
xor eax, eax
jmp 0x4ab110
movzx ecx, word [eax + str.g_ac]
mov word [ebp + eax - 0x4b4], cx
add eax, 2
test cx, cx
jne 0x4ab110
push 0x48e
lea edx, [ebp - 0xc44]
push 0
push edx
call fcn.004e8ba0
lea eax, [ebp - 0x28]
push 0x525578
push eax
call fcn.004e571a
add esp, 0x14
test eax, eax
jne 0x4ab197
lea eax, [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ab155
sub eax, edx
sar eax, 1
je 0x4ab197
lea ecx, [ebp - 0x6b4]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x1ac]
push edx
lea eax, [ebp - 0xc44]
push str._s_t_t_.4s__.2s__.2s_t_t_t_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
jmp 0x4ab1be
lea ecx, [ebp - 0x6b4]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0xc44]
push str._s_t_t_s_t_t_t_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0xc44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ab1c7
mov ebx, dword [ebp - 0x289c]
sub eax, edx
sar eax, 1
cmp dword [ebx], 0x400
mov edx, 1
mov word [ebp + eax*2 - 0xc44], dx
jae 0x4ab232
lea eax, [ebp - 0xc44]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ab200
mov edi, dword [ebp - 0x28a0]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4ab216
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2860]
inc dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x288c]
mov dword [ebp - 0x2860], 0
inc dword [ebp - 0x2868]
xor edi, edi
mov esi, dword [ebp - 0x287c]
push 0x400
push edi
push esi
call fcn.004e8ba0
mov eax, dword [ebp - 0x2868]
mov ecx, dword [ebp - 0x286c]
add esp, 0xc
push 0x400
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4aad43
mov edx, dword [ebp - 0x286c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x287c]
push eax
mov dword [ebp - 0x286c], 0
call fcn.004e577a
mov ecx, dword [ebp - 0x2870]
push ecx
call fcn.004e577a
mov edx, dword [ebp - 0x288c]
push edx
call fcn.004e577a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
xor edi, edi
mov esi, dword [ebp - 0x2898]
lea eax, [ebp - 0x286c]
push eax
or esi, 0x20019
push esi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingPackages
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2868], edi
mov dword [ebp - 0x286c], edi
mov dword [ebp - 0x2898], esi
call ebx
test eax, eax
jne 0x4ab4df
push 0x3fe
lea edx, [ebp - 0x124a]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x124c], cx
call fcn.004e8ba0
mov ecx, dword [ebp - 0x286c]
add esp, 0xc
push 0x200
lea eax, [ebp - 0x124c]
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4ab4d2
push 0x3fe
lea eax, [ebp - 0x244a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x244c], dx
call fcn.004e8ba0
lea ecx, [ebp - 0x124c]
push ecx
lea edx, [ebp - 0x244c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingPackages_sOwners
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x2874]
push eax
push esi
push edi
lea ecx, [ebp - 0x244c]
push ecx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2874], edi
call ebx
test eax, eax
jne 0x4ab486
push 0x3fe
lea eax, [ebp - 0x284a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x284c], dx
call fcn.004e8ba0
lea ecx, [ebp - 0x124c]
push ecx
lea edx, [ebp - 0x284c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingPackages_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x2864]
push eax
push esi
push edi
lea ecx, [ebp - 0x284c]
push ecx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x2864], edi
call ebx
test eax, eax
jne 0x4ab513
mov eax, 4
lea edx, [ebp - 0x2894]
push edx
mov edx, dword [ebp - 0x2864]
mov dword [ebp - 0x28a4], eax
mov dword [ebp - 0x2894], eax
lea eax, [ebp - 0x2888]
push eax
lea ecx, [ebp - 0x28a4]
push ecx
push edi
push str.CurrentState
push edx
mov dword [ebp - 0x2888], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x2888]
cmp eax, 0x70
je 0x4ab513
cmp eax, 0x40
je 0x4ab513
mov eax, dword [ebp - 0x2864]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2874]
push ecx
mov dword [ebp - 0x2864], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2874], edi
inc dword [ebp - 0x2868]
push 0x3fe
lea eax, [ebp - 0x124a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x124c], dx
call fcn.004e8ba0
mov edx, dword [ebp - 0x2868]
mov eax, dword [ebp - 0x286c]
add esp, 0xc
push 0x200
lea ecx, [ebp - 0x124c]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4ab351
mov ecx, dword [ebp - 0x286c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x2860]
inc dword [ebp - 0x2868]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2860], edi
jmp 0x4ab259
push 0x3fe
lea eax, [ebp - 0x164a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x164c], dx
call fcn.004e8ba0
xor eax, eax
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x4a], eax
mov dword [ebp - 0x46], eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov word [ebp - 0x2e], ax
lea edx, [ebp - 0x2870]
push edx
mov word [ebp - 0x4c], cx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28b0]
push ecx
mov ecx, dword [ebp - 0x2874]
push edi
lea edx, [ebp - 0x28bc]
push edx
lea eax, [ebp - 0x164c]
push eax
push edi
push ecx
mov dword [ebp - 0x28bc], 0x200
mov dword [ebp - 0x2870], 0x10
mov dword [ebp - 0x28b0], 4
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4abeb7
lea ecx, [ebp - 0x124c]
lea eax, [ebp - 0x164c]
xor edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ab5db
cmp dx, di
je 0x4ab5d7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ab5db
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4ab5b5
xor eax, eax
jmp 0x4ab5e0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4ab5ff
mov edx, dword [ebp - 0x2864]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x2874]
push eax
jmp 0x4abecf
push 0x206
lea edx, [ebp - 0x1a52]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x1a54], cx
call fcn.004e8ba0
lea eax, [ebp - 0x164c]
push eax
lea ecx, [ebp - 0x1a54]
push str.C:Windows_servicingPackages_s.mum
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push edi
push 0x80
push 3
push edi
push 1
push bind
lea edx, [ebp - 0x1a54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4abeb7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2860], eax
cmp eax, 0xffffffff
je 0x4abeb0
push eax
call fcn.004e5420
mov esi, eax
mov eax, dword [ebp - 0x2860]
push eax
push 0
push esi
call fcn.004e8ba0
mov edx, dword [ebp - 0x2860]
add esp, 0x10
push 0
lea ecx, [ebp - 0x2860]
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2860]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e5420
mov ebx, eax
mov eax, dword [ebp - 0x2860]
lea ecx, [eax + eax + 2]
push ecx
push 0
push ebx
call fcn.004e8ba0
mov edi, dword [ebp - 0x2860]
push ebx
push esi
call fcn.004b7750
mov edx, dword [ebp - 0x2860]
push edx
push 0
push esi
call fcn.004e8ba0
push esi
call fcn.004e577a
xor eax, eax
push 0xfe
push eax
lea ecx, [ebp - 0x2aa]
push ecx
mov word [ebp - 0x2ac], ax
call fcn.004e8ba0
push str.displayName
push ebx
call fcn.004e571a
mov esi, eax
add esp, 0x3c
test esi, esi
je 0x4ab764
add esi, 0x1a
push 0x22
push esi
call fcn.004e53f9
xor edi, edi
add esp, 8
cmp eax, edi
je 0x4ab766
sub eax, esi
sar eax, 1
add eax, eax
push eax
push esi
lea edx, [ebp - 0x2ac]
push 0x100
push edx
call fcn.004e699e
add esp, 0x10
jmp 0x4ab766
xor edi, edi
push 0x7e
lea ecx, [ebp - 0x732]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x734], ax
call fcn.004e8ba0
push str.company
push ebx
call fcn.004e571a
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x4ab7c0
add esi, 0x12
push 0x22
push esi
call fcn.004e53f9
add esp, 8
cmp eax, edi
je 0x4ab7c0
sub eax, esi
sar eax, 1
add eax, eax
push eax
push esi
lea edx, [ebp - 0x734]
push 0x80
push edx
call fcn.004e699e
add esp, 0x10
push 0x1fe
lea ecx, [ebp - 0x184a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x184c], ax
call fcn.004e8ba0
push str.supportInformation
push ebx
call fcn.004e571a
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x4ab81d
add esi, 0x28
push 0x22
push esi
call fcn.004e53f9
add esp, 8
cmp eax, edi
je 0x4ab81d
sub eax, esi
sar eax, 1
add eax, eax
push eax
push esi
lea edx, [ebp - 0x184c]
push 0x200
push edx
call fcn.004e699e
add esp, 0x10
push 0xfe
lea ecx, [ebp - 0x5b2]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x5b4], ax
call fcn.004e8ba0
push str.name
push ebx
call fcn.004e571a
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x4ab87a
add esi, 0xc
push 0x22
push esi
call fcn.004e53f9
add esp, 8
cmp eax, edi
je 0x4ab87a
sub eax, esi
sar eax, 1
add eax, eax
push eax
push esi
lea edx, [ebp - 0x5b4]
push 0x100
push edx
call fcn.004e699e
add esp, 0x10
push 0xfe
lea ecx, [ebp - 0x1aa]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x1ac], ax
call fcn.004e8ba0
push str.package_identifier
push ebx
call fcn.004e571a
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x4ab8d7
add esi, 0x28
push 0x22
push esi
call fcn.004e53f9
add esp, 8
cmp eax, edi
je 0x4ab8d7
sub eax, esi
sar eax, 1
add eax, eax
push eax
push esi
lea edx, [ebp - 0x1ac]
push 0x100
push edx
call fcn.004e699e
add esp, 0x10
xor eax, eax
push str.releaseType
push ebx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
call fcn.004e571a
mov esi, eax
add esp, 8
cmp esi, edi
je 0x4ab932
add esi, 0x1a
push 0x22
push esi
call fcn.004e53f9
add esp, 8
cmp eax, edi
je 0x4ab932
sub eax, esi
sar eax, 1
add eax, eax
push eax
push esi
lea ecx, [ebp - 0x28]
push 0x20
push ecx
call fcn.004e699e
add esp, 0x10
mov edx, dword [ebp - 0x2860]
lea eax, [edx + edx + 2]
push eax
push edi
push ebx
call fcn.004e8ba0
push ebx
call fcn.004e577a
add esp, 0x10
mov ecx, str.Update
lea eax, [ebp - 0x28]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ab97b
cmp dx, di
je 0x4ab977
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ab97b
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4ab955
xor eax, eax
jmp 0x4ab980
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4aba3a
mov ecx, str.Security_Update
lea eax, [ebp - 0x28]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ab9b6
cmp dx, di
je 0x4ab9b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ab9b6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4ab990
xor eax, eax
jmp 0x4ab9bb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4aba3a
mov ecx, str.Hotfix
lea eax, [ebp - 0x28]
jmp 0x4ab9d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ab9f6
cmp dx, di
je 0x4ab9f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ab9f6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4ab9d0
xor eax, eax
jmp 0x4ab9fb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4aba3a
mov ecx, str.Service_Pack
lea eax, [ebp - 0x28]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4aba2d
cmp dx, di
je 0x4aba29
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4aba2d
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4aba07
xor eax, eax
jmp 0x4aba32
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4abeb7
push 0x206
lea edx, [ebp - 0x1e52]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x1e54], cx
call fcn.004e8ba0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x2878]
push eax
mov eax, dword [ebp - 0x2864]
lea ecx, [ebp - 0x1e54]
push ecx
lea edx, [ebp - 0x2880]
push edx
push edi
push str.InstallLocation
push eax
mov dword [ebp - 0x2880], 1
mov dword [ebp - 0x2878], 0x208
call esi
lea ecx, [ebp - 0x2878]
push ecx
mov ecx, dword [ebp - 0x2864]
lea edx, [ebp - 0x288c]
push edx
lea eax, [ebp - 0x2880]
push eax
push edi
push str.InstallTimeHigh
mov ebx, 4
push ecx
mov dword [ebp - 0x288c], edi
mov dword [ebp - 0x2880], ebx
mov dword [ebp - 0x2878], ebx
call esi
lea edx, [ebp - 0x2878]
push edx
mov edx, dword [ebp - 0x2864]
lea eax, [ebp - 0x287c]
push eax
lea ecx, [ebp - 0x2880]
push ecx
push edi
push str.InstallTimeLow
push edx
mov dword [ebp - 0x287c], edi
mov dword [ebp - 0x2880], ebx
mov dword [ebp - 0x2878], ebx
call esi
mov eax, dword [ebp - 0x288c]
mov ecx, dword [ebp - 0x287c]
mov dword [ebp - 0x28b4], edi
mov dword [ebp - 0x28b4], eax
xor eax, eax
mov dword [ebp - 0x285a], eax
mov dword [ebp - 0x2856], eax
mov dword [ebp - 0x2852], eax
mov word [ebp - 0x284e], ax
lea eax, [ebp - 0x285c]
mov dword [ebp - 0x28b8], ecx
push eax
lea ecx, [ebp - 0x28b8]
xor edx, edx
push ecx
mov word [ebp - 0x285c], dx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x3e
lea eax, [ebp - 0xaa]
xor edx, edx
push edi
push eax
mov word [ebp - 0xac], dx
call fcn.004e8ba0
movzx ecx, word [ebp - 0x2856]
movzx edx, word [ebp - 0x285a]
movzx eax, word [ebp - 0x285c]
push ecx
push edx
push eax
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0xac]
push str._04u__02u__02u
push ecx
call ebx
push 0x7e
lea eax, [ebp - 0x7b2]
xor edx, edx
push edi
push eax
mov word [ebp - 0x7b4], dx
call fcn.004e8ba0
add esp, 0x2c
lea ecx, [ebp - 0x2878]
push ecx
mov ecx, dword [ebp - 0x2864]
lea edx, [ebp - 0x7b4]
push edx
lea eax, [ebp - 0x2880]
push eax
push edi
push str.InstallUser
push ecx
mov dword [ebp - 0x2880], 1
mov dword [ebp - 0x2878], 0x80
call esi
lea edx, [ebp - 0x2890]
push edx
push str.S_1_5_21_2246665963_3247233360_1294444167_1000
mov dword [ebp - 0x2890], edi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
push 0x1fe
lea ecx, [ebp - 0xe42]
xor eax, eax
push edi
push ecx
mov word [ebp - 0xe44], ax
call fcn.004e8ba0
push 0x1fe
lea eax, [ebp - 0x4aa]
xor edx, edx
push edi
mov esi, 0x100
push eax
mov dword [ebp - 0x2884], esi
mov word [ebp - 0x4ac], dx
call fcn.004e8ba0
add esp, 0x18
lea ecx, [ebp - 0x28ac]
push ecx
lea edx, [ebp - 0x28a8]
push edx
lea eax, [ebp - 0x4ac]
push eax
mov eax, dword [ebp - 0x2890]
lea ecx, [ebp - 0x2884]
push ecx
lea edx, [ebp - 0xe44]
push edx
push eax
push edi
mov dword [ebp - 0x28a8], esi
mov dword [ebp - 0x28ac], edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov ecx, str.default
lea eax, [ebp - 0x2ac]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4abcbe
cmp dx, di
je 0x4abcba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4abcbe
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4abc98
xor eax, eax
jmp 0x4abcc3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4abce5
lea eax, [ebp - 0x2ac]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4abcd0
sub eax, edx
sar eax, 1
jne 0x4abde3
mov ecx, str.Update
lea eax, [ebp - 0x28]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4abd16
cmp dx, di
je 0x4abd12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4abd16
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4abcf0
xor eax, eax
jmp 0x4abd1b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4abd30
lea ecx, [ebp - 0x1ac]
push ecx
push 0x525cd0
jmp 0x4abdd7
mov ecx, str.Security_Update
lea eax, [ebp - 0x28]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4abd5e
cmp dx, di
je 0x4abd5a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4abd5e
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4abd38
xor eax, eax
jmp 0x4abd63
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4abd7f
lea eax, [ebp - 0x1ac]
push eax
push 0x525d08
lea ecx, [ebp - 0x2ac]
push ecx
jmp 0x4abdde
mov ecx, str.Service_Pack
lea eax, [ebp - 0x28]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4abdad
cmp dx, di
je 0x4abda9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4abdad
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4abd87
xor eax, eax
jmp 0x4abdb2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4abdcb
lea edx, [ebp - 0x1ac]
push edx
push 0x525d48
lea eax, [ebp - 0x2ac]
push eax
jmp 0x4abdde
lea ecx, [ebp - 0x1ac]
push ecx
push str.Microsoft_Windows
lea edx, [ebp - 0x2ac]
push edx
call ebx
add esp, 0xc
push 0x48e
lea eax, [ebp - 0xc44]
push edi
push eax
call fcn.004e8ba0
lea ecx, [ebp - 0x184c]
push ecx
lea edx, [ebp - 0xe44]
push edx
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0xac]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0xc44]
push str._s_t_s_t_s_t_s_s_tMicrosoft_Corporation_t_s
push ecx
call ebx
lea eax, [ebp - 0xc44]
add esp, 0x2c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4abe36
mov ebx, dword [ebp - 0x289c]
sub eax, edx
sar eax, 1
cmp dword [ebx], 0x400
mov edx, 1
mov word [ebp + eax*2 - 0xc44], dx
jae 0x4abeac
lea eax, [ebp - 0xc44]
mov edx, eax
jmp 0x4abe70
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4abe70
sub eax, edx
mov esi, edx
mov edx, eax
mov eax, dword [ebp - 0x28a0]
add eax, 0xfffffffe
lea ebx, [ebx]
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4abe90
mov ecx, edx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [ebx]
jmp 0x4abeb7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2864]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [ebp - 0x2874]
xor edi, edi
push ecx
mov dword [ebp - 0x2864], edi
call esi
inc dword [ebp - 0x2868]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x2898]
mov dword [ebp - 0x2874], edi
xor edi, edi
jmp 0x4ab48c