Function at 0x407dca
Capabilities:
Query or enumerate registry value
Read .ini file
Set current directory

Disassembly:
mov eax, 0x420156
call fcn.00415d54
mov eax, 0x1f80
call fcn.00415f30
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00401046
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
call fcn.0040105f
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.0040da7a
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040b0af
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x4081c5
push 0x42ba38
lea eax, [ebp - 0x70]
push 0x14
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x429960
push dword [0x42160c]
push dword [0x4215c0]
call edi
cmp byte [ebp - 0x70], 0x79
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x407e5d
cmp byte [ebp - 0x70], 0x59
jne 0x407f58
cmp dword [0x42c908], ebx
je 0x407ea3
push 0x42ba38
lea eax, [ebp - 0x5c]
push 0x14
push eax
push 0x429960
push dword [0x421610]
push dword [0x4215c0]
call edi
cmp byte [ebp - 0x5c], 0x79
je 0x407e97
cmp byte [ebp - 0x5c], 0x59
je 0x407e97
mov dword [ebp - 0x14], ebx
jmp 0x4081c5
mov dword [ebp - 0x14], 1
jmp 0x407f61
lea eax, [ebp - 0x5c]
push eax
push ebx
call fcn.00410b57
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x677]
mov byte [ebp - 0x678], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x678]
push 0x400
push eax
push 0x66e
call fcn.0040fb4b
mov eax, dword [ebp - 0x18]
add esp, 0x14
add eax, 0x478
push eax
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x174]
push eax
call esi
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push ebx
push 0x401
push dword [0x42b628]
call edi
lea eax, [ebp - 0x5c]
push 0x24
push eax
lea eax, [ebp - 0x174]
push eax
push dword [0x42b628]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x407f49
push 0x3ea
mov dword [ebp - 0x14], ebx
push dword [0x42b628]
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0xf
push eax
call edi
push ebx
push ebx
push 0x401
push dword [0x42b628]
call edi
cmp dword [ebp - 0x14], ebx
je 0x4081c5
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x34]
push 1
push eax
lea eax, [ebp - 0x278]
push ebx
push eax
mov eax, str.dotnetfx.exe
push eax
push eax
mov ecx, edi
call fcn.0040a1df
test eax, eax
je 0x408674
cmp dword [ebp - 0x34], 1
jne 0x407ff4
lea eax, [ebp - 0x174]
mov ecx, edi
push eax
push str.dotnetredist.exe
push dword [ebp - 0x3c]
call fcn.0040b269
lea eax, [ebp - 0x1a88]
mov ecx, edi
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0040a353
test eax, eax
je 0x408674
lea eax, [ebp - 0x1584]
mov ecx, edi
push eax
push str.dotnetredistSp2.exe
push dword [ebp - 0x3c]
call fcn.0040b269
lea eax, [ebp - 0x1b8c]
mov ecx, edi
push eax
lea eax, [ebp - 0x1584]
push eax
call fcn.0040a353
test eax, eax
je 0x408674
cmp dword [ebp - 0x44], ebx
je 0x40800b
lea eax, [ebp - 0x278]
push str.__q:a__c:_install__q_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
lea edi, [ebp - 0x5b]
mov byte [ebp - 0x5c], bl
push 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.004156d0
add esp, 0xc
lea eax, [ebp - 0x5c]
push dword [ebp - 0x3c]
push str.__l_d
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x1080]
push 0x104
push eax
push 0x452
call fcn.0040fb4b
add esp, 0xc
lea eax, [ebp - 0x1080]
push str.Microsoft_R__.NET_Framework
push eax
lea eax, [ebp - 0xf7c]
push eax
call esi
mov ecx, dword [ebp - 0x18]
add esp, 0xc
lea eax, [ebp - 0xf7c]
push eax
call fcn.0040e2b9
xor eax, eax
cmp dword [0x42c908], ebx
push 2
push dword [0x42b628]
sete al
mov dword [ebp - 0x30], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
mov edi, eax
push ebx
push edi
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x278]
push dword [ebp - 0x30]
push eax
call fcn.00410bba
push 1
push edi
mov dword [ebp - 0x24], eax
call esi
cmp dword [ebp - 0x24], 0x2000
mov esi, 0xbc2
je 0x408120
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x408120
cmp eax, 0x800704c7
jne 0x4080fe
cmp byte [ebp - 0x70], 0x79
je 0x407e8f
cmp byte [ebp - 0x70], 0x59
jne 0x408111
jmp 0x407e8f
cmp eax, ebx
je 0x4081c5
cmp eax, 0x1008
je 0x4081c5
mov dword [0x42c904], 0x66d
jmp 0x408674
call fcn.0041067a
test eax, eax
jne 0x40813a
cmp dword [ebp - 0x24], esi
je 0x40813a
push 1
mov dword [ebp - 0x2c], 2
pop eax
jmp 0x408143
push 1
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ebx
mov dword [ecx + 0x38], eax
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004062b7
test eax, eax
jne 0x4081b3
push 0x40
lea edi, [ebp - 0x173]
pop ecx
mov byte [ebp - 0x174], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x104
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push str.InstallerLocation
mov dword [ebp - 0x38], ebx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], ebx
je 0x4081c5
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], ebx
jne 0x4082d0
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x78]
push eax
call fcn.00409c05
cmp eax, ebx
jne 0x4082c5
mov ecx, esi
call fcn.0040da60
test eax, eax
je 0x4082cb
push 1
mov ecx, esi
pop edi
mov dword [ebp - 0x28], edi
call fcn.0040d994
mov eax, dword [eax]
dec eax
je 0x408246
dec eax
jne 0x408297
cmp dword [esi + 0x18c4], ebx
je 0x408230
lea eax, [esi + 0x18c8]
push eax
lea eax, [ebp - 0x1984]
push eax
call fcn.004157c0
pop ecx
mov dword [ebp - 0x20], edi
pop ecx
lea eax, [ebp - 0x34]
push edi
push eax
lea eax, [ebp - 0x1984]
push dword [ebp - 0x20]
push eax
mov eax, dword [str.INSTMSIW.EXE]
jmp 0x40827a
cmp dword [esi + 0x14c0], ebx
je 0x408266
lea eax, [esi + 0x14c4]
push eax
lea eax, [ebp - 0x1984]
push eax
call fcn.004157c0
pop ecx
mov dword [ebp - 0x20], edi
pop ecx
lea eax, [ebp - 0x34]
push edi
push eax
lea eax, [ebp - 0x1984]
push dword [ebp - 0x20]
push eax
mov eax, dword [str.INSTMSIA.EXE]
mov ecx, dword [ebp - 0x10]
push eax
push eax
call fcn.0040a1df
test eax, eax
jne 0x408297
mov dword [0x42c904], 0x482
jmp 0x408674
lea eax, [ebp - 0x1984]
push eax
call fcn.00410313
test eax, eax
jne 0x4082d6
lea ecx, [ebp - 0x1984]
mov eax, 0x482
push ecx
push eax
mov dword [0x42c904], eax
call fcn.0040fa6b
pop ecx
pop ecx
jmp 0x408679
jg 0x408679
mov dword [ebp - 0x20], ebx
jmp 0x4082d9
mov esi, dword [ebp - 0x18]
push 1
pop edi
mov dword [ebp - 0x20], edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x147f]
mov byte [ebp - 0x1480], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ecx, ecx
cmp dword [esi + 0x1cc8], ebx
je 0x408313
lea eax, [esi + 0x1ccc]
push eax
lea eax, [ebp - 0x1480]
push eax
call fcn.004157c0
pop ecx
pop ecx
push 1
pop ecx
xor eax, eax
cmp dword [ebp - 0x20], ebx
lea edx, [ebp - 0x40]
sete al
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
lea eax, [esi + 0x878]
push edx
push ecx
lea ecx, [ebp - 0x1480]
mov dword [ebp - 0x30], eax
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push eax
call fcn.0040a1df
test eax, eax
je 0x408674
cmp dword [ebp - 0x40], 2
mov dword [ebp - 0x38], ebx
jne 0x40835d
cmp dword [ebp - 0x20], ebx
je 0x40835d
mov dword [ebp - 0x38], 1
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xe77]
mov byte [ebp - 0xe78], bl
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
push 1
stosw word es:[edi], ax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
stosb byte es:[edi], al
call fcn.00409f36
test eax, eax
je 0x4083ef
xor eax, eax
cmp dword [esi + 0x20cc], ebx
je 0x4083af
lea eax, [esi + 0x20d0]
push eax
lea eax, [ebp - 0xe78]
push eax
call fcn.004157c0
pop ecx
pop ecx
push 1
pop edi
mov eax, edi
jmp 0x4083b2
push 1
pop edi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x34]
push ecx
push eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xe78]
push eax
push dword [0x421600]
push str.ISScript8.Msi
call fcn.0040a1df
test eax, eax
je 0x408674
cmp dword [ebp - 0x34], 2
mov dword [ebp - 0x18], edi
jne 0x4083f2
cmp dword [ebp - 0x20], ebx
je 0x4083f2
mov dword [ebp - 0x14], edi
jmp 0x4083f2
push 1
pop edi
cmp dword [ebp - 0x28], ebx
je 0x408414
cmp dword [ebp - 0x1c], ebx
je 0x408401
cmp dword [ebp - 0x2c], edi
je 0x408414
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1984]
push eax
call fcn.00409dfc
cmp dword [ebp - 0x2c], ebx
je 0x408455
cmp dword [ebp - 0x1c], ebx
jne 0x408455
push 0x42ba38
lea eax, [ebp - 0x70]
push 0x400
push eax
push 0x429960
push dword [0x4215c4]
push dword [0x4215c0]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x70], 0x79
je 0x408452
cmp byte [ebp - 0x70], 0x59
mov dword [ebp - 0x1c], edi
jne 0x408455
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x2c], 2
jne 0x408484
cmp dword [ebp - 0x1c], ebx
jne 0x408484
lea eax, [esi + 0x1080]
push str._ISSCHEDULEREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push str.ISSCHEDULEREBOOT1
push 0x425190
mov ecx, esi
call fcn.0040e70a
cmp dword [ebp - 0x18], ebx
je 0x4085ee
cmp dword [ebp - 0x1c], ebx
je 0x40849b
cmp dword [ebp - 0x2c], edi
je 0x4085ee
lea eax, [ebp - 0xe78]
push 0x429964
push eax
lea ecx, [ebp - 0xa78]
call fcn.00403c4e
lea eax, [ebp - 0xe78]
lea ecx, [ebp - 0xa78]
push eax
mov dword [ebp - 4], edi
call fcn.00403cc8
test eax, eax
je 0x4084e4
call fcn.004063a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa78]
call fcn.00403cb2
jmp 0x408679
cmp dword [ebp - 0x14], ebx
je 0x40854b
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x677]
mov byte [ebp - 0x678], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x10]
stosb byte es:[edi], al
lea eax, [ebp - 0x678]
push eax
push str.ISScript8.Msi
call fcn.0040a6af
test eax, eax
je 0x4084d0
lea eax, [ebp - 0x678]
push 0x429960
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40854b
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x678]
push 1
push eax
lea eax, [ebp - 0xe78]
push eax
call fcn.0040a747
test eax, eax
je 0x4084cb
cmp dword [ebp - 0x38], ebx
je 0x4085b8
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x677]
mov byte [ebp - 0x678], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [ebp - 0x10]
stosb byte es:[edi], al
lea eax, [ebp - 0x678]
push eax
push dword [ebp - 0x30]
call fcn.0040a6af
test eax, eax
je 0x4084d0
lea eax, [ebp - 0x678]
push 0x429960
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4085b8
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x678]
push 1
push eax
lea eax, [ebp - 0xe78]
push eax
call fcn.0040a747
test eax, eax
je 0x4084cb
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xe78]
push eax
call fcn.0040a10a
test eax, eax
je 0x4084d0
cmp dword [ebp - 0x24], ebx
je 0x4085df
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa78]
call fcn.00403cb2
mov edi, dword [ebp - 0x1c]
mov ecx, esi
push edi
call fcn.0040da7a
cmp dword [ebp - 0x40], 3
je 0x40865a
cmp edi, ebx
jne 0x40867d
lea eax, [ebp - 0x1480]
push 0x429964
push eax
lea ecx, [ebp - 0x1f8c]
call fcn.00403c4e
lea eax, [ebp - 0x1480]
lea ecx, [ebp - 0x1f8c]
push eax
mov dword [ebp - 4], 2
call fcn.00403cc8
test eax, eax
je 0x40864b
call fcn.004063a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f8c]
jmp 0x4084da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f8c]
call fcn.00403cb2
cmp edi, ebx
jne 0x40867d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1480]
push eax
push dword [ebp - 0x30]
call fcn.0040a9c7
test eax, eax
jne 0x40867d
call fcn.004063a0
xor eax, eax
jmp 0x408690
mov ecx, dword [ebp - 0x10]
push edi
push dword [ebp - 0x34]
lea eax, [ebp - 0x1480]
push eax
call fcn.0040869f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret