Function at 0x43a450
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59963e
mov eax, dword fs:[0]
push eax
sub esp, 0xc48
mov eax, dword [0x63434c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.utilityinstall.ini
push dword [0x63ca80]
lea eax, [ebp - 0xc48]
push eax
call fcn.00448eb0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0055c530
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0x18
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b4868
push str.suitepackage
push str.installinfo
call esi
mov ecx, 0x5b6e0c
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a50c
test dx, dx
je 0x43a508
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a50c
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a4e6
xor eax, eax
jmp 0x43a511
sbb eax, eax
or eax, 1
or edi, 0xffffffff
test eax, eax
jne 0x43aa7b
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0x420]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b4868
push str.foxmail
push str.installinfo
call esi
mov ecx, 0x5b6e0c
lea eax, [ebp - 0x420]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a586
test dx, dx
je 0x43a582
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a586
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a560
xor eax, eax
jmp 0x43a58b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a64b
push str.Foxmail
push dword [0x60e0f0]
lea eax, [ebp - 0xc50]
push eax
call fcn.00448eb0
push 0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 1
push 0x80000002
push eax
call fcn.00463fd0
add esp, 0x20
mov edx, dword [ebp - 0xc50]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a5ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43a630
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push 0x5b7784
push eax
call fcn.0047f450
push eax
push str.1121_tKAllAux::UninstallSuite_tUninstall_Foxmail_return__d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0xc44]
add esp, 0x30
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a64b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0x628]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b4868
push str.foxitreader
push str.installinfo
call esi
mov ecx, 0x5b6e0c
lea eax, [ebp - 0x628]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a6b6
test dx, dx
je 0x43a6b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a6b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a690
xor eax, eax
jmp 0x43a6bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a760
push str.utilityPhantomSetup.exe
push dword [0x63ca80]
lea eax, [ebp - 0xc44]
push eax
call fcn.00448eb0
add esp, 0xc
push dword [ebp - 0xc44]
mov byte [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a73f
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push str.UnInstall
push dword [ebp - 0xc44]
call fcn.0047f450
add esp, 0x1c
mov esi, eax
push dword [ebp - 0xc44]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push str.1134_tKAllAux::UninstallSuite_tUninstall_FoxitReader_return__d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x14
mov edx, dword [ebp - 0xc44]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a760
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0x830]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b4868
push str.sogou
push str.installinfo
call esi
mov ecx, 0x5b6e0c
lea eax, [ebp - 0x830]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a7ca
test dx, dx
je 0x43a7c6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a7ca
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a7a4
xor eax, eax
jmp 0x43a7cf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a947
push str.Sogou_Input
push dword [0x60e0f0]
lea eax, [ebp - 0xc50]
push eax
call fcn.00448eb0
push 0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 5
push 0x80000002
push eax
call fcn.00463fd0
add esp, 0x20
mov edx, dword [ebp - 0xc50]
mov eax, edi
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a830
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc44]
mov ebx, dword [edx - 0xc]
mov dword [ebp - 0xc4c], ebx
test ebx, ebx
je 0x43a92c
js 0x43ac20
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x43a870
push ebx
lea ecx, [ebp - 0xc44]
call fcn.00429e50
mov edx, dword [ebp - 0xc44]
lea eax, [edx + ebx*2]
mov ecx, edx
mov dword [ebp - 0xc54], eax
cmp edx, eax
jae 0x43a8c3
nop
cmp word [edx], 0x22
lea ebx, [edx + 2]
je 0x43a8ae
lea edi, [ecx + 2]
xor esi, esi
cmp ecx, edi
je 0x43a8ae
cmp esi, 1
jae 0x43a8a8
mov ax, word [edx]
inc esi
mov word [ecx], ax
add edx, 2
add ecx, 2
cmp ecx, edi
jne 0x43a892
mov eax, dword [ebp - 0xc54]
mov edx, ebx
cmp ebx, eax
jb 0x43a880
mov ebx, dword [ebp - 0xc4c]
or edi, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub edx, ecx
xor eax, eax
sar edx, 1
sub ebx, edx
mov word [ecx], ax
js 0x43ac20
mov eax, dword [ebp - 0xc44]
cmp ebx, dword [eax - 8]
jg 0x43ac20
xor ecx, ecx
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0xc44]
push ecx
push 1
push ecx
push ecx
push 0xffffffffffffffff
mov word [eax + ebx*2], cx
push 0x5b7784
push dword [ebp - 0xc44]
call fcn.0047f450
push eax
push str.1147_tKAllAux::UninstallSuite_tUninstall_Sogou_return__d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov edx, dword [ebp - 0xc44]
add esp, 0x30
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a947
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0xa38]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b4868
push str.istylepdf
push str.installinfo
call esi
mov ecx, 0x5b6e0c
lea eax, [ebp - 0xa38]
jmp 0x43a990
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a9b6
test dx, dx
je 0x43a9b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a9b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a990
xor eax, eax
jmp 0x43a9bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43aa7b
push str.iStylePDF
push dword [0x60e0f0]
lea eax, [ebp - 0xc4c]
push eax
call fcn.00448eb0
push 0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 8
push 0x80000002
push eax
call fcn.00463fd0
add esp, 0x20
mov edx, dword [ebp - 0xc4c]
mov eax, edi
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43aa1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43aa60
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push 0x5b7784
push eax
call fcn.0047f450
push eax
push str.1159_tKAllAux::UninstallSuite_tUninstall_iStylePDF_return__d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0xc44]
add esp, 0x30
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43aa7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.0055c530
add esp, 0xc
lea eax, [ebp - 0xc40]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b4868
push 0x5b7928
push str.installinfo
call esi
mov ecx, 0x5b6e0c
lea eax, [ebp - 0xc40]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43aae6
test dx, dx
je 0x43aae2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43aae6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43aac0
xor eax, eax
jmp 0x43aaeb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43abe4
push str.PowerWord2012cut
push dword [0x60e090]
lea eax, [ebp - 0xc4c]
push eax
call fcn.00448eb0
push 0
push str.PathName
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 0xb
push 0x80000002
push eax
call fcn.00463fd0
add esp, 0x20
mov edx, dword [ebp - 0xc4c]
mov eax, edi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ab4c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43abcd
push str.Uninst.exe
push eax
lea eax, [ebp - 0xc54]
push eax
call fcn.00448eb0
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push str.48E32C2A_4A45_43CB_9BE3_C26F201CD20D__s
push dword [eax]
mov byte [ebp - 4], 0xe
call fcn.0047f450
mov edx, dword [ebp - 0xc54]
mov esi, eax
add esp, 0x28
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43abaa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
push str.1173_tKAllAux::UninstallSuite_tUninstall_Ksd_return__d
push str.H:pub_9qls_rc_bug_mas_v12_2407Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x63cbb0
call fcn.0046bb20
mov eax, dword [ebp - 0xc44]
add esp, 0x14
lea edx, [eax - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43abe4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc48]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x43abff
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00557e89
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00429b00
int3