Function at 0x1000b103
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x16ec]
mov eax, 0x16ec
call fcn.101d14f0
push 0xffffffffffffffff
push 0x101ecbf8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x16e8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.InstallInfo:GetInstallInfo
lea ecx, [ebp + 0x6a4]
call fcn.100010f3
and dword [ebp - 4], 0
test byte [0x102757a4], 1
mov esi, 0x400
mov ebx, str.Main
mov edi, 0x10275d40
jne 0x1000b2fd
push 0x101efcc8
call fcn.1000a6f3
push 0
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xee8]
push eax
push 0
push 0x101efcc8
push ebx
call fcn.10005b3c
add esp, 0x1c
cmp word [ebp + 0xee8], 0
jne 0x1000b202
cmp dword [ebp - 0x10], 0
jne 0x1000b222
push 0x101eeb08
push 0x101efcc8
mov ecx, edi
call fcn.100172ee
test eax, eax
jne 0x1000b1fb
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0x6a8]
push eax
mov dword [ebp + method.CLogFunc.virtual_0], vtable.CLogFunc.0
call fcn.101d12b4
pop ecx
push 8
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x16e8]
xor ecx, ebp
call fcn.101d14d7
add ebp, 0x16ec
leave
ret
push 0x101eeb08
jmp 0x1000b225
lea eax, [ebp + 0xee8]
push eax
push 0x101efcc8
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
jmp 0x1000b225
push dword [ebp - 0x10]
push 0x101efcc8
call fcn.101d135a
pop ecx
pop ecx
push 0
push esi
lea eax, [ebp + 0xee8]
push eax
push 0
push str.Publisher
push ebx
call fcn.10005b3c
add esp, 0x18
cmp word [ebp + 0xee8], 0
jne 0x1000b26a
push 0x101f33bc
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.10016ac1
add esp, 0xc
lea eax, [ebp + 0xee8]
push eax
push str.Publisher
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.Publisher
call fcn.101d135a
push 0
push esi
lea eax, [ebp + 0xee8]
push eax
push 0
push str.PublisherNickName
push ebx
call fcn.10005b3c
add esp, 0x20
cmp word [ebp + 0xee8], 0
jne 0x1000b2cf
push 0x101f3388
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.10016ac1
add esp, 0xc
lea eax, [ebp + 0xee8]
push eax
push str.PublisherNickName
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.PublisherNickName
call fcn.101d135a
pop ecx
pop ecx
push 0
push esi
lea eax, [ebp + 0xee8]
push eax
push 0
push str.BrandingText
push ebx
call fcn.10005b3c
add esp, 0x18
cmp word [ebp + 0xee8], 0
jne 0x1000b336
push str.AhnLab_Installation_System
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.10016ac1
add esp, 0xc
lea eax, [ebp + 0xee8]
push eax
push str.BrandingText
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.BrandingText
call fcn.101d135a
test byte [0x102757a4], 1
pop ecx
pop ecx
jne 0x1000b3ff
push 0
push esi
lea eax, [ebp + 0xee8]
push eax
push 0
push str.URLHomepage
push ebx
call fcn.10005b3c
add esp, 0x18
lea eax, [ebp + 0xee8]
push eax
push str.URLHomepage
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.URLHomepage
call fcn.101d135a
push 0
push esi
lea eax, [ebp + 0xee8]
push eax
push 0
push str.URLOnlineRegistration
push ebx
call fcn.10005b3c
add esp, 0x20
lea eax, [ebp + 0xee8]
push eax
push str.URLOnlineRegistration
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.URLOnlineRegistration
call fcn.101d135a
pop ecx
pop ecx
push 0
push 0x101f32e4
push ebx
call fcn.1000520d
push 0
push 0
push 0x101f32e0
mov dword [ebp - 0x10], eax
call fcn.1000a38d
add esp, 0x18
test eax, eax
jne 0x1000b453
push eax
push eax
push str.silent
call fcn.1000a38d
add esp, 0xc
test eax, eax
jne 0x1000b453
push eax
push eax
push str.nonstop
call fcn.1000a38d
add esp, 0xc
test eax, eax
je 0x1000b45a
mov dword [ebp - 0x10], 1
jmp 0x1000b45a
mov dword [ebp - 0x10], 2
push dword [ebp - 0x10]
call sym.AhnIEx.dll_AhnIEx_SetMode
push dword [ebp - 0x10]
push 0x101f32e4
call fcn.101d1372
push 0
push 0x101f32b8
push ebx
call fcn.1000520d
push 0
push 0
push 0x101f32b8
mov dword [ebp - 0x10], eax
call fcn.1000a38d
add esp, 0x24
test eax, eax
jne 0x1000b4a7
push eax
push eax
push str.APC2
call fcn.1000a38d
add esp, 0xc
test eax, eax
je 0x1000b4ae
mov dword [ebp - 0x10], 1
push dword [ebp - 0x10]
lea eax, [ebp + 0xee8]
push 0x101ee5d8
push esi
push eax
call fcn.1001d140
add esp, 0x10
lea eax, [ebp + 0xee8]
push eax
push 0x101f32b8
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push 0x101f32b8
call fcn.101d135a
test byte [0x102757a4], 1
pop ecx
pop ecx
jne 0x1000b5d8
push 0
push str.EvaluationPeriod
push ebx
call fcn.1000520d
push eax
push 0x101ee5d8
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.1001d140
add esp, 0x1c
lea eax, [ebp + 0xee8]
push eax
push str.EvaluationPeriod
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.EvaluationPeriod
call fcn.101d135a
test byte [0x102757a4], 1
pop ecx
pop ecx
jne 0x1000b5d8
push 0
push str.ReinstallMode
mov ebx, str.Scenario
push ebx
call fcn.1000520d
add esp, 0xc
mov dword [ebp - 0x10], eax
call sym.AhnIEx.dll_AhnIEx_GetMode
dec eax
cmp eax, 1
ja 0x1000b58d
cmp dword [ebp - 0x10], 0
jne 0x1000b597
mov dword [ebp - 0x10], 1
jmp 0x1000b597
cmp dword [ebp - 0x10], 5
je 0x1000b597
and dword [ebp - 0x10], 0
push dword [ebp - 0x10]
lea eax, [ebp + 0xee8]
push 0x101ee5d8
push esi
push eax
call fcn.1001d140
add esp, 0x10
lea eax, [ebp + 0xee8]
push eax
push str.ReinstallMode
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.ReinstallMode
jmp 0x1000b653
push 0
push str.UninstallMode
mov ebx, str.Scenario
push ebx
call fcn.1000520d
add esp, 0xc
mov dword [ebp - 0x10], eax
call sym.AhnIEx.dll_AhnIEx_GetMode
dec eax
cmp eax, 1
ja 0x1000b60a
cmp dword [ebp - 0x10], 0
jne 0x1000b614
mov dword [ebp - 0x10], 1
jmp 0x1000b614
cmp dword [ebp - 0x10], 5
je 0x1000b614
and dword [ebp - 0x10], 0
push dword [ebp - 0x10]
lea eax, [ebp + 0xee8]
push 0x101ee5d8
push esi
push eax
call fcn.1001d140
add esp, 0x10
lea eax, [ebp + 0xee8]
push eax
push str.UninstallMode
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.UninstallMode
call fcn.101d135a
test byte [0x102757a4], 1
pop ecx
pop ecx
jne 0x1000b898
and dword [ebp - 0x10], 0
xor eax, eax
mov word [ebp + 0xee8], ax
push esi
lea eax, [ebp + 0xee8]
push eax
push str.InstDir
call fcn.1000a38d
add esp, 0xc
test eax, eax
jne 0x1000b6b4
push str.InstDir
call fcn.1000a6f3
push 0
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xee8]
push eax
push 0
push str.InstDir
push ebx
call fcn.10005b3c
add esp, 0x1c
cmp word [ebp + 0xee8], 0
jne 0x1000b6e3
cmp dword [ebp - 0x10], 0
jne 0x1000b71e
push str._ProgramFilesDir__PublisherNickName__ProductName_
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.10016ac1
add esp, 0xc
cmp word [ebp + 0xee8], 0
je 0x1000b71e
lea eax, [ebp + 0xee8]
push eax
lea eax, [ebp + 0x6e8]
push esi
push eax
call fcn.1000a481
add esp, 0xc
lea eax, [ebp + 0x6e8]
push eax
push str.InstDir
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0x6e8]
push eax
jmp 0x1000b721
push dword [ebp - 0x10]
push str.InstDir
call fcn.101d135a
pop ecx
pop ecx
push 0
push esi
lea eax, [ebp + 0xee8]
push eax
push 0
push str.StartMenuDir
push ebx
call fcn.10005b3c
add esp, 0x18
cmp word [ebp + 0xee8], 0
jne 0x1000b766
push str._PublisherNickName__ProductName_
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.10016ac1
add esp, 0xc
lea eax, [ebp + 0xee8]
push eax
lea eax, [ebp + 0x6e8]
push esi
push eax
call fcn.1000a481
add esp, 0xc
lea eax, [ebp + 0x6e8]
push eax
push str.StartMenuDir
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0x6e8]
push eax
push str.StartMenuDir
call fcn.101d135a
push 1
push str.CreateShortcutOnDesktop
push ebx
call fcn.1000520d
push eax
push 0x101ee5d8
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.1001d140
add esp, 0x24
lea eax, [ebp + 0xee8]
push eax
push str.CreateShortcutOnDesktop
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.CreateShortcutOnDesktop
call fcn.101d135a
push 1
push str.CreateShortcutOnStartMenu
push ebx
call fcn.1000520d
push eax
push 0x101ee5d8
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.1001d140
add esp, 0x24
lea eax, [ebp + 0xee8]
push eax
push str.CreateShortcutOnStartMenu
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.CreateShortcutOnStartMenu
call fcn.101d135a
push 1
push str.CreateUninstallShortcut
push ebx
call fcn.1000520d
push eax
push 0x101ee5d8
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.1001d140
add esp, 0x24
lea eax, [ebp + 0xee8]
push eax
push str.CreateUninstallShortcut
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.CreateUninstallShortcut
call fcn.101d135a
pop ecx
pop ecx
push 0
push str.RebootType
push ebx
call fcn.1000520d
add esp, 0xc
mov dword [ebp - 0x10], eax
call sym.AhnIEx.dll_AhnIEx_GetMode
cmp eax, 1
jbe 0x1000b8cd
cmp eax, 2
jne 0x1000b8c9
cmp dword [ebp - 0x10], 0
jne 0x1000b8cd
mov dword [ebp - 0x10], 1
jmp 0x1000b8cd
and dword [ebp - 0x10], 0
push dword [ebp - 0x10]
lea eax, [ebp + 0xee8]
push 0x101ee5d8
push esi
push eax
call fcn.1001d140
add esp, 0x10
lea eax, [ebp + 0xee8]
push eax
push str.RebootType
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.RebootType
call fcn.101d135a
push 0
push str.DeleteRecycledData
push ebx
call fcn.1000520d
neg eax
sbb eax, eax
neg eax
push eax
push 0x101ee5d8
lea eax, [ebp + 0xee8]
push esi
push eax
call fcn.1001d140
add esp, 0x24
lea eax, [ebp + 0xee8]
push eax
push str.DeleteRecycledData
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push str.DeleteRecycledData
call fcn.101d135a
test byte [0x102757a4], 1
pop ecx
pop ecx
jne 0x1000bd85
push str.UserInfoTableIndex
call fcn.1000a6f3
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x1000b995
push eax
call fcn.101d1b9e
movzx eax, ax
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x1000b99c
mov dword [ebp - 0x10], 0xffff
push 0x6a4
lea eax, [ebp]
push ebx
push eax
call fcn.101d19d0
add esp, 0xc
test dword [0x102757a4], 0x100000
je 0x1000b9cc
push ebx
lea eax, [ebp]
push 0x6a4
push eax
call fcn.100040cf
add esp, 0xc
push esi
lea eax, [ebp + 0xee8]
push eax
push str.UserName
call fcn.1000a38d
add esp, 0xc
test eax, eax
jne 0x1000bac2
push ebx
push esi
lea eax, [ebp + 0xee8]
push eax
push ebx
push 0x101efce0
push str.User
call fcn.10005b3c
add esp, 0x18
cmp word [ebp + 0xee8], bx
jne 0x1000bac2
test dword [0x102757a4], 0x100000
je 0x1000ba48
lea eax, [ebp]
push eax
push esi
lea eax, [ebp + 0xee8]
push eax
call fcn.1000108c
cmp word [ebp + 0xee8], bx
jne 0x1000bac2
test dword [0x102757a4], 0x200000
jne 0x1000ba75
mov eax, 0xffff
cmp word [ebp - 0x10], ax
je 0x1000ba75
push ebx
push ebx
push ebx
push ebx
push esi
lea eax, [ebp + 0xee8]
push eax
push ebx
push ebx
push dword [ebp - 0x10]
call fcn.1000532d
add esp, 0x24
cmp word [ebp + 0xee8], bx
jne 0x1000bac2
call sym.AhnIEx.dll_AhnIEx_IsWinNT
push esi
test eax, eax
lea eax, [ebp + 0xee8]
push eax
push str.RegisteredOwner
je 0x1000bab0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call fcn.10014b17
lea eax, [ebp + 0xee8]
push eax
push str.RegisteredOwner
call fcn.101d135a
add esp, 0x1c
jmp 0x1000bac2
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call fcn.10014a86
add esp, 0x14
lea eax, [ebp + 0xee8]
push eax
push str.UserName
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
push esi
lea eax, [ebp + 0xee8]
push eax
push str.UserOrganization
call fcn.1000a38d
add esp, 0xc
test eax, eax
jne 0x1000bbd6
push ebx
push esi
lea eax, [ebp + 0xee8]
push eax
push ebx
push str.Organization
push str.User
call fcn.10005b3c
add esp, 0x18
cmp word [ebp + 0xee8], bx
jne 0x1000bbd6
test dword [0x102757a4], 0x100000
je 0x1000bb5c
lea eax, [ebp + 0x190]
push eax
push esi
lea eax, [ebp + 0xee8]
push eax
call fcn.1000108c
cmp word [ebp + 0xee8], bx
jne 0x1000bbd6
test dword [0x102757a4], 0x200000
jne 0x1000bb89
mov eax, 0xffff
cmp word [ebp - 0x10], ax
je 0x1000bb89
push ebx
push ebx
push esi
lea eax, [ebp + 0xee8]
push eax
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call fcn.1000532d
add esp, 0x24
cmp word [ebp + 0xee8], bx
jne 0x1000bbd6
call sym.AhnIEx.dll_AhnIEx_IsWinNT
push esi
test eax, eax
lea eax, [ebp + 0xee8]
push eax
push str.RegisteredOrganization
je 0x1000bbc4
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call fcn.10014b17
lea eax, [ebp + 0xee8]
push eax
push str.RegisteredOrganization
call fcn.101d135a
add esp, 0x1c
jmp 0x1000bbd6
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call fcn.10014a86
add esp, 0x14
lea eax, [ebp + 0xee8]
push eax
push str.UserOrganization
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
test dword [0x102757a4], 0x100000
je 0x1000bcc8
push esi
lea eax, [ebp + 0xee8]
push eax
push str.UserDepartment
call fcn.1000a38d
add esp, 0xc
test eax, eax
jne 0x1000bcad
push ebx
push esi
lea eax, [ebp + 0xee8]
push eax
push ebx
push str.Department
push str.User
call fcn.10005b3c
add esp, 0x18
cmp word [ebp + 0xee8], bx
jne 0x1000bcad
lea eax, [ebp + 0x320]
push eax
push esi
lea eax, [ebp + 0xee8]
push eax
call fcn.1000108c
cmp word [ebp + 0xee8], bx
jne 0x1000bcad
call sym.AhnIEx.dll_AhnIEx_IsWinNT
push esi
test eax, eax
lea eax, [ebp + 0xee8]
push eax
push str.RegisteredDepartment
je 0x1000bc9b
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call fcn.10014b17
lea eax, [ebp + 0xee8]
push eax
push str.RegisteredDepartment
call fcn.101d135a
add esp, 0x1c
jmp 0x1000bcad
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call fcn.10014a86
add esp, 0x14
lea eax, [ebp + 0xee8]
push eax
push str.UserDepartment
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
push esi
lea eax, [ebp + 0xee8]
push eax
push str.UserProductNumber
call fcn.1000a38d
add esp, 0xc
test eax, eax
jne 0x1000bcfd
push ebx
push esi
lea eax, [ebp + 0xee8]
push eax
push ebx
push str.ProductNumber
push str.User
call fcn.10005b3c
add esp, 0x18
lea eax, [ebp + 0xee8]
push eax
push str.UserProductNumber
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
push str._ExeDir_BldInfo.ini
lea eax, [ebp + 0x6e8]
push esi
push eax
call fcn.1000a481
add esp, 0xc
lea eax, [ebp + 0x6e8]
push eax
push esi
lea eax, [ebp + 0xee8]
push eax
push 0x101eeb08
push str.BuildNumber
push str.Build
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp + 0xee8], bx
je 0x1000bd85
lea eax, [ebp + 0xee8]
push eax
mov ebx, str.BuildNumber
push ebx
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push ebx
call fcn.101d135a
pop ecx
pop ecx
push esi
lea eax, [ebp + 0xee8]
push eax
mov ebx, str.AfterReboot
push ebx
call fcn.1000a38d
add esp, 0xc
mov ecx, edi
test eax, eax
jne 0x1000bdf5
push 0x101ee764
push ebx
call fcn.100172ee
test eax, eax
je 0x1000b1ba
push 0x101ee764
push ebx
call fcn.101d135a
pop ecx
pop ecx
push esi
lea eax, [ebp + 0xee8]
push eax
push str.ChildSetup
call fcn.1000a38d
add esp, 0xc
test eax, eax
je 0x1000bdee
lea eax, [ebp + 0xee8]
push eax
call fcn.101d1b9e
push eax
call fcn.10018ae5
pop ecx
pop ecx
xor esi, esi
jmp 0x1000bed4
push 0x101ee7b4
push ebx
call fcn.100172ee
test eax, eax
je 0x1000b1ba
push 0x101ee7b4
push ebx
call fcn.101d135a
lea eax, [ebp + 0xee8]
push eax
mov ebx, str.Jump
push ebx
call fcn.101d135a
add esp, 0x10
cmp word [ebp + 0xee8], 0
je 0x1000be88
lea eax, [ebp + 0xee8]
push closesocket
push eax
call fcn.1001661b
cmp word [ebp + eax*2 + 0xee6], 0x2b
pop ecx
pop ecx
jne 0x1000be88
push 0x101ee7b4
push str.JumpNext
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push closesocket
push eax
call fcn.1001661b
pop ecx
pop ecx
xor ecx, ecx
mov word [ebp + eax*2 + 0xee6], cx
jmp 0x1000bea1
push 0x101ee764
push str.JumpNext
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
lea eax, [ebp + 0xee8]
push eax
push ebx
mov ecx, edi
call fcn.100172ee
test eax, eax
je 0x1000b1ba
push 0x101ee764
push str.JumpFlag
mov ecx, edi
call fcn.100172ee
test eax, eax
jne 0x1000bdc1
push 8
pop esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0x6a8]
push eax
mov dword [ebp + method.CLogFunc.virtual_0], vtable.CLogFunc.0
call fcn.101d12b4
pop ecx
mov eax, esi
jmp 0x1000b1d8