Function at 0x4034cd
Capabilities:
Delete file
Terminate process

Disassembly:
push 0x950
mov eax, 0x4bbf66
call fcn.004180a8
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x934], esi
inc ebx
mov dword [0x511070], ebx
mov edi, ebx
mov dword [ebp - 0x93c], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov dword [ebp - 0x940], 2
cmp dword [eax], ebx
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
jle 0x4035fe
call ebx
push 0x4d4c08
mov eax, dword [eax]
push dword [eax + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4035f8
call ebx
push 0x4d4bec
mov eax, dword [eax]
push dword [eax + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403556
mov dword [ebp - 0x93c], 1
jmp 0x4035db
call ebx
push str._sconf
mov eax, dword [eax]
push dword [eax + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4035ec
call ebx
push str._sfxname
mov eax, dword [eax]
push dword [eax + edi*4]
call sub.VCRUNTIME140.dll_wcsstr
pop ecx
pop ecx
mov esi, eax
call ebx
mov eax, dword [eax]
cmp esi, dword [eax + edi*4]
jne 0x4035d9
call ebx
mov ecx, 0x5201fc
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
add eax, 0x12
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push dword [0x5201fc]
lea eax, [ebp - 0x938]
push eax
call fcn.00406f5a
pop ecx
pop ecx
xor esi, esi
mov ecx, 0x5201fc
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x4035db
xor esi, esi
inc edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp edi, dword [eax]
jl 0x403513
jmp 0x4035fe
mov dword [0x511070], 2
jmp 0x4035fe
mov dword [0x511070], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [eax], 2
jle 0x40392f
call ebx
push str._delself
mov eax, dword [eax]
push dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
pop ecx
pop ecx
test eax, eax
jne 0x40392f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0x728]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x728]
push eax
call fcn.004024f9
call ebx
push esi
push esi
lea ecx, [ebp - 0x930]
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0x520]
push ecx
push dword [eax + 8]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
add esp, 0x20
call fcn.004078f8
lea ecx, [ebp - 0x938]
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_296]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
call fcn.00403c90
push 4
pop edi
test esi, esi
je 0x40375a
test eax, eax
je 0x4036ee
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x944]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push 0x4d4c34
push eax
lea eax, [ebp - 0x940]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x934], ebx
call fcn.00401a36
add esp, 0xc
push 3
pop ebx
mov dword [ebp - 4], ebx
jmp 0x403704
push 0x4d3a20
lea ecx, [ebp - 0x93c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
mov dword [ebp - 4], edi
mov ebx, edi
push eax
lea ecx, [ebp - 0x938]
mov dword [ebp - 0x934], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
test bl, 4
je 0x40372b
lea ecx, [ebp - 0x93c]
and ebx, 0xfffffffb
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test bl, 2
je 0x40373f
lea ecx, [ebp - 0x940]
and ebx, 0xfffffffd
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 1
test bl, 1
je 0x403842
lea ecx, [ebp - 0x944]
jmp 0x40383c
test eax, eax
lea eax, [ebp - 0x520]
push eax
je 0x40379f
lea ecx, [ebp - 0x948]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push 0x4d4c5c
push eax
lea eax, [ebp - 0x940]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x934], 8
call fcn.00401a36
add esp, 0xc
mov dword [ebp - 4], 6
push 0x18
jmp 0x4037da
lea ecx, [ebp - 0x93c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
push 0x4d4c7c
push eax
lea eax, [ebp - 0x944]
mov dword [ebp - 4], 7
push eax
mov dword [ebp - 0x934], 0x20
call fcn.00401a36
add esp, 0xc
mov dword [ebp - 4], 8
push 0x60
pop ebx
push eax
lea ecx, [ebp - 0x938]
mov dword [ebp - 0x934], ebx
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__26]
test bl, 0x40
je 0x403802
lea ecx, [ebp - 0x944]
and ebx, 0xffffffbf
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test bl, 0x20
je 0x403816
lea ecx, [ebp - 0x93c]
and ebx, 0xffffffdf
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test bl, 0x10
je 0x40382a
lea ecx, [ebp - 0x940]
and ebx, 0xffffffef
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 1
test bl, 8
je 0x403842
lea ecx, [ebp - 0x948]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x938]
call dword [sym.imp.mfc140u.dll_Ordinal_5884]
cmp eax, edi
jle 0x4038c0
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x944]
push str.regsvr32.exe__s__u__
push eax
call fcn.00402461
push 0x4d45b4
push eax
lea eax, [ebp - 0x948]
mov byte [ebp - 4], 9
push eax
call fcn.00401a36
add esp, 0x18
push 0x1388
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0xa
push ecx
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call fcn.00407ff9
add esp, 0xc
lea ecx, [ebp - 0x948]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x944]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov eax, dword [eax]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x520]
push eax
call fcn.0040299d
cmp dword [0x511070], 0
pop ecx
jne 0x403927
lea ecx, [ebp - 0x934]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x14
lea ecx, [ebp - 0x934]
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__23]
push 0
push 0
lea ecx, [ebp - 0x934]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call sub.mfc140u.dll_AfxMessageBox_1
lea ecx, [ebp - 0x934]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call edi
mov esi, eax
call sub.mfc140u.dll_AfxGetModuleState
push 0
mov dword [eax + 8], esi
call edi
mov esi, eax
call sub.mfc140u.dll_AfxGetModuleState
push 0x80
mov dword [eax + 0xc], esi
lea eax, [ebp - 0x318]
push eax
push 2
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [eax], 1
jle 0x403992
call ebx
push str._install
mov eax, dword [eax]
push dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403992
inc eax
mov dword [ebp - 0x934], eax
jmp 0x403a00
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x938]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__28]
lea ecx, [ebp - 0x938]
mov dword [ebp - 4], 0xc
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
push 0
push str.setup.exe
lea ecx, [ebp - 0x938]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
mov esi, eax
not esi
shr esi, 0x1f
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 0x934], esi
test esi, esi
je 0x403a21
cmp dword [ebp - 0x93c], 0
mov edi, dword [ebp - 0x934]
jne 0x403a77
cmp dword [0x511070], 2
jge 0x403a77
and dword [0x511070], 0
jmp 0x403a77
call fcn.00406c23
cmp dword [0x511070], 0
mov edi, esi
mov dword [ebp - 0x934], edi
jne 0x403a77
push 0x100
lea eax, [ebp - 0x218]
push eax
push 6
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x134
lea eax, [ebp - 0x318]
mov dword [ebp - 0x934], edi
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x403c88
mov ecx, 0x51c4d0
call fcn.0040bb40
lea esi, [eax - 1]
mov dword [ebp - 0x93c], esi
test esi, esi
jle 0x403c78
test edi, edi
je 0x403bba
and dword [ebp - 0x948], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [eax], 2
jle 0x403b30
mov esi, dword [ebp - 0x948]
push 8
mov dword [ebp - 0x938], 8
pop edi
call ebx
push 0x4d4cf4
mov eax, dword [eax]
push dword [edi + eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x403af9
call ebx
mov ecx, dword [ebp - 0x938]
push 0x4d4bec
mov eax, dword [eax]
push dword [eax + ecx]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x403afc
xor esi, esi
inc esi
inc dword [ebp - 0x940]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
add dword [ebp - 0x938], 4
add edi, 4
mov ecx, dword [ebp - 0x940]
cmp ecx, dword [eax]
jl 0x403ac3
mov edi, dword [ebp - 0x934]
test esi, esi
mov esi, dword [ebp - 0x93c]
jne 0x403bba
lea eax, [ebp - 0x218]
push 0x100
push eax
cmp esi, 1
jne 0x403b4d
push 0x21
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x403b69
push 4
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x218]
push esi
push eax
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x318]
push 0x34
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call ebx
cmp eax, 6
je 0x403bba
push 0x100
lea eax, [ebp - 0x218]
push eax
push 0xf
push 0
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
lea ecx, [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
call ebx
xor eax, eax
inc eax
jmp 0x403c8a
lea ecx, [ebp - 0x95c]
call sub.mfc140u.dll_CDWordArray::CDWordArray
lea eax, [ebp - 0x95c]
mov dword [ebp - 4], 0xd
push eax
mov ecx, 0x51c4d0
call fcn.0040b990
test eax, eax
je 0x403c69
mov ebx, dword [ebp - 0x93c]
xor edi, edi
push edi
lea ecx, [ebp - 0x95c]
call fcn.00403436
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcessId
cmp dword [esi], eax
je 0x403c5e
push edi
lea ecx, [ebp - 0x95c]
call fcn.00403436
push dword [eax]
call fcn.0040ba80
pop ecx
push 0
push 0x3e9
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea ecx, [ebp - 0x95c]
call fcn.00403436
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403c5e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jl 0x403bed
mov edi, dword [ebp - 0x934]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x95c]
call fcn.004174ac
test edi, edi
je 0x403c83
call fcn.00405cb2
jmp 0x403c8a
call fcn.00402854
xor eax, eax
call fcn.00418057
ret