Function at 0x40c2f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Create process suspended
Enumerate processes
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad595
mov eax, dword fs:[0]
push eax
mov eax, 0x174c
call fcn.00484290
mov eax, dword [0x4d8104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x15c0]
push 0x110
push 0
push eax
mov dword [ebp - 0x16e0], esi
call fcn.00486710
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x15c4]
add esp, 0xc
mov dword [ebp - 0x15c4], 0x114
push eax
call edi
push 0x208
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.00486710
mov eax, dword [ebp - 0x15c0]
add esp, 0xc
cmp eax, 5
jge 0x40c387
push eax
call fcn.0040d420
add esp, 4
test al, al
je 0x40c39d
push str.Global_
push 0x104
lea eax, [ebp - 0x808]
push eax
call fcn.0040da40
push str._ADAPPMGRSVCUPDATER_054DA169_BD90_4901_B004_A390C42F9497
push 0x104
lea eax, [ebp - 0x808]
push eax
call fcn.0040da40
xorps xmm0, xmm0
mov dword [ebp - 0x16fc], 0
push 0x14
movq qword [ebp - 0x1704], xmm0
call fcn.0049204f
add esp, 4
mov dword [ebp - 0x1700], eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push dword [ebp - 0x1700]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x808]
mov dword [ebp - 0x1704], 0xc
push eax
push 1
lea eax, [ebp - 0x1704]
mov dword [ebp - 0x16fc], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x1700]
mov dword [ebp - 0x16ec], eax
test ecx, ecx
je 0x40c446
push ecx
call fcn.0048cda1
mov eax, dword [ebp - 0x16ec]
add esp, 4
mov dword [ebp - 0x1700], 0
test eax, eax
jne 0x40c4d7
call fcn.0040f900
push 0x2a
push str.Unable_to_create_global_installer_mutex._r_n
lea ecx, [ebp - 0x1498]
mov dword [ebp - 0x1488], 0
mov dword [ebp - 0x1484], 0xf
mov byte [ebp - 0x1498], 0
call fcn.00401a40
lea eax, [ebp - 0x1498]
mov dword [ebp - 4], 0
push eax
call fcn.0040fa10
mov edx, dword [ebp - 0x1484]
add esp, 4
cmp edx, 0x10
jb 0x40c4d0
mov ecx, dword [ebp - 0x1498]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c4c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d1ef
push edx
push ecx
call fcn.00483e09
add esp, 8
xor al, al
jmp 0x40d1d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c54b
call fcn.0040f900
push 0x42
push str.Webinstaller_or_another_instance_of_updater_is_running._Quiting._r_n
lea ecx, [ebp - 0x1498]
mov dword [ebp - 0x1488], 0
mov dword [ebp - 0x1484], 0xf
mov byte [ebp - 0x1498], 0
call fcn.00401a40
lea eax, [ebp - 0x1498]
mov dword [ebp - 4], 1
push eax
call fcn.0040fa10
add esp, 4
lea ecx, [ebp - 0x1498]
call fcn.00401340
mov edi, dword [ebp - 0x16ec]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40d1d4
lea eax, [ebp - 0x16f8]
push eax
push 0x20019
push 0
push str.SOFTWAREAutodeskAutodesk_Application_Manager
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c6d1
push 0x208
push eax
lea eax, [ebp - 0xa10]
mov dword [ebp - 0x16e8], 1
push eax
mov dword [ebp - 0x16f0], 0x400
call fcn.00486710
add esp, 0xc
lea eax, [ebp - 0x16f0]
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x16e8]
push eax
push 0
push 0x4b29f0
push dword [ebp - 0x16f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [ebp - 0x1470], 0
lea ecx, [ebp - 0xa10]
mov dword [ebp - 0x146c], 7
mov word [ebp - 0x1480], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c5f0
sub ecx, edx
lea eax, [ebp - 0xa10]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1480]
call fcn.00401b30
cmp dword [ebp - 0x146c], 8
lea edx, [ebp - 0x1480]
mov eax, dword [ebp - 0x1470]
lea ecx, [ebp - 0x1450]
cmovae edx, dword [ebp - 0x1480]
mov dword [ebp - 4], 2
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0xf
lea esi, [edx + eax*2]
mov byte [ebp - 0x1450], 0
lea edx, [ebp - 0x1480]
mov eax, esi
cmovae edx, dword [ebp - 0x1480]
sub eax, edx
mov dword [ebp - 0x16e4], edx
sar eax, 1
push eax
call fcn.0040f460
push dword [ebp - 0x16f4]
lea ecx, [ebp - 0x1450]
push esi
push dword [ebp - 0x16e4]
call fcn.00402c60
push dword [ebp - 0x16f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [ebp - 0x1450]
lea ecx, [ebp - 0x1480]
movups xmmword [ebp - 0x1498], xmm0
movq xmm0, qword [ebp - 0x1440]
movq qword [ebp - 0x1488], xmm0
call fcn.00401390
mov esi, dword [ebp - 0x16e0]
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x40c6fe
push 0
push 0x4b1470
lea ecx, [ebp - 0x1498]
mov dword [ebp - 0x1488], 0
mov dword [ebp - 0x1484], 0xf
mov byte [ebp - 0x1498], 0
call fcn.00401a40
push 0x208
lea eax, [ebp - 0x600]
mov dword [ebp - 4], 3
push 0
push eax
call fcn.00486710
push 0x208
lea eax, [ebp - 0xc18]
push 0
push eax
call fcn.00486710
add esp, 0x18
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40c738
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x600]
push 0x104
push eax
call fcn.00491feb
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40c755
mov esi, dword [esi]
push esi
lea eax, [ebp - 0xc18]
push 0x104
push eax
call fcn.00491feb
add esp, 0xc
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xorps xmm0, xmm0
mov dword [ebp - 0x1758], 0x44
push 0x208
lea eax, [ebp - 0x1438]
movlpd qword [ebp - 0x1754], xmm0
push 0
push eax
movups xmmword [ebp - 0x1714], xmm0
movlpd qword [ebp - 0x174c], xmm0
movlpd qword [ebp - 0x1744], xmm0
movlpd qword [ebp - 0x173c], xmm0
movlpd qword [ebp - 0x1734], xmm0
movlpd qword [ebp - 0x172c], xmm0
movlpd qword [ebp - 0x1724], xmm0
movlpd qword [ebp - 0x171c], xmm0
call fcn.00486710
add esp, 0xc
call fcn.004101d0
mov dword [ebp - 0x16e4], eax
lea ecx, [ebp - 0x1450]
push 0x2f
xor eax, eax
mov dword [ebp - 0x1440], 0
push str._ADSKAPP_D6CDB8FF_004A_482D_BF55_67E3288C9D59
mov dword [ebp - 0x143c], 7
mov word [ebp - 0x1450], ax
call fcn.00401b30
push 0x110
lea eax, [ebp - 0x16d4]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.00486710
add esp, 0xc
mov dword [ebp - 0x16d8], 0x114
lea eax, [ebp - 0x16d8]
push eax
call edi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486710
mov eax, dword [ebp - 0x16d4]
add esp, 0xc
cmp eax, 5
jge 0x40c876
push eax
call fcn.0040d420
add esp, 4
test al, al
je 0x40c88c
push str.Global_
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0040da40
cmp dword [ebp - 0x143c], 8
lea eax, [ebp - 0x1450]
cmovae eax, dword [ebp - 0x1450]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0040da40
xorps xmm0, xmm0
mov dword [ebp - 0x1454], 0
push 0x14
movq qword [ebp - 0x145c], xmm0
call fcn.0049204f
add esp, 4
mov dword [ebp - 0x1458], eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push dword [ebp - 0x1458]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x145c], 0xc
push eax
push 0
lea eax, [ebp - 0x145c]
mov dword [ebp - 0x1454], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1450]
mov byte [ebp - 4], 3
call fcn.00401390
cmp edi, 0xb7
jne 0x40c9a7
call fcn.0040f900
push 0x12
push str.Service_is_busy._r_n
lea ecx, [ebp - 0x1450]
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0xf
mov byte [ebp - 0x1450], 0
call fcn.00401a40
lea eax, [ebp - 0x1450]
mov byte [ebp - 4], 5
push eax
call fcn.0040fa10
add esp, 4
lea ecx, [ebp - 0x1450]
call fcn.00401340
mov byte [ebp - 0x16d9], 1
jmp 0x40d1c3
push 0x16
xor eax, eax
mov byte [ebp - 0x16da], 0
push str.AutodeskDesktopApp.exe
lea ecx, [ebp - 0x1468]
mov dword [ebp - 0x1458], 0
mov dword [ebp - 0x1454], 7
mov word [ebp - 0x1468], ax
call fcn.00401b30
push 0
push 2
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x16e0], esi
cmp esi, 0xffffffff
je 0x40cae4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x1468]
call fcn.0040dd70
test eax, eax
jne 0x40ca38
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov byte [ebp - 0x16d9], 1
jmp 0x40caeb
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40cadc
mov edx, dword [ebp - 0x1458]
lea eax, [ebp - 0x218]
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ca60
sub eax, esi
lea edi, [ebp - 0x1468]
sar eax, 1
mov esi, edx
cmp dword [ebp - 0x1454], 8
cmovae edi, dword [ebp - 0x1468]
cmp eax, edx
lea edx, [ebp - 0x218]
cmovb esi, eax
test esi, esi
je 0x40cab1
mov ecx, edx
sub edi, ecx
nop dword [eax + eax]
mov cx, word [edx + edi]
cmp cx, word [edx]
jne 0x40cabb
add edx, 2
sub esi, 1
jne 0x40caa0
cmp dword [ebp - 0x1458], eax
jb 0x40cabb
jbe 0x40cac6
mov esi, dword [ebp - 0x16e0]
jmp 0x40ca38
push dword [ebp - 0x16e0]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov byte [ebp - 0x16d9], 1
jmp 0x40caeb
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov byte [ebp - 0x16d9], 0
lea ecx, [ebp - 0x1468]
call fcn.00401390
cmp byte [ebp - 0x16d9], 0
je 0x40cbf0
push str.AutodeskDesktopApp.exe
lea ecx, [ebp - 0x1450]
mov byte [ebp - 0x16da], 1
call fcn.0040bd80
cmp dword [ebp - 0x143c], 8
lea eax, [ebp - 0x1450]
cmovae eax, dword [ebp - 0x1450]
push eax
call fcn.0040c1c0
add esp, 4
xor edi, edi
test eax, eax
je 0x40cb91
nop dword [eax]
cmp edi, 0xa
jge 0x40cb91
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40cb6f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x143c], 8
lea eax, [ebp - 0x1450]
cmovae eax, dword [ebp - 0x1450]
push eax
call fcn.0040c1c0
add esp, 4
inc edi
test eax, eax
jne 0x40cb40
lea ecx, [ebp - 0x1450]
call fcn.00401390
call fcn.0040f900
push 0x2e
push str.Stopped_running_Autodesk_Desktop_App_process_r_n
lea ecx, [ebp - 0x1450]
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0xf
mov byte [ebp - 0x1450], 0
call fcn.00401a40
lea eax, [ebp - 0x1450]
mov byte [ebp - 4], 6
push eax
call fcn.0040fbf0
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1450]
call fcn.00401340
mov esi, dword [ebp - 0x16e4]
cmp byte [esi + 5], 0
je 0x40ccd6
cmp dword [esi + 0x1c], 8
lea edi, [esi + 8]
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x1458], 0
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x16e0], eax
jb 0x40cc28
mov edi, dword [edi]
cmp eax, 8
jae 0x40cc4f
movups xmm0, xmmword [edi]
mov dword [ebp - 0x1458], eax
lea eax, [ebp - 0x1468]
mov dword [ebp - 0x1454], 7
movups xmmword [ebp - 0x1468], xmm0
jmp 0x40ccad
mov esi, eax
lea ecx, [ebp - 0x1468]
mov eax, accept
or esi, 7
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.00401890
mov ecx, dword [ebp - 0x16e0]
mov dword [ebp - 0x1468], eax
lea ecx, [ecx*2 + 2]
push ecx
push edi
push eax
call fcn.004859b0
mov eax, dword [ebp - 0x16e0]
add esp, 0xc
mov dword [ebp - 0x1458], eax
cmp esi, 8
lea eax, [ebp - 0x1468]
mov dword [ebp - 0x1454], esi
cmovae eax, dword [ebp - 0x1468]
push eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x1438]
push str.__s____mode_unattended___extractFiles__1____installdir__s
push eax
call fcn.0040baf0
add esp, 0x10
lea ecx, [ebp - 0x1468]
call fcn.00401390
jmp 0x40cd3e
cmp byte [esi + 0x23], 0
je 0x40ccf3
call fcn.0040d200
test al, al
je 0x40ccf3
lea eax, [ebp - 0x600]
push eax
push str.__s____mode_unattended___launchClient__0____launchedFromOdis__1_
jmp 0x40cd2f
cmp byte [esi + 0x21], 0
je 0x40cd07
lea eax, [ebp - 0x600]
push eax
push str.__s____launchClient__0_
jmp 0x40cd2f
call fcn.0040d200
test al, al
jne 0x40cd23
cmp byte [esi + 0x20], al
jne 0x40cd23
lea eax, [ebp - 0x600]
push eax
push str.__s____launchClient__0_
jmp 0x40cd2f
lea eax, [ebp - 0x600]
push eax
push str.__s____mode_unattended___launchClient__0_
lea eax, [ebp - 0x1438]
push eax
call fcn.0040baf0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x14a0], 0
lea ecx, [ebp - 0x1438]
mov dword [ebp - 0x149c], 7
mov word [ebp - 0x14b0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cd64
sub ecx, edx
lea eax, [ebp - 0x1438]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x14b0]
call fcn.00401b30
mov byte [ebp - 4], 7
call fcn.0040f900
push 2
push 0x4b177c
lea ecx, [ebp - 0x1480]
mov dword [ebp - 0x1470], 0
mov dword [ebp - 0x146c], 0xf
mov byte [ebp - 0x1480], 0
call fcn.00401a40
cmp dword [ebp - 0x149c], 8
lea edx, [ebp - 0x14b0]
mov eax, dword [ebp - 0x14a0]
lea ecx, [ebp - 0x1450]
cmovae edx, dword [ebp - 0x14b0]
mov byte [ebp - 4], 8
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0xf
lea esi, [edx + eax*2]
mov byte [ebp - 0x1450], 0
lea edx, [ebp - 0x14b0]
mov eax, esi
cmovae edx, dword [ebp - 0x14b0]
sub eax, edx
mov dword [ebp - 0x16e8], edx
sar eax, 1
push eax
call fcn.0040f460
push dword [ebp - 0x16f4]
lea ecx, [ebp - 0x1450]
push esi
push dword [ebp - 0x16e8]
call fcn.00402c60
lea eax, [ebp - 0x1480]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x1450]
push eax
lea eax, [ebp - 0x1468]
push eax
call fcn.0040b560
push eax
mov byte [ebp - 4], 0xa
call fcn.0040fbf0
add esp, 0x10
lea ecx, [ebp - 0x1468]
call fcn.00401340
lea ecx, [ebp - 0x1450]
call fcn.00401340
lea ecx, [ebp - 0x1480]
mov byte [ebp - 4], 7
call fcn.00401340
lea eax, [ebp - 0x1714]
push eax
lea eax, [ebp - 0x1758]
push eax
lea eax, [ebp - 0xc18]
push eax
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x1438]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40cf82
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x3e8
mov esi, eax
lea eax, [ebp - 0x3f8]
push 0
push eax
call fcn.00486710
push esi
lea eax, [ebp - 0x3f8]
push str.Install:_createprocess_returned__d_r_n
push eax
call fcn.0040bac0
add esp, 0x18
lea eax, [ebp - 0x3f8]
lea ecx, [ebp - 0x1450]
push eax
call fcn.0040bd80
mov byte [ebp - 4], 0xb
call fcn.0040f900
cmp dword [ebp - 0x143c], 8
lea ecx, [ebp - 0x1450]
mov eax, dword [ebp - 0x1440]
lea edx, [ebp - 0x16da]
cmovae ecx, dword [ebp - 0x1450]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x1450]
cmovae ecx, dword [ebp - 0x1450]
push eax
push ecx
lea ecx, [ebp - 0x1480]
call fcn.0040a4d0
push eax
mov byte [ebp - 4], 0xc
call fcn.0040fa10
add esp, 4
lea ecx, [ebp - 0x1480]
call fcn.00401340
push dword [ebp - 0x1714]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1710]
call esi
lea ecx, [ebp - 0x1450]
call fcn.00401390
jmp 0x40d1b1
mov esi, dword [ebp - 0x1714]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x16f4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1714]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1710]
call esi
mov edi, dword [ebp - 0x16ec]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call esi
cmp dword [ebp - 0x1488], 0
je 0x40cfe7
mov eax, dword [ebp - 0x16e4]
mov al, byte [eax + 0x21]
test al, al
jne 0x40cfe7
cmp byte [ebp - 0x16da], al
je 0x40d1a1
lea eax, [ebp - 0x16e4]
push eax
push 0x20019
push 0
push str.SOFTWAREAutodeskAutodesk_Application_Manager
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d0fa
push 0x208
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x16f0], 1
push eax
mov dword [ebp - 0x16e8], 0x400
call fcn.00486710
add esp, 0xc
lea eax, [ebp - 0x16e8]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x16f0]
push eax
push 0
push str.Location
push dword [ebp - 0x16e4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [ebp - 0x1470], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x146c], 7
mov word [ebp - 0x1480], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d084
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1480]
call fcn.00401b30
push dword [ebp - 0x16e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [ebp - 0x1480]
xor eax, eax
lea ecx, [ebp - 0x1480]
mov word [ebp - 0x1480], ax
movups xmmword [ebp - 0x1468], xmm0
movq xmm0, qword [ebp - 0x1470]
movq qword [ebp - 0x1458], xmm0
mov dword [ebp - 0x1470], 0
mov dword [ebp - 0x146c], 7
call fcn.00401390
jmp 0x40d128
xor eax, eax
mov dword [ebp - 0x1458], 0
push eax
push 0x4b2150
lea ecx, [ebp - 0x1468]
mov dword [ebp - 0x1454], 7
mov word [ebp - 0x1468], ax
call fcn.00401b30
cmp dword [ebp - 0x1458], 0
mov byte [ebp - 4], 0xd
je 0x40d146
lea eax, [ebp - 0x1468]
push eax
call fcn.0040ec30
add esp, 4
jmp 0x40d196
call fcn.0040f900
push 0x35
push str.Unable_to_get_the_installed_location_from_registry._r_n
lea ecx, [ebp - 0x1450]
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0xf
mov byte [ebp - 0x1450], 0
call fcn.00401a40
lea eax, [ebp - 0x1450]
mov byte [ebp - 4], 0xe
push eax
call fcn.0040fa10
add esp, 4
lea ecx, [ebp - 0x1450]
call fcn.00401340
lea ecx, [ebp - 0x1468]
call fcn.00401390
cmp dword [ebp - 0x16f4], 0
mov byte [ebp - 0x16d9], 1
je 0x40d1b8
mov byte [ebp - 0x16d9], 0
lea ecx, [ebp - 0x14b0]
call fcn.00401390
lea ecx, [ebp - 0x1498]
call fcn.00401340
mov al, byte [ebp - 0x16d9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483e17
mov esp, ebp
pop ebp
ret
call fcn.0048969c
int3