Function at 0x43a250
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59db3e
mov eax, dword fs:[0]
push eax
sub esp, 0xc48
mov eax, dword [0x639354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.utilityinstall.ini
push dword [0x641b9c]
lea eax, [ebp - 0xc48]
push eax
call fcn.00448a10
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00560a80
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0x18
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b9868
push str.suitepackage
push str.installinfo
call esi
mov ecx, 0x5bbd7c
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a30c
test dx, dx
je 0x43a308
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a30c
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a2e6
xor eax, eax
jmp 0x43a311
sbb eax, eax
or eax, 1
or edi, 0xffffffff
test eax, eax
jne 0x43a87b
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0x420]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b9868
push str.foxmail
push str.installinfo
call esi
mov ecx, 0x5bbd7c
lea eax, [ebp - 0x420]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a386
test dx, dx
je 0x43a382
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a386
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a360
xor eax, eax
jmp 0x43a38b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a44b
push str.Foxmail
push dword [0x6130f0]
lea eax, [ebp - 0xc50]
push eax
call fcn.00448a10
push 0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 1
push 0x80000002
push eax
call fcn.00463be0
add esp, 0x20
mov edx, dword [ebp - 0xc50]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a3ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43a430
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push 0x5bc71c
push eax
call fcn.0047fdb0
push eax
push str.1126_tKAllAux::UninstallSuite_tUninstall_Foxmail_return__d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0xc44]
add esp, 0x30
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a44b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0x628]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b9868
push str.foxitreader
push str.installinfo
call esi
mov ecx, 0x5bbd7c
lea eax, [ebp - 0x628]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a4b6
test dx, dx
je 0x43a4b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a4b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a490
xor eax, eax
jmp 0x43a4bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a560
push str.utilityPhantomSetup.exe
push dword [0x641b9c]
lea eax, [ebp - 0xc44]
push eax
call fcn.00448a10
add esp, 0xc
push dword [ebp - 0xc44]
mov byte [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a53f
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push str.UnInstall
push dword [ebp - 0xc44]
call fcn.0047fdb0
add esp, 0x1c
mov esi, eax
push dword [ebp - 0xc44]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push str.1139_tKAllAux::UninstallSuite_tUninstall_FoxitReader_return__d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x14
mov edx, dword [ebp - 0xc44]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a560
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0x830]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b9868
push str.sogou
push str.installinfo
call esi
mov ecx, 0x5bbd7c
lea eax, [ebp - 0x830]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a5ca
test dx, dx
je 0x43a5c6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a5ca
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a5a4
xor eax, eax
jmp 0x43a5cf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a747
push str.Sogou_Input
push dword [0x6130f0]
lea eax, [ebp - 0xc50]
push eax
call fcn.00448a10
push 0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 5
push 0x80000002
push eax
call fcn.00463be0
add esp, 0x20
mov edx, dword [ebp - 0xc50]
mov eax, edi
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a630
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc44]
mov ebx, dword [edx - 0xc]
mov dword [ebp - 0xc4c], ebx
test ebx, ebx
je 0x43a72c
js 0x43aa20
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x43a670
push ebx
lea ecx, [ebp - 0xc44]
call fcn.00429eb0
mov edx, dword [ebp - 0xc44]
lea eax, [edx + ebx*2]
mov ecx, edx
mov dword [ebp - 0xc54], eax
cmp edx, eax
jae 0x43a6c3
nop
cmp word [edx], 0x22
lea ebx, [edx + 2]
je 0x43a6ae
lea edi, [ecx + 2]
xor esi, esi
cmp ecx, edi
je 0x43a6ae
cmp esi, 1
jae 0x43a6a8
mov ax, word [edx]
inc esi
mov word [ecx], ax
add edx, 2
add ecx, 2
cmp ecx, edi
jne 0x43a692
mov eax, dword [ebp - 0xc54]
mov edx, ebx
cmp ebx, eax
jb 0x43a680
mov ebx, dword [ebp - 0xc4c]
or edi, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub edx, ecx
xor eax, eax
sar edx, 1
sub ebx, edx
mov word [ecx], ax
js 0x43aa20
mov eax, dword [ebp - 0xc44]
cmp ebx, dword [eax - 8]
jg 0x43aa20
xor ecx, ecx
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0xc44]
push ecx
push 1
push ecx
push ecx
push 0xffffffffffffffff
mov word [eax + ebx*2], cx
push 0x5bc71c
push dword [ebp - 0xc44]
call fcn.0047fdb0
push eax
push str.1152_tKAllAux::UninstallSuite_tUninstall_Sogou_return__d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov edx, dword [ebp - 0xc44]
add esp, 0x30
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a747
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0xa38]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b9868
push str.istylepdf
push str.installinfo
call esi
mov ecx, 0x5bbd7c
lea eax, [ebp - 0xa38]
jmp 0x43a790
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a7b6
test dx, dx
je 0x43a7b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a7b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a790
xor eax, eax
jmp 0x43a7bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a87b
push str.iStylePDF
push dword [0x6130f0]
lea eax, [ebp - 0xc4c]
push eax
call fcn.00448a10
push 0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 8
push 0x80000002
push eax
call fcn.00463be0
add esp, 0x20
mov edx, dword [ebp - 0xc4c]
mov eax, edi
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a81c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43a860
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push 0x5bc71c
push eax
call fcn.0047fdb0
push eax
push str.1164_tKAllAux::UninstallSuite_tUninstall_iStylePDF_return__d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0xc44]
add esp, 0x30
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a87b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.00560a80
add esp, 0xc
lea eax, [ebp - 0xc40]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b9868
push 0x5bc8c0
push str.installinfo
call esi
mov ecx, 0x5bbd7c
lea eax, [ebp - 0xc40]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a8e6
test dx, dx
je 0x43a8e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a8e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a8c0
xor eax, eax
jmp 0x43a8eb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43a9e4
push str.PowerWord2012cut
push dword [0x613090]
lea eax, [ebp - 0xc4c]
push eax
call fcn.00448a10
push 0
push str.PathName
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 0xb
push 0x80000002
push eax
call fcn.00463be0
add esp, 0x20
mov edx, dword [ebp - 0xc4c]
mov eax, edi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a94c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43a9cd
push str.Uninst.exe
push eax
lea eax, [ebp - 0xc54]
push eax
call fcn.00448a10
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push str.48E32C2A_4A45_43CB_9BE3_C26F201CD20D__s
push dword [eax]
mov byte [ebp - 4], 0xe
call fcn.0047fdb0
mov edx, dword [ebp - 0xc54]
mov esi, eax
add esp, 0x28
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a9aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
push str.1178_tKAllAux::UninstallSuite_tUninstall_Ksd_return__d
push str.D:pub_bh8h_rc_bug_mas_v12_2409Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x641cc8
call fcn.0046b730
mov eax, dword [ebp - 0xc44]
add esp, 0x14
lea edx, [eax - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43a9e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc48]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x43a9ff
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c3a9
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00429b60
int3