Function at 0x402a80
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc14
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc08], eax
mov edx, edi
cmp dword [ebp + 8], edx
jle 0x402c9e
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrTrimA]
nop dword [eax + eax]
push 9
push str._runtype
push dword [eax + edi*4]
call esi
mov ecx, dword [ebp - 0xc08]
add esp, 0xc
mov ecx, dword [ecx + edi*4]
test eax, eax
jne 0x402b67
add ecx, 9
lea edx, [ebp - 0x404]
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402af0
push 0x4182e8
lea eax, [ebp - 0x404]
push eax
call ebx
lea eax, [ebp - 0x404]
push str.CIUMON_KIT
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x402b36
mov dword [0x421530], 1
lea edx, [eax + 1]
jmp 0x402c8e
lea eax, [ebp - 0x404]
push str.FULL_KIT
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
mov edx, 1
test eax, eax
jne 0x402c8e
mov dword [0x421530], 2
jmp 0x402c8e
push 6
push str._start
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x402b85
mov byte [0x41e019], al
lea edx, [eax + 1]
jmp 0x402c8e
mov eax, dword [ebp - 0xc08]
push 5
push str._stop
push dword [eax + edi*4]
call esi
add esp, 0xc
test eax, eax
jne 0x402bad
mov byte [0x41e019], 1
lea edx, [eax + 1]
jmp 0x402c8e
mov eax, dword [ebp - 0xc08]
push 0xc
push str._pluginsdir
push dword [eax + edi*4]
call esi
mov ecx, dword [ebp - 0xc08]
add esp, 0xc
mov ecx, dword [ecx + edi*4]
test eax, eax
jne 0x402bfb
add ecx, 0xc
mov edx, 0x420110
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x402bd7
push 0x4185a8
push 0x420110
call ebx
mov edx, 1
jmp 0x402c8e
push 6
push str._abort
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x402c18
mov byte [0x420512], 1
lea edx, [eax + 1]
jmp 0x402c8e
mov eax, dword [ebp - 0xc08]
push 0xd
push str._crypkeycheck
push dword [eax + edi*4]
call esi
add esp, 0xc
test eax, eax
jne 0x402c3d
mov byte [0x41e8ef], 1
lea edx, [eax + 1]
jmp 0x402c8e
mov eax, dword [ebp - 0xc08]
push 0x10
push str._CrypServCurrent
push dword [eax + edi*4]
call esi
add esp, 0xc
test eax, eax
jne 0x402c62
mov byte [0x420510], 1
lea edx, [eax + 1]
jmp 0x402c8e
mov eax, dword [ebp - 0xc08]
push 0xc
push str._DebugRevert
push dword [eax + edi*4]
call esi
movzx ecx, byte [0x41e8ec]
add esp, 0xc
test eax, eax
mov edx, 1
cmove ecx, edx
mov byte [0x41e8ec], cl
mov eax, dword [ebp - 0xc08]
inc edi
cmp edi, dword [ebp + 8]
jl 0x402ac0
cmp byte [0x41e8ef], 0
je 0x402cd2
call fcn.004089e0
mov ecx, 0x420110
call fcn.00403c50
test al, al
je 0x403472
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
cmp byte [0x41e019], 0
jne 0x402cf8
call fcn.004089e0
call fcn.00408460
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
cmp dword [0x421530], 0
jne 0x402dd1
xor ecx, ecx
call fcn.00403490
test eax, eax
je 0x402dbd
cmp byte [0x420511], 0
je 0x402dd8
movups xmm0, xmmword [str.This_kit_is_not_appropriate_for_Windows_NT4._n]
mov eax, dword [0x418610]
lea edi, [ebp - 0x404]
mov dword [ebp - 0x3dc], eax
dec edi
mov ax, word [0x418614]
movups xmmword [ebp - 0x404], xmm0
mov word [ebp - 0x3d8], ax
movups xmm0, xmmword [0x4185f8]
movups xmmword [ebp - 0x3f4], xmm0
movq xmm0, qword [0x418608]
movq qword [ebp - 0x3e4], xmm0
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402d70
mov ecx, 0x10
mov esi, str.Please_contact_G._Michaels_Consulting_Ltd._for_more_information._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x404]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402d90
push 0x50030
push str.Windows_NT4_Not_Supported
lea eax, [ebp - 0x404]
mov ecx, 9
push eax
mov esi, str.The_installation_will_not_continue.
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.00403490
cmp dword [0x421530], 0
jne 0x402ea2
call fcn.004036c0
test eax, eax
jne 0x402ea2
movups xmm0, xmmword [str.You_are_not_logged_in_with_Admininstrator_privileges._n]
mov eax, dword [0x4186cc]
lea edi, [ebp - 0x404]
mov dword [ebp - 0x3d4], eax
dec edi
mov ax, word [0x4186d0]
movups xmmword [ebp - 0x404], xmm0
mov word [ebp - 0x3d0], ax
movups xmm0, xmmword [0x4186ac]
mov al, byte [0x4186d2]
mov byte [ebp - 0x3ce], al
movups xmmword [ebp - 0x3f4], xmm0
movups xmm0, xmmword [0x4186bc]
movups xmmword [ebp - 0x3e4], xmm0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402e46
mov ecx, 0x13
mov esi, str.See_your_System_Administrator_about_getting_the_required_logon_privileges._n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x404]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402e61
push 0x50030
push str.Administration_Privileges_Required
lea eax, [ebp - 0x404]
mov ecx, 9
push eax
mov esi, str.The_installation_will_not_continue.
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
call fcn.004089e0
mov eax, dword [0x421530]
test eax, eax
jne 0x402eef
push eax
push 0x4041e0
push dword [0x41f8f0]
push str.UPDATE_TYPE
push dword [0x41f8f8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x403472
movzx ecx, byte [0x41e01a]
xor edx, edx
cmp eax, 2
mov eax, dword [0x421530]
cmove ecx, edx
mov byte [0x41e01a], cl
cmp eax, 2
jne 0x402f1a
mov eax, dword [0x41875c]
movq xmm0, qword [str.BuildPlus.exe]
mov dword [0x41e028], eax
mov ax, word [0x418760]
movq qword [str.CIUMon.exe], xmm0
mov word [0x41e02c], ax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push 0
push str.SoftwareG._Michaels_Consulting_Ltd.
push 0x80000002
call edi
test eax, eax
jne 0x402f8e
lea eax, [ebp - 0xc10]
mov dword [ebp - 0xc10], 0x400
push eax
push 0x41f900
lea eax, [ebp - 0xc14]
push eax
push 0
push str.CIUMON
push dword [ebp - 0xc0c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ecx, byte [0x41f900]
xor edx, edx
push dword [ebp - 0xc0c]
test eax, eax
cmovne ecx, edx
mov byte [0x41f900], cl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov al, byte [ecx + 0x41f900]
lea ecx, [ecx + 1]
mov byte [ecx + 0x41fcff], al
test al, al
jne 0x402f90
mov ecx, 0x41f900
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402fb0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendA]
sub ecx, edx
je 0x40320d
cmp byte [0x41e8ee], al
je 0x40320d
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x41f900]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x405], al
test al, al
jne 0x402fe0
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strlwr]
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strstr]
lea eax, [ebp - 0x404]
push str.program_files__x86__
push eax
call ebx
mov esi, eax
lea eax, [ebp - 0x404]
push str.program_files_
push eax
call ebx
add esp, 0x14
mov edi, eax
test esi, esi
jne 0x4031fb
test edi, edi
je 0x4031fb
push esi
push 0x26
push 0x420520
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4031fb
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + 0x420520]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x805], al
test al, al
jne 0x403060
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strlwr]
add esp, 4
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x804]
push str.program_files__x86__
push eax
call ebx
add esp, 8
test eax, eax
je 0x4031fb
lea ecx, [ebp - 0x404]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4030b3
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4030c1
sub edx, esi
lea eax, [ebp - 0x404]
sub ecx, edx
push ecx
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea ecx, [ebp - 0x404]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4030f0
sub ecx, edx
mov edx, edi
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x403100
sub edx, esi
sub ecx, edx
cmp ecx, 0x400
jae 0x403485
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov byte [ebp + ecx - 0x804], al
lea eax, [ebp - 0x804]
push str.program_files__x86_
push eax
call ebx
add edi, 0xf
lea eax, [ebp - 0x804]
push edi
push eax
call ebx
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov al, byte [ecx + 0x420520]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xc05], al
test al, al
jne 0x403150
push edi
lea eax, [ebp - 0xc04]
push eax
call ebx
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x403201
push 0x4187d0
lea eax, [ebp - 0xc04]
push eax
call ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
je 0x403207
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x420520]
lea ecx, [ecx + 1]
mov byte [ecx + 0x41fcff], al
test al, al
jne 0x4031b0
mov ecx, 0x41f900
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4031d0
sub ecx, edx
lea edx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4031e0
sub edi, edx
sub ecx, edi
add ecx, 0x41f900
push ecx
push 0x41fd00
call ebx
jmp 0x403207
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
nop
mov al, byte [ecx + 0x41fd00]
lea ecx, [ecx + 1]
mov byte [ecx + 0x41e8ef], al
test al, al
jne 0x403210
push 0x400
push 0x41f4f0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.System32_regsvr32.exe
push 0x41f4f0
call ebx
push 0x41f4f0
call esi
neg eax
sbb al, al
and byte [0x41f4f0], al
call fcn.00403ae0
cmp byte [0x41e01a], 0
mov byte [0x420510], al
je 0x403277
mov ecx, 1
call fcn.00408aa0
call fcn.00404280
call fcn.00408ad0
mov ecx, 3
call fcn.00408aa0
call fcn.00401b50
cmp byte [0x41e01a], 0
je 0x4032d9
call fcn.00405640
mov ecx, dword [0x421530]
mov ebx, eax
cmp ecx, 1
je 0x4032a6
cmp ecx, 2
jne 0x4032e5
test ebx, ebx
jne 0x4032c6
cmp byte [0x420513], bl
jne 0x4032c6
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412814
mov esp, ebp
pop ebp
ret
call fcn.00408ad0
call fcn.00406520
xor ebx, ebx
call fcn.00408ad0
cmp byte [0x420d20], 0
jne 0x403472
call fcn.00404d50
call fcn.004053b0
cmp byte [0x420d21], 0
je 0x403392
cmp byte [0x420510], 0
jne 0x403392
cmp byte [0x41e8ed], 0
je 0x403392
call fcn.004053f0
test al, al
je 0x403472
movups xmm0, xmmword [str.You_will_need_to_reboot_now_in_order_to_get_the_CrypKey_license_server_running._n]
mov al, byte [0x418848]
lea edi, [ebp - 0x404]
mov byte [ebp - 0x3b4], al
dec edi
movups xmmword [ebp - 0x404], xmm0
movups xmm0, xmmword [0x418808]
movups xmmword [ebp - 0x3f4], xmm0
movups xmm0, xmmword [0x418818]
movups xmmword [ebp - 0x3e4], xmm0
movups xmm0, xmmword [0x418828]
movups xmmword [ebp - 0x3d4], xmm0
movups xmm0, xmmword [0x418838]
movups xmmword [ebp - 0x3c4], xmm0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403385
jmp 0x403458
mov eax, dword [0x421530]
cmp eax, 1
je 0x4033a5
cmp eax, 2
jne 0x403472
test ebx, ebx
jne 0x403472
lea eax, [ebp - 0xc0c]
push eax
push 0x20019
push ebx
push str.SoftwareGMCL_Upgrade
push 0x80000002
call edi
test eax, eax
jne 0x4033fc
push dword [ebp - 0xc0c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x13
lea edi, [ebp - 0x404]
mov esi, str.You_will_need_to_reboot_now_in_order_to_get_the_virtual_serial_ports_running._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x404]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4033f2
jmp 0x403458
cmp byte [0x41e8ee], 0
jne 0x403472
cmp dword [0x420514], 0
je 0x403472
mov ecx, 0x18
lea edi, [ebp - 0x404]
mov esi, str.If_you_use_virtual_serial_ports_then_you_will_need_to_reboot_in_order_to_get_them_working_again._n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x404]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403430
mov ecx, 0xf
mov esi, str.If_you_do_not_use_them_then_a_reboot_will_not_be_required._n
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x404]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403450
mov ecx, 6
mov esi, str.Do_you_wish_to_reboot_now_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x404]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405550
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412814
mov esp, ebp
pop ebp
ret
call fcn.0041294b
int3