Function at 0x420210
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry value
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x13d8]
mov eax, 0x13d8
call fcn.006218a0
push 0xffffffffffffffff
push 0x644434
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x13d4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044b030
call fcn.00449550
mov ecx, ebx
call fcn.00418e40
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], edi
push 0x75da08
call fcn.00415e50
mov eax, dword [0x75da08]
push eax
push 0x678ea8
push 0x75da0c
call fcn.00402f70
add esp, 0x10
mov dword [ebp - 0xc8], 0x400
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp + 0xf94]
push edx
push edi
push edi
push str.szCustomUserAgent
mov eax, dword [0x75dbe4]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x4202e6
lea ecx, [ebp + 0xf94]
push ecx
push 0x678ea8
push 0x75da08
call fcn.00402f70
add esp, 0xc
mov ecx, ebx
call fcn.0041ce60
mov ecx, ebx
call fcn.004101a0
cmp dword [0x75dbd4], edi
jne 0x4203b8
mov dword [ebp - 0x30], 0x40
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp + 0x1394]
push eax
push 0
push 0
push str.idmvers
mov ecx, dword [0x75dbe4]
push ecx
call esi
test eax, eax
jne 0x4203ae
mov edx, dword [0x75dda0]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420337
sub eax, esi
push eax
push edx
lea edx, [ebp + 0x1394]
push edx
call fcn.006218cb
add esp, 0xc
test eax, eax
je 0x42036e
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x42036e
cmp byte [eax + 0x51], 0
jne 0x42036e
mov dword [0x75dbd4], 1
push 8
push str.v6.35b09
lea eax, [ebp + 0x1394]
push eax
call fcn.00624bdd
add esp, 0xc
test eax, eax
je 0x4203a2
push 8
push str.v6.35b10
lea ecx, [ebp + 0x1394]
push ecx
call fcn.00624bdd
add esp, 0xc
test eax, eax
jne 0x4203b8
mov dword [0x75dbd8], 1
jmp 0x4203b8
mov dword [0x75dbd4], 1
cmp dword [0x75dbb8], edi
je 0x4203e1
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4203d7
cmp byte [eax + 0x51], 0
jne 0x4203d7
cmp dword [0x75dbd4], edi
je 0x4203e1
call fcn.004148f0
call fcn.00410330
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4203f8
cmp byte [eax + 0x51], 0
jne 0x4203f8
cmp dword [0x75dbd4], edi
je 0x420409
push 1
call fcn.0046d960
push 0
call fcn.00473c30
add esp, 8
call fcn.0041bb80
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp + 0xed0], 0x94
lea edx, [ebp + 0xed0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x420470
cmp dword [ebp + 0xee0], 2
jne 0x420470
mov esi, 1
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0xed4], 6
jb 0x420470
mov dword [ebp - 0x28], esi
push 0x80000001
call fcn.00412c40
push 0x80000002
call fcn.00412c40
add esp, 8
mov dword [ebp - 0x40], 4
test esi, esi
je 0x4205bd
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.EnableDriver
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4204aa
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov esi, 1
mov dword [ebp - 0xb4], esi
lea edx, [ebp - 0x1c]
push edx
push 0x20019
push 0
push 0x678e18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420513
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.AdvIntDriverEnabled2
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420509
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xb4], esi
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], esi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
jne 0x420572
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.bVistaAdvInt
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x42056f
mov eax, 1
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0x4c], eax
push 4
lea edx, [ebp - 0x4c]
push edx
push 4
push 0
push str.bVistaAdvInt
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x420572
mov dword [ecx + 0x1c], esi
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
je 0x4205bd
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
call fcn.00410500
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x3c], edi
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
sete bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], 1
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push 0
push str.EnableDriver
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4205dc
cmp byte [eax + 0x51], 0
jne 0x4205eb
cmp dword [0x75dbd4], 0
je 0x42066d
cmp byte [eax + 0x51], 0
jne 0x4205eb
cmp dword [0x75dbd4], 0
je 0x420625
lea ecx, [ebp - 0x18]
call fcn.00500ab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00500b10
test eax, eax
je 0x420619
lea ecx, [ebp - 0x18]
call fcn.00500ad0
test eax, eax
jne 0x420619
push 1
lea ecx, [ebp - 0x18]
call fcn.00501000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00500ac0
mov dword [ebp - 0x2c], 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.DebugFlags
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42066d
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push str.DebugFlags
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x420890
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x18]
call fcn.00500ab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00500b10
test eax, eax
jne 0x420800
xor edi, edi
cmp dword [0x75dbcc], edi
jne 0x4206b3
push edi
lea ecx, [ebp - 0x18]
call fcn.00501000
lea ecx, [ebp - 0x18]
call fcn.00500c00
mov dword [ebp - 0x20], edi
mov dword [ebp + 0xf64], edi
mov dword [ebp + 0xf6c], edi
xor edx, edx
mov word [ebp + 0xf68], dx
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041f020
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0xf64]
push ecx
mov ecx, esi
call fcn.00417860
test eax, eax
je 0x420793
mov ebx, dword [ebp - 0x20]
cmp ebx, 1
je 0x420793
xor esi, esi
mov dword [ebp - 0xc0], esi
mov edx, dword [ebp - 0x14]
cmp esi, dword [edx + 0x28]
jge 0x420793
mov edi, edx
add edi, 0x20
push esi
mov ecx, edi
call fcn.00453c90
mov eax, dword [eax]
cmp ebx, dword [eax + 8]
jne 0x4207fa
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
push esi
mov ecx, edi
call fcn.00453c90
mov eax, dword [eax]
add eax, 0x14
cmp ebx, dword [eax + 8]
jge 0x420793
mov eax, dword [ebp + 0xf64]
test eax, eax
je 0x420751
mov dword [ebp - 0x1c], eax
jmp 0x42075a
lea ecx, [ebp + 0xf68]
mov dword [ebp - 0x1c], ecx
push esi
mov ecx, edi
call fcn.00453c90
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d160
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
push eax
call fcn.0062567a
add esp, 8
test eax, eax
jne 0x4207f4
push esi
mov ecx, edi
call fcn.00453c90
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d160
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], eax
jne 0x4207c6
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0xbc], eax
push 4
lea edx, [ebp - 0xbc]
push edx
push 4
push eax
push str.AdvancedIntegration
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0041fb20
mov dword [0x75da04], 1
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xf64]
call fcn.00401210
mov edi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x70]
jmp 0x420881
inc ebx
jmp 0x42072a
inc esi
jmp 0x4206fe
cmp dword [ebp - 0x28], 0
je 0x420884
call fcn.00516dd0
mov esi, eax
test esi, esi
je 0x420881
mov dword [ebp - 0xc4], 4
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push str.StEnableBFEMsg
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x420877
mov dword [ebp - 0x48], 1
push 4
lea ecx, [ebp - 0x48]
push ecx
push 4
push 0
push str.StEnableBFEMsg
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
push 0
push esi
push 0x411740
call fcn.005ffb6b
jmp 0x420881
xor ebx, ebx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x3c], edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00500ac0
cmp dword [esi + 0x1c], 0
je 0x420c60
test ebx, ebx
je 0x420c40
xor esi, esi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x34], esi
je 0x420c0a
push esi
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041bf40
cmp dword [ebp - 0x28], esi
jne 0x4208fc
push 1
mov ecx, ebx
call fcn.0041abb0
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [0x75da00], 1
mov ecx, ebx
test edi, edi
je 0x4208ed
call fcn.00416c40
xor edi, edi
mov dword [ebp - 0x3c], edi
jmp 0x420c06
call fcn.00410440
xor edi, edi
mov dword [ebp - 0x3c], edi
jmp 0x420c06
mov dword [ebp + 0xf88], esi
mov dword [ebp + 0xf90], esi
xor eax, eax
mov word [ebp + 0xf8c], ax
mov byte [ebp - 4], 4
mov eax, dword [0x75dc58]
cmp eax, esi
jne 0x420923
mov eax, 0x75dc5c
push esi
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xf88]
call fcn.00402320
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420a1c
cmp dword [0x75dbd4], esi
jne 0x420a1c
cmp byte [eax + 0x29], 0
je 0x420a1c
mov edi, 1
mov dword [ebx + 0x4c], edi
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebx + 4]
call fcn.0040dbf0
test eax, eax
je 0x420bef
push 0x3c
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.00620850
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf88]
cmp eax, esi
je 0x4209bf
mov dword [ebp - 0xa0], eax
jmp 0x4209cb
lea ecx, [ebp + 0xf8c]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420a14
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], edi
jmp 0x420bef
push 0x3c
push esi
lea ecx, [ebp - 0xb0]
push ecx
call fcn.00620850
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf88]
cmp eax, esi
je 0x420a5e
mov dword [ebp - 0xa0], eax
jmp 0x420a6a
lea edx, [ebp + 0xf8c]
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], 0x67ca5c
mov eax, dword [ebp + 0xf88]
cmp eax, esi
jne 0x420aa8
lea eax, [ebp + 0xf8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420bef
mov eax, dword [ebp + 0xf88]
cmp eax, esi
jne 0x420ac8
lea eax, [ebp + 0xf8c]
push esi
push eax
mov ecx, ebx
call fcn.00416a00
test al, al
je 0x420bef
lea eax, [ebp - 0xb0]
push eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call esi
test eax, eax
je 0x420be9
mov dword [ebp - 0x54], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x420b1d
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x54], ecx
push 1
mov ecx, dword [ebp - 0x14]
call fcn.004117a0
test eax, eax
je 0x420b35
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4c], 2
mov dword [0x75da00], 1
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040dbf0
test eax, eax
je 0x420bef
push 0x3c
push 0
lea edx, [ebp - 0xb0]
push edx
call fcn.00620850
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf88]
test eax, eax
jne 0x420b9b
lea eax, [ebp + 0xf8c]
mov dword [ebp - 0xa0], eax
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], eax
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea ecx, [ebp - 0xb0]
push ecx
call esi
test eax, eax
je 0x420be0
push 0xffffffffffffffff
mov edx, dword [ebp - 0x78]
push edx
call ebx
mov dword [ebp - 0x44], 1
jmp 0x420bef
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x3c], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf88]
call fcn.00401210
mov esi, dword [ebp - 0x54]
test esi, esi
jne 0x420c11
mov dword [ebp - 0x24], 0
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0xcc], eax
push 4
lea ecx, [ebp - 0xcc]
push ecx
push 4
push 0
push str.lastintres
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x34], 0
je 0x420c60
test edi, edi
je 0x420c53
mov ecx, esi
call fcn.00416c40
jmp 0x420c60
cmp dword [ebp - 0x28], 0
jne 0x420c60
mov ecx, esi
call fcn.00410440
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420c78
cmp byte [eax + 0x51], 0
jne 0x420c78
cmp dword [0x75dbd4], 0
je 0x420c7f
mov ecx, esi
call fcn.0041d3f0
cmp dword [ebp - 0x34], 0
je 0x420c8e
mov dword [ebp - 0x24], 0
jmp 0x420c94
cmp dword [ebp - 0x24], 0
jne 0x420ce0
mov dword [ebp - 0x74], 4
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0
push str.NeedChAfRb
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420f04
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x24], esi
push str.NeedChAfRb
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420f04
push str.NeedChAfRb
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push str.ClChIDMRes
mov ecx, dword [0x75dbe4]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x420d28
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push str.ClChIERes
mov ecx, dword [0x75dbe4]
push ecx
call edi
test eax, eax
jne 0x420d55
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x420d5e
cmp ebx, 1
jne 0x420f04
mov edi, 1
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x30]
call fcn.00500ab0
mov byte [ebp - 4], 5
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
lea ecx, [ebp - 0x30]
call fcn.00500c50
cmp esi, edi
jne 0x420d93
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420d93
xor edi, edi
mov dword [ebp - 0x38], edi
cmp ebx, 1
jne 0x420da7
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420da7
mov dword [ebp - 0x38], 0
jmp 0x420daf
test edi, edi
jne 0x420ea3
push 0x50030
mov ecx, dword [0x75f038]
push ecx
mov edx, dword [0x75f048]
push edx
push 0
call fcn.004734a0
add esp, 0x10
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 4]
call fcn.0040ee60
mov dword [ebp - 0x18], 0
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.AdvancedIntegration
mov ecx, dword [0x75dbe4]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov dword [edi + 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.00500ab0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
lea ecx, [ebp - 0x4c]
call fcn.00500c50
mov eax, 1
mov dword [ebp - 0x38], eax
cmp esi, eax
jne 0x420e38
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420e38
xor eax, eax
mov dword [ebp - 0x38], eax
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x420e51
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420e51
mov dword [ebp - 0x38], 0
jmp 0x420e55
test eax, eax
jne 0x420e92
mov dword [ebp - 0x18], esi
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
push str.NeedSnRpAfRb
mov edx, dword [0x75dbe4]
push edx
call ebx
push 0x50030
mov eax, dword [0x75f038]
push eax
mov ecx, dword [0x75f04c]
push ecx
push 0
call fcn.004734a0
add esp, 0x10
push esi
call fcn.00411670
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.00500ac0
jmp 0x420ef8
push 0x50000
cmp dword [ebp - 0x2c], 1
jne 0x420ebd
mov edx, dword [0x75f038]
push edx
mov eax, dword [0x75f078]
push eax
jmp 0x420ecb
mov ecx, dword [0x75f038]
push ecx
mov edx, dword [0x75f050]
push edx
push 0
call fcn.004734a0
add esp, 0x10
mov dword [ebp - 0x18], 1
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.AdvancedIntegration
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00500ac0
cmp dword [ebp - 0x60], 0
jne 0x420f4f
mov dword [ebp - 0x5c], 4
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push str.NeedSnRpAfRb
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420f71
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
push str.NeedSnRpAfRb
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420f71
push 0
lea ecx, [ebp]
call fcn.0052d4a0
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.005f6434
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.004153d0
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.00410660
push 1
mov ecx, edi
call fcn.0041bf40
mov ecx, edi
call fcn.00410430
xor ebx, ebx
test eax, eax
jne 0x420fb3
push ebx
push ebx
call fcn.00417520
push ebx
push ebx
mov ecx, edi
call fcn.004175c0
push ebx
push ebx
mov ecx, edi
call fcn.0041d380
push ebx
push ebx
mov ecx, edi
call fcn.00417580
mov ecx, edi
cmp dword [edi + 0x1c], ebx
je 0x420fc3
push 1
call fcn.004152f0
jmp 0x420fd4
call fcn.00410d70
test eax, eax
jne 0x420fd4
push ebx
mov ecx, edi
call fcn.0041fb20
cmp dword [0x75dbd4], ebx
je 0x420fe3
mov ecx, edi
call fcn.0041f5d0
cmp dword [ebp - 0x34], ebx
je 0x4212df
lea esi, [edi + 4]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, esi
call fcn.0040dbf0
test eax, eax
je 0x42114d
cmp dword [ebp - 0x28], ebx
jne 0x42101e
mov ecx, esi
call fcn.0040ee60
mov dword [ebp - 0x44], 1
jmp 0x4212e4
mov dword [ebp + 0xf7c], ebx
mov dword [ebp + 0xf84], ebx
xor edx, edx
mov word [ebp + 0xf80], dx
mov byte [ebp - 4], 8
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x421045
mov eax, 0x75dc5c
push ebx
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xf7c]
call fcn.00402320
mov eax, dword [ebp + 0xf7c]
cmp eax, ebx
jne 0x42106c
lea eax, [ebp + 0xf80]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42113e
mov eax, dword [ebp + 0xf7c]
cmp eax, ebx
jne 0x42108c
lea eax, [ebp + 0xf80]
push ebx
push eax
mov ecx, edi
call fcn.00416a00
test al, al
je 0x42113e
push 0x3c
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.00620850
add esp, 0xc
mov dword [ebp - 0x108], 0x3c
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
mov eax, dword [ebp + 0xf7c]
cmp eax, ebx
je 0x4210df
mov dword [ebp - 0xf8], eax
jmp 0x4210eb
lea ecx, [ebp + 0xf80]
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], str._uninstlsp
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x421137
push 0xffffffffffffffff
mov eax, dword [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf7c]
call fcn.00401210
cmp dword [ebp - 0x28], ebx
je 0x4212df
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x42117b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4211b6
call fcn.00448070
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
lea ecx, [ebp - 0x5c]
push ecx
push eax
push ebx
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4212df
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xf70], ebx
mov dword [ebp + 0xf78], ebx
xor eax, eax
mov word [ebp + 0xf74], ax
mov byte [ebp - 4], 9
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x4211dd
mov eax, 0x75dc5c
push ebx
push str.Uninstall.exe
push eax
push 0x678de0
lea ecx, [ebp + 0xf70]
call fcn.00402320
mov eax, dword [ebp + 0xf70]
cmp eax, ebx
jne 0x421204
lea eax, [ebp + 0xf74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4212d0
mov eax, dword [ebp + 0xf70]
cmp eax, ebx
jne 0x421224
lea eax, [ebp + 0xf74]
push 1
push eax
mov ecx, edi
call fcn.00416a00
test al, al
je 0x4212d0
push 0x3c
push ebx
lea ecx, [ebp + 0x1398]
push ecx
call fcn.00620850
add esp, 0xc
mov dword [ebp + 0x1398], 0x3c
mov dword [ebp + 0x139c], 0x40
mov dword [ebp + 0x13a4], str.open
mov eax, dword [ebp + 0xf70]
cmp eax, ebx
je 0x421278
mov dword [ebp + 0x13a8], eax
jmp 0x421284
lea edx, [ebp + 0xf74]
mov dword [ebp + 0x13a8], edx
mov dword [ebp + 0x13b0], ebx
mov dword [ebp + 0x13b4], 3
mov dword [ebp + 0x13b8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp + 0x13a0], eax
mov dword [ebp + 0x13ac], str._uninsttdi
lea eax, [ebp + 0x1398]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4212d0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x13d0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf70]
call fcn.00401210
cmp dword [ebp - 0x44], ebx
je 0x4212ff
push 0x50030
mov edx, dword [0x75f01c]
push edx
mov eax, dword [0x75f070]
push eax
push ebx
call fcn.004734a0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x13d4]
xor ecx, ebp
call fcn.0062016f
add ebp, 0x13d8
mov esp, ebp
pop ebp
ret