Function at 0x4198a0
Capabilities:
Delete registry key
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004524c7
test al, al
je 0x4198c0
out 0x81, eax
insb byte es:[edi], dx
mov al, byte [0x61411050]
jo 0x419938
push edx
jns 0x419919
xor al, 0xfe
sub al, ch
push eax
mov dword [ebx], eax
add byte [eax + eax*8 + 0x7aba1774], al
sbb edx, dword [edi - 0x54750f5d]
pop eax
fidivr word gs:[ebp - 0x5e85c681]
mov ebx, dword [ebp + 0x723bf296]
pop ss
call fcn.00452215
test al, al
je 0x4198e0
mov edx, 0xa3971b7a
invalid
call fcn.00452101
test al, al
je 0x419908
cmp byte [ebx + 0x5e], bl
fstp dword [ebx]
ret
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0xc]
push 0xf003f
neg eax
push 0
sbb eax, eax
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
add eax, reloc.OLEAUT32.dll_SysReAllocString
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41994b
invalid
add byte [eax], al
adc byte [eax - 1], 0x15
or al, 0x60
pop esi
add byte [ebp - 0xea8a40], al
jne 0x419941
push dword [ebp + 8]
or bh, bh
jne 0x419938
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
add bh, bh
jne 0x419941
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00452077
test al, al
je 0x41996d
jbe 0x4199a4
lodsb al, byte gs:[esi]
jo 0x419970
jns 0x419928
mov ah, al
scasd eax, dword es:[edi]
loopne 0x41995e
mov bh, 0xb5
and dword [edi - 0x4dd57291], edi
insd dword es:[edi], dx
inc ebp
or ebp, dword [edi + ebx*2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mul dword [edx]
aad 0xb8
popfd
xor al, 0x87
xor dword [esp + edx*4 - 0x17b0b24c], edi
push eax
sbb eax, 0xc0850000
xchg dword [ecx], esi
mov esp, 0x4f4db494
call fcn.0041b700
test eax, eax
je 0x4199bd
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x24]
call fcn.00452146
test al, al
je 0x4199da
sbb ebp, dword [edi]
bound edx, qword [edi]
xchg ecx, eax
ja 0x41999e
loop 0x419a1b
cdq
pop ebx
cmp ah, byte [ebx + 0x53]
in eax, 0xc5
out 0x83, eax
int3
call fcn.004523f8
test al, al
je 0x4199ff
and edi, edx
cwde
leave
out dx, eax
mov dh, 0xac
adc byte [edx], dh
invalid
call fcn.00452620
test al, al
je 0x419a1d
std
leave
cmp byte [edi + 0x29], bh
jge 0x419a4c
jmp 0xbd184969
xchg edi, eax
push eax
pop edi
pop esi
pop ebx
ret
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xf64], eax
call fcn.0045250c
add eax, dword [eax]
test al, al
je 0x419a81
cld
test byte [edx - 0x78], bh
pop ebx
nop
jne 0x419aea
push edx
or byte [0x4f5b4b12], ah
dec eax
jmp 0x419a6a
call fcn.00452215
test al, al
je 0x419aa9
pop ss
jne 0x419ab3
push ebp
or ebp, dword [eax - 0x67]
add al, 3
pop ebp
xor dword [edx], esp
jae 0x419a9e
inc eax
lahf
jne 0x419ab6
pop ss
invalid
call fcn.00452032
test al, al
je 0x419ac8
adc al, 0xd4
pop ss
aam 0x17
and ch, byte [0xf845332f]
sub eax, 0xf845332f
retf
lea eax, [ebp - 0xf54]
mov dword [ebp - 0xf54], 0
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419b11
push 0x5e6c34
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00452620
test al, al
je 0x419b2d
sal byte [ebx + edx + 0x57], 0x33
mov ebx, 0x8c5f3fbb
push edi
xor edi, dword [ebx - 0x73a0c045]
fidivr word [edi - 0x36]
cmp ebp, dword [edx + 0x21]
aam 0xc9
sbb dword [eax], esi
jne 0x419b17
call fcn.00452596
test al, al
je 0x419b51
add eax, 0xa748ecca
insd dword es:[edi], dx
in eax, dx
xchg ecx, eax
pushal
lahf
xor al, 0xa8
movsd dword es:[edi], dword [esi]
mov dword [0xfde056f9], eax
mov dh, 0x53
jmp 0x419b78
call fcn.00452551
test al, al
je 0x419b73
invalid
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0xf54], 0
push 0
push eax
mov dword [ebp - 0xf5c], 0
mov dword [ebp - 0xf58], 0
mov dword [ebp - 0xf60], 0
call fcn.00480620
add esp, 0xc
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
call fcn.00451fed
test al, al
je 0x419bee
fsub dword [0xf5f85afe]
shl byte [esp + ebx*4 + 0x29], 1
jmp 0xc05964f1
test esi, esi
jne 0x41a8fe
call fcn.0045225a
test al, al
je 0x419c0f
jmp 0x419c0f
call fcn.004525db
test al, al
je 0x419c38
sbb eax, 0xbc4360b9
push cs
stosb byte es:[edi], al
cli
call 0xea55b407
in eax, dx
invalid
call fcn.00451fed
test al, al
je 0x419c5f
push ebx
int3
push 0
lea eax, [ebp - 0xf60]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e6c34
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x419c9c
push dword [ebp - 0xf54]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x41a8fe
call fcn.004524c7
add eax, dword [eax]
test al, al
je 0x419cb6
lcall 0x9ca7, 0x2d10d70f
mov edi, 0xd4d54131
pop edx
rcl dword [edx], cl
popal
jl 0x419c9f
call fcn.00402310
mov ecx, eax
call 0x471d10
push eax
lea ecx, [ebp - 0xea8]
call fcn.00404060
cmp dword [ebp - 0xe94], 8
lea ecx, [ebp - 0xea8]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0xea8]
nop
push ebp
xchg dh, bh
dec dword [ebx - 0x7fb11738]
add eax, 0x8d8d5000
pop eax
int1
invalid
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x419cf0
call fcn.0045243d
test al, al
je 0x419d27
mov dword [0x8f327e27], eax
push edi
sbb ecx, dword [ebx + 0x38082960]
jg 0x419d25
adc al, bl
invalid
sahf
shr al, 1
jmp 0x8441a0b1
call fcn.00452215
test al, al
je 0x419d50
push ss
hlt
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.InstallPath
push dword [ebp - 0xf60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xf60]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xf54]
call ebx
mov dword [ebp - 0xf54], 0
call fcn.00452596
test al, al
je 0x419dc0
out dx, al
hlt
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
push str.softwareMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
jne 0x41a8e0
call fcn.004523f8
test al, al
je 0x419e01
mov bh, 0x73
adc dword ds:[eax + 0x23], 0xffffffa4
jo 0x419e51
fiadd dword [ecx]
sub dword [edi - 0x19], 0xffffffdc
lea eax, [ebp - 0xf5c]
push eax
push 0xf003f
push 0
push str.Uninstall
push dword [ebp - 0xf54]
call ebx
mov dword [ebp - 0xf74], eax
call fcn.004523f8
test al, al
je 0x419e48
push edi
lcall 0x65cb, 0x837d294a
add dword [ebp - 0x6c], esi
jno 0x419e95
invalid
call fcn.0045250c
test al, al
je 0x419e6f
cmpsd dword [esi], dword es:[edi]
mov esi, 0xb434eee3
pop ebp
and eax, 0x85ef3576
dec ebp
pop ss
int 0xe3
sar cl, cl
pop eax
cmp edi, dword [edx - 0x67893e27]
mov dh, 0x3a
jno 0x419eb4
aaa
cmp dword [ebp - 0xf74], 0
je 0x419eb5
push 0
lea eax, [ebp - 0xf5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Uninstall
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x419eb5
lodsb al, byte [esi]
invalid
push dword [ebp - 0xf54]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x41a8e0
shr cl, 1
sub ecx, dword [edx]
add byte [eax], al
add al, ch
pop ebx
add dword [ebx], 0
call fcn.00452215
test al, al
je 0x419ed9
pop edx
loopne 0x419f3b
and al, 0x49
jl 0x419eaf
ror dword [ebp + 0x34], 0x59
xor al, 0x77
hlt
call fcn.004520bc
test al, al
je 0x419f00
jo 0x419f5b
ret
push 0
lea eax, [ebp - 0xf58]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e6c34
push dword [ebp - 0xf5c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x419f3d
push dword [ebp - 0xf5c]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x41a8e0
add byte [eax], al
call fcn.004520bc
test al, al
je 0x419f65
cmp byte [edx], cl
scasd eax, dword es:[edi]
push ecx
and ebx, ebp
mov ch, 0x29
aam 0x74
mov esi, 0xb41a71f2
pop ss
jl 0x419fc6
or al, 0xa4
sal byte [esi - 0x5b3c1eec], 1
sbb byte [edi - 0x1f], ch
test al, 0x68
or byte [edx], al
add byte [eax], al
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0xe48]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.00480620
add esp, 0x48
call fcn.0045236e
test al, al
je 0x419ffa
add al, byte [eax]
add byte [ebp - 0xa377b], cl
jmp [edx]
enter 0x3d76, 0x2e
ret
arpl word [edx], bp
sar dword [eax], 0xad
dec eax
push cs
xor ebx, dword [esi + 0x3f]
mov ah, 0xe8
add al, byte [ecx - 0x3f7bfffd]
call fcn.00452101
test al, al
je 0x41a01b
pop edx
in eax, 0xe6
test dword [edi + ebp*4], esp
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
xchg dword [esi + ecx*4], edx
push ds
dec ecx
mov ebx, 0xd6e08ab2
jl 0x419fef
sub dword [edx - 5], esi
enter 0x6be8, 0xffffffffffffff81
add eax, dword [eax]
call fcn.0045218b
test al, al
je 0x41a03c
cli
cmp dword [eax - 0x1b2332e3], ecx
das
invalid
push str.10.3.1.0
lea ecx, [ebp - 0xf08]
call fcn.00404060
push str.10.3
lea ecx, [ebp - 0xe90]
mov byte [ebp - 4], 1
call fcn.00404060
mov ebx, dword [ebp - 0xf64]
lea ecx, [ebp - 0xf38]
push ebx
mov byte [ebp - 4], 2
call fcn.00404060
mov byte [ebp - 4], 3
call fcn.00452329
test al, al
je 0x41a095
aad 0x28
and bl, dl
jbe 0x41a0f3
add bh, al
inc edx
pop ebx
dec edx
in al, 0x25
mov dl, byte [edi - 0x427c8e0c]
fdiv st(0)
invalid
cmp dword [ebp - 0xf28], 0
je 0x41a1a7
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xf38]
push eax
lea ecx, [ebp - 0xf08]
call fcn.004029a0
mov dword [ebp - 0xf70], 0
mov dword [ebp - 0xf6c], 0
mov dword [ebp - 0xf68], 0
push 0x5e8850
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 4
call fcn.00404060
push ebx
lea ecx, [ebp - 0xf50]
mov byte [ebp - 4], 5
call fcn.00404060
lea eax, [ebp - 0xf70]
mov byte [ebp - 4], 6
cld
add eax, 0xfe9f66e8
dec dword [ebp - 0xf6f7b]
inc esi
inc ebp
cld
push es
push eax
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xf50]
push eax
call fcn.004575da
add esp, 0xc
lea ecx, [ebp - 0xf50]
call fcn.00447330
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 4
call fcn.00447330
mov ecx, dword [ebp - 0xf6c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0xf70]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 4
jne 0x41a198
lea eax, [ebp - 0xe90]
cmp eax, esi
je 0x41a16f
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.004029a0
push 0x5e8850
lea ecx, [ebp - 0xe90]
call fcn.0040aa00
mov eax, dword [ebp - 0xf70]
lea ecx, [ebp - 0xe90]
push 0xffffffffffffffff
add eax, 0x18
push 0
push eax
call fcn.00405b10
js 0x41a14f
invalid
lea ecx, [ebp - 0xf70]
mov byte [ebp - 4], 3
call fcn.00405ef0
call fcn.00452596
test al, al
je 0x41a1c0
jecxz 0x41a194
inc esi
ja 0x41a210
xor al, 0xa2
mov edi, 0x9d364816
push edi
or al, dl
invalid
call fcn.0041b700
mov ebx, eax
mov dword [ebp - 0xe4c], 7
xor eax, eax
mov dword [ebp - 0xf64], ebx
mov dword [ebp - 0xe50], 0
mov word [ebp - 0xe60], ax
mov dword [ebp - 0xe64], 7
mov dword [ebp - 0xe68], eax
mov word [ebp - 0xe78], ax
mov byte [ebp - 4], 8
call fcn.004524c7
test al, al
je 0x41a226
in al, 0x9c
hlt
test ebx, ebx
je 0x41a274
mov eax, dword [ebx]
lea ecx, [ebp - 0xec0]
push ecx
mov ecx, ebx
call dword [eax + 0x30]
push eax
lea ecx, [ebp - 0xe60]
call fcn.00404270
lea ecx, [ebp - 0xec0]
call fcn.00447330
mov eax, dword [ebx]
lea ecx, [ebp - 0xec0]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
push eax
lea ecx, [ebp - 0xe78]
call fcn.00404270
lea ecx, [ebp - 0xec0]
call fcn.00447330
cmp dword [ebp - 0xe50], 0
jne 0x41a28d
push 0x5e7d48
lea ecx, [ebp - 0xe60]
call fcn.004042f0
call fcn.004523f8
test al, al
je 0x41a2b1
stosb byte es:[edi], al
salc
imul eax, dword [eax + 0x4cd07a78], 0xffffffab
or dword [esi + 0x52], ecx
popfd
invalid
call fcn.0045225a
test al, al
je 0x41a2cf
xchg edi, eax
test eax, 0xcca8cc6e
idiv dword [esi - 7]
push esi
int3
call fcn.004523b3
test al, al
je 0x41a2ea
jne 0x41a2e2
jge 0x41a332
xchg dword [ecx], esp
sbb edx, dword [ebx]
dec eax
in eax, dx
fldenv [ebx]
pop ecx
iretd
cmp dword [ebp - 0xe68], 0
jne 0x41a303
push 0x5e8854
lea ecx, [ebp - 0xe78]
call fcn.004042f0
call fcn.004522e4
test al, al
je 0x41a320
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xabcb06cb
pop edi
push esi
cmc
add dword [edi + 0x2fa66d2a], esp
xlatb
out dx, al
jge 0x41a2d8
pop es
call fcn.00452101
test al, al
je 0x41a347
add ecx, esi
or cl, byte [eax]
sub al, byte [ecx - 0x63]
dec edi
outsb dx, byte [esi]
pop ss
std
inc eax
jnp 0x41a343
insb byte es:[edi], dx
mov edx, 0x69488d4d
cmpsd dword [esi], dword es:[edi]
pushal
cmp ecx, ebp
sbb ecx, 0x53
push ebx
and dword [esi + 0x37e84e8], ebp
add byte [eax + eax*8 + 0xec91f74], al
call fcn.004521d0
test al, al
je 0x41a36f
leave
push cs
dec ecx
fadd st(1)
cmp ah, cl
cmp eax, 0xa246164e
ret 0xe88a
push 0x5e8880
lea ecx, [ebp - 0xe60]
call fcn.0040aa00
push 0xffffffffffffffff
mov al, byte [0xe8fffff1]
add dword [esi], 0xff6affff
push 0
lea eax, [ebp - 0xe90]
push eax
lea ecx, [ebp - 0xe60]
call fcn.00405b10
call fcn.00402310
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0xef0]
call fcn.00404060
push 0x5e76a0
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 9
call fcn.0040aa00
call fcn.00451f63
test al, al
je 0x41a3da
dec eax
pop ebp
in eax, 0xd4
into
jo 0x41a376
retf
call fcn.00402310
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0xed8]
call fcn.00404060
push 0x5e8884
lea ecx, [ebp - 0xed8]
mov byte [ebp - 4], 0xa
call fcn.0040aa00
call fcn.004523f8
test al, al
je 0x41a42c
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
out 0x6b, al
push eax
xchg byte [ecx + 0x78], al
lea eax, [edi + 0x55]
push esi
loopne 0x41a48a
fdivr dword [esi]
cwde
sbb byte [eax - 0x5b], dh
and ah, ah
cwde
in al, dx
retf
call fcn.0045250c
test al, al
je 0x41a453
out 0xd3, eax
pushal
iretd
push 0x5e88a0
lea ecx, [ebp - 0xf20]
call fcn.00404060
cmp dword [ebp - 0xedc], 8
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x830]
cmovae ecx, dword [ebp - 0xef0]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a481
cmp dword [ebp - 0xe4c], 8
lea ecx, [ebp - 0xe60]
lea edx, [ebp - 0x420]
cmovae ecx, dword [ebp - 0xe60]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a4b0
cmp dword [ebp - 0xec4], 8
lea ecx, [ebp - 0xed8]
lea edx, [ebp - 0x628]
cmovae ecx, dword [ebp - 0xed8]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a4e0
cmp dword [ebp - 0xf0c], 8
lea ecx, [ebp - 0xf20]
lea edx, [ebp - 0xc40]
cmovae ecx, dword [ebp - 0xf20]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a510
cmp dword [ebp - 0xe64], 8
lea ecx, [ebp - 0xe78]
lea edx, [ebp - 0xe48]
cmovae ecx, dword [ebp - 0xe78]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a540
cmp dword [ebp - 0xef4], 8
lea ecx, [ebp - 0xf08]
lea edx, [ebp - 0xa38]
cmovae ecx, dword [ebp - 0xf08]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a570
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a590
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push 0x5e88ac
push dword [ebp - 0xf58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.0045250c
test al, al
je 0x41a5dd
invalid
call fcn.00452215
test al, al
je 0x41a605
retf 0xcd9
call fcn.00452032
test al, al
je 0x41a624
das
invalid
mov ebp, 0xd88d8d14
stc
invalid
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a630
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0xf58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00452620
test al, al
je 0x41a67f
mov cs, ebp
jns 0x41a622
sbb dword [eax + 0x64], esi
jae 0x41a68e
out dx, al
add eax, 0xb596d475
cmp dword [esp + ebx*4], 0x61
call fcn.00452596
test al, al
je 0x41a6a3
cmp esi, dword [ecx + ebp]
jge 0x41a693
cdq
imul ebp, edi, 0x4c
push 0x7e
xor eax, 0xf897cb26
dec edi
add byte [ebp - 0x72], ah
lodsd eax, dword [esi]
inc esp
mov ch, 0x3b
sbb cl, byte [ebx]
call fcn.00452551
test al, al
je 0x41a6c5
sal word [ebx + 0x71], cl
cdq
xchg dword [eax], ecx
jo 0x41a646
sar ebp, 1
retf 0xc653
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a6d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x830]
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0xf58]
call ebx
call fcn.00451fed
test al, al
je 0x41a728
invalid
lea ecx, [ebp - 0xa38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a731
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xa38]
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0xf58]
call ebx
call fcn.0045225a
test al, al
je 0x41a779
dec ecx
jae 0x41a6fd
and al, 0x4c
xor dword [ebx + edi*2 + 0x6d2b8877], esi
inc edi
cld
and byte [ebx - 0x18], dh
pop ebp
jle 0x41a780
call fcn.004525db
test al, al
add byte [eax + eax*8 + 0x216a2674], al
je 0x41a7a8
push 0x21
and bh, dh
or ecx, ecx
add eax, 0x481b9355
rcl dword [ecx + 0x39], cl
jo 0x41a7e3
xchg ecx, eax
inc ecx
mov edx, 0xaff8fe9b
push ebp
test eax, 0x332ed8de
out 0x94, eax
cmc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00451fed
test al, al
je 0x41a7cf
in eax, 0xb3
mov eax, dword [0x7fb9e09e]
rcl byte [esi - 0x1e]
fst dword [edx + 0x49]
into
invalid
lea ecx, [ebp - 0xc40]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a7e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0xf58]
call ebx
call fcn.00452551
test al, al
je 0x41a83a
xchg ecx, eax
and byte [ebx + 0x5c], 0xa2
push esp
lahf
dec esi
xlatb
mov dword [edx - 0x31], edi
add dword [ecx], edx
rcl bh, cl
sub esp, dword [esi + 0x755c7fa8]
xor ebx, dword [edi]
or eax, 0x8b0684ec
sbb eax, sym.imp.ADVAPI32.dll_RegSetValueExW
lea ecx, [ebp - 0xe48]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a843
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xe48]
push eax
push 1
push 0
push str.URLInfoAbout
push dword [ebp - 0xf58]
call ebx
push dword [ebp - 0xf58]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xf5c]
call ebx
lea ecx, [ebp - 0xf20]
call fcn.00447330
lea ecx, [ebp - 0xed8]
call fcn.00447330
lea ecx, [ebp - 0xef0]
call fcn.00447330
lea ecx, [ebp - 0xe78]
call fcn.00447330
lea ecx, [ebp - 0xe60]
call fcn.00447330
lea ecx, [ebp - 0xf38]
call fcn.00447330
lea ecx, [ebp - 0xe90]
call fcn.00447330
lea ecx, [ebp - 0xf08]
call fcn.00447330
mov eax, dword [ebp - 0xe94]
cmp eax, 8
jb 0x41a8fe
inc eax
lea ecx, [ebp - 0xea8]
push eax
push dword [ebp - 0xea8]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4