Function at 0x41a610
Capabilities:
Check if file exists
Check os version
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440a18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf80
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp dword [esi + 0xc], ebx
jne 0x41a640
call fcn.00418b90
mov eax, dword [ebp + 8]
push eax
call fcn.00419160
add esp, 4
lea ecx, [ebp - 0x44]
call fcn.0041c4c0
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x44], 0x4471f8
push ecx
mov dword [ebp - 0x94], 8
mov dword [ebp - 0x90], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x3c]
push edx
push eax
push 0x483e50
mov dword [ebp - 4], ebx
call fcn.0041cb40
mov eax, dword [0x483e58]
push ebx
push 0x41c9b0
push ebx
push 0x69
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x40]
neg eax
sbb eax, eax
and al, 0xfb
add eax, 5
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x41a708
cmp dword [ebp - 0x24], 0x12
je 0x41a6fe
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41a6d7
jmp 0x41a708
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Preparing_Installation...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x564]
push 0x80
push edx
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x564], bl
call fcn.0041e200
add esp, 0x14
test eax, eax
je 0x41a78b
push 1
lea eax, [ebp - 0x564]
push ebx
push eax
push 0x47eebc
call fcn.00419330
mov al, byte [ebp - 0x564]
add esp, 0x10
cmp al, 0x35
jge 0x41a78b
lea ecx, [ebp - 0x564]
push ebx
push ecx
push str.RoboForm_requires_Internet_Explorer_5.0_or_higher._Please__update_IE_and_run_Setup_again.
call fcn.0041cc40
add esp, 0xc
jmp 0x41bdab
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], 1
push ecx
call fcn.0041db60
mov eax, dword [ebp - 0x84]
add esp, 4
cmp eax, ebx
mov dword [ebp - 0x68], 0x47ef1c
jne 0x41a7bc
mov dword [ebp - 0x68], 0x47ef20
push 1
call fcn.0041daa0
mov edx, dword [ebp - 0x68]
push eax
push edx
push str.Admin_rights__
call fcn.00419330
push 1
push ebx
push ebx
push str.RunSfx_____START
call fcn.00419330
add esp, 0x20
lea eax, [ebp - 0x28]
push 1
push ebx
push ebx
push ebx
push eax
call esi
test eax, eax
je 0x41a823
cmp dword [ebp - 0x24], 0x12
je 0x41a819
lea ecx, [ebp - 0x28]
push ecx
call edi
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call esi
test eax, eax
jne 0x41a7f2
jmp 0x41a823
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edx, dword [ebp - 0x40]
push 0x3ef
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Testing_Integrity...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call esi
test eax, eax
je 0x41a87e
cmp dword [ebp - 0x24], 0x12
je 0x41a874
lea ecx, [ebp - 0x28]
push ecx
call edi
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call esi
test eax, eax
jne 0x41a84d
jmp 0x41a87e
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edx, dword [ebp - 0x40]
push 0x3ee
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
jne 0x41a8bc
lea eax, [ebp - 0xa78]
push 0x104
push eax
push ebx
lea edi, [ebp - 0xa78]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
push 3
push SysReAllocString
push edi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.0041e090
test eax, eax
jne 0x41a93a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Cant_extract_from_SFX
call fcn.0041cc40
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41bdca
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.0041c820
add esp, 8
test eax, eax
jne 0x41a95a
push ebx
push edi
push str.Corrupted_Setup_File
jmp 0x41bd98
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x41a9a0
cmp dword [ebp - 0x24], 0x12
je 0x41a996
lea edx, [ebp - 0x28]
push edx
call edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
jne 0x41a96f
jmp 0x41a9a0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0xc8
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x668]
push 0x104
push ecx
push edx
call fcn.00419100
add esp, 0xc
cmp eax, ebx
jne 0x41aa46
lea eax, [ebp - 0x668]
push 0x104
push eax
call fcn.00418e00
add esp, 8
cmp eax, ebx
jne 0x41aa46
push ebx
push ebx
push str.Cannot_get_create_writeable_temporary_file_folder
call fcn.0041cc40
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41bdca
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 1
lea eax, [ebp - 0x668]
push ebx
push eax
push str.GetTempPath:
call fcn.00419330
mov ecx, dword [ebp + 0xc]
add esp, 0x10
cmp dword [ecx + 0xc], ebx
je 0x41ab0b
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x198]
push 0x104
push edx
push str._unpack
push eax
call fcn.004190a0
add esp, 0x10
test eax, eax
jne 0x41aab3
push 1
push ebx
push 0x487a04
push str.Bad_Unpack_path__Will_use_TEMP_folder
call fcn.00419330
add esp, 0x10
lea ecx, [ebp - 0x668]
lea edx, [ebp - 0x198]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x198]
push ebx
push eax
push str.Unpack_path
call fcn.00419330
add esp, 0x10
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
je 0x41abc5
cmp dword [ebp - 0x24], 0x12
je 0x41abbb
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41aadd
jmp 0x41abc5
lea ecx, [ebp - 0x198]
lea edx, [ebp - 0x668]
push ecx
push edx
call fcn.0041c920
add esp, 8
cmp eax, ebx
jne 0x41aaca
push 1
push ebx
push 0x487a04
push str.Bad_TEMP__Try_to_create_temp_folder_near
call fcn.00419330
add esp, 0x10
lea eax, [ebp - 0x668]
push 0x487b04
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x198]
lea edx, [ebp - 0x668]
push ecx
push edx
call fcn.0041c920
add esp, 8
cmp eax, ebx
jne 0x41aaca
push ebx
push ebx
push str.Cant_create_temp_folder_to_unpack_files
call fcn.0041cc40
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41bdca
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Extracting_Program_Files...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
je 0x41ac20
cmp dword [ebp - 0x24], 0x12
je 0x41ac16
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41abef
jmp 0x41ac20
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x190
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x7c]
push edx
push str.roboform
push eax
call fcn.0041c4e0
mov edi, eax
add esp, 0xc
cmp edi, ebx
jge 0x41ac71
lea ecx, [ebp - 0x198]
push edi
push ecx
push str.Cant_unpack_roboform.bin_to
jmp 0x41b876
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x41acb7
cmp dword [ebp - 0x24], 0x12
je 0x41acad
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41ac86
jmp 0x41acb7
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Extracting_Language_Files...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
je 0x41ad12
cmp dword [ebp - 0x24], 0x12
je 0x41ad08
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41ace1
jmp 0x41ad12
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x2bc
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x7c]
push edx
push str.langs
push eax
call fcn.0041c4e0
add esp, 0xc
xor ecx, ecx
cmp eax, ebx
setge cl
mov eax, ecx
mov dword [ebp - 0x48], eax
cmp eax, ebx
mov eax, str.MULTILANGUAGE_Ver
jne 0x41ad65
mov eax, str.ENGLISH_Ver
push 1
push ebx
push ebx
push eax
call fcn.00419330
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
lea edx, [ebp + 0x10]
mov dword [ebp + 0x10], ebx
push edx
push 0x47f0f8
push eax
push ecx
call fcn.0041dee0
add esp, 0x20
cmp eax, ebx
je 0x41adbe
cmp dword [ebp + 0x10], ebx
jbe 0x41adbe
lea edx, [ebp - 0x198]
lea eax, [ebp - 0x7c]
push edx
push str.config
push eax
call fcn.0041c4e0
add esp, 0xc
xor ecx, ecx
cmp eax, ebx
setge cl
mov eax, ecx
cmp eax, ebx
mov eax, str.Custom_Config_Ver
jne 0x41adc3
mov eax, str.Ordinary_Configuration
push 1
push ebx
push ebx
push eax
call fcn.00419330
add esp, 0x10
lea edx, [ebp - 0x28]
push 1
push ebx
push ebx
push ebx
push edx
call esi
test eax, eax
je 0x41ae10
cmp dword [ebp - 0x24], 0x12
je 0x41ae06
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41addf
jmp 0x41ae10
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x320
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
je 0x41ae71
cmp dword [ebp - 0x24], 0x12
je 0x41ae67
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41ae40
jmp 0x41ae71
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Extracting...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x198]
lea eax, [ebp - 0xe88]
push edx
push str._s_affid.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0xe88]
push 1
push ecx
lea edx, [ebp - 0x7c]
push str.affid
push edx
call fcn.0041c680
add esp, 0x1c
lea eax, [ebp - 0x28]
push 1
push ebx
push ebx
push ebx
push eax
call esi
test eax, eax
je 0x41aeff
cmp dword [ebp - 0x24], 0x12
je 0x41aef5
lea ecx, [ebp - 0x28]
push ecx
call edi
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x28]
push ebx
push eax
call esi
test eax, eax
jne 0x41aece
jmp 0x41aeff
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edx, dword [ebp - 0x40]
push 0x3ee
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x384
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp + 0x10], edi
cmp dword [eax + 8], ebx
jne 0x41af67
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x68]
push ecx
push 0x47f15c
push edx
push eax
call fcn.0041dee0
add esp, 0x10
xor ecx, ecx
cmp eax, ebx
mov eax, str.PORTABLE_Ver
setne cl
mov edi, ecx
cmp edi, ebx
mov dword [ebp + 0x10], edi
jne 0x41af60
mov eax, str.FIXED_Ver
push 1
push ebx
push ebx
push eax
jmp 0x41af70
push 1
push ebx
push ebx
push str.FORCE_FIXED_Ver
call fcn.00419330
mov edx, dword [ebp + 0xc]
add esp, 0x10
cmp dword [edx + 0xc], ebx
je 0x41afd9
cmp edi, ebx
je 0x41af9c
lea eax, [ebp - 0x198]
lea ecx, [ebp - 0x7c]
push eax
push 0x47f194
push ecx
call fcn.0041c4e0
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41afc6
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x974]
push 0x104
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x974]
push edx
call fcn.0041cb80
add esp, 4
cmp eax, ebx
je 0x41b01a
lea ecx, [ebp - 0x974]
cmp eax, ecx
je 0x41b01a
lea edx, [ebp - 0x974]
mov byte [eax], bl
push edx
call fcn.004190d0
add esp, 4
lea eax, [ebp - 0x974]
push eax
push str._InstallerDir
push 0x47f1b0
push SysReAllocString
call fcn.0041e300
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x41b08e
push edi
push ebx
push str.Roboform_Setup_can_not_write_registry_settings_and_will_be_cancelled
call fcn.0041cc40
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b8b4
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x47f210
push 0x47f21c
push SysReAllocString
call fcn.0041e400
mov eax, str._options
add esp, 0xc
mov ecx, eax
mov dword [ebp - 0x18], eax
test ecx, ecx
mov dword [ebp - 0x14], str._passwd
mov dword [ebp - 0x10], ebx
je 0x41b1a5
lea edi, [ebp - 0x18]
lea edx, [ebp - 0x76c]
push 0x104
push edx
push eax
mov eax, dword [ebp + 8]
mov byte [ebp - 0x76c], bl
push eax
call fcn.004190a0
add esp, 0x10
test eax, eax
je 0x41b197
lea ecx, [ebp - 0x76c]
push ecx
call fcn.0041a200
add esp, 4
test eax, eax
jne 0x41b197
lea edx, [ebp - 0x974]
lea eax, [ebp - 0x29c]
push edx
push eax
mov byte [ebp - 0x29c], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x29c]
push ecx
call fcn.0041cbc0
add esp, 4
lea edx, [ebp - 0x76c]
lea eax, [ebp - 0x29c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41b217
mov edx, dword [edi]
push 1
push ebx
push str.param___copy_file:
push edx
call fcn.00419330
push 1
lea eax, [ebp - 0x29c]
push ebx
push eax
push str.__________________from
call fcn.00419330
lea ecx, [ebp - 0x198]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.0041d460
add esp, 0x28
test eax, eax
je 0x41b279
mov eax, dword [edi + 4]
add edi, 4
cmp eax, ebx
jne 0x41b0c4
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov eax, 0x47f2bc
jne 0x41b1b6
mov eax, 0x47f2c0
mov edx, dword [ebp + 8]
push edx
push eax
lea eax, [ebp - 0xd84]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x28]
push 1
push ebx
push ebx
push ebx
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x41b2e5
cmp dword [ebp - 0x24], 0x12
je 0x41b2db
lea edx, [ebp - 0x28]
push edx
call edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
jne 0x41b1e9
jmp 0x41b2e5
lea eax, [ebp - 0x29c]
push 2
push eax
push str.Could_not_find_the_specified_file:
call fcn.0041cc40
lea ecx, [ebp - 0x198]
push ecx
call fcn.0041c7a0
add esp, 0x10
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b263
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x29c]
push 2
push ecx
push str.Could_not_copy_the_specified_file:
call fcn.0041cc40
lea edx, [ebp - 0x198]
push edx
call fcn.0041c7a0
add esp, 0x10
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b2c5
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3e8
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x40]
push ebx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
je 0x41b351
cmp dword [ebp - 0x24], 0x12
je 0x41b347
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x28]
push ebx
push edx
call esi
test eax, eax
jne 0x41b320
jmp 0x41b351
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 1
push 0x47f2cc
push 0x47f2dc
push SysReAllocString
call fcn.0041e380
push 1
lea ecx, [ebp - 0x8c]
push 1
lea edx, [ebp - 0xd84]
push ecx
push edx
lea eax, [ebp - 0x198]
push str.rfwipeout.exe
push eax
mov dword [ebp - 0x8c], ebx
call fcn.0041d850
mov edi, eax
add esp, 0x28
cmp edi, ebx
jge 0x41b3cd
lea ecx, [ebp - 0x198]
push edi
push ecx
push str.Can_not_run
call fcn.0041cc40
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x198]
push edx
call fcn.0041c7a0
add esp, 4
jmp 0x41b88a
lea edx, [ebp - 0x88]
mov dword [ebp - 0x88], ebx
push edx
push str._CancelInstall
push 0x47f324
push SysReAllocString
call fcn.0041e280
mov eax, dword [ebp - 0x88]
add esp, 0x10
cmp eax, ebx
je 0x41b431
mov eax, dword [ebp - 0x8c]
push 1
push eax
push ebx
push str.RfWipeout_cancelled
call fcn.00419330
add esp, 0x10
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x198]
push ecx
call fcn.0041c7a0
add esp, 4
jmp 0x41bda0
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x3a0], bl
cmp eax, ebx
mov eax, str.RoboFormFolderPort
jne 0x41b448
mov eax, str.RoboFormFolder
lea ecx, [ebp - 0x3a0]
push 0x104
push ecx
push eax
push 0x47f374
push SysReAllocString
call fcn.0041e200
push 1
lea edx, [ebp - 0x3a0]
push ebx
push edx
push str.RoboFormFolder_set_to
mov edi, eax
call fcn.00419330
add esp, 0x24
cmp edi, ebx
jne 0x41c267
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x41c267
lea ecx, [ebp - 0x3a0]
push ecx
call fcn.004190d0
lea edx, [ebp - 0xb7c]
push 0x104
push edx
push str.LocalizationFile
push str.SoftwareSiber_SystemsRoboForm
push SysReAllocString
call fcn.0041e200
mov eax, dword [ebp + 0x10]
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x68], ebx
jne 0x41b521
lea eax, [ebp - 0x4e4]
push 0x40
push eax
push str._UseAdminFiles
push 0x47f450
push SysReAllocString
call fcn.0041e200
push 1
lea ecx, [ebp - 0x4e4]
push ebx
push ecx
push str._UseAdminFiles:
call fcn.00419330
add esp, 0x24
lea edx, [ebp - 0x4e4]
push 0x47f47c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 1
push eax
push str._WasFresh
push 0x47f48c
push SysReAllocString
call fcn.0041e280
add esp, 0x10
lea ecx, [ebp - 0x28]
push 1
push ebx
push ebx
push ebx
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x41b589
cmp dword [ebp - 0x24], 0x12
je 0x41b57f
lea edx, [ebp - 0x28]
push edx
call edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
jne 0x41b558
jmp 0x41b589
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ef
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Copying_Files...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
je 0x41b5e4
cmp dword [ebp - 0x24], 0x12
je 0x41b5da
lea edx, [ebp - 0x28]
push edx
call edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
jne 0x41b5b3
jmp 0x41b5e4
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
je 0x41b641
cmp dword [ebp - 0x24], 0x12
je 0x41b637
lea edx, [ebp - 0x28]
push edx
call edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ebx
push ecx
call esi
test eax, eax
jne 0x41b610
jmp 0x41b641
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0x48]
push ebx
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff3
add ecx, 0x1e
push ecx
push 0x404
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x40]
mov eax, dword [ecx]
neg eax
sbb eax, eax
and al, 0xfb
add eax, 5
push eax
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x68]
mov dword [0x488818], ebx
cmp eax, ebx
jne 0x41b6ac
lea eax, [ebp - 0x3a0]
push ebx
push eax
lea ecx, [ebp - 0x198]
push 0x41d5e0
push ecx
call fcn.0041d0c0
jmp 0x41b6ba
push 1
push ebx
push ebx
push str.____Copying_files_skipped_by_bUseAdmin
call fcn.00419330
mov eax, dword [ebp + 0x10]
add esp, 0x10
cmp eax, ebx
je 0x41b72d
cmp dword [0x488818], ebx
je 0x41b72d
lea edx, [ebp - 0x3a0]
push ebx
push edx
push str.One_or_more_files_were_locked__so_they_could_not_be_copied_to_folder:
call fcn.0041cc40
lea eax, [ebp - 0x198]
push eax
call fcn.0041c7a0
add esp, 0x10
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b717
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
mov eax, 0xfffffffb
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xb7c]
mov byte [ebp - 0x870], bl
push eax
mov dword [ebp - 0x1c], 0x47f528
mov dword [ebp - 0x18], str.roboform.dll
mov dword [ebp - 0x14], str.affid.txt
mov dword [ebp - 0x10], str.0123456789012345678901234567890
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, ebx
jle 0x41b78d
push 0x47f558
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp edi, eax
jge 0x41b78d
lea ecx, [ebp - 0xb7c]
push ecx
push str._s.rfi
push str.0123456789012345678901234567890
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41b790
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
je 0x41bb63
lea edx, [ebp - 0x870]
push 0x104
push edx
push str._PortableRootFolder
push str.SoftwareSiber_Systems
push SysReAllocString
call fcn.0041e200
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x41bb0b
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x41bb0b
lea ecx, [ebp - 0x870]
push ecx
call fcn.004190d0
add esp, 4
lea edx, [ebp - 0x64]
push 1
push ebx
push ebx
push ebx
push edx
call esi
test eax, eax
je 0x41b830
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x60], 0x12
je 0x41b826
lea eax, [ebp - 0x64]
push eax
call edi
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
jne 0x41b7ff
jmp 0x41b830
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Copying_RoboForm2Go_Files...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x870]
lea eax, [ebp - 0x7c]
push edx
push str.portable
push eax
call fcn.0041c4e0
mov edi, eax
add esp, 0xc
cmp edi, ebx
jge 0x41b8c7
lea ecx, [ebp - 0x870]
push edi
push ecx
push str.Cant_unpack_RoboForm2Go_files_to
call fcn.0041cc40
lea edx, [ebp - 0x198]
push edx
call fcn.0041c7a0
add esp, 0x10
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41b8b4
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x48], ebx
lea edi, [ebp - 0x1c]
mov eax, dword [edi]
cmp eax, ebx
je 0x41b933
lea edx, [ebp - 0x198]
push eax
push edx
lea eax, [ebp - 0x29c]
push 0x47f668
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x668]
lea edx, [ebp - 0x29c]
push ecx
push edx
call fcn.0041d460
add esp, 0x18
test eax, eax
jne 0x41b924
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x29c]
push eax
push str.Err_copying_file
call fcn.00419330
add esp, 0x10
mov eax, dword [ebp - 0x48]
add edi, 4
inc eax
cmp eax, 4
mov dword [ebp - 0x48], eax
jl 0x41b8cd
push 1
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ebx
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
test eax, eax
je 0x41b979
cmp dword [ebp - 0x60], 0x12
je 0x41b96f
lea edx, [ebp - 0x64]
push edx
call edi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ebx
push ecx
call esi
test eax, eax
jne 0x41b948
jmp 0x41b979
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x12c
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ebx
push ecx
call esi
test eax, eax
je 0x41b9da
cmp dword [ebp - 0x60], 0x12
je 0x41b9d0
lea edx, [ebp - 0x64]
push edx
call edi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ebx
push ecx
call esi
test eax, eax
jne 0x41b9a9
jmp 0x41b9da
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x190
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x3a0]
lea edx, [ebp - 0x29c]
push ecx
push str._sAiRoboForm_Portable.bin
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 1
lea eax, [ebp - 0xa78]
push ebx
push eax
push str.Copy_fr
call fcn.00419330
push 1
lea ecx, [ebp - 0x29c]
push ebx
push ecx
push str.Copy_to
call fcn.00419330
lea edx, [ebp - 0x29c]
push ebx
lea eax, [ebp - 0xa78]
push edx
push eax
call fcn.0041d3a0
add esp, 0x38
cmp eax, ebx
jne 0x41ba72
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x29c]
push eax
push ecx
push str.FAILED_to_copy_RoboForm2Go_to
call fcn.0041cc40
add esp, 0xc
lea edx, [ebp - 0xb7c]
lea eax, [ebp - 0x198]
push edx
push eax
lea ecx, [ebp - 0x29c]
push str._s_s.rfi
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x3a0]
lea eax, [ebp - 0x29c]
push edx
push eax
call fcn.0041d460
add esp, 0x18
lea ecx, [ebp - 0x64]
push 1
push ebx
push ebx
push ebx
push ecx
call esi
test eax, eax
je 0x41bae8
cmp dword [ebp - 0x60], 0x12
je 0x41bade
lea edx, [ebp - 0x64]
push edx
call edi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ebx
push ecx
call esi
test eax, eax
jne 0x41bab7
jmp 0x41bae8
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x320
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x41bb69
push edi
push ebx
push str.Root_folder_for_RoboForm2Go_is_not_specified._Please__run_Setup_again_and_report_this_error_to_ask_roboform.com
call fcn.0041cc40
lea ecx, [ebp - 0x198]
push ecx
call fcn.0041c7a0
add esp, 0x10
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41bb50
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x68], ebx
jne 0x41bc0b
cmp dword [ebp + 0x10], ebx
jne 0x41bc0b
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x3a0]
push ecx
push edx
lea eax, [ebp - 0x198]
push 0x41d4c0
push eax
call fcn.0041d0c0
push 1
lea ecx, [ebp - 0x3a0]
push ebx
push ecx
push str.Files_moved_to
call fcn.00419330
mov eax, dword [ebp - 0x80]
add esp, 0x20
cmp eax, ebx
je 0x41bbbd
cmp dword [0x488818], ebx
je 0x41bc0b
push 1
push ebx
push ebx
push str.____REBOOT_required
mov dword [ebp - 0x48], 1
call fcn.00419330
add esp, 0x10
push 1
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
je 0x41bc1a
cmp dword [ebp - 0x60], 0x12
je 0x41bc10
lea eax, [ebp - 0x64]
push eax
call edi
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
jne 0x41bbe4
jmp 0x41bc1a
mov dword [ebp - 0x48], ebx
jmp 0x41bbd5
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3de
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov eax, 0x47f700
jne 0x41bc4c
mov eax, 0x47f704
lea edx, [ebp - 0x4a4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
cmp dword [eax], ebx
je 0x41bc73
lea ecx, [ebp - 0x4a4]
push 0x47f708
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x10], ebx
je 0x41bc8d
lea eax, [ebp - 0x4a4]
push 0x47f70c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xf8c]
push 0x104
push ecx
push str._act
push edx
call fcn.004190a0
add esp, 0x10
test eax, eax
je 0x41bce6
lea eax, [ebp - 0x4a4]
push str.__act_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xf8c]
lea edx, [ebp - 0x4a4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x4a4]
push 0x47f720
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0x48]
push 1
cmp eax, ebx
je 0x41bed5
mov ecx, dword [0x488818]
push ecx
push ebx
push str.RunSfx_____configuring_post_reboot
call fcn.00419330
add esp, 0x10
lea edx, [ebp - 0x64]
push 1
push ebx
push ebx
push ebx
push edx
call esi
test eax, eax
je 0x41bd48
cmp dword [ebp - 0x60], 0x12
je 0x41bd3e
lea eax, [ebp - 0x64]
push eax
call edi
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
jne 0x41bd17
jmp 0x41bd48
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Configuring_Post_reboot_actions...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x3a0]
push ebx
push edx
lea eax, [ebp - 0x198]
push 0x41d700
push eax
call fcn.0041d0c0
lea ecx, [ebp - 0x198]
mov edi, eax
push ecx
call fcn.0041c7a0
add esp, 0x14
cmp edi, ebx
jne 0x41bdde
push ebx
push ebx
push str.Some_files_remain_locked_and_can_not_be_copied_after_reboot._nSetup_is_not_complete__you_must_reinstall_RoboForm_from_Administartor_account.
call fcn.0041cc40
add esp, 0xc
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41bdca
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov dword [ebp + 0x10], edi
lea ecx, [ebp - 0x48]
lea edx, [ebp + 8]
push ecx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push SysReAllocString
mov byte [ebp - 4], 2
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x41be49
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
lea eax, [ebp - 0x4a4]
push eax
jb 0x41be54
lea ecx, [ebp - 0x3a0]
push str.is__arg
push ecx
lea edx, [ebp - 0x29c]
push str.__s_rfwipeout.exe___s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x41be70
push 1
push eax
push ebx
push str.Failed_to_open_RunOnce
jmp 0x41bea6
lea ecx, [ebp - 0x3a0]
lea edx, [ebp - 0x29c]
push ecx
push str.__sidentities.exe___s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea ecx, [ebp - 0x29c]
push eax
push ecx
xor ebx, ebx
push 1
push ebx
push str.RoboForm
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea edx, [ebp - 0x29c]
push eax
push edx
push str.Post_setup_scheduled
call fcn.00419330
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov ecx, dword [eax + 4]
push ecx
call fcn.0041dd90
add esp, 4
cmp edi, ebx
mov byte [ebp - 4], 1
je 0x41c1aa
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c1aa
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
je 0x41bf13
cmp dword [ebp - 0x60], 0x12
je 0x41bf09
lea eax, [ebp - 0x64]
push eax
call edi
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
jne 0x41bee2
jmp 0x41bf13
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.Deleting_Temporary_Files...
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x198]
push edx
call fcn.0041c7a0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x29c]
push 0x104
push eax
push str._setmp
push ecx
xor edi, edi
mov byte [ebp - 0x29c], bl
call fcn.004190a0
add esp, 0x14
test eax, eax
je 0x41bf68
mov edi, 1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc80]
push 0x104
push edx
push str._oldmp
push eax
mov byte [ebp - 0xc80], bl
call fcn.004190a0
add esp, 0x10
lea ecx, [ebp - 0x64]
push 1
push ebx
push ebx
push ebx
push ecx
call esi
test eax, eax
je 0x41bfcf
cmp dword [ebp - 0x60], 0x12
je 0x41bfc5
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea ecx, [ebp - 0x64]
push ebx
push ecx
call esi
test eax, eax
jne 0x41bf9a
jmp 0x41bfcf
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x40]
push 0x3ee
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, edi
push ebx
neg ecx
sbb ecx, ecx
and cl, 0x38
add ecx, 0x3e8
push ecx
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x40]
push ebx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
lea eax, [ebp - 0x668]
jne 0x41c019
lea eax, [ebp - 0x3a0]
push 1
push 1
lea ecx, [ebp - 0x4a4]
push ebx
push ecx
push 0x47f8d0
push eax
call fcn.0041d850
mov eax, dword [ebp + 0x10]
add esp, 0x18
cmp eax, ebx
je 0x41c0a9
mov dword [ebp + 0xc], ebx
lea edi, [ebp - 0x1c]
mov eax, dword [edi]
cmp eax, ebx
je 0x41c1aa
lea edx, [ebp - 0x668]
push eax
push edx
lea eax, [ebp - 0x76c]
push 0x47f8e0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x76c]
push ebx
push ecx
call fcn.0041d340
add esp, 0x18
cmp eax, ebx
jne 0x41c095
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x76c]
push eax
push edx
push str.Error_deleting
call fcn.00419330
add esp, 0x10
mov eax, dword [ebp + 0xc]
add edi, 4
inc eax
cmp eax, 4
mov dword [ebp + 0xc], eax
jl 0x41c040
jmp 0x41c1aa
cmp edi, ebx
je 0x41c1aa
mov eax, dword [ebp + 0xc]
cmp dword [eax], ebx
jne 0x41c0c4
mov ecx, dword [ebp - 0x40]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea edx, [ebp - 0x4a4]
push str._setmps__
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x29c]
lea ecx, [ebp - 0x4a4]
push eax
push ecx
call edi
lea edx, [ebp - 0x4a4]
push 0x47f904
push edx
call edi
lea eax, [ebp - 0xc80]
lea ecx, [ebp - 0x4a4]
push eax
push ecx
call edi
lea edx, [ebp - 0x4a4]
push 0x47f908
push edx
call edi
push 1
push 1
lea eax, [ebp - 0x4a4]
push ebx
push eax
lea ecx, [ebp - 0x3a0]
push str.identities.exe
push ecx
call fcn.0041d850
add esp, 0x18
lea edx, [ebp - 0x64]
push 1
push ebx
push ebx
push ebx
push edx
call esi
test eax, eax
je 0x41c17e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x60], 0x12
je 0x41c174
lea eax, [ebp - 0x64]
push eax
call edi
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea edx, [ebp - 0x64]
push ebx
push edx
call esi
test eax, eax
jne 0x41c14d
jmp 0x41c17e
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0x40]
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3e8
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x40]
push ebx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push ebx
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
call esi
test eax, eax
je 0x41c1f0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [ebp - 0x60], 0x12
je 0x41c1e6
lea ecx, [ebp - 0x64]
push ecx
call edi
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x64]
push ebx
push eax
call esi
test eax, eax
jne 0x41c1bf
jmp 0x41c1f0
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edx, dword [ebp - 0x40]
push 0x3ee
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push 0x3e8
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push ebx
push ebx
push str.RunSfx_____END
call fcn.00419330
mov eax, dword [ebp - 0x40]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
add esp, 0x10
push eax
call esi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c254
mov edx, dword [ebp - 0x40]
push edx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push edi
push ebx
push str.Installation_folder_is_not_specified._Please__run_Setup_again_and_report_this_error_to_ask_roboform.com
call fcn.0041cc40
lea eax, [ebp - 0x198]
push eax
call fcn.0041c7a0
add esp, 0x10
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.0041e170
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], 0x4471f8
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c2ac
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret