Function at 0x4098ef
Capabilities:
Copy file
Create directory
Query or enumerate registry value
Set registry value

Disassembly:
push 0xab4
mov eax, 0x562aaf
call fcn.00531cbc
xor eax, eax
xor ebx, ebx
push 0x208
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
call fcn.00532330
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409c2e
lea ecx, [ebp - 0xaa8]
call fcn.00409738
push 0x5a77e0
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xa3c]
call fcn.004046e2
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xaa8]
mov byte [ebp - 4], 2
call fcn.004034f0
cmp dword [ebp - 0xa28], 8
lea eax, [ebp - 0xa3c]
push ebx
cmovae eax, dword [ebp - 0xa3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 0x18
mov edi, str.package
mov ecx, esp
mov dword [ebp - 0xa24], esp
push edi
call fcn.00402387
lea eax, [ebp - 0xa54]
mov byte [ebp - 4], 3
push eax
push ecx
xor ecx, ecx
call fcn.0040ad5d
pop ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040b4e7
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0xa3c]
mov byte [ebp - 4], 4
call fcn.00404640
push ebx
push 1
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 2
call fcn.004034f0
mov esi, str.Uninstall.exe
mov ecx, esi
call fcn.00403479
push eax
push esi
lea ecx, [ebp - 0xa3c]
call fcn.0040459f
cmp dword [ebp - 0xa28], 8
lea eax, [ebp - 0xa3c]
push ebx
cmovae eax, dword [ebp - 0xa3c]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409bc5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa24], esp
push edi
call fcn.00402387
lea eax, [ebp - 0xa90]
mov byte [ebp - 4], 5
push eax
push ecx
xor ecx, ecx
call fcn.0040ad5d
pop ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040b4e7
push eax
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa54]
call fcn.0040636e
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xa90]
mov byte [ebp - 4], 8
call fcn.004034f0
cmp dword [ebp - 0xa40], 8
lea ecx, [ebp - 0xa70]
lea eax, [ebp - 0xa54]
cmovae eax, dword [ebp - 0xa54]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x409bb1
push 0x7fe
mov word [ebp - 0xa20], ax
lea eax, [ebp - 0xa1e]
push ebx
push eax
call fcn.00532330
add esp, 0xc
mov dword [ebp - 0xa24], 0x400
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0xa20]
push eax
push ebx
push ebx
push str.UninstallString
push dword [ebp - 0xa70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x409bb1
cmp dword [ebp - 0xa24], eax
je 0x409bb1
push dword [ebp - 0xa24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0xa20]
push eax
push 1
push ebx
push str.UninstallStringOld
push dword [ebp - 0xa70]
call edi
mov esi, eax
test esi, esi
jne 0x409bb1
lea eax, [ebp - 0xa3c]
mov edx, 0x5a8da8
push eax
lea ecx, [ebp - 0xac0]
call fcn.004063ea
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa6c]
mov edx, eax
mov dword [esp], str.___uninstall
call fcn.004046e2
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xac0]
call fcn.004034f0
cmp dword [ebp - 0xa58], 8
lea ecx, [ebp - 0xa6c]
mov eax, dword [ebp - 0xa5c]
cmovae ecx, dword [ebp - 0xa6c]
add eax, eax
push eax
push ecx
push 1
push ebx
push str.UninstallString
push dword [ebp - 0xa70]
call edi
push ebx
push 1
lea ecx, [ebp - 0xa6c]
mov esi, eax
call fcn.004034f0
push ebx
push 1
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 2
call fcn.004034f0
jmp 0x409bcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa24], esp
push 0x5a76f4
call fcn.00402387
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0xa78], esp
push 0x5a77de
call fcn.00402387
sub esp, 0x18
mov byte [ebp - 4], 0xb
mov ecx, esp
push str.makeMeUninstall
call fcn.00402387
mov dl, 1
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.0040516a
add esp, 0x48
lea ecx, [ebp - 0xa3c]
push ebx
push 1
call fcn.004034f0
mov eax, esi
call fcn.00531c6b
ret