Function at 0x401600
Capabilities:
Check for time delay via gettickcount
Check os version
Delete file
Delete registry key
Enumerate files on windows
Enumerate process modules
Enumerate processes
Get common file path
Get installed programs
Hide graphical window
Move file
Read file on windows
Set file attributes

Disassembly:
sub esp, 0xca4
mov eax, dword [0x41f00c]
xor eax, esp
mov dword [esp + 0xca0], eax
mov eax, dword [esp + 0xca8]
push ebx
mov ebx, dword [esp + 0xcb4]
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov dword [0x41fad4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jae 0x401722
push 0x104
lea eax, [esp + 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x3dc]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401660
sub ecx, edx
cmp byte [esp + ecx + 0x3db], 0x5c
je 0x401693
lea edi, [esp + 0x3dc]
dec edi
jmp 0x401680
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x401680
mov ax, word [0x417284]
mov word [edi], ax
lea ecx, [esp + 0x3dc]
dec ecx
jmp 0x4016a0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4016a0
mov eax, dword [str.ctl3d32.dll]
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ecx], eax
mov eax, dword [0x41728c]
mov dword [ecx + 4], eax
mov eax, dword [0x417290]
push 0x8001
mov dword [ecx + 8], eax
call edi
mov esi, eax
lea eax, [esp + 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov dword [0x423968], eax
call edi
mov eax, dword [0x423968]
test eax, eax
je 0x401722
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Ctl3dRegister
push eax
call esi
test eax, eax
je 0x401709
push dword [0x41fad4]
call eax
push str.Ctl3dAutoSubclass
push dword [0x423968]
call esi
test eax, eax
je 0x401722
push dword [0x41fad4]
call eax
push 0x417324
push ebx
call fcn.00403900
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40250d
add ebp, 2
push 0x417328
push ebp
mov dword [esp + 0x18], ebp
call fcn.00405b6e
mov edi, eax
add esp, 8
test edi, edi
je 0x40250d
push edi
call fcn.0040963d
push eax
call fcn.00409771
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.004051d4
push edi
push 1
push esi
push eax
mov dword [0x41fad8], eax
call fcn.00405d6d
mov eax, dword [0x41fad8]
push edi
mov byte [eax + esi], 0
call fcn.00405a47
push str._UNINSTALL_
push dword [0x41fad8]
call fcn.00403900
add esp, 0x28
test eax, eax
je 0x402506
push 0xd
push eax
call fcn.00403690
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x402506
inc ebx
cmp byte [ebx], 0xa
jne 0x4017c5
inc ebx
test ebx, ebx
je 0x402506
lea ecx, [ecx]
cmp byte [ebx], 0x5b
je 0x401995
push ebx
call fcn.004015a0
push 9
mov edi, eax
push str.GroupName
push edi
call fcn.0040923f
add esp, 0x10
test eax, eax
jne 0x4017ff
mov esi, 0x41f8c0
jmp 0x401938
push 9
push str.GroupFile
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x40181d
mov esi, 0x41f8f8
jmp 0x401938
push 9
push str.ShortName
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x40183b
mov esi, 0x41f948
jmp 0x401938
push 7
push str.ItemNum
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x401871
push 0x3d
push edi
call fcn.00403690
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0040557b
add esp, 0xc
mov dword [0x41fac4], eax
xor esi, esi
jmp 0x401938
push 0xe
push str.QuestionString
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x40188f
mov esi, 0x41f97c
jmp 0x401938
push 0xc
push str.DeleteString
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x4018ad
mov esi, 0x41f9b0
jmp 0x401938
push 0xc
push str.UninsString1
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x4018c8
mov esi, 0x41f9d8
jmp 0x401938
push 0xc
push str.UninsString2
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x4018e3
mov esi, 0x41f9c4
jmp 0x401938
push 0xc
push str.UninstallExe
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x4018fe
mov esi, 0x41fa28
jmp 0x401938
push 0xd
push str.UninstallFile
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x401919
mov esi, 0x41fa5c
jmp 0x401938
push 0xa
push str.DestopName
push edi
call fcn.0040923f
add esp, 0xc
mov esi, 0x41fa90
test eax, eax
mov eax, 0
cmovne esi, eax
push 0xd
push edi
call fcn.00403690
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x401958
inc ebx
cmp byte [ebx], 0xa
jne 0x401950
inc ebx
test ebx, ebx
je 0x401958
mov byte [ebx - 2], 0
test esi, esi
je 0x40198d
push edi
call section..text
push 0x3d
push edi
call fcn.00403690
add esp, 0xc
test eax, eax
je 0x40198d
inc eax
push eax
call fcn.004015a0
add esp, 4
sub esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x401980
test ebx, ebx
jne 0x4017d0
push 0xc0
push dword [0x41fac4]
call fcn.004051ac
mov dword [0x41fac8], eax
add esp, 8
xor eax, eax
cmp dword [0x41fac4], eax
jle 0x401b1f
xor ebp, ebp
lea ecx, [ecx]
inc eax
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c8]
push str._INSITEM_d_
push eax
call fcn.00402540
lea eax, [esp + 0x2d0]
push eax
push ebx
call fcn.00403900
add esp, 0x14
test eax, eax
je 0x402506
push 0xd
push eax
call fcn.00403690
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x402506
inc ebx
cmp byte [ebx], 0xa
jne 0x401a0d
inc ebx
test ebx, ebx
je 0x402506
cmp byte [ebx], 0x5b
je 0x401b05
push ebx
xor esi, esi
call fcn.004015a0
push 6
mov edi, eax
push str.DefExt
push edi
call fcn.0040923f
add esp, 0x10
test eax, eax
jne 0x401a44
mov esi, dword [0x41fac8]
jmp 0x401aa2
push 7
push str.ExtType
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x401a63
mov esi, dword [0x41fac8]
add esi, 5
jmp 0x401aa2
push 7
push str.ExeFile
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x401a82
mov esi, dword [0x41fac8]
add esi, 0x37
jmp 0x401aa2
push 0xa
push str.SystemName
push edi
call fcn.0040923f
add esp, 0xc
test eax, eax
jne 0x401aa4
mov esi, dword [0x41fac8]
add esi, 0x87
add esi, ebp
push 0xd
push edi
call fcn.00403690
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x401ac4
inc ebx
cmp byte [ebx], 0xa
jne 0x401abc
inc ebx
test ebx, ebx
je 0x401ac4
mov byte [ebx - 2], 0
test esi, esi
je 0x401afd
push edi
call section..text
push 0x3d
push edi
call fcn.00403690
add esp, 0xc
test eax, eax
je 0x401afd
inc eax
push eax
call fcn.004015a0
add esp, 4
sub esi, eax
lea esp, [esp]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x401af0
test ebx, ebx
jne 0x401a15
mov eax, dword [esp + 0x18]
add ebp, 0xc0
cmp eax, dword [0x41fac4]
jl 0x4019c0
mov ebp, dword [esp + 0x10]
push 0x41f8c0
lea eax, [esp + 0x4e4]
push 0x41f97c
push eax
call fcn.00402540
mov edx, 0x423970
add esp, 0xc
mov ecx, ebp
sub edx, ebp
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x401b42
push 0x5c
push 0x423970
call fcn.004037c0
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x4e0]
push 0x24
push 0x41f9b0
push eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call eax
cmp eax, 6
jne 0x402506
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401b90
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x401cc6
push 0x124
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00404670
add esp, 0xc
mov dword [esp + 0x34], 0x128
lea eax, [esp + 0x34]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401cc3
jmp 0x401be0
push dword [esp + 0x3c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x401cb0
push 0x220
lea eax, [esp + 0x7b8]
push 0
push eax
call fcn.00404670
add esp, 0xc
mov dword [esp + 0x7b0], 0x224
lea eax, [esp + 0x7b0]
push eax
push ebp
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x401cad
mov edi, edi
xor esi, esi
cmp dword [0x41fac4], esi
jle 0x401c91
xor edi, edi
lea esp, [esp]
mov eax, dword [0x41fac8]
add eax, 0x37
add eax, edi
push eax
push 0x423970
lea eax, [esp + 0x3e4]
push str._s_s
push eax
call fcn.00402540
lea eax, [esp + 0x8e0]
push eax
lea eax, [esp + 0x3f0]
push eax
call fcn.0040915c
add esp, 0x18
test eax, eax
je 0x401d6d
inc esi
add edi, 0xc0
cmp esi, dword [0x41fac4]
jl 0x401c40
lea eax, [esp + 0x7b0]
push eax
push ebp
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x401c30
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call edi
lea eax, [esp + 0x34]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401be0
push esi
call edi
push dword [esp + 0x10]
call fcn.004095c6
add esp, 4
test ebx, ebx
je 0x402506
push str._FILES_
push ebx
call fcn.00403900
add esp, 8
test eax, eax
je 0x402506
push 0xd
push eax
call fcn.00403690
add esp, 8
test eax, eax
je 0x402506
inc eax
cmp byte [eax], 0xa
jne 0x401d0a
inc eax
test eax, eax
je 0x402506
cmp byte [eax], 0x5b
je 0x401db8
push eax
call fcn.004015a0
mov esi, eax
push esi
call section..text
add esp, 8
cmp byte [esi], 0xd
je 0x401d45
mov ecx, dword [0x41fadc]
mov dword [ecx*4 + 0x41fae0], esi
inc ecx
mov dword [0x41fadc], ecx
push 0xd
push esi
call fcn.00403690
add esp, 8
test eax, eax
je 0x402506
inc eax
cmp byte [eax], 0xa
jne 0x401d5f
inc eax
test eax, eax
je 0x402506
mov byte [eax - 2], 0
jmp 0x401d12
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call edi
push dword [esp + 0x14]
call edi
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40
push 0x41f9b0
push 0x41f9d8
push 0
call ebp
push 0x24
push 0x41f9b0
lea eax, [esp + 0x4e8]
push eax
push 0
call ebp
cmp eax, 6
je 0x401b90
call fcn.00401040
jmp 0x40250f
push str._DIRECTORYS_
push eax
call fcn.00403900
add esp, 8
test eax, eax
je 0x402506
push eax
call fcn.004015e0
add esp, 4
test eax, eax
je 0x401e2f
jmp 0x401de0
cmp byte [eax], 0x5b
je 0x401e2f
push eax
call fcn.004015a0
mov esi, eax
push esi
call section..text
add esp, 8
cmp byte [esi], 0xd
je 0x401e0f
mov ecx, dword [0x421a20]
mov dword [ecx*4 + 0x421a28], esi
inc ecx
mov dword [0x421a20], ecx
push 0xd
push esi
call fcn.00403690
add esp, 8
test eax, eax
je 0x401e2f
inc eax
cmp byte [eax], 0xa
jne 0x401e25
inc eax
test eax, eax
je 0x401e2f
mov byte [eax - 2], 0
jmp 0x401de0
push 0
push 0x4010a0
push 0
push 1
push dword [0x41fad4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ebx, eax
mov dword [esp + 0x14], ebx
call fcn.00401310
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov ebp, eax
call esi
mov ecx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [esp + 0x28]
sub ecx, eax
sub eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
add eax, esi
push 1
push ecx
mov ecx, dword [esp + 0x34]
cdq
sub ecx, ebx
sub ebx, dword [esp + 0x34]
sub eax, edx
sar eax, 1
push ecx
push eax
lea eax, [ebx + ebp]
mov ebx, dword [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
push eax
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
xor ecx, ecx
lea ecx, [ecx]
mov al, byte [ecx + 0x41f9b0]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x29b], al
test al, al
jne 0x401eb0
lea edi, [esp + 0x29c]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x401ed0
mov ax, word [0x417418]
mov edx, 0x41f8c0
mov word [edi], ax
mov esi, edx
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x401ef0
lea edi, [esp + 0x29c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401f01
mov ecx, edx
lea eax, [esp + 0x29c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401310
cmp dword [0x41fadc], 0
mov dword [esp + 0x18], 0
jle 0x402066
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, 0x5a
mov esi, 0x41fae0
lea esp, [esp]
lea eax, [esp + 0x7b0]
mov dword [esp + 0x7b0], 0x23
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401fe2
push 0
push 0
lea eax, [esp + 0x3e4]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call fcn.00405965
push 0
lea eax, [esp + 0x7f4]
push eax
lea eax, [esp + 0x3f8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004056f3
lea eax, [esp + 0x5c]
push eax
call fcn.004095c6
add esp, 0x2c
lea eax, [esp + 0x7b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401f82
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esi]
call fcn.004095c6
mov eax, ebp
add esp, 4
cdq
idiv dword [0x41fadc]
cmp eax, dword [0x421a24]
jle 0x40204b
call ebx
mov edi, eax
call ebx
sub eax, edi
cmp eax, 0x14
jl 0x402001
mov eax, ebp
cdq
idiv dword [0x41fadc]
push 0x65
push dword [esp + 0x18]
mov dword [0x421a24], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x40204b
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esp + 0x18]
add esi, 4
inc eax
add ebp, 0x5a
mov dword [esp + 0x18], eax
cmp eax, dword [0x41fadc]
jl 0x401f60
mov ecx, dword [0x421a28]
lea edx, [esp + 0x2d8]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402075
lea ecx, [esp + 0x2d8]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402090
sub ecx, edx
cmp byte [esp + ecx + 0x2d7], 0x5c
je 0x4020c3
lea edi, [esp + 0x2d8]
dec edi
jmp 0x4020b0
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4020b0
mov ax, word [0x417284]
mov word [edi], ax
lea ecx, [esp + 0x2d8]
dec ecx
jmp 0x4020d0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4020d0
mov eax, dword [str..gid]
mov dword [ecx], eax
mov ax, word [0x417420]
mov word [ecx + 4], ax
lea eax, [esp + 0x15c]
push eax
lea eax, [esp + 0x2dc]
mov dword [esp + 0x160], 2
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4021ee
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ecx]
mov ecx, dword [0x421a28]
lea edx, [esp + 0x2d8]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402130
lea ecx, [esp + 0x2d8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402147
sub ecx, edx
cmp byte [esp + ecx + 0x2d7], 0x5c
je 0x402175
lea edi, [esp + 0x2d8]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402162
mov ax, word [0x417284]
mov word [edi], ax
lea edx, [esp + 0x188]
mov esi, edx
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x402180
lea edi, [esp + 0x2d8]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402191
mov eax, dword [esp + 0x15c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test al, 3
je 0x4021c0
and eax, 0xfffffffc
push eax
lea eax, [esp + 0x2dc]
push eax
call ebp
lea eax, [esp + 0x2d8]
push eax
call fcn.004095c6
add esp, 4
lea eax, [esp + 0x15c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402120
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [0x421a20]
dec esi
test esi, esi
jle 0x402214
lea esp, [esp]
push dword [esi*4 + 0x421a28]
call fcn.0040977c
dec esi
add esp, 4
test esi, esi
jg 0x402200
push dword [0x421a28]
call fcn.0040977c
mov ebx, dword [esp + 0x18]
add esp, 4
mov dword [0x421a24], 0x64
push 0x65
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x402265
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00401310
mov ebp, dword [sym.imp.KERNEL32.dll_GetVersion]
call ebp
movzx esi, al
shl esi, 8
call ebp
shr eax, 8
movzx eax, al
add eax, esi
cmp eax, 0x30b
jbe 0x4023a0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor edi, edi
cmp dword [0x41fac4], edi
jle 0x40234b
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor esi, esi
jmp 0x4022b0
mov eax, dword [0x41fac8]
add eax, esi
mov dword [esp + 0x10], 0
cmp byte [eax], 0
je 0x4022f2
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push eax
push 0x80000000
call ebp
test eax, eax
jne 0x4022f2
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x41fac8]
add eax, esi
push eax
push 0x80000000
call ebx
mov eax, dword [0x41fac8]
add eax, 5
add eax, esi
cmp byte [eax], 0
je 0x402332
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push eax
push 0x80000000
call ebp
test eax, eax
jne 0x402332
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x41fac8]
add eax, 5
add eax, esi
push eax
push 0x80000000
call ebx
inc edi
add esi, 0xc0
cmp edi, dword [0x41fac4]
jl 0x4022b0
mov ebp, dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, 0xd
lea edi, [esp + 0x2d8]
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov edx, 0x41f8c0
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402366
lea edi, [esp + 0x2d8]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402377
mov ecx, edx
lea eax, [esp + 0x2d8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x80000002
call ebx
mov ebx, dword [esp + 0x14]
push 0x41f8c0
call fcn.004026b0
add esp, 4
cmp byte [0x41fa90], 0
je 0x4023c3
push 0x41fa90
call fcn.00402740
add esp, 4
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.00401310
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x6ac]
push 0x104
push eax
push dword [esp + 0x28]
call esi
push 0
push 0
lea eax, [esp + 0xbb8]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x6bc]
push eax
call fcn.00405965
push 0
push 0
lea eax, [esp + 0xbcc]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x5cc]
push eax
call fcn.004056f3
lea ecx, [esp + 0x5d0]
add esp, 0x28
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402431
sub ecx, edx
cmp byte [esp + ecx + 0x5a7], 0x5c
jne 0x402458
dec ecx
cmp ecx, 0x104
jae 0x40252a
mov byte [esp + ecx + 0x5a8], al
push 0
lea eax, [esp + 0x6b0]
push eax
call fcn.00401380
push 0x400
lea eax, [esp + 0x7b4]
push eax
push 0
call esi
call ebp
shr eax, 0x1f
not eax
test al, 1
je 0x402497
push 4
push 0
lea eax, [esp + 0x7b8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x4024e5
push 0x100
lea eax, [esp + 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
lea eax, [esp + 0x3e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x3dc]
push eax
lea eax, [esp + 0x7b4]
push eax
push 0x4172c8
push str.Rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x41f9c4], 0
je 0x402506
push 0x40
lea eax, [esp + 0x2a0]
push eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x41f9c4
push 0
call eax
call fcn.00401040
jmp 0x40250f
xor eax, eax
mov ecx, dword [esp + 0xcb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402c19
add esp, 0xca4
ret 0x10
call fcn.00402b3f
int3