Function at 0x403acf
Capabilities:
Create directory
Persist via run registry key

Disassembly:
mov eax, 0x41e138
call fcn.0040699c
sub esp, 0x20
cmp dword [0x42b880], 0
push ebx
push esi
push edi
mov esi, 0x42b86c
mov ebx, str.HprUnInst.log
mov edi, 0x42b868
jne 0x403b7c
push str.install.log
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00419624
push dword [eax]
and dword [ebp - 4], 0
call fcn.00401d21
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0041941c
push ebx
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00419624
push dword [eax]
mov dword [ebp - 4], 1
call fcn.00401d21
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0041941c
push ebx
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00419624
mov eax, dword [eax]
push str.File_Del:
push dword [0x42b86c]
mov dword [ebp - 4], 2
push eax
call fcn.00401ee0
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0041941c
push ebx
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00419624
push dword [eax]
mov dword [ebp - 4], 3
call fcn.00403674
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0041941c
push dword [0x42b86c]
push dword [0x42b868]
push 0x4263b4
call fcn.00402fd1
add esp, 0xc
lea eax, [ebp - 0x1c]
push ebx
push esi
push eax
call fcn.00419624
mov eax, dword [eax]
mov edi, 0x429f70
push edi
push eax
call fcn.00402c3d
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0041941c
mov eax, dword [0x426a64]
mov dword [ebp - 0x14], eax
cmp dword [0x42b888], 0
mov dword [ebp - 4], 4
je 0x403c43
push str.Common_Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp - 0x1c]
push 0x80000002
push eax
call fcn.00403138
add esp, 0x10
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00419509
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 4
jge 0x403c3a
and dword [0x42b888], 0
cmp dword [0x42b888], 0
jne 0x403c77
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp - 0x1c]
push 0x80000001
push eax
call fcn.00403138
add esp, 0x10
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.00419509
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
push 0x5c
push 0x2f
mov ecx, 0x42b864
call fcn.0041492f
push str.__t_r_n_
mov ecx, 0x42b864
call fcn.004150d6
push str.__t_r_n_
mov ecx, 0x42b864
call fcn.00415037
or eax, 0xffffffff
inc eax
mov ecx, 0x42b864
push eax
push 0x5c
call fcn.0041984f
test eax, eax
mov dword [ebp - 0x2c], eax
jle 0x403d24
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x42b864
call fcn.00414c04
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push 0x426254
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 7
call fcn.00419624
push dword [ebp - 0x1c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004195be
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x20]
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.0041941c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0041941c
mov eax, dword [ebp - 0x2c]
jmp 0x403ca6
push 0x42b864
lea eax, [ebp - 0x2c]
push 0x426254
push eax
call fcn.00419698
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.00419792
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0041941c
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push str.Made_Dir:
push eax
call fcn.00419698
mov eax, dword [eax]
push ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 0xa
call fcn.00419624
push dword [ebp - 0x2c]
mov eax, dword [eax]
push eax
call fcn.00402c3d
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.0041941c
push 0
push dword [ebp - 0x14]
call fcn.00406dcf
pop ecx
mov ebx, str..lnk
test eax, eax
pop ecx
jne 0x404134
push 0x426254
lea ecx, [ebp - 0x14]
call fcn.0041976b
lea eax, [ebp - 0x1c]
push 0xf
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xb
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0xc
push eax
call fcn.00419624
mov eax, dword [eax]
push 0x4260f8
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 0xd
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
mov byte [ebp - 4], 0xe
push dword [ebp - 0x2c]
push eax
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xd
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xc
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.0041941c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
lea eax, [ebp - 0x1c]
push 0x65
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xf
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0x10
push eax
call fcn.00419624
mov eax, dword [eax]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2c], eax
push str.HprSnap5Man.chm
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
mov byte [ebp - 4], 0x12
push dword [ebp - 0x2c]
push eax
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x10
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xf
call fcn.0041941c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
lea eax, [ebp - 0x1c]
push 0x66
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x13
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0x14
push eax
call fcn.00419624
mov eax, dword [eax]
push str._readme.txt
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 0x15
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
mov byte [ebp - 4], 0x16
push dword [ebp - 0x2c]
push eax
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x15
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x14
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x13
call fcn.0041941c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
push str.RegHS5.hlp
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.00419624
mov eax, dword [eax]
push 0
push eax
call fcn.00406dcf
neg eax
pop ecx
sbb al, al
pop ecx
inc al
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0xd], al
call fcn.0041941c
cmp byte [ebp - 0xd], 0
push 0x67
je 0x404033
lea eax, [ebp - 0x1c]
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x17
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0x18
push eax
call fcn.00419624
mov eax, dword [eax]
push str.RegHS5.hlp
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 0x19
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
mov byte [ebp - 4], 0x1a
push dword [ebp - 0x2c]
push eax
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x19
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x18
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x17
call fcn.0041941c
lea ecx, [ebp - 0x1c]
jmp 0x40409c
lea eax, [ebp - 0x24]
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x1b
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1c
push eax
call fcn.00419624
push dword [0x42b86c]
mov eax, dword [eax]
mov byte [ebp - 4], 0x1d
push str._mapid_4_hprsnap5man.chm
push 1
push edi
push eax
push str.Hh.exe
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1c
call fcn.0041941c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.0041941c
lea eax, [ebp - 0x1c]
push 0x68
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x1e
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0x1f
push eax
call fcn.00419624
mov eax, dword [eax]
push str.HprUnInst.exe
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 0x20
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
mov byte [ebp - 4], 0x21
push dword [ebp - 0x2c]
push eax
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x20
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1f
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1e
call fcn.0041941c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
cmp dword [0x4264c4], 0
je 0x404238
cmp dword [0x42b888], 0
lea eax, [ebp - 0x2c]
je 0x40416b
push str.Common_Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
push eax
call fcn.00403138
add esp, 0x10
mov byte [ebp - 4], 0x22
jmp 0x404187
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
push eax
call fcn.00403138
add esp, 0x10
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x14]
push eax
call fcn.00419509
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0041941c
push 0x426254
lea ecx, [ebp - 0x14]
call fcn.0041976b
lea eax, [ebp - 0x1c]
push 0xf
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x24
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0x25
push eax
call fcn.00419624
mov eax, dword [eax]
push 0x4260f8
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 0x26
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
mov byte [ebp - 4], 0x27
push dword [ebp - 0x2c]
push eax
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x26
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x25
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x24
call fcn.0041941c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0041941c
cmp dword [0x42b88c], 0
je 0x404337
cmp dword [0x42b888], 0
lea eax, [ebp - 0x2c]
je 0x40426f
push str.Common_Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
push eax
call fcn.00403138
add esp, 0x10
mov byte [ebp - 4], 0x28
jmp 0x40428b
push str.Startup
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
push eax
call fcn.00403138
add esp, 0x10
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x14]
push eax
call fcn.00419509
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0041941c
push 0x426254
lea ecx, [ebp - 0x14]
call fcn.0041976b
lea eax, [ebp - 0x20]
push 0xf
push eax
call fcn.00402be8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x2a
call fcn.004195be
push ebx
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2b
push eax
call fcn.00419624
mov ebx, dword [eax]
push 0x4260f8
lea eax, [ebp - 0x2c]
push esi
push eax
mov byte [ebp - 4], 0x2c
call fcn.00419624
mov eax, dword [eax]
push 0
push 0
push 1
push edi
push ebx
push eax
mov byte [ebp - 4], 0x2d
call fcn.00403803
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2c
call fcn.0041941c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x2b
call fcn.0041941c
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2a
call fcn.0041941c
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.0041941c
cmp dword [0x42b888], 0
mov eax, 0x426758
jne 0x40434a
mov eax, 0x426754
push eax
push str.AllUsers
mov ebx, 0x80000002
push str.SOFTWAREHyperionicsHyperSnap_DX_v.5
push ebx
call fcn.004031b8
push dword [0x42b86c]
push str.Path
push str.SOFTWAREHyperionicsHyperSnap_DX_v.5
push ebx
call fcn.004031b8
push str.HyperSnap5.License
push 0
push 0x4262e4
push 0x80000000
call fcn.004031b8
add esp, 0x30
lea eax, [ebp - 0x28]
push esi
push 0x426474
push eax
call fcn.00419698
push str.HprSnap5.exe____1_
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x2e
push eax
call fcn.00419624
push dword [eax]
push 0
push str.HyperSnap5.License_shellopencommand
push 0x80000000
call fcn.004031b8
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0041941c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0041941c
push 0x4260f8
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.00419624
push dword [eax]
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsHprSnap5.exe
push ebx
call fcn.004031b8
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0041941c
push str.Support
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHyperSnap_DX_5
push str.Contact
push ebx
push 0x80000002
call fcn.004031b8
lea eax, [ebp - 0x2c]
push 0xf
push eax
call fcn.00402be8
push dword [eax]
push str.DisplayName
push ebx
push 0x80000002
call fcn.004031b8
add esp, 0x28
lea ecx, [ebp - 0x2c]
call fcn.0041941c
push 0x4266a4
push str.DisplayVersion
push ebx
push 0x80000002
call fcn.004031b8
push str.Hyperionics_Technology_LLC
push str.Publisher
push ebx
push 0x80000002
call fcn.004031b8
add esp, 0x20
lea eax, [ebp - 0x2c]
push str.HprUnInst.exe
push esi
push eax
call fcn.00419624
push dword [eax]
mov esi, 0x80000002
push str.UninstallString
push ebx
push esi
call fcn.004031b8
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0041941c
push str.http:__www.hyperionics.com
push str.URLInfoAbout
push ebx
push esi
call fcn.004031b8
push str.sfxname
call fcn.00407bb4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004039d4
push edi
mov byte [ebp - 4], 0x2f
push dword [ebp - 0x18]
call fcn.004078e2
add esp, 0x24
test eax, eax
pop edi
pop esi
pop ebx
jle 0x404507
push 0
push dword [0x42b86c]
push dword [ebp - 0x18]
push str.HprSnap5.ini
call fcn.00402c6e
push dword [0x42b86c]
push dword [ebp - 0x18]
push str..hs5lic
call fcn.00402fd1
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.0041941c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041941c
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
leave
ret