Function at 0x41fbb0
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry value
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x13c8]
mov eax, 0x13c8
call fcn.00616f00
push 0xffffffffffffffff
push 0x639a54
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x74d890]
xor eax, ebp
mov dword [ebp + 0x13c4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044b340
call fcn.00448920
mov ecx, ebx
call fcn.00418820
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], edi
push 0x752a08
call fcn.00415cd0
mov eax, dword [0x752a08]
push eax
push 0x66dea8
push 0x752a0c
call fcn.00402f70
add esp, 0x10
mov dword [ebp - 0xc8], 0x400
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp + 0xf84]
push edx
push edi
push edi
push str.szCustomUserAgent
mov eax, dword [0x752bcc]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x41fc86
lea ecx, [ebp + 0xf84]
push ecx
push 0x66dea8
push 0x752a08
call fcn.00402f70
add esp, 0xc
mov ecx, ebx
call fcn.0041c8f0
mov ecx, ebx
call fcn.0040fec0
cmp dword [0x752bbc], edi
jne 0x41fd58
mov dword [ebp - 0x30], 0x40
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp + 0x1384]
push eax
push 0
push 0
push str.idmvers
mov ecx, dword [0x752bcc]
push ecx
call esi
test eax, eax
jne 0x41fd4e
mov edx, dword [0x752d84]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fcd7
sub eax, esi
push eax
push edx
lea edx, [ebp + 0x1384]
push edx
call fcn.00616f2b
add esp, 0xc
test eax, eax
je 0x41fd0e
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41fd0e
cmp byte [eax + 0x51], 0
jne 0x41fd0e
mov dword [0x752bbc], 1
push 8
push str.v6.35b09
lea eax, [ebp + 0x1384]
push eax
call fcn.0061a1ff
add esp, 0xc
test eax, eax
je 0x41fd42
push 8
push str.v6.35b10
lea ecx, [ebp + 0x1384]
push ecx
call fcn.0061a1ff
add esp, 0xc
test eax, eax
jne 0x41fd58
mov dword [0x752bc0], 1
jmp 0x41fd58
mov dword [0x752bbc], 1
cmp dword [0x752ba8], edi
je 0x41fd81
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41fd77
cmp byte [eax + 0x51], 0
jne 0x41fd77
cmp dword [0x752bbc], edi
je 0x41fd81
call fcn.00414700
call fcn.00410050
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41fd98
cmp byte [eax + 0x51], 0
jne 0x41fd98
cmp dword [0x752bbc], edi
je 0x41fda9
push 1
call fcn.00468f70
push 0
call fcn.0046fa30
add esp, 8
call fcn.0041b550
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp + 0xec0], 0x94
lea edx, [ebp + 0xec0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41fe10
cmp dword [ebp + 0xed0], 2
jne 0x41fe10
mov esi, 1
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0xec4], 6
jb 0x41fe10
mov dword [ebp - 0x28], esi
push 0x80000001
call fcn.00412710
push 0x80000002
call fcn.00412710
add esp, 8
mov dword [ebp - 0x40], 4
test esi, esi
je 0x41ff5d
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.EnableDriver
mov edx, dword [0x752bcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fe4a
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov esi, 1
mov dword [ebp - 0xb4], esi
lea edx, [ebp - 0x1c]
push edx
push 0x20019
push 0
push 0x66de18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41feb3
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.AdvIntDriverEnabled2
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fea9
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xb4], esi
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], esi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
jne 0x41ff12
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.bVistaAdvInt
mov edx, dword [0x752bcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x41ff0f
mov eax, 1
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0x4c], eax
push 4
lea edx, [ebp - 0x4c]
push edx
push 4
push 0
push str.bVistaAdvInt
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x41ff12
mov dword [ecx + 0x1c], esi
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
je 0x41ff5d
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
call fcn.00410210
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x38], edi
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
sete bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], 1
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push 0
push str.EnableDriver
mov edx, dword [0x752bcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41ff7c
cmp byte [eax + 0x51], 0
jne 0x41ff8b
cmp dword [0x752bbc], 0
je 0x42000d
cmp byte [eax + 0x51], 0
jne 0x41ff8b
cmp dword [0x752bbc], 0
je 0x41ffc5
lea ecx, [ebp - 0x18]
call fcn.004f92b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004f9310
test eax, eax
je 0x41ffb9
lea ecx, [ebp - 0x18]
call fcn.004f92d0
test eax, eax
jne 0x41ffb9
push 1
lea ecx, [ebp - 0x18]
call fcn.004f98e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004f92c0
mov dword [ebp - 0x2c], 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.DebugFlags
mov edx, dword [0x752bcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42000d
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push str.DebugFlags
mov ecx, dword [0x752bcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x420238
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x18]
call fcn.004f92b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004f9310
test eax, eax
jne 0x4201a8
xor edi, edi
cmp dword [0x752bb4], edi
jne 0x42005b
push edi
lea ecx, [ebp - 0x18]
call fcn.004f98e0
lea ecx, [ebp - 0x18]
call fcn.004f9450
lea ecx, [ebp - 0x18]
call fcn.004f9400
mov dword [ebp - 0x20], edi
mov dword [ebp + 0xf54], edi
mov dword [ebp + 0xf5c], edi
xor edx, edx
mov word [ebp + 0xf58], dx
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041e9c0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0xf54]
push ecx
mov ecx, esi
call fcn.004136b0
test eax, eax
je 0x42013b
mov ebx, dword [ebp - 0x20]
cmp ebx, 1
je 0x42013b
xor esi, esi
mov dword [ebp - 0xc0], esi
mov edx, dword [ebp - 0x14]
cmp esi, dword [edx + 0x28]
jge 0x42013b
mov edi, edx
add edi, 0x20
push esi
mov ecx, edi
call fcn.00450050
mov eax, dword [eax]
cmp ebx, dword [eax + 8]
jne 0x4201a2
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
push esi
mov ecx, edi
call fcn.00450050
mov eax, dword [eax]
add eax, 0x14
cmp ebx, dword [eax + 8]
jge 0x42013b
mov eax, dword [ebp + 0xf54]
test eax, eax
je 0x4200f9
mov dword [ebp - 0x1c], eax
jmp 0x420102
lea ecx, [ebp + 0xf58]
mov dword [ebp - 0x1c], ecx
push esi
mov ecx, edi
call fcn.00450050
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d110
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
push eax
call fcn.0061acda
add esp, 8
test eax, eax
jne 0x42019c
push esi
mov ecx, edi
call fcn.00450050
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d110
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], eax
jne 0x42016e
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0xbc], eax
push 4
lea edx, [ebp - 0xbc]
push edx
push 4
push eax
push str.AdvancedIntegration
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0041f4c0
mov dword [0x752a04], 1
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xf54]
call fcn.00401210
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x70]
jmp 0x420229
inc ebx
jmp 0x4200d2
inc esi
jmp 0x4200a6
cmp dword [ebp - 0x28], 0
je 0x42022c
call fcn.0050f900
mov esi, eax
test esi, esi
je 0x420229
mov dword [ebp - 0xc4], 4
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push str.StEnableBFEMsg
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42021f
mov dword [ebp - 0x3c], 1
push 4
lea ecx, [ebp - 0x3c]
push ecx
push 4
push 0
push str.StEnableBFEMsg
mov edx, dword [0x752bcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
push 0
push esi
push 0x4112f0
call fcn.005f5219
jmp 0x420229
xor ebx, ebx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004f92c0
cmp dword [esi + 0x1c], 0
je 0x4205f8
test ebx, ebx
je 0x4205d8
xor esi, esi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x34], esi
je 0x4205a2
push esi
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041b9d0
cmp dword [ebp - 0x28], esi
jne 0x4202a4
push 1
mov ecx, ebx
call fcn.0041a580
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [0x752a00], 1
mov ecx, ebx
test edi, edi
je 0x420295
call fcn.004169b0
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x42059e
call fcn.00410150
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x42059e
mov dword [ebp + 0xf78], esi
mov dword [ebp + 0xf80], esi
xor eax, eax
mov word [ebp + 0xf7c], ax
mov byte [ebp - 4], 4
mov eax, dword [0x752c3c]
cmp eax, esi
jne 0x4202cb
mov eax, 0x752c40
push esi
push str.Uninstall.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xf78]
call fcn.00402320
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4203c4
cmp dword [0x752bbc], esi
jne 0x4203c4
cmp byte [eax + 0x29], 0
je 0x4203c4
mov edi, 1
mov dword [ebx + 0x4c], edi
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebx + 4]
call fcn.0040dba0
test eax, eax
je 0x420587
push 0x3c
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.00615eb0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
cmp eax, esi
je 0x420367
mov dword [ebp - 0xa0], eax
jmp 0x420373
lea ecx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4203bc
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], edi
jmp 0x420587
push 0x3c
push esi
lea ecx, [ebp - 0xb0]
push ecx
call fcn.00615eb0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
cmp eax, esi
je 0x420406
mov dword [ebp - 0xa0], eax
jmp 0x420412
lea edx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], 0x6718e0
mov eax, dword [ebp + 0xf78]
cmp eax, esi
jne 0x420450
lea eax, [ebp + 0xf7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420587
mov eax, dword [ebp + 0xf78]
cmp eax, esi
jne 0x420470
lea eax, [ebp + 0xf7c]
push esi
push eax
mov ecx, ebx
call fcn.00416880
test al, al
je 0x420587
lea eax, [ebp - 0xb0]
push eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call esi
test eax, eax
je 0x420581
mov dword [ebp - 0x54], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4204c5
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], ecx
mov dword [0x752a00], 1
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040dba0
test eax, eax
je 0x420587
push 0x3c
push 0
lea ecx, [ebp - 0xb0]
push ecx
call fcn.00615eb0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
test eax, eax
je 0x42052d
mov dword [ebp - 0xa0], eax
jmp 0x420539
lea edx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], edx
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], eax
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea eax, [ebp - 0xb0]
push eax
call esi
test eax, eax
je 0x420578
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
call ebx
mov dword [ebp - 0x44], 1
jmp 0x420587
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x38], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf78]
call fcn.00401210
mov esi, dword [ebp - 0x54]
test esi, esi
jne 0x4205a9
mov dword [ebp - 0x24], 0
xor edx, edx
test esi, esi
setne dl
mov dword [ebp - 0xcc], edx
push 4
lea eax, [ebp - 0xcc]
push eax
push 4
push 0
push str.lastintres
mov ecx, dword [0x752bcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x34], 0
je 0x4205f8
test edi, edi
je 0x4205eb
mov ecx, esi
call fcn.004169b0
jmp 0x4205f8
cmp dword [ebp - 0x28], 0
jne 0x4205f8
mov ecx, esi
call fcn.00410150
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420610
cmp byte [eax + 0x51], 0
jne 0x420610
cmp dword [0x752bbc], 0
je 0x420617
mov ecx, esi
call fcn.0041ce80
cmp dword [ebp - 0x34], 0
je 0x420626
mov dword [ebp - 0x24], 0
jmp 0x42062c
cmp dword [ebp - 0x24], 0
jne 0x420679
mov dword [ebp - 0x74], 4
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push str.NeedChAfRb
mov ecx, dword [0x752bcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420897
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], esi
push str.NeedChAfRb
mov edx, dword [0x752bcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420897
push str.NeedChAfRb
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x20]
push edx
push ebx
push ebx
push str.ClChIDMRes
mov eax, dword [0x752bcc]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x4206bf
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push str.ClChIERes
mov eax, dword [0x752bcc]
push eax
call edi
test eax, eax
jne 0x4206eb
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x4206f4
cmp ebx, 1
jne 0x420897
mov edi, 1
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x30]
call fcn.004f92b0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x30]
call fcn.004f9530
cmp esi, edi
jne 0x420729
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420729
xor edi, edi
mov dword [ebp - 0x48], edi
cmp ebx, 1
jne 0x42073d
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x42073d
mov dword [ebp - 0x48], 0
jmp 0x420745
test edi, edi
jne 0x420837
push 0x50030
mov eax, dword [0x753fe0]
push eax
mov ecx, dword [0x753ff0]
push ecx
push 0
call fcn.0046f2a0
add esp, 0x10
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 4]
call fcn.0040ebf0
mov dword [ebp - 0x18], 0
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.AdvancedIntegration
mov eax, dword [0x752bcc]
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov dword [edi + 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.004f92b0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x4c]
call fcn.004f9530
mov eax, 1
mov dword [ebp - 0x48], eax
cmp esi, eax
jne 0x4207cc
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4207cc
xor eax, eax
mov dword [ebp - 0x48], eax
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x4207e5
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4207e5
mov dword [ebp - 0x48], 0
jmp 0x4207e9
test eax, eax
jne 0x420826
mov dword [ebp - 0x18], esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.NeedSnRpAfRb
mov ecx, dword [0x752bcc]
push ecx
call ebx
push 0x50030
mov edx, dword [0x753fe0]
push edx
mov eax, dword [0x753ff4]
push eax
push 0
call fcn.0046f2a0
add esp, 0x10
push esi
call fcn.00411220
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.004f92c0
jmp 0x42088b
push 0x50000
cmp dword [ebp - 0x2c], 1
jne 0x420852
mov ecx, dword [0x753fe0]
push ecx
mov edx, dword [0x754020]
push edx
jmp 0x42085f
mov eax, dword [0x753fe0]
push eax
mov ecx, dword [0x753ff8]
push ecx
push 0
call fcn.0046f2a0
add esp, 0x10
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.AdvancedIntegration
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004f92c0
cmp dword [ebp - 0x60], 0
jne 0x4208e1
mov dword [ebp - 0x5c], 4
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x74]
push edx
push 0
push 0
push str.NeedSnRpAfRb
mov eax, dword [0x752bcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420903
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
push str.NeedSnRpAfRb
mov ecx, dword [0x752bcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420903
push 0
lea ecx, [ebp]
call fcn.00524d70
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.005eba8b
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00415250
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.00410370
push 1
mov ecx, edi
call fcn.0041b9d0
mov ecx, edi
call fcn.00567660
xor ebx, ebx
test eax, eax
jne 0x420945
push ebx
push ebx
call fcn.00417260
push ebx
push ebx
mov ecx, edi
call fcn.00417300
push ebx
push ebx
mov ecx, edi
call fcn.0041ce10
push ebx
push ebx
mov ecx, edi
call fcn.004172c0
mov ecx, edi
cmp dword [edi + 0x1c], ebx
je 0x420955
push 1
call fcn.004150f0
jmp 0x420966
call fcn.00410a70
test eax, eax
jne 0x420966
push ebx
mov ecx, edi
call fcn.0041f4c0
cmp dword [0x752bbc], ebx
je 0x420975
mov ecx, edi
call fcn.0041ef70
cmp dword [ebp - 0x34], ebx
je 0x420c69
lea esi, [edi + 4]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.0040dba0
test eax, eax
je 0x420ad7
cmp dword [ebp - 0x28], ebx
jne 0x4209b0
mov ecx, esi
call fcn.0040ebf0
mov dword [ebp - 0x44], 1
jmp 0x420c6e
mov dword [ebp + 0xf6c], ebx
mov dword [ebp + 0xf74], ebx
xor ecx, ecx
mov word [ebp + 0xf70], cx
mov byte [ebp - 4], 8
mov eax, dword [0x752c3c]
cmp eax, ebx
jne 0x4209d7
mov eax, 0x752c40
push ebx
push str.Uninstall.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xf6c]
call fcn.00402320
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x4209fe
lea eax, [ebp + 0xf70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420ac8
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420a1e
lea eax, [ebp + 0xf70]
push ebx
push eax
mov ecx, edi
call fcn.00416880
test al, al
je 0x420ac8
push 0x3c
push ebx
lea edx, [ebp - 0x108]
push edx
call fcn.00615eb0
add esp, 0xc
mov dword [ebp - 0x108], 0x3c
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420a6f
lea eax, [ebp + 0xf70]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], str._uninstlsp
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420ac1
push 0xffffffffffffffff
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf6c]
call fcn.00401210
cmp dword [ebp - 0x28], ebx
je 0x420c69
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x420b05
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420b40
call fcn.00447470
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
lea ecx, [ebp - 0x5c]
push ecx
push eax
push ebx
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x420c69
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xf60], ebx
mov dword [ebp + 0xf68], ebx
xor eax, eax
mov word [ebp + 0xf64], ax
mov byte [ebp - 4], 9
mov eax, dword [0x752c3c]
cmp eax, ebx
jne 0x420b67
mov eax, 0x752c40
push ebx
push str.Uninstall.exe
push eax
push 0x66dde0
lea ecx, [ebp + 0xf60]
call fcn.00402320
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
jne 0x420b8e
lea eax, [ebp + 0xf64]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420c5a
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
jne 0x420bae
lea eax, [ebp + 0xf64]
push 1
push eax
mov ecx, edi
call fcn.00416880
test al, al
je 0x420c5a
push 0x3c
push ebx
lea ecx, [ebp + 0x1388]
push ecx
call fcn.00615eb0
add esp, 0xc
mov dword [ebp + 0x1388], 0x3c
mov dword [ebp + 0x138c], 0x40
mov dword [ebp + 0x1394], str.open
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
je 0x420c02
mov dword [ebp + 0x1398], eax
jmp 0x420c0e
lea edx, [ebp + 0xf64]
mov dword [ebp + 0x1398], edx
mov dword [ebp + 0x13a0], ebx
mov dword [ebp + 0x13a4], 3
mov dword [ebp + 0x13a8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp + 0x1390], eax
mov dword [ebp + 0x139c], str._uninsttdi
lea eax, [ebp + 0x1388]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420c5a
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x13c0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf60]
call fcn.00401210
cmp dword [ebp - 0x44], ebx
je 0x420c89
push 0x50030
mov edx, dword [0x753fc4]
push edx
mov eax, dword [0x754018]
push eax
push ebx
call fcn.0046f2a0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x13c4]
xor ecx, ebp
call fcn.006157d3
add ebp, 0x13c8
mov esp, ebp
pop ebp
ret