Function at 0x44aed0
Capabilities:
Link many functions at runtime
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8d68
mov eax, dword fs:[0]
push eax
sub esp, 0x65c
mov eax, dword [0x67f4f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.0041af50
mov ecx, eax
test ecx, ecx
je 0x44b920
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64c], esi
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0053dd00
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x689748]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x617734
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0041aec0
mov edi, eax
mov dword [ebp - 0x62c], edi
cmp dword [edi], 0
jne 0x44b00a
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x44b180
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x60fe1c
push eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x60fe28
push dword [ecx]
mov dword [ecx + 4], eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x60fe34
push dword [ecx]
mov dword [ecx + 8], eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x60fe44
push dword [ecx]
mov dword [ecx + 0x10], eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x60fe54
push dword [ecx]
mov dword [ecx + 0x14], eax
call edi
mov edi, dword [ebp - 0x62c]
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x44b00a
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x44b180
cmp dword [edi + 4], 0
je 0x44b180
cmp dword [edi + 0xc], 0
je 0x44b180
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0053dd00
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push dword [0x689748]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0041af50
mov ecx, eax
test ecx, ecx
je 0x44b92a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
mov byte [ebp - 4], 1
call fcn.0041af50
mov ecx, eax
test ecx, ecx
je 0x44b934
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x62c]
call fcn.004084e0
test al, al
jne 0x44b0d9
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44b0b7
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x62c]
call fcn.004098e0
lea eax, [ebp - 0x630]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.00419d70
mov edx, dword [ebp - 0x62c]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b115
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov edi, esp
mov dword [ebp - 0x634], esp
call fcn.0041b160
push eax
mov ecx, edi
call fcn.00407f10
push ecx
mov edi, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x62c], edi
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x62c], eax
call fcn.00408620
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 1
call fcn.005d0900
mov edx, dword [ebp - 0x62c]
add esp, 8
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b180
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_class_CInstaller__class_CInstaller___void_.virtual_0], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0x638], 0x44a060
mov dword [ebp - 0x634], ebx
lea eax, [ebp - 0x63c]
mov byte [ebp - 4], 5
push eax
call fcn.0043be40
add esp, 4
mov byte [ebp - 4], 0
call fcn.0043d5a0
mov edi, eax
call fcn.0043d620
mov ecx, eax
call fcn.0043d790
mov ecx, dword [edi]
push dword [eax]
push edi
call dword [ecx + 0x24]
push eax
push str.install_type:_d__install_version:_s
call fcn.00443920
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 6
push eax
call fcn.0043be40
add esp, 0x10
mov byte [ebp - 4], 0
lea edi, [ebx + 4]
push edi
call fcn.0043d620
mov ecx, eax
call fcn.0043d7a0
push eax
call fcn.004591f0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 2
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 7
push eax
call fcn.0043be40
mov edi, dword [edi]
lea ecx, [ebp - 0x640]
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.00459a60
push edi
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 8
call fcn.0045a310
lea ecx, [ebp - 0x640]
call fcn.0045a620
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0
call fcn.00459b70
push str.remove_all_pending_files
call fcn.00443920
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 3
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 9
push eax
call fcn.0043be40
push str..tmp
push dword [ebx + 4]
lea edi, [ebx + 4]
mov byte [ebp - 4], 0
call fcn.004095e0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 4
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xa
push eax
call fcn.0043be40
push dword [edi]
mov byte [ebp - 4], 0
push str.remove_all_.tmp_files_in__s
call fcn.00443920
push str.update
lea eax, [ebp - 0x630]
push edi
push eax
call fcn.00417970
push dword [eax]
mov byte [ebp - 4], 0xb
call fcn.00408c90
mov edx, dword [ebp - 0x630]
or edi, 0xffffffff
add esp, 0x2c
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b374
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.update
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x630]
push eax
call fcn.00417970
push dword [eax]
mov byte [ebp - 4], 0xc
push str.Delete_directory_recursively:__s
call fcn.00443920
mov edx, dword [ebp - 0x630]
add esp, 0x14
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b3bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 5
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xd
push eax
call fcn.0043be40
add esp, 4
mov byte [ebp - 4], 0
mov ecx, ebx
call fcn.00448be0
and eax, 1
mov dword [ebp - 0x62c], eax
jne 0x44b422
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0x64c]
call fcn.00418720
mov esi, dword [ebp - 0x64c]
mov ecx, ebx
call fcn.004490b0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x5d
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xe
push eax
call fcn.0043be40
push dword [ebx + 4]
mov byte [ebp - 4], 0
call fcn.0045d720
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x5e
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xf
push eax
call fcn.0043be40
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.0043d5a0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x64]
test al, 1
je 0x44b4ce
call fcn.004214e0
mov ecx, eax
call fcn.0041e150
mov dword [ebp - 0x630], 1
test eax, eax
je 0x44b4d8
mov dword [ebp - 0x630], 0
call fcn.0043d5a0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x64]
test al, 2
je 0x44b4fd
call fcn.004214e0
mov ecx, eax
call fcn.0041e330
test eax, eax
jne 0x44b4fd
lea edi, [eax + 1]
jmp 0x44b4ff
xor edi, edi
push 0
call fcn.004214e0
mov ecx, eax
call fcn.0041e610
neg eax
sbb eax, eax
inc eax
push eax
call fcn.004214e0
mov ecx, eax
call fcn.0041e430
neg eax
sbb eax, eax
inc eax
push eax
push edi
push dword [ebp - 0x630]
push ecx
mov edi, esp
mov dword [ebp - 0x634], edi
mov eax, dword [ebx + 4]
sub eax, 0x10
push eax
call fcn.00408620
add esp, 4
lea ecx, [ebp - 0x664]
add eax, 0x10
mov dword [edi], eax
call fcn.0043f890
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 0x10
call fcn.004414c0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x60
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x11
push eax
call fcn.0043be40
add esp, 4
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x664]
call fcn.00440a90
call fcn.004214e0
mov ecx, eax
call fcn.0041d730
test eax, eax
jne 0x44b641
lea eax, [ebp - 0x630]
mov ecx, ebx
push eax
call fcn.00449440
push dword [ebp - 0x630]
mov byte [ebp - 4], 0x12
push 0x617eec
push 0x60f11c
push 0x617ef0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.autorun
call fcn.00443920
add esp, 4
lea ecx, [ebp - 0x645]
call fcn.0045b390
push dword [ebx + 4]
lea ecx, [ebp - 0x645]
mov byte [ebp - 4], 0x13
call fcn.0045bdb0
lea ecx, [ebp - 0x645]
call fcn.0045b3a0
mov edx, dword [ebp - 0x630]
or eax, 0xffffffff
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b641
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, ebx
call fcn.0044a120
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x44a070
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x62
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x14
push eax
call fcn.0043be40
add esp, 4
mov byte [ebp - 4], 0x10
mov ecx, ebx
call fcn.00448890
mov ecx, ebx
call fcn.0044c8a0
push 4
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0
push eax
push 4
push str.CertificateRevocation
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x44b6c6
push str.Ban_Check_Certificate_suc
jmp 0x44b6cb
push str.Ban_Check_Certificate_fail
call fcn.00443920
add esp, 4
call fcn.004214e0
mov eax, dword [eax + 0x40]
sub eax, 0x10
push eax
call fcn.00408620
add esp, 4
add eax, 0x10
mov dword [ebp - 0x630], eax
mov ecx, str.__fromnewinstall
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44b71b
test dx, dx
je 0x44b717
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44b71b
add eax, 4
add ecx, 4
test dx, dx
jne 0x44b6f5
xor edi, edi
jmp 0x44b720
sbb edi, edi
or edi, 1
mov edx, dword [ebp - 0x630]
or eax, 0xffffffff
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44b742
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x44b7ac
call fcn.004214e0
mov ecx, eax
call fcn.0041eb50
test al, al
je 0x44b7ac
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0053dd00
add esp, 0xc
lea edi, [ebx + 4]
lea eax, [ebp - 0x218]
push str.UtilsUnstHelper.exe
push dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.run_helper
call fcn.00443920
add esp, 4
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push 0
push 0
push 1
push 1
push 0x6101d0
push eax
call fcn.004574f0
jmp 0x44b7af
lea edi, [ebx + 4]
mov ecx, ebx
call fcn.0044c0a0
test eax, eax
jne 0x44b7d8
push 0x14
push str.write_path_reg_fail
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0x62c], eax
call fcn.00418720
mov esi, dword [ebp - 0x64c]
call fcn.004214e0
mov ecx, eax
call fcn.0041df30
test al, al
je 0x44b82b
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0053dd00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x6181b4
push dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call fcn.00413560
push str.create_dir_log
call fcn.00443920
add esp, 8
push str.install_end.
call fcn.00443920
mov eax, dword [ebp - 0x62c]
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x640], 0x44a040
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], esi
lea eax, [ebp - 0x644]
mov byte [ebp - 4], 0x16
push eax
call fcn.0043be40
push str.real_install_end.
mov byte [ebp - 4], 0x10
call fcn.00443920
lea edi, [ebx + 0x78]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
add esp, 0xc
mov dword [ebp - 0x634], edi
test edi, edi
je 0x44b89e
mov eax, dword [edi]
push edi
call dword [eax]
mov ecx, dword [ebx + 0x68]
mov byte [ebp - 4], 0x17
test ecx, ecx
je 0x44b8af
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
push str.set_install_finish_event
call fcn.00443920
add esp, 4
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [ebp - 4], 0x18
test edi, edi
je 0x44b8d6
mov eax, dword [edi]
push edi
call dword [eax + 4]
lea ecx, [ebp - 0x664]
call fcn.0043fa20
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44b900
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478a88
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004084c0
push 0x80004005
call fcn.004084c0
push 0x80004005
call fcn.004084c0
int3