Function at 0x40fdd0
Capabilities:
Check os version
Delete registry key
Delete registry value
Get system information on windows
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a24d
mov eax, dword fs:[0]
push eax
sub esp, 0x5fc
mov eax, dword [0x486850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x17
xor eax, eax
push str.SoftwareAVGAWLSetup_
lea ecx, [ebp - 0x460]
mov byte [edi + 0x504], 0
mov dword [ebp - 0x44c], 7
mov dword [ebp - 0x450], 0
mov word [ebp - 0x460], ax
call fcn.00402900
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x404], 7
mov dword [ebp - 0x408], 0
mov word [ebp - 0x418], ax
push 0x11
push str.SoftwareAVGAWL_
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.00401b20
xor eax, eax
mov dword [ebp - 0x3d4], 7
mov dword [ebp - 0x3d8], 0
mov word [ebp - 0x3e8], ax
push 0x15
push str.SoftwareAVGAWL2014_
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 2
call fcn.00401b20
push 0x11c
lea eax, [ebp - 0x5b8]
push 0
push eax
call fcn.00444380
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x5b8]
push eax
mov dword [ebp - 0x5b8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4103f9
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x5b4]
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x40ff3a
xor ecx, ecx
jmp 0x40ff52
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ff43
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x18]
push eax
mov ecx, esi
call fcn.00401b20
push 1
push 0x46916c
mov ecx, esi
call fcn.00401b20
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x5b0]
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x40ff9c
xor ecx, ecx
jmp 0x40ffb4
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ffa5
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401b20
push 1
push 0x46916c
mov ecx, esi
call fcn.00401b20
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x5ac]
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x40fffb
xor ecx, ecx
jmp 0x410013
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410004
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401b20
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
cmp esi, ebx
je 0x410060
cmp dword [esi + 0x14], 8
jb 0x410045
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410077
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
movzx eax, word [ebp - 0x4a4]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x4100a3
xor ecx, ecx
jmp 0x4100bf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4100b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x78]
push eax
mov ecx, esi
call fcn.00401b20
push 1
push 0x46916c
mov ecx, esi
call fcn.00401b20
movzx eax, word [ebp - 0x4a2]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x41010b
xor ecx, ecx
jmp 0x410123
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410114
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00401b20
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
cmp esi, ebx
je 0x410170
cmp dword [esi + 0x14], 8
jb 0x410155
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410187
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
cmp dword [ebp - 0x5b4], 5
jbe 0x41023f
push str.GetProductInfo
push str.kernel32.dll
mov dword [ebp - 0x5d0], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x410349
lea ecx, [ebp - 0x5d0]
push ecx
movzx ecx, word [ebp - 0x4a2]
push ecx
movzx ecx, word [ebp - 0x4a4]
push ecx
push dword [ebp - 0x5b0]
push dword [ebp - 0x5b4]
call eax
test eax, eax
je 0x410349
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x5d0]
call fcn.0043e4f5
add esp, 0x10
lea eax, [ebp - 0x218]
lea esi, [edi + 0xa8]
push eax
mov ecx, esi
call fcn.00401a00
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
push eax
mov ecx, esi
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
jmp 0x410349
xor eax, eax
cmp byte [ebp - 0x49e], 1
jne 0x41029a
lea esi, [eax + 4]
mov eax, dword [ebp - 0x4a0]
test eax, 0x200
je 0x410261
mov esi, 1
jmp 0x41026a
test al, 0x40
je 0x41026a
mov esi, 8
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x57
call ebx
test eax, eax
je 0x41027f
mov eax, 9
jmp 0x41029a
push 0x56
call ebx
test eax, eax
je 0x41028e
mov eax, 7
jmp 0x41029a
push 0x58
call ebx
neg eax
sbb eax, eax
not eax
and eax, esi
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x4102bf
xor ecx, ecx
jmp 0x4102df
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x4102d0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4102d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0xa8]
push eax
mov ecx, esi
call fcn.00401b20
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
cmp esi, ebx
je 0x410332
cmp dword [esi + 0x14], 8
jb 0x410317
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410349
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
movzx eax, word [ebp - 0x4a0]
push 0xa
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0043e4f5
add esp, 0x10
cmp word [ebp - 0x218], 0
jne 0x410375
xor ecx, ecx
jmp 0x41038f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410380
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0xd8]
push eax
mov ecx, esi
call fcn.00401b20
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
cmp esi, ebx
je 0x4103e2
cmp dword [esi + 0x14], 8
jb 0x4103c7
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x4103f9
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x604], 9
mov edx, 0x4692ac
je 0x41041a
mov edx, 0x468d00
xor eax, eax
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
cmp word [edx], ax
jne 0x410440
xor ecx, ecx
jmp 0x410454
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410445
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3b8]
call fcn.00402900
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x3d0]
push eax
mov byte [ebp - 4], 3
call fcn.0040da90
mov ebx, eax
lea esi, [edi + 0x48]
cmp esi, ebx
je 0x4104ac
cmp dword [esi + 0x14], 8
jb 0x410491
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3bc], 8
jb 0x4104c3
push dword [ebp - 0x3d0]
call fcn.0043d3af
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3a4], 8
mov dword [ebp - 0x3bc], 7
mov dword [ebp - 0x3c0], 0
mov word [ebp - 0x3d0], ax
jb 0x4104f7
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [ebp - 0x434], 7
mov dword [ebp - 0x438], 0
mov word [ebp - 0x448], ax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.0040d990
test al, al
je 0x41059c
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
lea esi, [edi + 0x108]
cmp esi, ebx
je 0x410585
cmp dword [esi + 0x14], 8
jb 0x41056a
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x41059c
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.0040d990
test al, al
je 0x410620
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
lea esi, [edi + 0x138]
cmp esi, ebx
je 0x410609
cmp dword [esi + 0x14], 8
jb 0x4105ee
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410620
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
lea eax, [ebp - 0x3d0]
push eax
call fcn.0040d8d0
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 5
call fcn.0040da90
mov ebx, eax
lea esi, [edi + 0x168]
cmp esi, ebx
je 0x410674
cmp dword [esi + 0x14], 8
jb 0x410659
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x41068b
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x4106c3
push dword [ebp - 0x3d0]
call fcn.0043d3af
add esp, 4
push 0xd
lea ebx, [edi + 0x538]
push 0x4692b0
mov ecx, ebx
call fcn.00402900
push ebx
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
lea esi, [edi + 0x198]
cmp esi, ebx
je 0x41071b
cmp dword [esi + 0x14], 8
jb 0x410700
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410732
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor bl, bl
cmp dword [edi + 0x560], 0
mov byte [ebp - 0x5c5], bl
jne 0x4109e6
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x410762
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4108a0
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5d0]
push eax
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x41088c
cmp dword [ebp - 0x5d0], 1
jne 0x410857
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x410851
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call eax
push esi
lea ecx, [ebp - 0x3b8]
call fcn.00402a00
push eax
lea ecx, [edi + 0x550]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push esi
call fcn.0043d412
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
mov bl, byte [ebp - 0x5c5]
cmp dword [edi + 0x560], 0
je 0x41088c
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
push eax
lea ecx, [edi + 0x1f8]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
mov bl, 1
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x410a1c
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x4108b5
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
jne 0x410a1c
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5d0]
push eax
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x4109d8
cmp dword [ebp - 0x5d0], 1
jne 0x4109a5
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x4109a5
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
push 0
push str.UILanguage
push dword [ebp - 0x5bc]
call eax
push esi
lea ecx, [ebp - 0x3b8]
call fcn.00402a00
push eax
lea ecx, [edi + 0x550]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push esi
call fcn.0043d412
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
cmp dword [edi + 0x560], 0
je 0x4109d8
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
push eax
lea ecx, [edi + 0x1f8]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410a1c
lea eax, [edi + 0x550]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
push eax
lea ecx, [edi + 0x1f8]
call fcn.00401970
cmp dword [ebp - 0x3a4], 8
jb 0x410a1c
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
cmp dword [ebp - 0x44c], 8
mov eax, dword [ebp - 0x460]
jae 0x410a31
lea eax, [ebp - 0x460]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x2001b
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x410ea9
push 0x468378
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 0x5c5], al
call fcn.00402a00
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0
mov byte [ebp - 4], 6
push 0x468378
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5d0], 0x80
call esi
test eax, eax
jne 0x410afc
cmp dword [ebp - 0x5e0], 1
jne 0x410afc
mov eax, dword [ebp - 0x5d0]
test eax, eax
je 0x410afc
shr eax, 1
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x2a0]
push 0x41
push eax
call fcn.0043ef71
add esp, 0x10
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
test eax, eax
setns bl
mov byte [ebp - 0x5c5], bl
test bl, bl
jne 0x410e09
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.TUU2011
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x410c0d
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5d4], eax
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5d4]
push eax
push 0
push 0x468378
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x410d6b
cmp dword [ebp - 0x5d4], 1
jne 0x410d6b
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x410d6b
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x468378
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x410d62
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0
push ebx
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5cc], 0x80
call esi
test eax, eax
jne 0x410d62
cmp dword [ebp - 0x5d8], 1
jne 0x410d62
mov eax, dword [ebp - 0x5cc]
jmp 0x410d11
lea eax, [ebp - 0x5c0]
push eax
push 0x20019
push 0
push str.TUU2010
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x410d77
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0x468378
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x410d6b
cmp dword [ebp - 0x5cc], 1
jne 0x410d6b
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x410d6b
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x468378
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x410d62
lea eax, [ebp - 0x5d4]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0
push ebx
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5d4], 0x80
call esi
test eax, eax
jne 0x410d62
cmp dword [ebp - 0x5d8], 1
jne 0x410d62
mov eax, dword [ebp - 0x5d4]
test eax, eax
je 0x410d62
shr eax, 1
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x2a0]
push 0x41
push eax
call fcn.0043ef71
add esp, 0x10
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2a0]
push eax
mov eax, dword [sym.imp.ole32.dll_IIDFromString]
call eax
test eax, eax
js 0x410d62
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 0x5c5], 1
call fcn.004019b0
push ebx
call fcn.0043d412
add esp, 4
push dword [ebp - 0x5c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3a8], 0
je 0x410dfc
mov esi, dword [ebp - 0x3a4]
mov edx, dword [ebp - 0x3b8]
mov ecx, edx
cmp esi, 8
jae 0x410d9d
lea ecx, [ebp - 0x3b8]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410da0
sub ecx, ebx
sar ecx, 1
cmp esi, 8
jae 0x410dba
lea edx, [ebp - 0x3b8]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x468378
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x410dfc
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.TUU2011
push dword [ebp - 0x5bc]
call esi
push str.TUU2010
push dword [ebp - 0x5bc]
call esi
cmp byte [ebp - 0x5c5], 0
je 0x410e82
rol word [ebp - 0x3f4], 8
mov ecx, dword [ebp - 0x3f8]
mov edx, ecx
rol word [ebp - 0x3f2], 8
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebp - 0x3f8], edx
push 0x10
lea edx, [ebp - 0x3f8]
lea ecx, [ebp - 0x3d0]
call fcn.0040dbd0
add esp, 4
lea ecx, [edi + 0x258]
push eax
call fcn.00401970
cmp dword [ebp - 0x3bc], 8
jb 0x410e82
push dword [ebp - 0x3d0]
call fcn.0043d3af
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3a4], 8
jb 0x410ea9
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
push str.AWL2014
lea ecx, [ebp - 0x3b8]
call fcn.00402a00
mov ebx, eax
lea esi, [edi + 0x288]
cmp esi, ebx
je 0x410ef0
cmp dword [esi + 0x14], 8
jb 0x410ed5
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410f07
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
mov ecx, esi
call fcn.0040b950
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
mov ebx, eax
cmp esi, ebx
je 0x410f4c
cmp dword [esi + 0x14], 8
jb 0x410f31
push dword [esi]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push ebx
mov ecx, esi
mov word [esi], ax
call fcn.004022d0
cmp dword [ebp - 0x3a4], 8
jb 0x410f63
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
lea eax, [ebp - 0x3d0]
push eax
call fcn.0040e450
mov byte [ebp - 4], 7
cmp dword [ebp - 0x3bc], 8
mov eax, dword [ebp - 0x3d0]
jae 0x410f88
lea eax, [ebp - 0x3d0]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x468378
push str.TUAppMode
push str.VersionInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x41102c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x400]
call fcn.00402a00
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 8
call fcn.0040da90
push eax
lea ecx, [edi + 0x2b8]
call fcn.00401970
cmp dword [ebp - 0x3a4], 8
jb 0x410ff8
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
xor eax, eax
cmp dword [ebp - 0x3ec], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x41102c
push dword [ebp - 0x400]
call fcn.0043d3af
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
jb 0x411047
push dword [ebp - 0x3d0]
call fcn.0043d3af
add esp, 4
cmp dword [edi + 0x530], 0
jne 0x4113ae
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x411069
lea eax, [ebp - 0x3e8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x4111f3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x411122
cmp dword [ebp - 0x5c4], 1
jne 0x4111e1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x4111e1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.CurSID
jmp 0x4111a4
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push 0x469340
push dword [ebp - 0x5bc]
call ebx
test eax, eax
jne 0x4111e1
cmp dword [ebp - 0x5c4], 1
jne 0x4111e1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x4111e1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push 0x469340
push dword [ebp - 0x5bc]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call eax
test eax, eax
jne 0x4111d8
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.00402a00
push eax
lea ecx, [edi + 0x520]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push ebx
call fcn.0043d412
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [edi + 0x530], 0
jne 0x4113ae
lea eax, [ebp - 0x5bc]
push eax
push 0x2001f
push 0
push str.SoftwareAVGAWL_
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x4113ae
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4112f0
cmp dword [ebp - 0x5cc], 1
jne 0x4112f0
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x4112f0
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4112e7
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.00402a00
push eax
lea ecx, [edi + 0x520]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push ebx
call fcn.0043d412
add esp, 4
cmp dword [edi + 0x530], 0
je 0x411391
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x411312
lea eax, [ebp - 0x3e8]
push 0
lea ecx, [ebp - 0x5d4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x411391
cmp dword [edi + 0x534], 8
lea edx, [edi + 0x520]
jb 0x41134b
mov ecx, dword [edx]
jmp 0x41134d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411350
sub ecx, esi
sar ecx, 1
cmp dword [edx + 0x14], 8
jb 0x411367
mov edx, dword [edx]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.CurSID
push dword [ebp - 0x5d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.CurSID
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3d0]
call fcn.00402a00
lea ecx, [edi + 0x520]
push ecx
mov edx, eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 9
call fcn.00401e00
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4113e1
mov eax, dword [eax]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
sete bl
cmp dword [ebp - 0x3a4], 8
jb 0x411418
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x411450
push dword [ebp - 0x3d0]
call fcn.0043d3af
add esp, 4
test bl, bl
je 0x411879
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.Download
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41154e
cmp dword [ebp - 0x5c0], 1
jne 0x41154e
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41154e
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.Download
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411545
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.00402a00
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xa
call fcn.0040da90
push eax
lea ecx, [edi + 0x3a8]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.004023c0
push ebx
call fcn.0043d412
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.Install
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411644
cmp dword [ebp - 0x5c0], 1
jne 0x411644
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x411644
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.Install
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41163b
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.00402a00
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xb
call fcn.0040da90
push eax
lea ecx, [edi + 0x378]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.004023c0
push ebx
call fcn.0043d412
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push str.tbar
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411777
cmp dword [ebp - 0x5c0], 1
jne 0x411777
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x411777
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push str.tbar
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41176e
push ebx
lea ecx, [ebp - 0x3b8]
call fcn.00402a00
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x3a8], 0
je 0x41175f
lea edx, [ebp - 0x3b8]
lea ecx, [ebp - 0x400]
call fcn.0040b9a0
mov byte [ebp - 4], 0xd
push dword [ebp - 0x3a8]
mov ecx, eax
call fcn.00416e70
mov edx, eax
lea ecx, [ebp - 0x3d0]
call fcn.0040dbd0
add esp, 4
lea ecx, [edi + 0x438]
push eax
call fcn.00401970
lea ecx, [ebp - 0x3d0]
call fcn.004023c0
lea ecx, [ebp - 0x400]
call fcn.00416f50
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 4
call fcn.004023c0
push ebx
call fcn.0043d412
add esp, 4
lea eax, [ebp - 0x5c4]
push eax
push 0
lea eax, [ebp - 0x5c0]
push eax
push 0
push 0x468d70
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5c4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41186d
cmp dword [ebp - 0x5c0], 1
jne 0x41186d
mov esi, dword [ebp - 0x5c4]
test esi, esi
je 0x41186d
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c4]
push eax
push ebx
push 0
push 0
push 0x468d70
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411864
push ebx
lea ecx, [ebp - 0x3d0]
call fcn.00402a00
push eax
lea eax, [ebp - 0x3b8]
push eax
mov byte [ebp - 4], 0xe
call fcn.0040da90
push eax
lea ecx, [edi + 0x498]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 4
call fcn.004023c0
push ebx
call fcn.0043d412
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x404], 8
mov eax, dword [ebp - 0x418]
jae 0x41188e
lea eax, [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x4118e1
cmp dword [ebp - 0x404], 8
mov eax, dword [ebp - 0x418]
jae 0x4118c3
lea eax, [ebp - 0x418]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x411a32
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.RegistrationMail
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411a26
cmp dword [ebp - 0x5cc], 1
jne 0x411a26
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x411a20
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov esi, eax
push 0
push esi
mov dword [ebp - 0x5d0], esi
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push esi
push 0
push 0
push str.RegistrationMail
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411a17
push eax
push eax
push eax
push eax
push ebx
push esi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x5d4], eax
test eax, eax
jle 0x411a17
push eax
call fcn.0043c839
add esp, 4
mov esi, eax
push 0
push 0
push dword [ebp - 0x5d4]
push esi
push ebx
push dword [ebp - 0x5d0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x5d4]
mov edx, esi
lea ecx, [ebp - 0x3b8]
call fcn.0040dbd0
add esp, 4
lea ecx, [edi + 0x3d8]
push eax
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push esi
call fcn.0043d412
mov esi, dword [ebp - 0x5d0]
add esp, 4
push esi
call fcn.0043d412
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x411a47
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x411aa5
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x411a76
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x411aa5
push 0x468378
lea ecx, [edi + 0x568]
call fcn.004019b0
jmp 0x411bed
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.ProductKey
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411be1
cmp dword [ebp - 0x5cc], 1
jne 0x411be1
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x411be1
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.ProductKey
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411bd2
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402a00
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040dfb0
push eax
lea ecx, [edi + 0x228]
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
push ebx
lea ecx, [edi + 0x568]
call fcn.004019b0
cmp dword [edi + 0x578], 0x23
jne 0x411bd2
push 0x1f
push 0
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [edi + 0x568]
call fcn.00403970
mov ecx, eax
mov byte [ebp - 4], 0xf
call fcn.004022c0
push eax
lea ecx, [edi + 0x568]
call fcn.004019b0
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 4
call fcn.004023c0
push ebx
call fcn.0043d412
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
lea esi, [edi + 0x2e8]
push 0x469378
mov ecx, esi
call fcn.00402900
push 7
push str.AWL2014
mov ecx, esi
call fcn.00401b20
mov ecx, esi
call fcn.0040b950
push 0x469380
lea ecx, [ebp - 0x430]
call fcn.00402a00
mov byte [ebp - 4], 0x10
cmp byte [edi + 0x598], 0
je 0x411c4a
push 2
push 0x469388
lea ecx, [ebp - 0x430]
call fcn.00402900
jmp 0x411dc0
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x411c5f
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x411cbd
cmp dword [ebp - 0x3d4], 8
mov eax, dword [ebp - 0x3e8]
jae 0x411c8e
lea eax, [ebp - 0x3e8]
lea ecx, [ebp - 0x5bc]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x411cbd
push 0x469380
lea ecx, [ebp - 0x430]
call fcn.004019b0
jmp 0x411dc0
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.PKStatus
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411d94
cmp dword [ebp - 0x5cc], 1
jne 0x411db4
mov ebx, dword [ebp - 0x5c0]
test ebx, ebx
je 0x411db4
shr ebx, 1
inc ebx
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [ebx + ebx]
push ecx
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x5d8], eax
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.PKStatus
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411d89
push ebx
lea ecx, [ebp - 0x430]
call fcn.004019b0
push 0x4693a4
lea ecx, [ebp - 0x430]
call fcn.00401a00
push ebx
call fcn.0043d412
add esp, 4
jmp 0x411db4
cmp dword [edi + 0x578], 0
lea ecx, [ebp - 0x430]
je 0x411daa
push 0x4693a8
jmp 0x411daf
push 0x4693b0
call fcn.004019b0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00401cf0
cmp dword [edi + 0x560], 0
je 0x411e3e
cmp dword [edi + 0x564], 8
lea ebx, [edi + 0x550]
jb 0x411dee
mov eax, dword [ebx]
jmp 0x411df0
mov eax, ebx
mov ecx, str.silent
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411e1b
test dx, dx
je 0x411e17
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411e1b
add eax, 4
add ecx, 4
test dx, dx
jne 0x411df5
xor eax, eax
jmp 0x411e20
sbb eax, eax
or eax, 1
test eax, eax
je 0x411e3e
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00401cf0
push 0x4693a4
mov ecx, esi
call fcn.00401a00
jmp 0x411e4c
push 6
push str.xx_xx_
mov ecx, esi
call fcn.00401b20
push 0xffffffffffffffff
push 0
lea ebx, [edi + 0x520]
push ebx
mov ecx, esi
call fcn.00401cf0
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3d0]
call fcn.00402a00
push ebx
mov edx, eax
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x11
call fcn.00401e00
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x411e8b
mov eax, dword [eax]
lea ecx, [ebp - 0x5bc]
push ecx
push 0xf003f
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
sete bl
cmp dword [ebp - 0x3a4], 8
jb 0x411ec2
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x3bc], 8
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], 0
mov word [ebp - 0x3b8], ax
jb 0x411efa
push dword [ebp - 0x3d0]
call fcn.0043d3af
add esp, 4
test bl, bl
je 0x411f55
cmp dword [esi + 0x14], 8
jb 0x411f08
mov ecx, dword [esi]
jmp 0x411f0a
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411f10
sub ecx, edx
sar ecx, 1
cmp dword [esi + 0x14], 8
jb 0x411f29
mov edx, dword [esi]
jmp 0x411f2b
mov edx, esi
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.x_sid
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.0040b950
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
push eax
mov ecx, esi
call fcn.00401970
cmp dword [ebp - 0x3a4], 8
jb 0x411f88
push dword [ebp - 0x3b8]
call fcn.0043d3af
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5bc]
push eax
push 0x20019
push 0
push str.SoftwareAVGAWLSIDData_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4122f4
xor ebx, ebx
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], 0x104
mov dword [ebp - 0x3a4], 7
mov dword [ebp - 0x3a8], ebx
mov word [ebp - 0x3b8], ax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
mov byte [ebp - 4], 0x12
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x412276
jmp 0x412010
push 0x19
push str.SoftwareAVGAWLSIDData_
lea ecx, [ebp - 0x3b8]
call fcn.00402900
cmp word [ebp - 0x218], 0
jne 0x412030
xor ecx, ecx
jmp 0x41204f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412040
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00401b20
cmp dword [ebp - 0x3a4], 8
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5cc], 0
jae 0x41208b
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x5c4]
push ecx
push 0xf003f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x412224
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0
push str.x_sid
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41216f
cmp dword [ebp - 0x5cc], 1
jne 0x412212
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x412212
shr esi, 1
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043c839
add esp, 4
lea ecx, [esi + esi]
push ecx
mov ebx, eax
push 0
push ebx
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
push ebx
push 0
push 0
push str.x_sid
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41215b
push ebx
lea ecx, [edi + 0x348]
call fcn.00401a00
push 0x4693d8
lea ecx, [edi + 0x348]
call fcn.00401a00
push ebx
call fcn.0043d412
mov ebx, dword [ebp - 0x5d4]
add esp, 4
jmp 0x412212
cmp eax, 2
jne 0x412212
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x3d0]
call fcn.00402a00
push 0
push 0x4693dc
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x13
call fcn.00412800
cmp eax, 0xffffffff
je 0x4121cb
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3d0]
push eax
lea ecx, [edi + 0x348]
call fcn.00401cf0
push 0x4693d8
lea ecx, [edi + 0x348]
call fcn.00401a00
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x3bc]
cmp eax, 8
jb 0x4121fb
inc eax
push eax
push dword [ebp - 0x3d0]
lea eax, [ebp - 0x5c5]
push eax
lea ecx, [ebp - 0x3d0]
call fcn.004027b0
mov ecx, eax
call fcn.00402780
push 0
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 0x3bc], 7
call fcn.004028d0
push dword [ebp - 0x5c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x208
lea eax, [ebp - 0x218]
push 0
inc ebx
push eax
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], 0x104
call fcn.00444380
add esp, 0xc
lea eax, [ebp - 0x5d0]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x412010
lea esi, [edi + 0x348]
mov ecx, esi
call fcn.00401b10
test al, al
jne 0x4122d3
lea eax, [ebp - 0x5d8]
push eax
mov ecx, esi
call fcn.00402290
mov ecx, eax
call fcn.00412850
push dword [eax]
lea eax, [ebp - 0x5e0]
push eax
mov ecx, esi
call fcn.004127c0
mov ecx, esi
call fcn.0040b950
push esi
lea eax, [ebp - 0x3d0]
push eax
call fcn.0040da90
push eax
mov ecx, esi
call fcn.00401970
lea ecx, [ebp - 0x3d0]
call fcn.004023c0
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3b8]
mov byte [ebp - 4], 0x10
call fcn.004023c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ecx
push 0
push ecx
lea ecx, [edi + 0x580]
call fcn.004022c0
push eax
lea ecx, [edi + 0x538]
call fcn.004022c0
push eax
lea ecx, [ebp - 0x494]
call fcn.00401270
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 0x14
call fcn.00401730
lea ebx, [edi + 0x468]
push eax
mov ecx, ebx
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
mov ecx, ebx
call fcn.00401b10
test al, al
jne 0x412410
mov edx, ebx
lea ecx, [ebp - 0x3d0]
call fcn.0040b9a0
mov esi, eax
mov ecx, ebx
mov byte [ebp - 4], 0x15
call fcn.004023f0
push eax
mov ecx, esi
call fcn.00416e70
mov edx, eax
lea ecx, [ebp - 0x3b8]
call fcn.0040dbd0
add esp, 4
mov ecx, ebx
push eax
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 0x14
call fcn.00416f50
lea eax, [ebp - 0x5bc]
push eax
push 0x2001b
push 0
lea ecx, [ebp - 0x3e8]
call fcn.004022c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x412410
mov ecx, ebx
call fcn.004023f0
lea eax, [eax*2 + 2]
push eax
mov ecx, ebx
call fcn.004022c0
push eax
push 1
push 0
push 0x4693f4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5bc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x3e8]
call fcn.004022c0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4125c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push str.CurRIT
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x412519
cmp dword [ebp - 0x5c4], 4
jne 0x412519
cmp dword [ebp - 0x5c0], eax
jbe 0x412519
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0
push str.CurRIT
push dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 4
call esi
test eax, eax
jne 0x412519
push ecx
mov ecx, dword [ebp - 0x5cc]
lea edx, [ebp - 0x3cc]
call fcn.00412e20
add esp, 4
lea esi, [edi + 0x408]
push str.tcp2_
mov ecx, esi
call fcn.00401a00
lea eax, [ebp - 0x3cc]
push eax
mov ecx, esi
call fcn.00401a00
push esi
lea eax, [ebp - 0x3b8]
push eax
call fcn.0040da90
push eax
mov ecx, esi
call fcn.00401970
lea ecx, [ebp - 0x3b8]
call fcn.004023c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, ebx
call fcn.00401b10
test al, al
je 0x4125b4
lea eax, [ebp - 0x5c0]
push eax
push 0
lea eax, [ebp - 0x5c4]
push eax
push 0
push 0x4693f4
push dword [ebp - 0x5bc]
call esi
test eax, eax
jne 0x4125b4
cmp dword [ebp - 0x5c4], 1
jne 0x4125b4
mov eax, dword [ebp - 0x5c0]
test eax, eax
je 0x4125b4
push eax
lea ecx, [ebp - 0x5dc]
call fcn.004128d0
push ecx
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x16
call fcn.00412930
mov esi, eax
lea eax, [ebp - 0x5c0]
push eax
push esi
push 0
push 0
push 0x4693f4
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4125a5
push esi
mov ecx, ebx
call fcn.004019b0
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0x14
call fcn.00412900
push dword [ebp - 0x5bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.0040ec00
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 0x10
call fcn.00401300
lea ecx, [ebp - 0x430]
call fcn.004023c0
lea ecx, [ebp - 0x448]
call fcn.004023c0
lea ecx, [ebp - 0x3e8]
call fcn.004023c0
lea ecx, [ebp - 0x418]
call fcn.004023c0
lea ecx, [ebp - 0x460]
call fcn.004023c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d3b4
mov esp, ebp
pop ebp
ret