Function at 0x100078c0
Capabilities:
Check if file exists
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b995
mov eax, dword fs:[0]
push eax
mov eax, 0x16f0
call fcn.1000aeb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x10050ef4
mov dword [ebp - 0x16dc], edi
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x16c0]
call fcn.100077d0
mov eax, dword [ebp - 0x16c0]
push 0
push 0xf003f
push eax
push SysReAllocString
mov dword [ebp - 4], 0
call fcn.1001dc20
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
push 0x100418d4
call ebx
push 0x100418d4
push eax
lea ecx, [ebp - 0x16c0]
call fcn.10002360
mov ecx, 0x10050f14
call fcn.1001b4a0
mov esi, eax
test esi, esi
je 0x10007963
push esi
call ebx
push esi
push eax
lea ecx, [ebp - 0x16c0]
call fcn.10002360
mov ecx, dword [ebp - 0x16c0]
push 0
push 0xf003f
push ecx
push SysReAllocString
call fcn.1001dc20
add esp, 0x10
push 0x13
lea edx, [ebp - 0x80]
push edx
push 1
lea ecx, [ebp - 0x16fc]
mov dword [ebp - 0x80], 0xe6f7f3c9
mov bl, 0xe2
mov dword [ebp - 0x7c], 0xe2aca89b
mov dword [ebp - 0x78], 0xe5adefc3
mov dword [ebp - 0x74], 0xb8ecf4ce
mov word [ebp - 0x70], 0xe8c2
mov byte [ebp - 0x6e], 0xee
call fcn.1001b390
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x286]
push ecx
mov byte [ebp - 4], 1
mov word [ebp - 0x288], ax
call fcn.1000ae30
add esp, 0xc
push 4
add edi, 0x628
push edi
push 4
push str.InstallType
mov ecx, 0x10050e64
call fcn.1001b4a0
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x40
lea edx, [ebp - 0x288]
push edx
push 0x10
call fcn.10028bf0
add esp, 0xc
test eax, eax
je 0x10007aa4
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10007a30
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.Version
mov ecx, 0x10050e64
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10007a70
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x288]
push eax
push 1
push str.DisplayVersion
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x48e]
push edx
mov dword [ebp - 0x16b4], 1
mov word [ebp - 0x490], cx
call fcn.1000ae30
add esp, 0xc
lea eax, [ebp - 0x16b8]
push eax
lea ecx, [ebp - 0x490]
push ecx
lea edx, [ebp - 0x16b4]
push edx
push str.stup.exe
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x16b8], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x490]
push 0x104
push eax
call fcn.1000cb12
lea ecx, [ebp - 0x490]
push str.tencent
push ecx
call fcn.1000b3e6
add esp, 0x10
test eax, eax
je 0x10007b3e
push str.stup.exe
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x36
lea edx, [ebp - 0x48]
push edx
mov al, 0xf9
mov byte [ebp - 0x32], bl
push 4
lea ecx, [ebp - 0x16d4]
mov dword [ebp - 0x48], 0xede0e5f7
mov dword [ebp - 0x44], 0xfcf4ebd3
mov dword [ebp - 0x40], 0xfaefc7f8
mov dword [ebp - 0x3c], 0xf6f5e5d6
mov dword [ebp - 0x38], 0xcedafec2
mov word [ebp - 0x34], 0xe4cd
mov dword [ebp - 0x31], 0xdaf9d3f6
mov dword [ebp - 0x2d], 0xf4f8d1da
mov bl, 0xca
mov dword [ebp - 0x29], 0xd0fecafc
mov dword [ebp - 0x25], 0xeff9d6fc
mov dword [ebp - 0x21], 0xc3d6caf6
mov dword [ebp - 0x1d], 0xd5d6d0e1
mov dword [ebp - 0x19], 0xeffed0fc
mov word [ebp - 0x15], 0xc3f7
mov byte [ebp - 0x13], al
call fcn.1001b390
mov ecx, dword [0x1004223c]
mov eax, dword [0x10042238]
mov edx, dword [0x10042240]
mov dword [ebp - 0x16ac], ecx
mov dword [ebp - 0x16b0], eax
mov eax, dword [0x10042244]
lea ecx, [ebp - 0x16b4]
push ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x16bc], 0
mov dword [ebp - 0x16a8], edx
mov dword [ebp - 0x16a4], eax
call fcn.1001fa30
add esp, 4
mov eax, dword [ebp - 0x16b4]
mov byte [ebp - 4], 3
test eax, eax
jne 0x100081df
xor esi, esi
lea edx, [ebp - 0x16b0]
push edx
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x16bc]
push eax
lea ecx, [ebp - 0x16b0]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x48e]
push eax
mov word [ebp - 0x490], dx
call fcn.1000ae30
mov ecx, dword [ebp - 0x16bc]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x16d4]
call fcn.1001b4a0
push eax
push 0x10041304
lea edx, [ebp - 0x490]
push 0x104
push edx
call fcn.1000c6df
add esp, 0x14
mov eax, 4
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16d8], eax
lea eax, [ebp - 0x16d8]
push eax
lea ecx, [ebp - 0x16b8]
push ecx
lea edx, [ebp - 0x16c4]
push edx
push 0x10041b2c
lea eax, [ebp - 0x490]
push eax
push SysReAllocString
mov dword [ebp - 0x16b8], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor esi, esi
test eax, eax
jne 0x10007d07
cmp dword [ebp - 0x16b8], 1
jne 0x10007d07
push 4
lea ecx, [ebp - 0x16a0]
push ecx
push 4
push 0x10041b2c
lea edx, [ebp - 0x490]
push edx
push SysReAllocString
mov dword [ebp - 0x16a0], esi
call edi
mov eax, dword [ebp - 0x16bc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x16b4]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 2
cmp ecx, dword [0x10050de4]
je 0x10007d49
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10007d49
mov eax, dword [ebp - 0x16b4]
add eax, 0xfffffff4
push eax
call fcn.1000b015
add esp, 4
lea edx, [ebp - 0x16b4]
push edx
push 0x10040998
mov dword [ebp - 0x16b4], esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
push 0x206
lea ecx, [ebp - 0x48e]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x490], ax
call fcn.1000ae30
mov edx, dword [ebp - 0x16b4]
add esp, 0xc
push edx
lea ecx, [ebp - 0x16d4]
call fcn.1001b4a0
push eax
push 0x10041304
lea eax, [ebp - 0x490]
push 0x104
push eax
call fcn.1000c6df
add esp, 0x14
mov eax, 4
lea ecx, [ebp - 0x16a0]
push ecx
lea edx, [ebp - 0x16b8]
push edx
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16a0], eax
lea eax, [ebp - 0x16c4]
push eax
push 0x10041b2c
lea ecx, [ebp - 0x490]
push ecx
push SysReAllocString
mov dword [ebp - 0x16b8], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, esi
jne 0x10007e1f
cmp dword [ebp - 0x16b8], 1
jne 0x10007e1f
push 4
lea edx, [ebp - 0x16d8]
push edx
push 4
push 0x10041b2c
lea eax, [ebp - 0x490]
push eax
push SysReAllocString
mov dword [ebp - 0x16d8], esi
call edi
mov ecx, dword [ebp - 0x16b4]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 1
call fcn.1001b3d0
call fcn.1001d960
test eax, eax
je 0x10008032
push 0x3c
lea edx, [ebp - 0x4c]
push edx
push 0x1a
lea ecx, [ebp - 0x16b0]
mov dword [ebp - 0x4c], 0xdbfacfe9
mov word [ebp - 0x48], 0xc1cd
mov byte [ebp - 0x46], 0xee
mov byte [ebp - 0x45], bl
mov dword [ebp - 0x44], 0xccf5ede6
mov dword [ebp - 0x40], 0xc0efcfc8
mov dword [ebp - 0x3c], 0xf8c0d4dc
mov dword [ebp - 0x38], 0xc0f8ced3
mov dword [ebp - 0x34], 0xecc0d3cd
mov word [ebp - 0x30], 0xd2cf
mov byte [ebp - 0x2e], 0xee
mov byte [ebp - 0x2d], bl
mov word [ebp - 0x2c], 0xd4d4
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x28], 0xc0f5d3c8
mov dword [ebp - 0x24], 0xc0ccfcd4
mov dword [ebp - 0x20], 0xc6ffc9d6
mov dword [ebp - 0x1c], 0xeac0d3df
mov dword [ebp - 0x18], 0xecc0d4c2
mov dword [ebp - 0x14], 0xebd5f3f6
call fcn.1001b390
lea eax, [ebp - 0x16b4]
push eax
mov byte [ebp - 4], 4
call fcn.1001fa30
add esp, 4
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 5
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x16a0]
call fcn.100077d0
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 6
call fcn.1001b4a0
push 4
push 0x10041b28
push 1
push 0
lea ecx, [ebp - 0x16b4]
mov esi, eax
call fcn.100020c0
push eax
push esi
push SysReAllocString
call edi
mov eax, dword [ebp - 0x16a0]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x10050de4]
je 0x10007f5b
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10007f5b
push esi
call fcn.1000b015
add esp, 4
mov eax, dword [ebp - 0x16b4]
lea edx, [eax - 0xc]
mov byte [ebp - 4], 4
cmp edx, dword [0x10050de4]
je 0x10007f90
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10007f90
mov eax, dword [ebp - 0x16b4]
add eax, 0xfffffff4
push eax
call fcn.1000b015
add esp, 4
lea eax, [ebp - 0x16b4]
push eax
push 0x10040998
mov dword [ebp - 0x16b4], 0
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov ecx, dword [ebp - 0x16b4]
push ecx
lea ecx, [ebp - 0x16b8]
call fcn.100077d0
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 7
call fcn.1001b4a0
push 4
push 0x10041b28
push 1
push 0
lea ecx, [ebp - 0x16b8]
mov esi, eax
call fcn.100020c0
push eax
push esi
push SysReAllocString
call edi
mov edx, dword [ebp - 0x16b4]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x16b8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x10050de4]
je 0x10008023
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10008023
push esi
call fcn.1000b015
add esp, 4
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 1
call fcn.1001b3d0
mov esi, dword [ebp - 0x16dc]
mov ecx, esi
call fcn.10005220
mov dword [ebp - 0x3c], 0xede0e5f7
mov dword [ebp - 0x38], 0xfcf4ebd3
mov dword [ebp - 0x34], 0xfaefc7f8
mov dword [ebp - 0x30], 0xf6f5e5d6
mov dword [ebp - 0x2c], 0xd0dafec2
mov byte [ebp - 0x28], bl
mov word [ebp - 0x27], 0xe3fe
mov byte [ebp - 0x25], 0xeb
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], 0xe1b9f2ef
mov dword [ebp - 0x1f], 0xcbf5f6f2
mov dword [ebp - 0x1b], 0xf8ebe3f8
mov word [ebp - 0x17], 0xe7c7
mov byte [ebp - 0x15], 0xf0
mov byte [ebp - 0x14], bl
push 0x29
test eax, eax
je 0x1000832e
lea edx, [ebp - 0x3c]
push edx
push 4
lea ecx, [ebp - 0x16ec]
call fcn.1001b390
push 0xa
lea eax, [ebp - 0x58]
push eax
push 0x3e
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 8
mov dword [ebp - 0x58], 0xa1a1b08d
mov dword [ebp - 0x54], 0xb290e4aa
mov word [ebp - 0x50], 0xa1b9
call fcn.1001b390
push 0x12
lea ecx, [ebp - 0x6c]
push ecx
push 0x19
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 9
mov dword [ebp - 0x6c], 0xdeefebd1
mov dword [ebp - 0x68], 0xc6b4b083
mov dword [ebp - 0x64], 0xdfb5f0d8
mov dword [ebp - 0x60], 0xc1f8b1c8
mov word [ebp - 0x5c], 0xb0d4
call fcn.1001b390
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.10005290
test eax, eax
je 0x10008227
lea ecx, [ebp - 0x16b0]
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x288]
push 0x104
push edx
call fcn.1000c44d
lea eax, [ebp - 0x288]
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008150
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16d4]
mov esi, eax
call fcn.1001b4a0
lea ecx, [esi + esi + 2]
push ecx
lea edx, [ebp - 0x288]
push edx
push 1
push eax
lea ecx, [ebp - 0x16ec]
call fcn.1001b4a0
push eax
push SysReAllocString
call edi
call fcn.1001d960
lea ecx, [ebp - 0x16b0]
test eax, eax
je 0x100081fa
call fcn.1001b4a0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100081a5
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16b0]
mov esi, eax
call fcn.1001b4a0
lea ecx, [esi + esi + 2]
push ecx
push eax
push 1
lea ecx, [ebp - 0x16d4]
call fcn.1001b4a0
push eax
push str.SOFTWAREAppDataLowTencentTBH
jmp 0x100082fe
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x10007c1a
push 0x8007000e
call fcn.10001e60
call fcn.1001b4a0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008202
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16b0]
mov esi, eax
call fcn.1001b4a0
lea edx, [esi + esi + 2]
jmp 0x100082e9
xor eax, eax
push 0xffe
push eax
lea ecx, [ebp - 0x1696]
push ecx
mov word [ebp - 0x1698], ax
call fcn.1000ae30
add esp, 0xc
lea ecx, [ebp - 0x16d4]
mov dword [ebp - 0x16c4], 1
mov dword [ebp - 0x16a0], 0xffe
call fcn.1001b4a0
lea ecx, [ebp - 0x16ec]
mov esi, eax
call fcn.1001b4a0
lea edx, [ebp - 0x16a0]
push edx
lea ecx, [ebp - 0x1698]
push ecx
lea edx, [ebp - 0x16c4]
push edx
push esi
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10008305
call fcn.1001d960
test eax, eax
lea eax, [ebp - 0x1698]
lea edx, [eax + 2]
je 0x100082d0
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100082b0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x1698]
push ecx
jmp 0x100081c7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100082d0
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
lea eax, [ebp - 0x1698]
push edx
push eax
push 1
lea ecx, [ebp - 0x16d4]
call fcn.1001b4a0
push eax
push str.SOFTWARETencentTBH
push SysReAllocString
call edi
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 9
call fcn.1001b3d0
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 8
call fcn.1001b3d0
lea ecx, [ebp - 0x16ec]
jmp 0x10008442
lea ecx, [ebp - 0x3c]
push ecx
push 4
lea ecx, [ebp - 0x16d4]
call fcn.1001b390
push 0xa
lea edx, [ebp - 0x58]
push edx
push 0x3e
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x58], 0xa1a1b08d
mov dword [ebp - 0x54], 0xb290e4aa
mov word [ebp - 0x50], 0xa1b9
call fcn.1001b390
push 0x12
lea eax, [ebp - 0x6c]
push eax
push 0x19
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x6c], 0xdeefebd1
mov dword [ebp - 0x68], 0xc6b4b083
mov dword [ebp - 0x64], 0xdfb5f0d8
mov dword [ebp - 0x60], 0xc1f8b1c8
mov word [ebp - 0x5c], 0xb0d4
call fcn.1001b390
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.10005290
test eax, eax
je 0x1000841e
lea ecx, [ebp - 0x16ec]
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x288]
push 0x104
push ecx
call fcn.1000c44d
lea eax, [ebp - 0x288]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x100083e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100083e0
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16b0]
mov esi, eax
call fcn.1001b4a0
lea edx, [esi + esi + 2]
push edx
lea ecx, [ebp - 0x288]
push ecx
push 1
push eax
lea ecx, [ebp - 0x16d4]
call fcn.1001b4a0
push eax
push SysReAllocString
call edi
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0xc
call fcn.1001b3d0
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 0xb
call fcn.1001b3d0
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 1
call fcn.1001b3d0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x696]
push eax
mov word [ebp - 0x698], dx
call fcn.1000ae30
lea ecx, [ebp - 0x698]
push ecx
push 8
call fcn.10024bf0
add esp, 0x14
push 0x104
lea edx, [ebp - 0x698]
push edx
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push str.Uninstall
lea ecx, [ebp - 0x698]
push ecx
push str.Rundll32.exe__s__s
lea edx, [ebp - 0x288]
push 0x103
push edx
call fcn.1000c37d
lea eax, [ebp - 0x288]
add esp, 0x14
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100084c0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.UninstallString
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x208
lea edx, [ebp - 0x288]
push 0
push edx
call fcn.1000ae30
mov ecx, dword [0x10050e00]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
add esp, 0xc
push 0x208
lea eax, [ebp - 0x288]
push eax
push 0x70
push ecx
call esi
lea eax, [ebp - 0x288]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10008530
sub eax, ecx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x288]
push eax
push 1
push str.DisplayName
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x208
lea ecx, [ebp - 0x288]
push 0
push ecx
call fcn.1000ae30
mov eax, dword [0x10050e00]
add esp, 0xc
push 0x208
lea edx, [ebp - 0x288]
push edx
push 0x71
push eax
call esi
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100085a0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x288]
push edx
push 1
push str.Publisher
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
call fcn.1001d900
test eax, eax
jne 0x10008654
push 0x104
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.msiexec.exe
lea ecx, [ebp - 0x288]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008654
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
jmp 0x10008620
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008620
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.DisplayIcon
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x104
lea ecx, [ebp - 0x16fc]
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
jmp 0x10008680
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008680
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.HelpLink
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
call fcn.1001d960
test eax, eax
je 0x10008927
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x48e]
push eax
mov word [ebp - 0x490], dx
call fcn.1000ae30
add esp, 0xc
lea ecx, [ebp - 0x16bc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x221
push 0x20
push 2
lea edx, [ebp - 0x16a0]
push edx
mov dword [ebp - 0x16bc], 0
mov dword [ebp - 0x16a0], 0
mov word [ebp - 0x169c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10008927
mov ecx, 0x10050e64
call fcn.1001b4a0
push eax
push str.MACHINE_s
lea eax, [ebp - 0x490]
push 0x103
push eax
call fcn.1000c37d
mov ecx, dword [ebp - 0x16bc]
push 0
push 2
push 0xf003f
push 0
push ecx
lea edx, [ebp - 0x490]
push 4
push edx
call fcn.1001e2f0
add esp, 0x2c
test eax, eax
jne 0x10008789
lea eax, [ebp - 0x490]
push eax
push str.AddAceToObjectsSecurityDescriptor__s__FAILED
call fcn.1001aca0
add esp, 8
mov ecx, 0x10050e74
call fcn.1001b4a0
push eax
push str.MACHINE_s
lea ecx, [ebp - 0x490]
push 0x103
push ecx
call fcn.1000c37d
mov edx, dword [ebp - 0x16bc]
push 0
push 2
push 0xf003f
push 0
push edx
lea eax, [ebp - 0x490]
push 4
push eax
call fcn.1001e2f0
add esp, 0x2c
test eax, eax
jne 0x100087e5
lea ecx, [ebp - 0x490]
push ecx
push str.AddAceToObjectsSecurityDescriptor__s__FAILED
call fcn.1001aca0
add esp, 8
mov eax, dword [0x1004223c]
mov edx, dword [0x10042238]
mov ecx, dword [0x10042240]
mov dword [ebp - 0x16ac], eax
mov dword [ebp - 0x16b0], edx
mov edx, dword [0x10042244]
lea eax, [ebp - 0x16b4]
push eax
mov dword [ebp - 0x16a8], ecx
mov dword [ebp - 0x16a4], edx
call fcn.1001fa30
add esp, 4
mov eax, dword [ebp - 0x16b4]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x1000898a
xor esi, esi
lea ecx, [ebp - 0x16b0]
push ecx
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edx, [ebp - 0x16b0]
mov dword [ebp - 0x16d4], edx
mov dword [ebp - 0x16d0], 0x10040978
mov dword [ebp - 0x16cc], 0x10040988
mov dword [ebp - 0x16c8], 0x10040998
xor esi, esi
jmp 0x10008880
mov eax, dword [ebp + esi*4 - 0x16d4]
push eax
call fcn.1001de50
push eax
push str.CLASSES_ROOTCLSID_s
lea ecx, [ebp - 0x490]
push 0x103
push ecx
call fcn.1000c37d
mov edx, dword [ebp - 0x16bc]
push 0
push 2
push 0xf003f
push 0
push edx
lea eax, [ebp - 0x490]
push 4
push eax
call fcn.1001e2f0
add esp, 0x30
test eax, eax
jne 0x100088df
lea ecx, [ebp - 0x490]
push ecx
push str.AddAceToObjectsSecurityDescriptor__s__FAILED
call fcn.1001aca0
add esp, 8
inc esi
cmp esi, 4
jb 0x10008880
mov edx, dword [ebp - 0x16bc]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x16b4]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 1
cmp ecx, dword [0x10050de4]
je 0x10008927
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10008927
mov eax, dword [ebp - 0x16b4]
add eax, 0xfffffff4
push eax
call fcn.1000b015
add esp, 4
mov ecx, dword [ebp - 0x16dc]
call fcn.10005070
lea ecx, [ebp - 0x16fc]
mov byte [ebp - 4], 0
call fcn.1001b3d0
mov eax, dword [ebp - 0x16c0]
lea edx, [eax - 0xc]
cmp edx, dword [0x10050de4]
je 0x10008969
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x10008969
push esi
call fcn.1000b015
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x10008837
push 0x8007000e
call fcn.10001e60
int3