Function at 0x40194e
Capabilities:
Create directory
Create process on windows
Extract resource via kernel32 functions
Get common file path
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x287c
call fcn.00413830
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0x2878], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov eax, edx
push edi
push str._unattended
push eax
mov dword [esp + 0x1c], eax
mov ebx, ecx
xor edi, edi
call esi
test eax, eax
je 0x401a3c
push str._noconsole
push dword [esp + 0x18]
mov dword [0x41d42c], 1
call esi
test eax, eax
jne 0x401a32
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push edi
call fcn.00403f68
pop ecx
push eax
push 0x419e1c
lea eax, [esp + 0x20]
push str.CONIN_
push eax
call fcn.00405cc8
push 1
call fcn.00403f68
add esp, 0x14
mov esi, str.CONOUT_
push eax
push 0x419e28
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00405cc8
push 2
call fcn.00403f68
add esp, 0x14
push eax
push 0x419e28
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00405cc8
add esp, 0x10
mov esi, 0xfde9
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
and dword [0x422438], edi
push str.SC_CryptoProxy_unattended_installation_r_n_r_n
call fcn.004012f0
pop ecx
jmp 0x401a3c
mov dword [0x422438], 1
push ecx
call fcn.004013be
pop ecx
test al, al
je 0x401dfe
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full
push 0x80000002
mov dword [0x41d428], 1
call esi
test eax, eax
je 0x401a97
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREWow6432NodeMicrosoftNET_Framework_SetupNDP_v4Full
push 0x80000002
call esi
test eax, eax
jne 0x401e04
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 4
push eax
xor ecx, ecx
lea eax, [esp + 0x30]
push eax
push ecx
push ecx
push str.Release
push dword [esp + 0x2c]
mov dword [esp + 0x44], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
mov ecx, 0x6040e
test esi, esi
jne 0x401d61
cmp eax, ecx
jb 0x401d61
mov edi, 0x420438
mov esi, 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x401d4a
test eax, eax
je 0x401d4a
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.SCCryptoProxy
push edi
call ebx
call fcn.0040173b
test eax, eax
jne 0x401b25
push 3
jmp 0x401d5b
push 0x2000
push edi
mov edi, 0x41d430
push edi
call fcn.00403920
add esp, 0xc
push str.data
push edi
call ebx
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401b6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401b6c
mov edx, str.Cant_create_directory
mov ecx, edi
call fcn.00401461
push 4
jmp 0x401bb4
push 0xa
pop edi
push edi
push 0xc8
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401b97
mov edx, str.Cant_find_resource
mov ecx, str.FindResource
call fcn.00401461
push 5
jmp 0x401bb4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401bc1
mov edx, str.Cant_load_resource
mov ecx, 0x41a068
call fcn.00401461
push 6
pop esi
call fcn.004017d2
mov eax, esi
jmp 0x401f72
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esp + 0x10]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x420438
mov edx, eax
mov ecx, esi
call fcn.004017ea
mov esi, eax
pop ecx
test esi, esi
je 0x401bf8
call fcn.004017d2
lea eax, [esi + 0x64]
jmp 0x401f72
push edi
push 0xc9
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401c22
mov edx, str.Cant_find_resource
mov ecx, str.FindResource
call fcn.00401461
push 7
pop edi
jmp 0x401c3e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401c4a
mov edx, str.Cant_load_resource
mov ecx, 0x41a068
call fcn.00401461
call fcn.004017d2
mov eax, edi
jmp 0x401f72
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esp + 0x10]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x41d430
mov edx, eax
mov ecx, esi
call fcn.004017ea
mov esi, eax
pop ecx
test esi, esi
je 0x401c84
call fcn.004017d2
lea eax, [esi + 0xc8]
jmp 0x401f72
push 0x44
pop esi
push esi
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00403170
xor eax, eax
mov dword [esp + 0x44], esi
lea edi, [esp + 0x28]
add esp, 0xc
stosd dword es:[edi], eax
mov esi, 0x420438
push 0x2000
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x888]
push eax
call fcn.00403920
add esp, 0xc
lea eax, [esp + 0x880]
push 0x41a084
push eax
call ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x8a4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401d0f
mov edx, str.Cant_start_process
mov ecx, str.CreateProcess
call fcn.00401461
call fcn.004017d2
push 0xc
jmp 0x401d5b
push 0xffffffffffffffff
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x20]
call esi
call fcn.004017d2
mov eax, dword [esp + 0x34]
jmp 0x401f72
mov edx, str.Cant_get_temp_directory
mov ecx, str.GetTempPath
call fcn.00401461
push 2
pop eax
jmp 0x401f72
cmp eax, 0x8234d
jb 0x401d72
mov edi, str.4.8.1
jmp 0x401e04
cmp eax, 0x80ea8
jb 0x401d83
mov edi, 0x41a0ec
jmp 0x401e04
cmp eax, 0x70bf0
jb 0x401d91
mov edi, str.4.7.2
jmp 0x401e04
cmp eax, 0x709fc
jb 0x401d9f
mov edi, str.4.7.1
jmp 0x401e04
cmp eax, 0x707fe
jb 0x401dad
mov edi, 0x41a10c
jmp 0x401e04
cmp eax, 0x60632
jb 0x401dbb
mov edi, str.4.6.2
jmp 0x401e04
cmp eax, ecx
jb 0x401dc6
mov edi, str.4.6.1
jmp 0x401e04
cmp eax, 0x6004f
jb 0x401dd4
mov edi, 0x41a12c
jmp 0x401e04
cmp eax, 0x5cbf5
jb 0x401de2
mov edi, str.4.5.2
jmp 0x401e04
cmp eax, 0x5c733
jb 0x401df0
mov edi, str.4.5.1
jmp 0x401e04
cmp eax, 0x5c615
jb 0x401e04
mov edi, 0x41a14c
jmp 0x401e04
and dword [0x41d428], edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
movzx eax, al
mov ecx, eax
cmp eax, 0x19
je 0x401e68
cmp ecx, 0x23
je 0x401e68
mov esi, 0x400
push esi
push 0x41f438
push 0x3ea
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x41d428], 0
push esi
je 0x401e5c
lea eax, [esp + 0x84]
push eax
push 0x3ec
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test edi, edi
jne 0x401eb9
mov edi, str.no_4.5_or_later_version_detected
jmp 0x401eb9
push 0x41fc38
push 0x3ee
jmp 0x401eb2
mov esi, 0x400
push esi
push 0x41f438
push 0x3e9
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x41d428], 0
push esi
je 0x401ea8
lea eax, [esp + 0x84]
push eax
push 0x3eb
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test edi, edi
jne 0x401eb9
mov edi, 0x41a158
jmp 0x401eb9
push 0x41fc38
push 0x3ed
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x41d428], 0
je 0x401edd
push edi
lea eax, [esp + 0x84]
push eax
push 0x800
push 0x41fc38
call fcn.00401347
add esp, 0x10
cmp dword [0x41d42c], 0
je 0x401f40
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push 0x41fc38
push eax
push 0xfde9
call edi
mov esi, eax
push esi
call fcn.00402184
pop ecx
mov ebx, eax
xor eax, eax
push eax
push eax
push esi
push ebx
push 0xffffffffffffffff
push 0x41fc38
push eax
push 0xfde9
call edi
cmp dword [0x422438], 0
jne 0x401f37
push ebx
push str._S_r_n
call fcn.004012f0
pop ecx
pop ecx
push ebx
call fcn.0040217f
pop ecx
jmp 0x401f6f
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push ebx
call esi
push 0x66
push ebx
mov dword [0x41f430], eax
call esi
push 0
push 0x401f87
push 0
push 0x3ed
push ebx
mov dword [0x41f434], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x2884]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402171
mov esp, ebp
pop ebp
ret