Function at 0x41f700
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry value
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x13a0]
mov eax, 0x13a0
call fcn.005f9ca0
push 0xffffffffffffffff
push 0x61c884
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x139c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00449a50
call fcn.00447040
mov ecx, ebx
call fcn.00418640
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xc8], 0x400
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp + 0xf5c]
push ecx
push edi
push edi
push str.szCustomUserAgent
mov edx, dword [0x70f604]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x41f7b5
lea eax, [ebp + 0xf5c]
push eax
push 0x64edec
push 0x7110cc
call fcn.00402f60
add esp, 0xc
mov ecx, ebx
call fcn.0041c440
mov ecx, ebx
call fcn.00410060
cmp dword [0x70f5f4], edi
jne 0x41f886
mov dword [ebp - 0x30], 0x40
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp + 0x135c]
push edx
push 0
push 0
push str.idmvers
mov eax, dword [0x70f604]
push eax
call esi
test eax, eax
jne 0x41f87c
mov edx, dword [0x70f7b4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f805
sub eax, esi
push eax
push edx
lea ecx, [ebp + 0x135c]
push ecx
call fcn.005f9ccb
add esp, 0xc
test eax, eax
je 0x41f83c
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41f83c
cmp byte [eax + 0x51], 0
jne 0x41f83c
mov dword [0x70f5f4], 1
push 8
push str.v6.35b09
lea edx, [ebp + 0x135c]
push edx
call fcn.005fd020
add esp, 0xc
test eax, eax
je 0x41f870
push 8
push str.v6.35b10
lea eax, [ebp + 0x135c]
push eax
call fcn.005fd020
add esp, 0xc
test eax, eax
jne 0x41f886
mov dword [0x70f5f8], 1
jmp 0x41f886
mov dword [0x70f5f4], 1
cmp dword [0x70f5e0], edi
je 0x41f8af
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41f8a5
cmp byte [eax + 0x51], 0
jne 0x41f8a5
cmp dword [0x70f5f4], edi
je 0x41f8af
call fcn.00414b10
call fcn.004104b0
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41f8c6
cmp byte [eax + 0x51], 0
jne 0x41f8c6
cmp dword [0x70f5f4], edi
je 0x41f8d7
push 1
call fcn.00464310
push 0
call fcn.0046a2f0
add esp, 8
call fcn.0041b830
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp + 0xe98], 0x94
lea ecx, [ebp + 0xe98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41f93e
cmp dword [ebp + 0xea8], 2
jne 0x41f93e
mov esi, 1
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0xe9c], 6
jb 0x41f93e
mov dword [ebp - 0x28], esi
push 0x80000001
call fcn.00412b50
push 0x80000002
call fcn.00412b50
add esp, 8
mov dword [ebp - 0x40], 4
test esi, esi
je 0x41fa8b
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push str.EnableDriver
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f978
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], edx
mov esi, 1
mov dword [ebp - 0xb4], esi
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push 0
push 0x64ed98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f9e1
mov dword [ebp - 0x40], 4
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push str.AdvIntDriverEnabled2
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f9d7
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xb4], esi
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x1c], ebx
jne 0x41fa41
mov dword [ebp - 0x40], 4
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push str.bVistaAdvInt
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x14]
test eax, eax
je 0x41fa3e
mov eax, 1
mov dword [edx + 0x1c], eax
mov dword [ebp - 0x4c], eax
push 4
lea eax, [ebp - 0x4c]
push eax
push 4
push 0
push str.bVistaAdvInt
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x41fa41
mov dword [edx + 0x1c], esi
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x1c], ebx
je 0x41fa8b
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00410670
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x38], edi
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
sete bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], 1
push 4
lea edx, [ebp - 0x58]
push edx
push 4
push 0
push str.EnableDriver
mov eax, dword [0x70f604]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41faaa
cmp byte [eax + 0x51], 0
jne 0x41fab9
cmp dword [0x70f5f4], 0
je 0x41fb39
cmp byte [eax + 0x51], 0
jne 0x41fab9
cmp dword [0x70f5f4], 0
je 0x41faf3
lea ecx, [ebp - 0x18]
call fcn.004f03c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004f0420
test eax, eax
je 0x41fae7
lea ecx, [ebp - 0x18]
call fcn.004f03e0
test eax, eax
jne 0x41fae7
push 1
lea ecx, [ebp - 0x18]
call fcn.004f09f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004f03d0
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.DebugFlags
mov eax, dword [0x70f604]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fb39
mov dword [ebp - 0x1c], eax
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 4
push eax
push str.DebugFlags
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x41fd6a
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x18]
call fcn.004f03c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004f0420
test eax, eax
jne 0x41fcd5
xor edi, edi
cmp dword [0x70f5ec], edi
jne 0x41fb87
push edi
lea ecx, [ebp - 0x18]
call fcn.004f09f0
lea ecx, [ebp - 0x18]
call fcn.004f0560
lea ecx, [ebp - 0x18]
call fcn.004f0510
mov dword [ebp - 0x20], edi
mov dword [ebp + 0xf2c], edi
mov dword [ebp + 0xf34], edi
xor eax, eax
mov word [ebp + 0xf30], ax
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041e510
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp + 0xf2c]
push edx
mov ecx, esi
call fcn.00413ac0
test eax, eax
je 0x41fc67
mov ebx, dword [ebp - 0x20]
cmp ebx, 1
je 0x41fc67
xor esi, esi
mov dword [ebp - 0xc0], esi
mov eax, dword [ebp - 0x14]
cmp esi, dword [eax + 0x28]
jge 0x41fc67
mov edi, eax
add edi, 0x20
push esi
mov ecx, edi
call fcn.00453680
mov ecx, dword [eax]
cmp ebx, dword [ecx + 8]
jne 0x41fccf
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
push esi
mov ecx, edi
call fcn.00453680
mov eax, dword [eax]
add eax, 0x14
cmp ebx, dword [eax + 8]
jge 0x41fc67
mov eax, dword [ebp + 0xf2c]
test eax, eax
je 0x41fc25
mov dword [ebp - 0x1c], eax
jmp 0x41fc2e
lea edx, [ebp + 0xf30]
mov dword [ebp - 0x1c], edx
push esi
mov ecx, edi
call fcn.00453680
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d090
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
push ecx
push eax
call fcn.005fdd2a
add esp, 8
test eax, eax
jne 0x41fcc9
push esi
mov ecx, edi
call fcn.00453680
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d090
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], eax
jne 0x41fc9b
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], eax
mov dword [ebp - 0xbc], eax
push 4
lea ecx, [ebp - 0xbc]
push ecx
push 4
push eax
push str.AdvancedIntegration
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0041f010
mov dword [0x70f444], 1
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xf2c]
call fcn.004011f0
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x70]
jmp 0x41fd5b
inc ebx
jmp 0x41fbfe
inc esi
jmp 0x41fbd2
cmp dword [ebp - 0x28], 0
je 0x41fd5e
call fcn.00506490
mov esi, eax
test esi, esi
je 0x41fd5b
mov dword [ebp - 0xc4], 4
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push str.StEnableBFEMsg
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41fd51
mov dword [ebp - 0x3c], 1
push 4
lea eax, [ebp - 0x3c]
push eax
push 4
push 0
push str.StEnableBFEMsg
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
push 0
push esi
push 0x411760
call fcn.005db08e
jmp 0x41fd5b
xor ebx, ebx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004f03d0
cmp dword [esi + 0x1c], 0
je 0x420121
test ebx, ebx
je 0x420101
xor esi, esi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x34], esi
je 0x4200cc
push esi
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041a620
cmp dword [ebp - 0x28], esi
jne 0x41fdd6
push 1
mov ecx, ebx
call fcn.0041a140
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [0x70f440], 1
mov ecx, ebx
test edi, edi
je 0x41fdc7
call fcn.004167d0
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x4200c8
call fcn.004105b0
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x4200c8
mov dword [ebp + 0xf50], esi
mov dword [ebp + 0xf58], esi
xor edx, edx
mov word [ebp + 0xf54], dx
mov byte [ebp - 4], 4
mov eax, dword [0x70f66c]
cmp eax, esi
jne 0x41fdfd
mov eax, 0x70f670
push esi
push str.Uninstall.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xf50]
call fcn.00402300
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x41feee
cmp dword [0x70f5f4], esi
jne 0x41feee
cmp byte [eax + 0x29], 0
je 0x41feee
mov edi, 1
mov dword [ebx + 0x4c], edi
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebx + 4]
call fcn.0040db20
test eax, eax
je 0x4200b1
push 0x3c
push esi
lea edx, [ebp - 0xb0]
push edx
call fcn.005f8cb0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf50]
cmp eax, esi
jne 0x41fe97
lea eax, [ebp + 0xf54]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41fee6
push 0xffffffffffffffff
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], edi
jmp 0x4200b1
push 0x3c
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.005f8cb0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf50]
cmp eax, esi
je 0x41ff30
mov dword [ebp - 0xa0], eax
jmp 0x41ff3c
lea ecx, [ebp + 0xf54]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], 0x6527a4
mov eax, dword [ebp + 0xf50]
cmp eax, esi
jne 0x41ff7a
lea eax, [ebp + 0xf54]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4200b1
mov eax, dword [ebp + 0xf50]
cmp eax, esi
jne 0x41ff9a
lea eax, [ebp + 0xf54]
push esi
push eax
mov ecx, ebx
call fcn.004166a0
test al, al
je 0x4200b1
lea edx, [ebp - 0xb0]
push edx
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call esi
test eax, eax
je 0x4200ab
mov dword [ebp - 0x54], 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41ffef
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov dword [0x70f440], 1
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040db20
test eax, eax
je 0x4200b1
push 0x3c
push 0
lea eax, [ebp - 0xb0]
push eax
call fcn.005f8cb0
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf50]
test eax, eax
je 0x420057
mov dword [ebp - 0xa0], eax
jmp 0x420063
lea ecx, [ebp + 0xf54]
mov dword [ebp - 0xa0], ecx
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], eax
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea edx, [ebp - 0xb0]
push edx
call esi
test eax, eax
je 0x4200a2
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call ebx
mov dword [ebp - 0x44], 1
jmp 0x4200b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x38], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf50]
call fcn.004011f0
mov esi, dword [ebp - 0x54]
test esi, esi
jne 0x4200d3
mov dword [ebp - 0x24], 0
xor ecx, ecx
test esi, esi
setne cl
mov dword [ebp - 0xcc], ecx
push 4
lea edx, [ebp - 0xcc]
push edx
push 4
push 0
push str.lastintres
mov eax, dword [0x70f604]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x34], 0
je 0x420121
test edi, edi
je 0x420114
mov ecx, esi
call fcn.004167d0
jmp 0x420121
cmp dword [ebp - 0x28], 0
jne 0x420121
mov ecx, esi
call fcn.004105b0
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420139
cmp byte [eax + 0x51], 0
jne 0x420139
cmp dword [0x70f5f4], 0
je 0x420140
mov ecx, esi
call fcn.0041c9d0
cmp dword [ebp - 0x34], 0
je 0x42014f
mov dword [ebp - 0x24], 0
jmp 0x420155
cmp dword [ebp - 0x24], 0
jne 0x4201a1
mov dword [ebp - 0x74], 4
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x3c]
push edx
push 0
push 0
push str.NeedChAfRb
mov eax, dword [0x70f604]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4203c3
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], esi
push str.NeedChAfRb
mov ecx, dword [0x70f604]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x4203c3
push str.NeedChAfRb
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x20]
push ecx
push ebx
push ebx
push str.ClChIDMRes
mov edx, dword [0x70f604]
push edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x4201e9
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
push str.ClChIERes
mov edx, dword [0x70f604]
push edx
call edi
test eax, eax
jne 0x420216
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x42021f
cmp ebx, 1
jne 0x4203c3
mov edi, 1
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x30]
call fcn.004f03c0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x30]
call fcn.004f0640
cmp esi, edi
jne 0x420254
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420254
xor edi, edi
mov dword [ebp - 0x48], edi
cmp ebx, 1
jne 0x420268
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420268
mov dword [ebp - 0x48], 0
jmp 0x420270
test edi, edi
jne 0x420363
push 0x50030
mov edx, dword [0x710938]
push edx
mov eax, dword [0x710948]
push eax
push 0
call fcn.00469b60
add esp, 0x10
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 4]
call fcn.0040ed70
mov dword [ebp - 0x18], 0
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
push str.AdvancedIntegration
mov edx, dword [0x70f604]
push edx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov dword [edi + 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.004f03c0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x4c]
call fcn.004f0640
mov eax, 1
mov dword [ebp - 0x48], eax
cmp esi, eax
jne 0x4202f8
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4202f8
xor eax, eax
mov dword [ebp - 0x48], eax
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x420311
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420311
mov dword [ebp - 0x48], 0
jmp 0x420315
test eax, eax
jne 0x420352
mov dword [ebp - 0x18], esi
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.NeedSnRpAfRb
mov eax, dword [0x70f604]
push eax
call ebx
push 0x50030
mov ecx, dword [0x710938]
push ecx
mov edx, dword [0x71094c]
push edx
push 0
call fcn.00469b60
add esp, 0x10
push esi
call fcn.00411690
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.004f03d0
jmp 0x4203b7
push 0x50000
cmp dword [ebp - 0x2c], 1
jne 0x42037d
mov eax, dword [0x710938]
push eax
mov ecx, dword [0x710978]
push ecx
jmp 0x42038a
mov edx, dword [0x710938]
push edx
mov eax, dword [0x710950]
push eax
push 0
call fcn.00469b60
add esp, 0x10
mov dword [ebp - 0x18], 1
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
push 0
push str.AdvancedIntegration
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004f03d0
cmp dword [ebp - 0x60], 0
jne 0x42040d
mov dword [ebp - 0x5c], 4
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x74]
push ecx
push 0
push 0
push str.NeedSnRpAfRb
mov edx, dword [0x70f604]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42042f
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
push str.NeedSnRpAfRb
mov eax, dword [0x70f604]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x42042f
push 0
lea ecx, [ebp]
call fcn.0051b730
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.005d199e
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.004155e0
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.004107d0
push 1
mov ecx, edi
call fcn.0041a620
mov ecx, edi
call fcn.0055a380
xor ebx, ebx
test eax, eax
jne 0x420471
push ebx
push ebx
call fcn.00417080
push ebx
push ebx
mov ecx, edi
call fcn.00417120
push ebx
push ebx
mov ecx, edi
call fcn.0041c960
push ebx
push ebx
mov ecx, edi
call fcn.004170e0
mov ecx, edi
cmp dword [edi + 0x1c], ebx
je 0x420481
push 1
call fcn.00415500
jmp 0x420492
call fcn.00410ed0
test eax, eax
jne 0x420492
push ebx
mov ecx, edi
call fcn.0041f010
cmp dword [0x70f5f4], ebx
je 0x4204a1
mov ecx, edi
call fcn.0041eac0
cmp dword [ebp - 0x34], ebx
je 0x420795
lea esi, [edi + 4]
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
mov ecx, esi
call fcn.0040db20
test eax, eax
je 0x42060b
cmp dword [ebp - 0x28], ebx
jne 0x4204dc
mov ecx, esi
call fcn.0040ed70
mov dword [ebp - 0x44], 1
jmp 0x42079a
mov dword [ebp + 0xf44], ebx
mov dword [ebp + 0xf4c], ebx
xor eax, eax
mov word [ebp + 0xf48], ax
mov byte [ebp - 4], 8
mov eax, dword [0x70f66c]
cmp eax, ebx
jne 0x420503
mov eax, 0x70f670
push ebx
push str.Uninstall.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xf44]
call fcn.00402300
mov eax, dword [ebp + 0xf44]
cmp eax, ebx
jne 0x42052a
lea eax, [ebp + 0xf48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4205fc
mov eax, dword [ebp + 0xf44]
cmp eax, ebx
jne 0x42054a
lea eax, [ebp + 0xf48]
push ebx
push eax
mov ecx, edi
call fcn.004166a0
test al, al
je 0x4205fc
push 0x3c
push ebx
lea ecx, [ebp - 0x108]
push ecx
call fcn.005f8cb0
add esp, 0xc
mov dword [ebp - 0x108], 0x3c
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
mov eax, dword [ebp + 0xf44]
cmp eax, ebx
je 0x42059d
mov dword [ebp - 0xf8], eax
jmp 0x4205a9
lea edx, [ebp + 0xf48]
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], str._uninstlsp
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4205f5
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xd0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf44]
call fcn.004011f0
cmp dword [ebp - 0x28], ebx
je 0x420795
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x420639
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420674
call fcn.00445c40
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
lea edx, [ebp - 0x5c]
push edx
push eax
push ebx
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x420795
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xf38], ebx
mov dword [ebp + 0xf40], ebx
xor ecx, ecx
mov word [ebp + 0xf3c], cx
mov byte [ebp - 4], 9
mov eax, dword [0x70f66c]
cmp eax, ebx
jne 0x42069b
mov eax, 0x70f670
push ebx
push str.Uninstall.exe
push eax
push 0x64ed70
lea ecx, [ebp + 0xf38]
call fcn.00402300
mov eax, dword [ebp + 0xf38]
cmp eax, ebx
jne 0x4206c2
lea eax, [ebp + 0xf3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420786
mov eax, dword [ebp + 0xf38]
cmp eax, ebx
jne 0x4206e2
lea eax, [ebp + 0xf3c]
push 1
push eax
mov ecx, edi
call fcn.004166a0
test al, al
je 0x420786
push 0x3c
push ebx
lea edx, [ebp + 0x1360]
push edx
call fcn.005f8cb0
add esp, 0xc
mov dword [ebp + 0x1360], 0x3c
mov dword [ebp + 0x1364], 0x40
mov dword [ebp + 0x136c], str.open
mov eax, dword [ebp + 0xf38]
cmp eax, ebx
jne 0x420734
lea eax, [ebp + 0xf3c]
mov dword [ebp + 0x1370], eax
mov dword [ebp + 0x1378], ebx
mov dword [ebp + 0x137c], 3
mov dword [ebp + 0x1380], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp + 0x1368], eax
mov dword [ebp + 0x1374], str._uninsttdi
lea ecx, [ebp + 0x1360]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420786
push 0xffffffffffffffff
mov edx, dword [ebp + 0x1398]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf38]
call fcn.004011f0
cmp dword [ebp - 0x44], ebx
je 0x4207b5
push 0x50030
mov eax, dword [0x71091c]
push eax
mov ecx, dword [0x710970]
push ecx
push ebx
call fcn.00469b60
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x139c]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x13a0
mov esp, ebp
pop ebp
ret