Function at 0x4034a0
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Delete file
Delete registry key
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.USER32.DLL
mov esi, ecx
mov dword [ebp - 0xa1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4034e2
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4034e2
call eax
mov ecx, str.RICHED20.DLL
call fcn.00401030
push 0x105
lea edi, [esi + 0x35c]
mov dword [esi + 0x4bc8], eax
push edi
push 0
mov dword [esi + 0x4bbc], 0
mov dword [esi + 0x4bc0], 0
mov dword [esi + 0x4bc4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40352b
mov word [edi], ax
mov eax, edi
mov edx, eax
movzx ecx, word [eax]
test cx, cx
je 0x403551
movzx ecx, cx
add eax, 2
cmp ecx, 0x5c
je 0x403547
cmp ecx, 0x3a
jne 0x403549
mov edx, eax
movzx ecx, word [eax]
test cx, cx
jne 0x403537
mov dword [esi + 0x770], edx
test edx, edx
je 0x403560
xor eax, eax
mov word [edx], ax
push edi
lea ebx, [esi + 0x566]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.SETUP.INI
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x114
lea edi, [esi + 0x10]
push 0
push edi
call fcn.00406cf0
add esp, 0xc
mov dword [edi], 0x114
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esi + 0x20], 2
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x403a30
cmp dword [esi + 0x14], 5
jb 0x403a30
mov eax, dword [ebp + 0x10]
cmp word [eax], 0
je 0x403726
lea eax, [ebp - 0xa18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, 1
mov dword [ebp - 0xa0c], eax
lea ebx, [esi + 0x124]
mov dword [esi + 8], ebx
cmp dword [ebp - 0xa18], edi
jle 0x403726
nop dword [eax + eax]
mov eax, dword [eax + edi*4]
mov dword [esi + 4], eax
cmp word [eax], 0x2d
je 0x403623
push eax
push ebx
mov dword [esi + 0x330], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp case.0x40363f.70
add eax, 2
mov dword [esi + 4], eax
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x32
ja case.0x40363f.70
movzx eax, byte [eax + 0x404458]
jmp dword [eax*4 + 0x40442c]
mov dword [esi + 0x334], 1
jmp case.0x40363f.70
mov dword [esi + 0x338], 1
jmp case.0x40363f.70
mov dword [esi + 0x33c], 1
jmp case.0x40363f.70
mov dword [esi + 0x340], 1
jmp case.0x40363f.70
mov dword [esi + 0x45b4], 1
jmp case.0x40363f.70
mov dword [esi + 0x45b4], 2
jmp case.0x40363f.70
mov dword [esi + 0x45b4], 3
jmp case.0x40363f.70
mov dword [esi + 0x45b4], 4
jmp case.0x40363f.70
mov dword [esi + 0x344], 1
jmp case.0x40363f.70
lea eax, [ebp - 0xa14]
mov dword [ebp - 0xa10], 0
push eax
lea ecx, [ebp - 0xa10]
mov dword [ebp - 0xa14], str.ANALYSIS
call fcn.00401140
dec eax
neg eax
sbb eax, eax
and eax, 2
add eax, 2
cmp dword [ebp - 0xa10], 0
mov dword [esi + 0x45b4], eax
je case.0x40363f.70
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0xa10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa0c]
inc edi
cmp edi, dword [ebp - 0xa18]
jl 0x403600
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ebx, [esi + 0x794]
push str.Global_
push ebx
call edi
push str.IJPLMINSTALLER
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [esi + 0x334], 0
je 0x40375b
push str._UNINSTALL
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xc], eax
test eax, eax
je 0x403a24
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403a24
cmp dword [esi + 0x334], 0
jne 0x4037a1
cmp dword [esi + 0x344], 0
jne 0x4037a1
cmp dword [esi + 0x330], 0
je 0x403a24
cmp dword [esi + 0x330], 0
je 0x4037f3
push 0
push str.APPLICATION_COMPLETED
lea edx, [esi + 0x124]
call fcn.00401320
lea eax, [esi + 0x348]
push eax
push str.PRIMARY_LANGID
lea edx, [esi + 0x124]
call fcn.004013d0
lea eax, [esi + 0x34c]
push eax
push str.SUB_LANGID
lea edx, [esi + 0x124]
call fcn.004013d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x18
call fcn.004027f0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp dword [esi + 0x330], 0
mov word [esi + 0x350], ax
je 0x403830
cmp dword [esi + 0x348], 0
je 0x403830
mov ax, word [esi + 0x34c]
shl ax, 0xa
or ax, word [esi + 0x348]
mov word [esi + 0x350], ax
mov eax, dword [str.English]
mov dword [esi + 0x354], 0x41e780
cmp dword [str.English], 0
mov dword [0x41f520], eax
je 0x4038ae
mov dword [ebp - 0xa0c], 0x400
nop word [eax + eax]
mov edx, dword [esi + 0x354]
movzx ecx, word [edx]
cmp cx, word [ebp - 0xa0c]
jae 0x403886
mov ax, word [esi + 0x350]
xor ax, cx
mov ecx, 0x3ff
test cx, ax
jmp 0x40388d
cmp cx, word [esi + 0x350]
je 0x4038a0
lea eax, [edx + 8]
mov dword [esi + 0x354], eax
cmp dword [eax + 4], 0
jne 0x403860
jmp 0x4038ae
mov eax, dword [esi + 0x354]
mov eax, dword [eax + 4]
mov dword [0x41f520], eax
push 0x105
push 0x41f740
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
mov ecx, 0x41f740
call fcn.00401280
add esp, 4
mov dword [esi + 4], eax
push str.RESMESSAGE_
push eax
call edi
mov eax, dword [0x41f520]
test eax, eax
je 0x4038ee
push eax
push 0x41f740
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MESSAGE.INI
push 0x41f740
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x41f740
push 0
push str.RTLREADING
push str.STRING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ecx
mov edx, 0x41f530
mov dword [0x41f730], eax
mov ecx, str.APPNAME
call fcn.00401630
lea edx, [esi + 0x23a0]
mov ecx, str.PSVI03
call fcn.00401630
lea edx, [esi + 0x2ba0]
mov ecx, str.PSVI04
call fcn.00401630
lea edx, [esi + 0x33a0]
mov ecx, str.PSVI05
call fcn.00401630
lea edx, [esi + 0x3ba0]
mov ecx, str.PSVI08
call fcn.00401630
add esp, 4
call fcn.00401c90
test eax, eax
jne 0x403b5f
mov eax, dword [esi + 0x334]
test eax, eax
jne 0x4039b9
cmp dword [esi + 0x344], eax
jne 0x4039b5
lea edi, [esi + 0xf94]
push ecx
mov edx, edi
mov ecx, str.PSVI06
call fcn.00401630
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 4
push 0x41f530
push edi
push ebx
call eax
add esp, 0xc
jmp 0x4039f6
test eax, eax
je 0x4039ca
cmp dword [esi + 0x344], 0
jne 0x4039ca
push ecx
mov ecx, str.PSVI09
jmp 0x4039d0
push ecx
mov ecx, str.PSVI14
lea edi, [esi + 0xf94]
mov edx, edi
call fcn.00401630
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 4
push 0x41f530
push 0x41f530
push edi
push ebx
call eax
add esp, 0x10
cmp dword [0x41f730], 0
mov ecx, 0x180010
mov eax, 0x10
cmovne eax, ecx
push eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x41f530
push ebx
push 0
call eax
mov dword [0x41e898], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [esi + 0x334], 0
je 0x403ace
cmp dword [esi + 0x338], 0
jne 0x403ace
cmp dword [0x41e898], 0
push 0x400
je 0x4043f7
lea eax, [esi + 0x23a0]
push eax
lea edi, [esi + 0x794]
push edi
call ecx
test eax, eax
jne 0x403a75
xor eax, eax
mov word [edi], ax
push 0x400
lea eax, [esi + 0x33a0]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edi, [esi + 0xf94]
push edi
call eax
test eax, eax
je 0x403ace
cmp word [esi + 0x794], 0
lea ecx, [esi + 0x794]
je 0x403ace
cmp word [edi], 0
je 0x403ace
cmp dword [0x41f730], 0
mov edx, 0x180040
mov eax, 0x40
cmovne eax, edx
push eax
push edi
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esi + 0x358], eax
cmp dword [esi + 0x330], 0
je 0x403aec
push 1
push str.APPLICATION_COMPLETED
lea edx, [esi + 0x124]
call fcn.00401320
add esp, 8
mov eax, dword [esi + 0x4bc8]
test eax, eax
je 0x403b07
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x4bc8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x403b18
push eax
call ebx
mov dword [esi + 0xc], 0
mov eax, dword [0x41f73c]
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
test eax, eax
je 0x403b34
push eax
call esi
mov dword [0x41f73c], 0
mov eax, dword [0x41f528]
test eax, eax
je 0x403b4a
push eax
call esi
mov dword [0x41f73c], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404e4f
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [sym.imp.USER32.dll_LoadImageW]
push 0
push 0x10
push 0x10
push 1
push 0x6b
push dword [ebp - 0xa1c]
call edi
push 0
push 0x30
push 0x30
push 1
push 0x6b
push dword [ebp - 0xa1c]
mov dword [0x41f73c], eax
call edi
cmp dword [esi + 0x344], 0
mov dword [0x41f528], eax
je 0x403c05
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [esi + 0xf94]
push 0x41f530
push str.Canon__s
push edi
call eax
add esp, 8
mov edx, ebx
mov ecx, str.PSVI13
call fcn.00401630
add esp, 4
mov ecx, 0x180044
cmp dword [0x41f730], 0
mov eax, 0x44
cmovne eax, ecx
push eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push ebx
push 0
call eax
xor ecx, ecx
mov dword [esi + 0x358], eax
cmp eax, 6
sete cl
inc ecx
mov dword [esi + 0x4bbc], ecx
call fcn.004031b0
jmp 0x403a24
cmp dword [esi + 0x334], 0
jne 0x403c59
cmp dword [esi + 0x338], 0
jne 0x403c36
mov eax, dword [esi + 0x45b4]
cmp eax, 3
jne 0x403c48
mov dword [esi + 0x334], 1
mov dword [esi + 0x338], 1
cmp dword [0x41e898], 0
je 0x403a24
jmp 0x403ccc
cmp eax, 4
jne 0x403c36
mov dword [esi + 0x334], 0
jmp 0x403c2c
cmp dword [esi + 0x338], 0
jne 0x403cc2
cmp dword [esi + 0x340], 0
jne 0x403cc2
lea edi, [esi + 0xf94]
push ecx
mov edx, edi
mov ecx, str.PSVI01
call fcn.00401630
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 4
push 0x41f530
push edi
push ebx
call eax
add esp, 8
mov edx, edi
mov ecx, str.PSVI02
call fcn.00401630
add esp, 4
mov edx, ebx
push 0x34
push edi
call fcn.00401600
add esp, 8
mov dword [esi + 0x358], eax
cmp eax, 7
jne 0x403c36
jmp 0x403a1a
mov dword [0x41e898], 1
cmp dword [esi + 0x334], 0
jne 0x403ce2
call fcn.004014b0
test eax, eax
jne 0x403a24
lea eax, [esi + 0x77c]
push eax
push 2
push 0
lea eax, [esi + 0x566]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov dword [esi + 0x778], eax
cmp eax, 0xffffffff
je 0x403a24
push 0x41f530
lea eax, [ebp - 0x208]
push str.Canon__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push 0
push 0
push 1
push eax
push 0xea60
push dword [esi + 0x778]
call dword [sym.imp.SETUPAPI.dll_SetupSetDirectoryIdExW]
cmp dword [esi + 0x334], 0
jne 0x403d56
mov dword [esi + 0x774], str.INSTALL
jmp 0x403d60
mov dword [esi + 0x774], str.UNINSTALL
lea ebx, [esi + 0x780]
xor eax, eax
push ebx
push str.EXEC
mov word [esi + 0x1b94], ax
push dword [esi + 0x774]
push dword [esi + 0x778]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x403df7
mov edi, dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
lea eax, [esi + 0x2394]
push eax
push pe_nt_image_headers32
lea ecx, [esi + 0x1794]
push ecx
push 1
push ebx
call edi
lea eax, [esi + 0x2398]
push eax
push pe_nt_image_headers32
lea ebx, [esi + 0x1994]
push ebx
push 2
lea eax, [esi + 0x780]
push eax
call edi
lea eax, [esi + 0x239c]
push eax
push 0x400
lea edi, [esi + 0x1b94]
push edi
lea eax, [esi + 0x1794]
push eax
push 0
push dword [esi + 0x778]
call dword [sym.imp.SETUPAPI.dll_SetupGetTargetPathW]
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [esi + 0x778]
mov dword [0x41f524], 0
call fcn.004021e0
cmp dword [esi + 0x334], 0
mov dword [esi + 0x45b0], eax
jne 0x403e6d
test eax, eax
jne 0x403e6d
lea ecx, [esi + 0x49bc]
call fcn.00401f20
push str.AutoSend
mov edx, str.SoftwareCanonIJPLM
mov ecx, 0x80000002
call fcn.00402560
mov dword [esi + 0x4bbc], eax
call fcn.00402480
lea ecx, [esi + 0x4bc0]
add esp, 4
mov dword [ecx], eax
or eax, edx
mov dword [ecx + 4], edx
jne 0x403e62
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esi + 0x778]
call fcn.00402380
cmp dword [esi + 0x334], 0
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionW]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi + 0x790], 1
jne 0x403e99
cmp dword [esi + 0x45b0], 0
jne 0x403ff3
push str.IJPLMUI_CLOSE
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x800
mov dword [ebp - 0xa0c], eax
lea eax, [ebp - 0xa08]
push 0
push eax
mov dword [esi + 0x790], 0
call fcn.00406cf0
add esp, 0xc
lea ecx, [ebp - 0xa08]
call fcn.00403260
test eax, eax
je 0x403f4f
xor ebx, ebx
nop dword [eax + eax]
lea eax, [ebp - 0xa08]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x403f0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
cmp eax, 0xb7
jne 0x403f43
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push dword [ebp - 0xa0c]
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov dword [esi + 0x790], 0
cmp ebx, 2
jl 0x403ee0
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionW]
jmp 0x403f59
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionW]
mov dword [esi + 0x790], 1
cmp dword [esi + 0x790], 0
jne 0x403fb0
lea eax, [ebp - 0xa08]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x403f92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403f92
mov dword [esi + 0x790], 1
jmp 0x403f9c
mov dword [esi + 0x790], 0
test edi, edi
je 0x403fa7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x790], 0
je 0x403fed
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea eax, [esi + 0x35c]
push 0
push 0
push 0
push 0x401b20
push 0x108
push eax
push 0x80000002
push 0x10
push dword [esi + 0x774]
push dword [esi + 0x778]
call edi
push eax
call ebx
mov dword [esi + 0x790], eax
jmp 0x403ff3
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [esi + 0x790], 0
je 0x40432a
mov eax, dword [esi + 0x334]
test eax, eax
jne 0x404020
cmp dword [esi + 0x45b0], eax
je 0x40401c
call fcn.00401e30
jmp 0x404395
test eax, eax
je 0x404035
cmp word [esi + 0x1b94], 0
je 0x404035
lea ecx, [esi + 0x1b94]
call fcn.00401c00
push 0
push 0
push 0
push 0x4019e0
push 0x108
lea eax, [esi + 0x35c]
push eax
push 0x80000002
push 0x14
push dword [esi + 0x774]
push dword [esi + 0x778]
call edi
push eax
call ebx
cmp dword [0x41f52c], 0
mov dword [esi + 0x790], eax
je 0x40407d
mov dword [esi + 0x790], 0
cmp dword [esi + 0x790], 0
je 0x40415c
cmp dword [esi + 0x334], 0
jne 0x40415c
call fcn.004014b0
test eax, eax
jne 0x403a24
call fcn.00401e30
call fcn.00402e90
mov ecx, dword [esi + 0x45b4]
call fcn.00402680
lea ecx, [esi + 0x49bc]
call fcn.00402040
lea edx, [ebp - 0xa0c]
lea ecx, [ebp - 0xa14]
call fcn.00401da0
test eax, eax
je 0x4040f3
call fcn.004012c0
test eax, eax
je 0x4040f3
mov edx, dword [ebp - 0xa0c]
mov ecx, dword [ebp - 0xa14]
call fcn.00401cf0
push dword [esi + 0x4bbc]
mov edx, str.SoftwareCanonIJPLM
mov ecx, 0x80000002
push str.AutoSend
call fcn.004025d0
add esp, 8
push dword [esi + 0x4bc4]
push dword [esi + 0x4bc0]
push ecx
call fcn.00402500
add esp, 0xc
mov edx, str.SoftwareCanonIJPLM
mov ecx, 0x80000002
push dword [esi + 0x348]
push str.PRIMARY_LANGID
call fcn.004025d0
push dword [esi + 0x34c]
mov edx, str.SoftwareCanonIJPLM
mov ecx, 0x80000002
push str.SUB_LANGID
call fcn.004025d0
add esp, 0x10
push 0x20a
lea edi, [esi + 0x43a0]
push 0
push edi
call fcn.00406cf0
add esp, 0xc
push edi
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x40418a
xor eax, eax
mov word [edi], ax
push str.CanonIJPLM
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [esi + 0x790], 0
je 0x404306
cmp dword [esi + 0x334], 0
jne 0x4041b8
mov ecx, edi
call fcn.00402400
jmp 0x404306
cmp dword [esi + 0x33c], 0
mov eax, 0x414
mov ebx, dword [sym.imp.SHELL32.dll_SHFileOperationW]
jne 0x40421e
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa3c]
push eax
mov dword [ebp - 0xa3c], 0
mov dword [ebp - 0xa38], 3
mov dword [ebp - 0xa34], edi
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa2a], 0
mov dword [ebp - 0xa26], 0
mov dword [ebp - 0xa22], 0
call ebx
push 0x20a
push 0
push edi
call fcn.00406cf0
add esp, 0xc
lea eax, [esi + 0x45ac]
push eax
push 0x105
push edi
push 0x41c248
push 0
push dword [esi + 0x778]
call dword [sym.imp.SETUPAPI.dll_SetupGetTargetPathW]
mov eax, 0x414
mov dword [ebp - 0xa3c], 0
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa3c]
push eax
mov dword [ebp - 0xa38], 3
mov dword [ebp - 0xa34], edi
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa2a], 0
mov dword [ebp - 0xa26], 0
mov dword [ebp - 0xa22], 0
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareCanonIJPLM
push 0x80000002
call edi
push str.canonij10
push 0x80000000
call edi
call fcn.004012c0
test eax, eax
je 0x404306
mov ecx, str.ADVAPI32.DLL
call fcn.00401030
mov edi, eax
test edi, edi
je 0x404306
push str.RegDeleteKeyExW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4042ff
push 0
push pe_nt_image_headers32
push str.SoftwareCanonIJPLM
push 0x80000002
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 0x334], 0
jne 0x404395
cmp word [esi + 0x1b94], 0
je 0x404395
lea ecx, [esi + 0x1b94]
call fcn.00401c00
jmp 0x404395
cmp dword [esi + 0x338], 0
jne 0x40438b
push 0x400
lea eax, [esi + 0x3ba0]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edi, [esi + 0xf94]
push edi
call eax
test eax, eax
je 0x404369
push 0x41f530
push edi
lea edi, [esi + 0x794]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x404374
xor eax, eax
mov word [edi], ax
lea edi, [esi + 0x794]
push 0x10
push 0x41f530
mov edx, edi
call fcn.00401600
add esp, 8
mov dword [esi + 0x358], eax
mov dword [0x41e898], 0
mov eax, dword [0x41f524]
test eax, eax
je 0x4043ab
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x45b8]
test eax, eax
je 0x4043e0
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x45b8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esi + 0x778]
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x403a2a
push dword [esi + 0x778]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x403a2a
lea eax, [esi + 0x2ba0]
push eax
lea edi, [esi + 0xf94]
push edi
call ecx
test eax, eax
je 0x403a70
push 0x41f530
lea eax, [esi + 0x794]
push edi
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403a75