Function at 0x4203f7
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x4fc
mov eax, 0x46e827
call fcn.00444285
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4e1]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x4e0]
push 1
push eax
xor ebx, ebx
mov dword [ebp - 0x4f4], esi
push esi
mov dword [ebp - 0x4f8], ebx
call fcn.0041085e
mov dword [ebp - 4], ebx
movzx eax, word [esi]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x41f711.71
movzx eax, byte [eax + 0x420734]
jmp dword [eax*4 + 0x4206d8]
push 0x481dac
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41f74f
mov eax, dword [edi + 0x260]
mov ecx, edi
push ebx
push ebx
push str._auto
mov byte [eax + 2], 1
call fcn.00435215
mov eax, dword [edi + 0x260]
mov byte [eax + 2], 1
jmp 0x41f8da
cmp dword [edi + 0xc], ebx
jne case.0x41f711.71
mov ecx, edi
call fcn.00438316
test eax, eax
je 0x41f7a2
push 1
lea eax, [ebp - 0x4e1]
push eax
push str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 2
push eax
push 0x86d
push edi
call fcn.0042111d
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404d40
jmp 0x4206bf
fldz
lea eax, [ebp - 0x500]
push eax
mov ecx, edi
fstp qword [ebp - 0x500]
call fcn.00438321
test eax, eax
je 0x41f7da
fld qword [ebp - 0x500]
push ecx
push ecx
fstp qword [esp]
push 0x86f
push edi
call fcn.00421164
add esp, 0x10
jmp 0x4206bf
push ebx
push ebx
push 0x482d64
mov ecx, edi
mov dword [edi + 0xc], 1
call fcn.00435215
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0041085e
mov byte [ebp - 4], 6
lea eax, [ebp - 0x480]
push ebx
push eax
push 0xe
mov ecx, edi
call fcn.004195d8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404d40
jmp 0x41f8da
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0041085e
mov byte [ebp - 4], 8
lea eax, [ebp - 0x480]
push ebx
push eax
push 0xc
mov ecx, edi
call fcn.004195d8
jmp 0x41f820
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x41f8da
push eax
mov ecx, edi
call fcn.004398ae
mov dword [edi + 0x3c], 1
jmp 0x41f8da
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4b0], 0x48e948
push eax
push str.debuglog
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x488], 0x48e950
call fcn.004105ca
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x4ac]
push ebx
push eax
lea ecx, [ebp - 0x4dc]
call fcn.00413e32
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4b0]
call fcn.00404d40
test esi, esi
jne 0x41f8e2
xor ebx, ebx
inc ebx
jmp 0x4206bf
push 1
push dword [ebp - 0x4f4]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x482d80
jmp 0x4206ac
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x480], 0x48e948
push eax
push str.embed
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x458], 0x48e950
call fcn.004105ca
mov byte [ebp - 4], 0xf
xor eax, eax
inc eax
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x47c]
push ebx
push eax
call fcn.00413e32
test eax, eax
jne 0x41f9a4
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4b0], 0x48e948
push eax
push 0x482d98
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x488], 0x48e950
call fcn.004105ca
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0x4e0]
push 3
pop eax
mov dword [ebp - 0x4f8], eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.0042209f
mov byte [ebp - 0x4e1], 1
test al, al
jne 0x41f9aa
mov byte [ebp - 0x4e1], bl
push 0xf
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x4f8]
test al, 2
je 0x41f9d7
and eax, 0xfffffffd
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x4b0]
call fcn.00404d40
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 4], ebx
test al, 1
je 0x41f9f5
and eax, 0xfffffffe
mov dword [ebp - 0x4f8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404d40
cmp byte [ebp - 0x4e1], 0
je 0x41fa28
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0041485b
mov byte [ebp - 4], 0x14
mov ecx, edi
push ebx
push eax
push 0x10
call fcn.004195d8
jmp 0x4203e9
push 0x482d9c
lea ecx, [ebp - 0x4dc]
call fcn.0041986d
test al, al
jne 0x41f8da
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_E_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41fa6b
push esi
mov esi, 0x4afff0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41fb34
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4f0]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404bd0
test eax, eax
jne 0x420603
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004523f0
add esp, 0xc
mov dword [ebp - 0x4f4], 0x104
lea eax, [ebp - 0x4f4]
lea ecx, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00404cc0
lea eax, [ebp - 0x218]
push eax
push 0x4afff0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [ebp - 0x4f0]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x41fb0f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x41fb29
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov esi, 0x4afff0
push esi
call fcn.0044310e
mov dword [edi + 0x3c], 1
mov eax, 0x4ab590
cmp dword [0x4ab5a4], 8
cmovae eax, dword [0x4ab590]
push eax
push esi
push 0x4af7e0
call fcn.00441f44
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x480], 0x48e948
push eax
push 0x48e7d0
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x458], 0x48e950
call fcn.00407a30
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x4e1]
push 1
push eax
push dword [0x481ce8]
lea ecx, [ebp - 0x450]
call fcn.00406bc0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x4e1]
push 1
push eax
push dword [0x481ce4]
lea ecx, [ebp - 0x4b0]
call fcn.00406bc0
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x450]
mov ecx, edi
push eax
lea eax, [ebp - 0x4b0]
push eax
push 5
call fcn.0041962c
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x4b0]
call fcn.00404d40
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x450]
call fcn.00404d40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404d40
push 2
mov ecx, edi
call fcn.004394a8
jmp 0x41f8da
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx eax, word [eax]
sub eax, 0x31
je 0x41fc8c
sub eax, 1
je 0x41fc72
sub eax, 1
je 0x41fc50
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x482e14
jmp 0x4206ac
push esi
mov byte [edi + 0x25c], 1
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
mov ecx, edi
call fcn.00439772
jmp 0x41f8da
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x482e0c
jmp 0x4206ac
push 1
lea eax, [ebp - 0x4e1]
push eax
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
lea ecx, [ebp - 0x480]
call fcn.0041085e
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x450]
push ebx
push ebx
push ecx
mov ecx, eax
mov dword [ebp - 0x4f8], 4
call fcn.00414125
mov dword [ebp - 4], 0x20
add eax, 4
mov dword [ebp - 0x4f8], 0xc
cmp dword [eax + 0x14], 8
jb 0x41fce9
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41fd40
sub esp, 0x30
lea eax, [ebp - 0x4e1]
mov esi, esp
mov dword [ebp - 0x4fc], esp
push 1
push eax
push dword [ebp - 0x4f4]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
mov ecx, esi
call fcn.0041085e
mov dword [ebp - 4], 0x21
mov byte [ebp - 4], 0x20
call fcn.00448b8f
add esp, 0x30
mov byte [ebp - 0x4e1], bl
test al, al
je 0x41fd47
mov byte [ebp - 0x4e1], 1
push 0x1f
pop eax
mov dword [ebp - 4], eax
push 0xc
pop esi
mov dword [ebp - 0x4f8], esi
and esi, 0xfffffff7
mov dword [ebp - 0x4f8], esi
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x450]
call fcn.00404d40
mov dword [ebp - 4], ebx
and esi, 0xfffffffb
mov dword [ebp - 0x4f8], esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404d40
cmp byte [ebp - 0x4e1], 0
je case.0x41f711.71
push 1
lea eax, [ebp - 0x4e1]
push eax
push dword [ebp - 0x4f4]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
lea ecx, [ebp - 0x480]
call fcn.0041085e
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x450]
push ebx
push ebx
push ecx
mov ecx, eax
call fcn.00414125
mov byte [ebp - 4], 0x25
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x41fddf
mov eax, dword [eax]
push eax
call fcn.0044216c
pop ecx
mov esi, eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x450]
call fcn.00404d40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x480]
call fcn.00404d40
test esi, esi
je case.0x41f711.71
push ebx
push dword [ebp - 0x4f4]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x482b60
mov ecx, edi
call fcn.00435215
mov dword [edi + 0x40], 1
jmp 0x41f8da
push str.hide_progress
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41fe51
mov byte [edi + 0x256], 1
push str.hide_splash
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41f8da
mov byte [edi + 0x257], 1
jmp 0x41f8da
push 1
lea eax, [ebp - 0x4e1]
push eax
push str.instance
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x44c]
push ebx
push eax
lea ecx, [ebp - 0x4dc]
call fcn.00413e32
mov esi, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404d40
test esi, esi
jne 0x41ff0c
push 0xfffffffffffffffd
pop esi
push 0xffffffffffffffff
add edi, 0x258
lea eax, [ebp - 0x480]
push 9
push eax
lea ecx, [ebp - 0x4e0]
mov dword [edi], esi
call fcn.0041485b
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x47c]
push 0x482e30
call fcn.0041986d
test al, al
je 0x41fef3
or dword [edi], 0xffffffff
jmp 0x41ff07
push 0xa
push edi
lea ecx, [ebp - 0x480]
call fcn.0042244b
test al, al
jne 0x41ff07
mov dword [edi], esi
jmp 0x41f820
push str.IS_temp
lea ecx, [ebp - 0x4dc]
call fcn.0041986d
test al, al
je 0x41f8da
mov byte [edi + 0x25e], 1
jmp 0x41f8da
cmp dword [edi + 0xc], ebx
jne case.0x41f711.71
push esi
mov dword [edi + 0xc], 3
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
lea ecx, [ebp - 0x450]
push 1
lea eax, [ebp - 0x4e1]
push eax
push esi
call fcn.0041085e
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x450]
push ebx
push eax
push 8
mov ecx, edi
call fcn.004195d8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404d40
push ebx
push esi
push 0x482e40
jmp 0x4206ac
push edi
lea eax, [ebp - 0x4f4]
mov dword [ebp - 0x4f4], ebx
push eax
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.0042076e
add esp, 0xc
test eax, eax
je case.0x41f711.71
mov ecx, dword [edi + 0x260]
mov ax, word [ebp - 0x4f4]
mov word [ecx + 0x52], ax
jmp 0x41f8da
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
sub ecx, 0x31
je 0x41ffeb
sub ecx, 1
je 0x41ffe4
mov esi, 0x482e58
jmp 0x41fff7
mov esi, 0x482e50
jmp 0x41fff0
mov esi, 0x482e48
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push ebx
push eax
push esi
jmp 0x4206ac
push str.noscript_uninst
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
jne 0x42001c
push ebx
push ebx
push str._noscript_uninst
jmp 0x4206ac
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x450]
push ebx
push eax
push 5
mov ecx, edi
call fcn.004195d8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
call fcn.00404d40
push 2
mov ecx, edi
call fcn.004394a8
jmp 0x41f87a
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4aec40
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41f8da
mov byte [edi + 0x25d], 1
jmp 0x41f8da
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4200a9
push ebx
push ebx
push 0x482998
jmp 0x4206ac
push str.runas
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
je 0x41f8da
push str.runfromtemp
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
je 0x41f8da
push 6
push str.reboot
push esi
call fcn.00457aa7
add esp, 0xc
test eax, eax
je 0x41f8da
push str.removeasmajorupgrade
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
je 0x41f8da
push ebx
push ebx
push 0x482ef4
jmp 0x4206ac
push str.skip_clone_wait
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
je 0x41f8da
push 0x482f1c
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
jne 0x42013e
push ebx
push ebx
push str._SMS
jmp 0x4206ac
push str.show_eval_msg
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
jne 0x42015e
mov eax, dword [edi + 0x260]
mov byte [eax + 0x18], 1
jmp 0x41f8da
push str.show_beta_msg
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
jne 0x42017e
mov eax, dword [edi + 0x260]
mov byte [eax + 0x19], 1
jmp 0x41f8da
push str.show_reboot_msg
push esi
call fcn.00457d2f
pop ecx
pop ecx
mov ecx, dword [edi + 0x260]
test eax, eax
jne 0x42019e
mov byte [ecx + 0x1d], 1
jmp 0x41f8da
push ebx
push ebx
mov byte [ecx + 1], 1
mov ecx, edi
push 0x482f50
call fcn.00435215
mov eax, dword [edi + 0x260]
mov byte [eax + 1], 1
jmp 0x41f8da
push ebx
push str.tempdisk1folder
lea ecx, [ebp - 0x4dc]
call fcn.00413e65
test eax, eax
je 0x41f8da
push ebx
push str.tempextractpath
lea ecx, [ebp - 0x4dc]
call fcn.00413e65
test eax, eax
je 0x41f8da
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x420217
push esi
mov ecx, edi
call fcn.0043982b
jmp 0x4202e3
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x4f0]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404bd0
test eax, eax
jne 0x420603
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004523f0
add esp, 0xc
mov dword [ebp - 0x4f4], 0x104
lea eax, [ebp - 0x4f4]
lea ecx, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00404cc0
lea eax, [ebp - 0x218]
push eax
call fcn.0044310e
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0043982b
push esi
mov esi, dword [ebp - 0x4f0]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x4202c3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, ebx
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x4ec], ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x4202dd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
push 3
jmp 0x42005d
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov eax, ecx
cmp eax, 0x41
je 0x4203b1
cmp eax, 0x4d
je 0x420377
cmp eax, 0x57
je 0x42033d
cmp eax, 0x61
je 0x4203b1
cmp eax, 0x6d
je 0x420377
cmp ecx, 0x77
je 0x42033d
push str.uninst
push esi
call fcn.00457d2f
pop ecx
pop ecx
test eax, eax
jne 0x41f8da
push ebx
push ebx
push str._uninst
jmp 0x4206ac
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x450]
push ebx
push eax
push 0xa
mov ecx, edi
call fcn.004195d8
jmp 0x4203e9
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x450]
push ebx
push eax
push 0xb
mov ecx, edi
call fcn.004195d8
jmp 0x4203e9
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x4e1]
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x450]
push ebx
push eax
push 9
mov ecx, edi
call fcn.004195d8
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x450]
jmp 0x41f829
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x4f0]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404bd0
test eax, eax
jne 0x42045c
mov eax, dword [ebp - 0x4f0]
push str.ISSetup
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x4f0]
test eax, eax
je 0x420456
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], ebx
push 7
push str.verbose
push esi
call fcn.00457aa7
add esp, 0xc
test eax, eax
je 0x420633
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_V_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x420521
lea eax, [ebp - 0x4fc]
mov dword [ebp - 0x4fc], 7
push eax
lea eax, [ebp - 0x508]
push eax
lea ecx, [edi + 4]
call fcn.004159ad
mov eax, dword [eax]
lea ecx, [eax + 0x18]
mov dword [ebp - 0x4f4], ecx
cmp dword [eax + 0x28], ebx
je 0x4204dd
push 0x481d20
call fcn.00454be3
pop ecx
mov ecx, dword [ebp - 0x4f4]
push eax
push 0x481d20
call fcn.0041515e
push 1
lea eax, [ebp - 0x4e1]
push eax
push esi
lea ecx, [ebp - 0x450]
call fcn.0041085e
mov byte [ebp - 4], 0x3d
add eax, 4
mov ecx, dword [ebp - 0x4f4]
push eax
call fcn.00415107
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x450]
call fcn.00404d40
push 1
push esi
push 0x48259c
jmp 0x42063e
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4f0]
call fcn.00404bd0
test eax, eax
jne 0x420603
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004523f0
add esp, 0xc
mov dword [ebp - 0x4fc], 0x104
lea eax, [ebp - 0x4fc]
lea ecx, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.00404cc0
push esi
mov esi, dword [ebp - 0x4f0]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x42059b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f0], ebx
push ebx
lea eax, [ebp - 0x4e1]
mov dword [ebp - 0x4ec], ebx
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x480], 0x48e948
push eax
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x458], 0x48e950
call fcn.004105ca
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x480]
push ebx
push eax
push 7
mov ecx, edi
call fcn.004195d8
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x480]
call fcn.00404d40
lea esi, [ebp - 0x420]
push 1
mov eax, esi
push eax
jmp 0x420517
push edi
call fcn.00420d79
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x4f0], 0
je 0x420628
push dword [ebp - 0x4f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
jmp 0x4206bf
push 1
add esi, 0xe
push esi
push str._verbose
mov ecx, edi
call fcn.00435215
test esi, esi
je 0x42065c
push esi
push 0x4acc40
mov byte [0x4aed08], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x4f0]
test eax, eax
je 0x420676
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
jmp 0x41f8da
mov dword [edi + 0x34], 1
jmp 0x41f8da
cmp dword [edi + 0xc], ebx
jne case.0x41f711.71
mov dword [edi + 0xc], 4
jmp 0x41f8da
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x483068
mov ecx, edi
call fcn.00435215
jmp 0x41f8da
push edi
call fcn.00420d79
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e0]
call fcn.00404d40
mov eax, ebx
call fcn.00444234
ret