Function at 0x4273f9
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x5e8
mov eax, 0x4a3e12
call fcn.00454652
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 1
lea eax, [ebp - 0x5d9]
push eax
xor ebx, ebx
push esi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x5f4], ebx
call fcn.004115ed
mov dword [ebp - 4], ebx
movzx eax, word [esi]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x427444.71
movzx eax, byte [eax + 0x428245]
jmp dword [eax*4 + 0x4281e9]
push 0x4b6aec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427482
mov eax, dword [edi + 0x260]
push ebx
push ebx
push 0x4b7870
mov ecx, edi
mov byte [eax + 2], 1
call fcn.00442e86
mov eax, dword [edi + 0x260]
mov byte [eax + 2], 1
jmp 0x427612
cmp dword [edi + 0xc], 0
jne case.0x427444.71
mov ecx, edi
call fcn.00446413
test eax, eax
je 0x4274d6
push 1
lea eax, [ebp - 0x5d9]
push eax
push str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
lea ecx, [ebp - 0x5a8]
call fcn.004115ed
mov byte [ebp - 4], 2
push eax
push 0x86d
push edi
call fcn.00428b95
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5a8]
call fcn.00401b80
jmp 0x4281d0
fldz
lea eax, [ebp - 0x5f0]
push eax
fstp qword [ebp - 0x5f0]
mov ecx, edi
call fcn.0044641e
test eax, eax
je 0x42750e
fld qword [ebp - 0x5f0]
push ecx
push ecx
fstp qword [esp]
push 0x86f
push edi
call fcn.00428bdc
add esp, 0x10
jmp 0x4281d0
push ebx
push ebx
push 0x4b79ec
mov ecx, edi
mov dword [edi + 0xc], 1
call fcn.00442e86
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x3c8]
call fcn.004115ed
mov byte [ebp - 4], 6
push ebx
lea eax, [ebp - 0x3c8]
push eax
push 0xe
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c8]
call fcn.00401b80
jmp 0x427612
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.004115ed
mov byte [ebp - 4], 8
push ebx
lea eax, [ebp - 0x428]
push eax
push 0xc
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x428]
jmp 0x42755d
push 1
mov ecx, edi
call fcn.00447a55
mov dword [edi + 0x3c], 1
jmp 0x427612
push 1
lea eax, [ebp - 0x5d9]
push eax
push str.debuglog
lea ecx, [ebp - 0x278]
call fcn.004115ed
mov byte [ebp - 4], 0xa
push dword [ebp - 0x264]
cmp dword [ebp - 0x260], 8
lea eax, [ebp - 0x274]
cmovae eax, dword [ebp - 0x274]
push ebx
push eax
lea ecx, [ebp - 0x244]
call fcn.00415d9f
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x278]
call fcn.00401b80
inc bl
je 0x42761a
xor ebx, ebx
inc ebx
jmp 0x4281d0
push 1
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4b7a08
jmp 0x4281bd
push 1
lea eax, [ebp - 0x5d9]
push eax
push str.embed
lea ecx, [ebp - 0x2d8]
call fcn.004115ed
mov byte [ebp - 4], 0xd
xor eax, eax
inc eax
mov dword [ebp - 0x5f4], eax
push dword [ebp - 0x2c4]
cmp dword [ebp - 0x2c0], 8
lea eax, [ebp - 0x2d4]
cmovae eax, dword [ebp - 0x2d4]
push ebx
push eax
lea ecx, [ebp - 0x244]
call fcn.00415d9f
test eax, eax
jne 0x4276c5
push 1
lea eax, [ebp - 0x5d9]
push eax
push 0x4b7a20
lea ecx, [ebp - 0x548]
call fcn.004115ed
mov dword [ebp - 4], 0xe
push 3
pop eax
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebp - 0x248]
call fcn.004298a5
mov byte [ebp - 0x5d9], 1
test al, al
jne 0x4276cb
mov byte [ebp - 0x5d9], bl
push 0xd
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x5f4]
test al, 2
je 0x4276f8
and eax, 0xfffffffd
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x548]
call fcn.00401b80
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 4], ebx
test al, 1
je 0x427716
and eax, 0xfffffffe
mov dword [ebp - 0x5f4], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2d8]
call fcn.00401b80
cmp byte [ebp - 0x5d9], 0
je 0x427752
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x5d8]
push eax
lea ecx, [ebp - 0x248]
call fcn.004173d8
mov byte [ebp - 4], 0x11
push ebx
push eax
push 0x10
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5d8]
jmp 0x42755d
push 0x4b7a24
lea ecx, [ebp - 0x244]
call fcn.0041d0fd
test eax, eax
je 0x427612
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_E_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x427795
push esi
mov esi, 0x4f3000
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x42784a
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov byte [ebp - 4], 0x13
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.004018f0
test eax, eax
jne 0x42813e
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004535d0
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x104
call fcn.004019e0
lea eax, [ebp - 0x218]
push eax
push 0x4f3000
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
mov esi, 0x4f3000
push esi
call fcn.004517e8
mov dword [edi + 0x3c], 1
cmp dword [0x4f2ef0], 8
mov eax, 0x4f2edc
cmovae eax, dword [0x4f2edc]
push eax
push esi
push 0x4f2658
call fcn.00450174
push 1
lea eax, [ebp - 0x5d9]
push eax
push 0x4cbeac
lea ecx, [ebp - 0x4e8]
call fcn.00402ca0
mov byte [ebp - 4], 0x15
push 1
lea eax, [ebp - 0x5d9]
push eax
push dword [0x4b6974]
lea ecx, [ebp - 0x488]
call fcn.00402ca0
mov byte [ebp - 4], 0x16
push 1
lea eax, [ebp - 0x5d9]
push eax
push dword [0x4b6970]
lea ecx, [ebp - 0x338]
call fcn.00402ca0
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x338]
push eax
push 5
mov ecx, edi
call fcn.0041c725
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x338]
call fcn.00401ac0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x488]
call fcn.00401ac0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4e8]
call fcn.00401ac0
push 2
mov ecx, edi
call fcn.00447608
jmp 0x427612
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx eax, word [eax]
sub eax, 0x31
je 0x427989
dec eax
je 0x427971
dec eax
je 0x427951
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
push 0x4b7a9c
jmp 0x4281bd
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
mov byte [edi + 0x25c], 1
call esi
push eax
call esi
push eax
mov ecx, edi
call fcn.0044790b
jmp 0x427612
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push eax
push 0x4b7a94
jmp 0x4281bd
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push eax
push 0x4b77e4
mov ecx, edi
call fcn.00442e86
mov dword [edi + 0x40], 1
jmp 0x427612
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push esi
call ebx
test eax, eax
jne 0x4279c8
mov byte [edi + 0x256], 1
push str.hide_splash
push esi
call ebx
test eax, eax
jne 0x427612
mov byte [edi + 0x257], 1
jmp 0x427612
push 1
lea eax, [ebp - 0x5d9]
push eax
push str.instance
lea ecx, [ebp - 0x2a8]
call fcn.004115ed
mov byte [ebp - 4], 0x1b
push dword [ebp - 0x294]
cmp dword [ebp - 0x290], 8
lea eax, [ebp - 0x2a4]
cmovae eax, dword [ebp - 0x2a4]
push ebx
push eax
lea ecx, [ebp - 0x244]
call fcn.00415d9f
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a8]
call fcn.00401b80
inc bl
je 0x427aa2
push 0xfffffffffffffffd
pop esi
push 0xffffffffffffffff
push 9
lea eax, [ebp - 0x308]
add edi, 0x258
push eax
lea ecx, [ebp - 0x248]
mov dword [edi], esi
call fcn.004173d8
mov byte [ebp - 4], 0x1d
push str.default
lea ecx, [ebp - 0x304]
call fcn.0041d0fd
test eax, eax
jne 0x427a7f
or dword [edi], 0xffffffff
jmp 0x427a93
push 0xa
push edi
lea ecx, [ebp - 0x308]
call fcn.004299e2
test al, al
jne 0x427a93
mov dword [edi], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x308]
jmp 0x42755d
push str.IS_temp
lea ecx, [ebp - 0x244]
call fcn.0041d0fd
test eax, eax
jne 0x427612
mov byte [edi + 0x25e], 1
jmp 0x427612
cmp dword [edi + 0xc], 0
jne case.0x427444.71
push esi
mov dword [edi + 0xc], 3
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push 1
lea eax, [ebp - 0x5d9]
push eax
push esi
lea ecx, [ebp - 0x368]
call fcn.004115ed
mov byte [ebp - 4], 0x20
push ebx
lea eax, [ebp - 0x368]
push eax
push 8
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x368]
call fcn.00401b80
push ebx
push esi
push 0x4b7ac8
jmp 0x4281bd
push edi
lea eax, [ebp - 0x5ec]
push eax
push esi
mov dword [ebp - 0x5ec], ebx
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.0042827f
add esp, 0xc
test eax, eax
je case.0x427444.71
mov ecx, dword [edi + 0x260]
mov ax, word [ebp - 0x5ec]
mov word [ecx + 0x46], ax
jmp 0x427612
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
movzx ecx, word [eax]
push ebx
push eax
sub ecx, 0x31
je 0x427b8d
dec ecx
je 0x427b80
push 0x4b7ae0
jmp 0x4281bd
call esi
push eax
push 0x4b7ad8
jmp 0x4281bd
call esi
push eax
push 0x4b7ad0
jmp 0x4281bd
push str.noscript_uninst
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
jne 0x427bb7
push ebx
push ebx
push str._noscript_uninst
jmp 0x4281bd
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x398]
call fcn.004115ed
mov byte [ebp - 4], 0x23
push ebx
lea eax, [ebp - 0x398]
push eax
push 5
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x398]
call fcn.00401b80
push 2
mov ecx, edi
call fcn.00447608
jmp 0x4275ac
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4f18a8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x427612
mov byte [edi + 0x25d], 1
jmp 0x427612
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427c44
push ebx
push ebx
push str._removeonly
jmp 0x4281bd
push str.runas
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
je 0x427612
push str.runfromtemp
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
je 0x427612
push 6
push str.reboot
push esi
call fcn.0045568c
add esp, 0xc
test eax, eax
je 0x427612
push str.removeasmajorupgrade
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
je 0x427612
push ebx
push ebx
push 0x4b7b94
jmp 0x4281bd
push 0x4b7b9c
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
jne 0x427cc4
push ebx
push ebx
push str._SMS
jmp 0x4281bd
push str.show_eval_msg
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
jne 0x427ce4
mov eax, dword [edi + 0x260]
mov byte [eax + 0x18], 1
jmp 0x427612
push str.show_beta_msg
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
jne 0x427d04
mov eax, dword [edi + 0x260]
mov byte [eax + 0x19], 1
jmp 0x427612
push str.show_reboot_msg
push esi
call fcn.00456155
pop ecx
test eax, eax
mov eax, dword [edi + 0x260]
pop ecx
jne 0x427d24
mov byte [eax + 0x1d], 1
jmp 0x427612
push ebx
push ebx
push 0x4b7bd0
mov ecx, edi
mov byte [eax + 1], 1
call fcn.00442e86
mov eax, dword [edi + 0x260]
mov byte [eax + 1], 1
jmp 0x427612
push str.tempdisk1folder
call fcn.00454574
pop ecx
push eax
push ebx
push str.tempdisk1folder
lea ecx, [ebp - 0x244]
call fcn.00415d9f
test eax, eax
je 0x427612
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x427d90
push esi
mov ecx, edi
call fcn.004479bd
jmp 0x427e48
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov byte [ebp - 4], 0x25
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.004018f0
test eax, eax
jne 0x42813e
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004535d0
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x104
call fcn.004019e0
lea eax, [ebp - 0x218]
push eax
call fcn.004517e8
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.004479bd
push esi
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
push 3
jmp 0x427bf8
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx eax, word [eax]
cmp eax, 0x41
je 0x427f28
cmp eax, 0x4d
je 0x427ee4
cmp eax, 0x57
je 0x427ea0
cmp eax, 0x61
je 0x427f28
cmp eax, 0x6d
je 0x427ee4
cmp eax, 0x77
je 0x427ea0
push str.uninst
push esi
call fcn.00456155
pop ecx
pop ecx
test eax, eax
jne 0x427612
push ebx
push ebx
push str._uninst
jmp 0x4281bd
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x3f8]
call fcn.004115ed
mov byte [ebp - 4], 0x29
push ebx
lea eax, [ebp - 0x3f8]
push eax
push 0xa
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3f8]
jmp 0x42755d
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x458]
call fcn.004115ed
mov byte [ebp - 4], 0x2b
push ebx
lea eax, [ebp - 0x458]
push eax
push 0xb
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x458]
jmp 0x42755d
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x4b8]
call fcn.004115ed
mov byte [ebp - 4], 0x27
push ebx
lea eax, [ebp - 0x4b8]
push eax
push 9
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4b8]
jmp 0x42755d
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov byte [ebp - 4], 0x2d
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.004018f0
test eax, eax
jne 0x427fbc
push str.ISSetup
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
push 7
push str.verbose
push esi
call fcn.0045568c
add esp, 0xc
test eax, eax
je 0x428155
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_V_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x428075
lea eax, [ebp - 0x5ec]
push eax
lea ecx, [edi + 4]
mov dword [ebp - 0x5ec], 7
call fcn.004193b9
mov dword [ebp - 0x5ec], eax
cmp dword [eax + 0x14], ebx
je 0x428034
push 0x4b6a70
call fcn.00454574
pop ecx
mov ecx, dword [ebp - 0x5ec]
push eax
push 0x4b6a70
add ecx, 4
call fcn.0042115d
push 1
lea eax, [ebp - 0x5d9]
push eax
push esi
lea ecx, [ebp - 0x578]
call fcn.004115ed
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x5ec]
push eax
call fcn.00417934
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x578]
call fcn.00401b80
push 1
push esi
push 0x4b70c4
jmp 0x428160
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.004018f0
test eax, eax
jne 0x42813e
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004535d0
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x104
call fcn.004019e0
push esi
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
push 1
lea eax, [ebp - 0x5d9]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x518]
call fcn.004115ed
mov byte [ebp - 4], 0x30
push ebx
lea eax, [ebp - 0x518]
push eax
push 7
mov ecx, edi
call fcn.0041c6d2
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x518]
call fcn.00401b80
lea esi, [ebp - 0x218]
push 1
mov eax, esi
push eax
jmp 0x42806b
push edi
call fcn.004287f1
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
jmp 0x4281d0
push 1
add esi, 0xe
push esi
push str._verbose
mov ecx, edi
call fcn.00442e86
test esi, esi
je 0x42817e
push esi
push 0x4ef8a8
mov byte [0x4ef89c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004018c0
jmp 0x427612
mov dword [edi + 0x34], 1
jmp 0x427612
cmp dword [edi + 0xc], 0
jne case.0x427444.71
mov dword [edi + 0xc], 4
jmp 0x427612
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4b7cc8
mov ecx, edi
call fcn.00442e86
jmp 0x427612
push edi
call fcn.004287f1
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00401b80
mov eax, ebx
call fcn.00454601
ret