Function at 0x41607f
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x46fb7e
call fcn.004549fc
sub esp, 0x54c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0x476628
mov esi, 0x476620
cmp eax, edi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], esi
jne 0x4160b0
mov eax, 0x494ad8
lea ecx, [ebp - 0x1e]
push edi
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00403cfd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x4160d3.71
jmp dword [eax*4 + 0x416f8c]
push 0x48a764
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416116
mov ecx, dword [ebp + 8]
push edi
push edi
push str._auto
mov eax, dword [ecx + 0x268]
lea esi, [ecx + 0x268]
mov byte [eax + 2], 1
call fcn.0042e842
mov eax, dword [esi]
mov byte [eax + 2], 1
jmp 0x416f55
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
je 0x41612a
push eax
call fcn.00415199
pop ecx
jmp 0x4162c5
mov ecx, dword [ebp + 8]
call fcn.0042d249
test eax, eax
je 0x416192
mov eax, str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
mov dword [ebp - 0x210], ebx
mov ecx, eax
mov dword [ebp - 0x1f0], esi
test ecx, ecx
jne 0x416152
mov eax, 0x494ad8
lea ecx, [ebp - 0x23]
push edi
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.00403cfd
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
push 0x86d
push dword [ebp + 8]
call fcn.00415a20
and byte [ebp - 4], 0
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.00402424
jmp 0x4162c5
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x48b31c
mov dword [ecx + 0x14], 1
call fcn.0042e842
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x308], esi
jne 0x4161c6
mov eax, 0x494ad8
lea ecx, [ebp - 0x25]
push edi
push ecx
push eax
lea ecx, [ebp - 0x328]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x328]
push edi
push eax
push 0xe
mov byte [ebp - 4], 2
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x328]
jmp 0x416c0d
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x100], esi
jne 0x41621a
mov eax, 0x494ad8
lea ecx, [ebp - 0x26]
push edi
push ecx
push eax
lea ecx, [ebp - 0x120]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x120]
push edi
push eax
push 0xc
mov byte [ebp - 4], 3
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
jmp 0x416c0d
mov esi, dword [ebp + 8]
push 1
pop edi
mov ecx, esi
push edi
call fcn.0042b34a
mov dword [esi + 0x44], edi
jmp 0x416f55
mov eax, str.debuglog
mov dword [ebp - 0x260], ebx
mov ecx, eax
mov dword [ebp - 0x240], esi
test ecx, ecx
jne 0x416282
mov eax, 0x494ad8
lea ecx, [ebp - 0x18]
push edi
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00403cfd
lea eax, [ebp - 0x260]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0040582a
mov ebx, eax
lea ecx, [ebp - 0x260]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00402424
test bl, bl
push 1
je 0x4162d8
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402424
mov eax, edi
jmp 0x416f7d
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x48b300
jmp 0x416f4d
mov eax, 0x48b2f0
mov dword [ebp - 0x300], ebx
mov ecx, eax
mov dword [ebp - 0x2e0], esi
test ecx, ecx
jne 0x416308
mov eax, 0x494ad8
lea ecx, [ebp - 0x20]
push edi
push ecx
push eax
lea ecx, [ebp - 0x300]
call fcn.00403cfd
lea eax, [ebp - 0x300]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.0040582a
test eax, eax
jne 0x41638a
mov eax, 0x48b2ec
mov dword [ebp - 0x170], ebx
mov ecx, eax
mov dword [ebp - 0x150], esi
test ecx, ecx
jne 0x41634d
mov eax, 0x494ad8
lea ecx, [ebp - 0x1a]
push edi
push ecx
push eax
lea ecx, [ebp - 0x170]
call fcn.00403cfd
lea eax, [ebp - 0x170]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 6
call fcn.0041732b
lea ecx, [ebp - 0x170]
mov bl, al
mov byte [ebp - 4], 5
call fcn.00402424
test bl, bl
je 0x41638a
mov bl, 1
jmp 0x41638c
xor bl, bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x300]
call fcn.00402424
test bl, bl
je 0x4163d1
push 0xffffffffffffffff
lea eax, [ebp - 0x350]
push 5
push eax
lea ecx, [ebp - 0x58]
call fcn.00403f9d
mov ecx, dword [ebp + 8]
push edi
push eax
push 0x10
mov byte [ebp - 4], 7
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x350]
jmp 0x416c0d
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov ebx, eax
push str._IS_E_
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4163fe
mov esi, 0x497f70
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4164a0
mov dword [ebp + 0xc], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.00417089
test eax, eax
jne 0x4165b0
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x556]
mov word [ebp - 0x558], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push ebx
mov dword [ebp - 0x10], edx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x558]
mov esi, 0x497f70
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x416492
push dword [ebp + 0xc]
call edi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x4164a0
push dword [ebp + 0xc]
call edi
push esi
call fcn.004367f9
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 1
mov eax, dword [0x496f20]
test eax, eax
jne 0x4164be
mov eax, 0x4765fc
push eax
push esi
push 0x496f40
call fcn.0043691c
lea eax, [ebp - 0x24]
push 0
mov ebx, 0x494ad8
mov edi, 0x4765e0
mov esi, 0x4765d8
push eax
push ebx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x88], esi
call fcn.004011a9
mov eax, dword [str.PackageName]
mov byte [ebp - 4], 9
test eax, eax
mov dword [ebp - 0x2b0], edi
mov dword [ebp - 0x290], esi
jne 0x416512
mov eax, ebx
lea ecx, [ebp - 0x1c]
push 0
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.004011a9
mov eax, dword [str.Startup]
mov byte [ebp - 4], 0xa
test eax, eax
mov dword [ebp - 0x1c0], edi
mov dword [ebp - 0x1a0], esi
jne 0x41653f
mov eax, ebx
lea ecx, [ebp - 0x22]
push 0
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.004011a9
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x1c0]
push eax
push 5
mov byte [ebp - 4], 0xb
call fcn.0040a517
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0xa
call fcn.00401093
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 9
call fcn.00401093
and byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00401093
mov ecx, dword [ebp + 8]
push 2
call fcn.0042b36c
jmp 0x416f55
push dword [ebp + 8]
call fcn.00415199
cmp dword [ebp + 0xc], edi
pop ecx
je 0x416f6f
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x416f6f
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push ebx
call esi
movzx eax, word [eax]
sub eax, 0x31
je 0x41662b
dec eax
je 0x416619
dec eax
je 0x4165fc
push edi
push ebx
call esi
push eax
push 0x48b280
jmp 0x416f4d
mov edi, dword [ebp + 8]
push ebx
mov byte [edi + 0x264], 1
call esi
push eax
call esi
push eax
mov ecx, edi
call fcn.0042b236
jmp 0x416f55
push edi
push ebx
call esi
push eax
call esi
push eax
push 0x48b278
jmp 0x416f4d
push edi
push ebx
call esi
push eax
call esi
mov esi, dword [ebp + 8]
push eax
push 0x48af7c
mov ecx, esi
call fcn.0042e842
mov dword [esi + 0x48], 1
jmp 0x416f55
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push dword [ebp + 0xc]
call esi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x41666c
mov byte [edi + 0x25e], 1
push str.hide_splash
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x416f55
mov byte [edi + 0x25f], 1
jmp 0x416f55
mov eax, str.instance
mov dword [ebp - 0xd0], ebx
mov ecx, eax
mov dword [ebp - 0xb0], esi
test ecx, ecx
jne 0x4166a6
mov eax, 0x494ad8
lea ecx, [ebp - 0x15]
push edi
push ecx
push eax
lea ecx, [ebp - 0xd0]
call fcn.00403cfd
lea eax, [ebp - 0xd0]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xc
call fcn.0040582a
mov ebx, eax
lea ecx, [ebp - 0xd0]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00402424
test bl, bl
je 0x416f55
mov eax, dword [ebp + 8]
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x58]
lea esi, [eax + 0x260]
push 0xffffffffffffffff
lea eax, [ebp - 0xf8]
push 9
push eax
mov dword [esi], edi
call fcn.00403f9d
lea eax, [ebp - 0xf8]
lea ecx, [ebp - 0xf4]
neg eax
sbb eax, eax
push str.default
and eax, ecx
mov byte [ebp - 4], 0xd
push eax
call fcn.0040c60e
pop ecx
test al, al
pop ecx
je 0x416737
or dword [esi], 0xffffffff
jmp 0x41674b
push 0xa
push esi
lea ecx, [ebp - 0xf8]
call fcn.004172c6
test al, al
jne 0x41674b
mov dword [esi], edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0xf8]
jmp 0x416c0d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
jne case.0x4160d3.71
push dword [ebp + 0xc]
mov dword [eax + 0x14], 3
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x128], esi
jne 0x41678e
mov eax, 0x494ad8
lea ecx, [ebp - 0x16]
push edi
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x148]
push edi
push eax
push 8
mov byte [ebp - 4], 0xe
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x148]
call fcn.00402424
push edi
push dword [ebp + 0xc]
push 0x48b24c
jmp 0x416f4d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.00417383
add esp, 0xc
test eax, eax
je 0x416806
mov eax, dword [esi + 0x268]
mov cx, word [ebp - 0x14]
mov word [eax + 0x4a], cx
jmp 0x416f55
push esi
jmp 0x416f69
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
movzx ecx, word [eax]
sub ecx, 0x31
je 0x41683b
dec ecx
push edi
push eax
je 0x41682e
push 0x48b244
jmp 0x416f4d
call esi
push eax
push 0x48b23c
jmp 0x416f4d
push edi
push eax
call esi
push eax
push 0x48b234
jmp 0x416f4d
push str.noscript_uninst
push dword [ebp + 0xc]
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
jne 0x416869
push edi
push edi
push str._noscript_uninst
jmp 0x416f4d
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x178], esi
jne 0x416887
mov eax, 0x494ad8
lea ecx, [ebp - 0x17]
push edi
push ecx
push eax
lea ecx, [ebp - 0x198]
call fcn.00403cfd
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x198]
push edi
push eax
push 5
mov ecx, esi
mov byte [ebp - 4], 0xf
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x198]
call fcn.00402424
push 2
mov ecx, esi
call fcn.0042b36c
mov dword [esi + 0x44], 1
jmp 0x416f55
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x494b78
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x416f55
mov eax, dword [ebp + 8]
mov byte [eax + 0x265], 1
jmp 0x416f55
mov esi, dword [ebp + 0xc]
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41691c
push edi
push edi
push str._removeonly
jmp 0x416f4d
push str.runas
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
je 0x416f55
push str.runfromtemp
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
je 0x416f55
push 6
push str.reboot
push esi
call fcn.004552a9
add esp, 0xc
test eax, eax
je 0x416f55
push str.removeasmajorupgrade
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
je 0x416f55
push edi
push edi
push 0x48b180
jmp 0x416f4d
mov esi, dword [ebp + 0xc]
push 0x48b178
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
jne 0x41699f
push edi
push edi
push str._SMS
jmp 0x416f4d
push str.show_eval_msg
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
jne 0x4169c2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x268]
mov byte [eax + 0x17], 1
jmp 0x416f55
push str.show_beta_msg
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
jne 0x4169e5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x268]
mov byte [eax + 0x18], 1
jmp 0x416f55
push str.show_reboot_msg
push esi
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
jne 0x416a08
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x268]
mov byte [eax + 0x1c], 1
jmp 0x416f55
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x48b144
mov eax, dword [ecx + 0x268]
lea esi, [ecx + 0x268]
mov byte [eax + 1], 1
call fcn.0042e842
mov eax, dword [esi]
mov byte [eax + 1], 1
jmp 0x416f55
mov esi, str.tempdisk1folder
push esi
call fcn.00454a24
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x54]
call fcn.00403e17
cmp eax, edi
je 0x416f55
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x416a7a
mov ecx, dword [ebp + 8]
push esi
call fcn.0042b1e8
jmp 0x416b22
mov dword [ebp + 0xc], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x10
call fcn.00417089
test eax, eax
jne 0x416b3b
xor ebx, ebx
mov ecx, 0x81
lea edi, [ebp - 0x556]
mov word [ebp - 0x558], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x558]
push eax
call fcn.004367f9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x558]
push eax
call fcn.0042b1e8
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416b14
push dword [ebp + 0xc]
call esi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x416b22
push dword [ebp + 0xc]
call esi
mov ecx, dword [ebp + 8]
push 3
call fcn.0042b36c
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 1
jmp 0x416f55
push dword [ebp + 8]
call fcn.00415199
cmp dword [ebp + 0xc], edi
pop ecx
je 0x416f6f
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x416f6f
push dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
cmp eax, 0x41
je 0x416c69
cmp eax, 0x4d
je 0x416c17
cmp eax, 0x57
je 0x416bbd
cmp eax, 0x61
je 0x416c69
cmp eax, 0x6d
je 0x416c17
cmp eax, 0x77
je 0x416bbd
push str.uninst
push dword [ebp + 0xc]
call fcn.00455f65
pop ecx
test eax, eax
pop ecx
jne 0x416f55
push eax
push eax
push str._uninst
jmp 0x416f4d
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1c8], esi
jne 0x416bda
mov eax, 0x494ad8
lea ecx, [ebp - 0x19]
push 0
push ecx
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1e8]
push 0
push eax
push 0xa
mov byte [ebp - 4], 0x12
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1e8]
call fcn.00402424
jmp 0x416f55
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x218], esi
jne 0x416c34
mov eax, 0x494ad8
lea ecx, [ebp - 0x1b]
push 0
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x238]
push 0
push eax
push 0xb
mov byte [ebp - 4], 0x13
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
jmp 0x416c0d
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x268], esi
jne 0x416c86
mov eax, 0x494ad8
lea ecx, [ebp - 0x1d]
push 0
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x288]
push 0
push eax
push 9
mov byte [ebp - 4], 0x11
call fcn.0040a3f7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x288]
jmp 0x416c0d
mov dword [ebp - 0x10], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.00417089
test eax, eax
jne 0x416cff
push str.ISSetup
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], edi
je 0x416cff
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
push 7
push str.verbose
push dword [ebp + 0xc]
call fcn.004552a9
add esp, 0xc
test eax, eax
je 0x416edb
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_V_
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x416dcd
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 7
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 4]
call fcn.0040aea8
cmp dword [eax + 0xc], edi
mov dword [ebp - 0x14], eax
je 0x416d73
push 0x48a370
call fcn.00454a24
pop ecx
push eax
mov eax, dword [ebp - 0x14]
push 0x48a370
lea ecx, [eax + 4]
call fcn.004100fc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], ebx
cmp eax, edi
mov dword [ebp - 0x60], esi
jne 0x416d85
mov eax, 0x494ad8
lea ecx, [ebp - 0x1f]
push edi
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00403cfd
push dword [0x476630]
lea eax, [ebp - 0x80]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x7c]
and eax, ecx
push edi
push eax
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x15
lea ecx, [eax + 4]
call fcn.0040b08e
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x14
call fcn.00402424
mov esi, dword [ebp + 0xc]
push 1
push esi
jmp 0x416eb1
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00417089
test eax, eax
jne 0x416eb8
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x556]
mov word [ebp - 0x558], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x104
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x30]
push eax
push edx
push dword [ebp + 0xc]
mov dword [ebp - 0x30], edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], 0
je 0x416e49
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x558]
mov dword [ebp - 0x2d8], ebx
test eax, eax
mov dword [ebp - 0x2b8], esi
lea eax, [ebp - 0x558]
jne 0x416e6a
mov eax, 0x494ad8
lea ecx, [ebp - 0x21]
push 0
push ecx
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2d8]
push 0
push eax
push 7
mov byte [ebp - 4], 0x16
call fcn.0040a3f7
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x14
call fcn.00402424
lea eax, [ebp - 0x558]
push 1
lea esi, [ebp - 0x558]
push eax
push 0x48a8ac
jmp 0x416ee9
push dword [ebp + 8]
call fcn.00415199
cmp dword [ebp - 0x10], edi
pop ecx
je 0x416f6f
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
jmp 0x416f6f
mov eax, dword [ebp + 0xc]
push 1
lea esi, [eax + 0xe]
push esi
push str._verbose
mov ecx, dword [ebp + 8]
call fcn.0042e842
test esi, esi
je 0x416f08
push esi
push 0x494c40
mov byte [0x496c6c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0x10], 0
je 0x416f55
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
jmp 0x416f55
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 1
jmp 0x416f55
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
je 0x416f34
push eax
jmp 0x416f69
mov dword [eax + 0x14], 4
jmp 0x416f55
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x48b04c
mov ecx, dword [ebp + 8]
call fcn.0042e842
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402424
push 1
pop eax
jmp 0x416f7d
push dword [ebp + 8]
call fcn.00415199
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402424
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret