Function at 0x4364b0
Capabilities:
Check if file exists
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e91c
mov eax, dword fs:[0]
push eax
sub esp, 0xdd4
mov eax, dword [0x5b4450]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
push esi
lea eax, [ebp - 0xd98]
mov edi, ecx
push str.CUNINSTALLERDlg::CleanupThread
push eax
mov dword [ebp - 0xd14], edi
call fcn.0040ac70
add esp, 0xc
mov ebx, 1
mov dword [ebp - 4], esi
mov dword [ebp - 0xd74], ebx
mov dword [ebp - 0xda8], ebx
mov dword [ebp - 0xd58], ebx
mov dword [ebp - 0xdb4], ebx
mov dword [ebp - 0xda4], ebx
mov dword [ebp - 0xdbc], ebx
mov dword [ebp - 0xdc0], esi
mov dword [ebp - 0xd84], esi
call fcn.0044033f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x436552
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd78], eax
mov byte [ebp - 4], 1
call fcn.00442c4d
mov esi, dword [eax + 4]
mov dword [ebp - 0xd30], esi
call fcn.0040bea0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x858]
mov dword [ebp - 0xdac], eax
mov dword [ebp - 0xda0], ebx
mov dword [ebp - 0xdb8], ebx
mov dword [ebp - 0xd6c], ebx
mov dword [ebp - 0xd40], ebx
call fcn.00441e85
push 0
xor ecx, ecx
mov edx, edi
call fcn.00435410
call fcn.00442c4d
mov ecx, dword [eax + 4]
call fcn.004499ce
mov byte [ebp - 4], 2
mov dword [esi + 0x870], ebx
mov dword [esi + 0x17c], ebx
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4365ea
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd54], eax
mov byte [ebp - 4], 3
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43661a
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xd70], ebx
push 3
mov byte [ebp - 4], 4
call fcn.00440235
test eax, eax
je 0x43664f
push 3
push eax
lea ecx, [ebp - 0xd70]
call fcn.00401350
mov ebx, dword [ebp - 0xd70]
push 0x20
call fcn.00440235
test eax, eax
je 0x436668
push 0x20
push eax
lea ecx, [ebp - 0xd54]
call fcn.00401350
mov edx, dword [ebp - 0xd54]
push 0
push 0x34
push edi
mov ecx, ebx
call fcn.004344a0
mov ecx, dword [edi + 0x20]
push ecx
mov esi, eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp esi, 7
jne 0x4366ad
push str.cancel
lea edx, [ebp - 0xd98]
push 2
push edx
call fcn.0040aed0
add esp, 0xc
mov byte [ebp - 4], 3
lea eax, [ebx - 0x10]
jmp 0x438326
xor esi, esi
mov dword [ebp - 0xd10], esi
mov dword [ebp - 0xd18], esi
mov dword [ebp - 0xd2c], esi
cmp dword [0x5ceb20], esi
je 0x4366e3
push 5
lea ecx, [edi + 0x55c]
call fcn.0044bb86
mov ecx, dword [edi + 0x57c]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.0044033f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4366fd
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd50], eax
mov byte [ebp - 4], 5
call fcn.0044033f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x43672d
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd48], eax
mov byte [ebp - 4], 6
call fcn.0044033f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x43675d
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd4c], eax
mov byte [ebp - 4], 7
call fcn.0044033f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x43678d
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd7c], eax
mov byte [ebp - 4], 8
call fcn.0044033f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4367bd
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd38], eax
push 0x3e
mov byte [ebp - 4], 9
call fcn.00440235
cmp eax, esi
je 0x4367ec
push 0x3e
push eax
lea ecx, [ebp - 0xd50]
call fcn.00401350
push 0x3f
call fcn.00440235
cmp eax, esi
je 0x436805
push 0x3f
push eax
lea ecx, [ebp - 0xd48]
call fcn.00401350
push 0x41
call fcn.00440235
cmp eax, esi
je 0x43681e
push 0x41
push eax
lea ecx, [ebp - 0xd7c]
call fcn.00401350
push 0x40
call fcn.00440235
cmp eax, esi
je 0x436837
push 0x40
push eax
lea ecx, [ebp - 0xd4c]
call fcn.00401350
push 0x42
call fcn.00440235
cmp eax, esi
je 0x436850
push 0x42
push eax
lea ecx, [ebp - 0xd38]
call fcn.00401350
cmp dword [0x5ceb20], esi
je 0x43687c
push 0x3f2
lea ecx, [edi + 0x55c]
call fcn.0044b9a5
mov ecx, dword [ebp - 0xd50]
push ecx
mov ecx, eax
mov dword [ebp - 0xd2c], eax
call fcn.0044babb
mov edx, dword [edi + 0xb4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1004
push edx
call esi
cmp dword [0x5ceb20], 0
mov ebx, eax
mov dword [ebp - 0xd80], ebx
je 0x436916
mov eax, dword [edi + 0x610]
push 0
push 1
push 0x402
push eax
call esi
mov eax, 0x14
test ebx, ebx
jle 0x4368fb
cdq
idiv ebx
test eax, eax
jg 0x436905
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xd10], eax
cmp eax, 1
jg 0x4368ee
mov eax, 2
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd18], eax
mov eax, 1
jmp 0x436905
mov dword [ebp - 0xd18], 0
mov ecx, dword [edi + 0x610]
push 0
push eax
push 0x404
push ecx
call esi
xor ecx, ecx
mov dword [ebp - 0xd3c], ecx
cmp ebx, ecx
jle 0x4369f1
jmp 0x436930
mov edx, dword [ebp - 0xd3c]
push edx
lea ecx, [edi + 0x94]
call fcn.00449e67
mov ebx, eax
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4369d0
lea eax, [edi + 0x55c]
push eax
push edi
call fcn.0042f630
cmp dword [0x5ceb20], 0
mov dword [ebp - 0xd8c], eax
je 0x4369c3
cmp dword [ebp - 0xd18], 0
jg 0x4369bd
mov ecx, dword [edi + 0x610]
push 0
push 0
push 0x408
push ecx
call esi
cmp eax, 0x14
jge 0x4369c3
mov edx, dword [edi + 0x610]
push 0
push 0
push 0x405
push edx
call esi
mov eax, dword [ebp - 0xd50]
mov ecx, dword [ebp - 0xd2c]
push eax
call fcn.0044babb
mov ecx, dword [ebp - 0xd10]
mov dword [ebp - 0xd18], ecx
jmp 0x4369c3
dec dword [ebp - 0xd18]
cmp dword [ebp - 0xd8c], 2
je 0x436a9b
mov eax, dword [ebp - 0xd3c]
inc eax
mov dword [ebp - 0xd3c], eax
cmp eax, dword [ebp - 0xd80]
jl 0x436930
mov ebx, dword [ebp - 0xd80]
xor ecx, ecx
cmp dword [0x5ceb20], ecx
je 0x436a1f
mov ecx, dword [edi + 0x610]
push 0
push 0x14
push 0x402
push ecx
call esi
mov edx, dword [ebp - 0xd48]
mov ecx, dword [ebp - 0xd2c]
push edx
call fcn.0044babb
xor ecx, ecx
mov dword [ebp - 0xd8c], ecx
mov dword [ebp - 0xd1c], ebx
mov dword [ebp - 0xdc4], ecx
mov dword [ebp - 0xd44], ecx
mov dword [ebp - 0xd34], ecx
mov dword [ebp - 0xd9c], ecx
cmp dword [0x5ceb20], ecx
je 0x436b13
mov eax, 0x14
cmp ebx, ecx
jle 0x436aee
cdq
idiv ebx
cmp eax, ecx
jg 0x436af4
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xd10], eax
cmp eax, 1
jg 0x436a8e
mov eax, 2
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd18], eax
mov eax, 1
jmp 0x436af4
movzx edx, word [ebx + 2]
shl edx, 0x10
or edx, 1
mov dword [ebx], edx
call fcn.00442c4d
mov eax, dword [eax + 4]
push str.In_case_of_busy
mov dword [eax + 0x148], 1
lea eax, [ebp - 0xd98]
push 2
push eax
call fcn.0040aed0
add esp, 0xc
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0xd38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x438275
mov dword [ebp - 0xd18], ecx
push 0
push eax
mov eax, dword [edi + 0x610]
push 0x404
push eax
call esi
lea ecx, [edi + 0x55c]
mov dword [ebp - 0xd9c], ecx
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0xd3c], esi
cmp ebx, ecx
jle 0x437089
push esi
lea ecx, [edi + 0x94]
call fcn.00449e67
dec dword [ebp - 0xd1c]
mov ebx, eax
mov ecx, dword [ebx + 4]
mov dword [ebp - 0xd0c], 0
test ecx, ecx
je 0x436f15
mov edx, dword [ebx]
push edx
lea edx, [ebp - 0xd0c]
call fcn.0042f8b0
mov esi, eax
test esi, esi
jne 0x436c08
movzx eax, word [ebx + 2]
shl eax, 0x10
or eax, 0x10
mov dword [ebx], eax
mov eax, 1
cmp dword [ebp - 0xd0c], eax
jne 0x436b83
mov dword [ebp - 0xdc0], eax
cmp dword [0x5ceb20], 0
je 0x436ee4
cmp dword [ebp - 0xd18], 0
jg 0x436bfd
mov ecx, dword [ebp - 0xd14]
mov edx, dword [ecx + 0x610]
push 0
push 0
push 0x408
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x28
jge 0x436ee4
mov eax, dword [ebp - 0xd14]
mov ecx, dword [eax + 0x610]
push 0
push 0
push 0x405
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xd48]
mov ecx, dword [ebp - 0xd2c]
push edx
call fcn.0044babb
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xd18], eax
jmp 0x436ee4
dec dword [ebp - 0xd18]
jmp 0x436ee4
call fcn.00442c4d
mov eax, dword [eax + 4]
mov dword [eax + 0x148], 1
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x436548
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd24], eax
mov byte [ebp - 4], 0xa
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x436548
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 0xb
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x436548
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd28], edi
mov edx, dword [ebp - 0xd3c]
push ebx
push 0
push 0
mov byte [ebp - 4], 0xc
movzx ecx, word [ebx + 2]
push 0
shl ecx, 0x10
push 0
or ecx, 1
push 4
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xd14]
push 0
push edx
add ecx, 0x94
call fcn.0044a2aa
mov dword [ebp - 0xd8c], 1
cmp esi, 3
jne 0x436d0d
push 0xb
call fcn.00440235
test eax, eax
je 0x436cf7
push 0xb
push eax
lea ecx, [ebp - 0xd28]
call fcn.00401350
mov edi, dword [ebp - 0xd28]
mov eax, dword [ebx + 8]
push eax
lea ecx, [ebp - 0xd24]
push edi
push ecx
call fcn.00405ba0
add esp, 0xc
jmp 0x436d74
cmp esi, 4
jne 0x436d40
push 0x10
call fcn.00440235
test eax, eax
je 0x436d31
push 0x10
push eax
lea ecx, [ebp - 0xd28]
call fcn.00401350
mov edi, dword [ebp - 0xd28]
mov eax, dword [ebx + 8]
push eax
push eax
push edi
lea edx, [ebp - 0xd24]
push edx
jmp 0x436d6c
push 4
call fcn.00440235
test eax, eax
je 0x436d5f
push 4
push eax
lea ecx, [ebp - 0xd28]
call fcn.00401350
mov edi, dword [ebp - 0xd28]
mov eax, dword [ebx + 8]
push eax
push eax
push edi
lea eax, [ebp - 0xd24]
push eax
call fcn.00405ba0
add esp, 0x10
push 3
call fcn.00440235
cmp dword [ebp - 0xd1c], 0
jle 0x436f95
test eax, eax
je 0x436d9a
push 3
push eax
lea ecx, [ebp - 0xd0c]
call fcn.00401350
push 0x12
call fcn.00440235
test eax, eax
je 0x436db9
push 0x12
push eax
lea ecx, [ebp - 0xd28]
call fcn.00401350
mov edi, dword [ebp - 0xd28]
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [ebp - 0xd24]
call fcn.004058b0
mov esi, dword [ebp - 0xd14]
mov edx, dword [ebp - 0xd24]
lea ecx, [esi + 0x55c]
push ecx
mov ecx, dword [ebp - 0xd0c]
push 0x34
push esi
call fcn.004344a0
cmp eax, 7
je 0x436f33
cmp dword [0x5ceb20], 0
je 0x436e78
mov edx, dword [ebp - 0xd9c]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push eax
call fcn.00445c40
cmp dword [ebp - 0xd18], 0
jg 0x436e72
push 0
push 0
mov ecx, esi
mov edx, dword [ecx + 0x610]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x408
push edx
call esi
cmp eax, 0x28
jge 0x436e78
mov eax, dword [ebp - 0xd14]
mov ecx, dword [eax + 0x610]
push 0
push 0
push 0x405
push ecx
call esi
mov edx, dword [ebp - 0xd48]
mov ecx, dword [ebp - 0xd2c]
push edx
call fcn.0044babb
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xd18], eax
jmp 0x436e78
dec dword [ebp - 0xd18]
add edi, 0xfffffff0
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436e98
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xd0c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436ebe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xd24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436ee4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xd3c]
push ebx
push 0
push 0
push 0
push 0
push 4
push 0
push ecx
mov ecx, dword [ebp - 0xd14]
add ecx, 0x94
call fcn.0044a2aa
mov esi, dword [ebp - 0xd3c]
mov edi, dword [ebp - 0xd14]
inc esi
mov dword [ebp - 0xd3c], esi
cmp esi, dword [ebp - 0xd80]
jl 0x436b23
mov esi, dword [ebp - 0xd14]
jmp 0x43703a
add edi, 0xfffffff0
mov dword [ebp - 0xdc4], 1
mov byte [ebp - 4], 0xb
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x436f5d
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xd0c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436f83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xd24]
add eax, 0xfffffff0
jmp 0x437021
test eax, eax
je 0x436fa7
push 3
push eax
lea ecx, [ebp - 0xd0c]
call fcn.00401350
mov esi, dword [ebp - 0xd14]
mov ebx, dword [ebp - 0xd24]
lea ecx, [esi + 0x55c]
push ecx
mov ecx, dword [ebp - 0xd0c]
push 0x30
push esi
mov edx, ebx
call fcn.004344a0
add edi, 0xfffffff0
mov dword [ebp - 0xd44], 1
mov byte [ebp - 4], 0xb
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x436ff4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xd0c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43701a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
lea eax, [ebx - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43703a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, 1
cmp dword [ebp - 0xd3c], edi
jl 0x43704d
mov dword [ebp - 0xd34], edi
cmp dword [ebp - 0xdc0], edi
jne 0x43706f
lea ecx, [ebp - 0xd08]
call fcn.004168b0
cmp eax, edi
jne 0x43706f
lea ecx, [ebp - 0xd08]
call fcn.004163f0
cmp dword [ebp - 0xdc4], 0
jne 0x437c57
cmp dword [ebp - 0xd44], 0
jne 0x437c51
mov ebx, dword [ebp - 0xd14]
lea ecx, [ebx + 0x55c]
mov dword [ebp - 0xd1c], ecx
call fcn.004336a0
cmp dword [ebp - 0xd34], 0
mov dword [ebp - 0xd58], eax
jne 0x4371f4
mov esi, dword [ebp - 0xd30]
cmp dword [esi + 0x870], 0
je 0x4370db
call fcn.0040e2f0
mov ecx, str.SPOOLER
call fcn.0040e4e0
mov dword [esi + 0x870], 0
call fcn.00433a70
test eax, eax
jne 0x4371f4
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x437102
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd34], edi
mov byte [ebp - 4], 0xd
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x437132
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd44], esi
push 2
mov byte [ebp - 4], 0xe
call fcn.00440235
test eax, eax
je 0x437167
push 2
push eax
lea ecx, [ebp - 0xd34]
call fcn.00401350
mov edi, dword [ebp - 0xd34]
push 3
call fcn.00440235
test eax, eax
je 0x437186
push 3
push eax
lea ecx, [ebp - 0xd44]
call fcn.00401350
mov esi, dword [ebp - 0xd44]
mov ecx, dword [ebp - 0xd1c]
push ecx
push 0x30
push ebx
mov ecx, esi
mov edx, edi
call fcn.004344a0
call fcn.00442c4d
mov eax, dword [eax + 4]
mov dword [eax + 0x148], 1
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xd
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4371cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436acf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x436acf
cmp dword [0x5ceb20], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x437239
mov ecx, dword [ebx + 0x610]
push 0
push 0x28
push 0x402
push ecx
call esi
mov edx, dword [ebp - 0xd4c]
mov ecx, dword [ebp - 0xd2c]
push edx
call fcn.0044babb
mov eax, dword [ebx + 0x610]
push 0
push 0x14
push 0x404
push eax
call esi
push ebx
call fcn.00430c40
xor edi, edi
mov dword [ebp - 0xda8], eax
cmp dword [0x5ceb20], edi
je 0x437271
mov ecx, dword [ebx + 0x610]
push edi
push edi
push 0x405
push ecx
call esi
mov edx, dword [ebp - 0xd4c]
mov ecx, dword [ebp - 0xd2c]
push edx
call fcn.0044babb
mov esi, dword [ebp - 0xd30]
mov eax, dword [esi + 0x5e8]
mov ecx, str.CAPT
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4372a8
cmp dx, di
je 0x4372a4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4372a8
add eax, 4
add ecx, 4
cmp dx, di
jne 0x437282
xor eax, eax
jmp 0x4372ad
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
sete al
test al, al
je 0x4372cd
cmp dword [esi + 0x62c], edi
je 0x4372cd
call fcn.00422180
test eax, eax
jne 0x4372cd
mov dword [ebp - 0xd6c], edi
mov ecx, dword [ebp - 0xd1c]
call fcn.00431ff0
push 0x14
mov dword [ebp - 0xd74], eax
mov dword [ebp - 0xd60], edi
call fcn.00440188
add esp, 4
cmp eax, edi
je 0x437d97
mov dword [ebp - 0xd64], eax
mov dword [eax], eax
mov eax, dword [ebp - 0xd64]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0xd64]
mov dword [eax + 8], eax
mov eax, dword [ebp - 0xd64]
mov byte [eax + 0x10], 1
mov ecx, dword [ebp - 0xd64]
mov byte [ecx + 0x11], 1
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0xd64]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0xd68]
call fcn.0043b140
mov eax, dword [ebp - 0xd64]
mov esi, dword [sym.imp.WINSPOOL.DRV_EnumPrinterDriversW]
lea ecx, [ebp - 0xd28]
push ecx
mov dword [eax + 4], eax
mov eax, dword [ebp - 0xd64]
lea edx, [ebp - 0xd24]
push edx
push edi
push edi
mov dword [eax], eax
mov eax, dword [ebp - 0xd64]
push 3
mov dword [eax + 8], eax
push edi
push edi
mov dword [ebp - 0xd60], edi
mov dword [ebp - 0xd24], edi
mov dword [ebp - 0xd28], edi
call esi
test eax, eax
jne 0x437434
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x437763
mov eax, dword [ebp - 0xd24]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0xd34], edi
test edi, edi
je 0x437763
mov eax, dword [ebp - 0xd24]
lea ecx, [ebp - 0xd28]
push ecx
lea edx, [ebp - 0xd24]
push edx
push eax
push edi
push 3
push 0
push 0
call esi
test eax, eax
je 0x437423
xor ebx, ebx
cmp dword [ebp - 0xd28], ebx
jbe 0x43741b
mov esi, edi
add esi, 0x20
mov edi, edi
push esi
lea ecx, [ebp - 0xd68]
call fcn.0043bac0
push eax
lea ecx, [ebp - 0xd68]
push ecx
lea edi, [ebp - 0xd88]
call fcn.0043b6e0
inc ebx
add esi, 0x28
cmp ebx, dword [ebp - 0xd28]
jb 0x4373f0
mov edi, dword [ebp - 0xd34]
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
jne 0x437763
xor edi, edi
call fcn.00442c4d
mov esi, dword [eax + 4]
mov dword [ebp - 0xd0c], esi
cmp esi, edi
je 0x437763
cmp dword [esi + 0x134], edi
je 0x437763
push 0x208
lea edx, [ebp - 0x2a0]
push edi
push edx
call fcn.005373f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x2a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [esi + 0x134]
mov eax, esi
mov dword [ebp - 0xd10], edi
jmp 0x4374a0
mov eax, dword [eax]
mov ecx, 0x58a8c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4374cd
cmp dx, di
je 0x4374c9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4374cd
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4374a7
xor eax, eax
jmp 0x4374d2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
setne al
test al, al
je 0x437763
mov edx, dword [ebp - 0xd10]
mov ebx, dword [ebp - 0xd64]
lea edi, [edx + esi]
mov ecx, edi
lea eax, [ebp - 0xd68]
call fcn.0043b2c0
mov dword [ebp - 0xd84], eax
cmp eax, dword [ebp - 0xd64]
je 0x43755d
mov eax, dword [eax + 0xc]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x436548
mov edi, dword [edi]
mov ecx, eax
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437547
test dx, dx
je 0x437543
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437547
add eax, 4
add ecx, 4
test dx, dx
jne 0x437521
xor eax, eax
jmp 0x43754c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sets al
test al, al
jne 0x43755d
lea eax, [ebp - 0xd84]
jmp 0x43756f
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0xd34], eax
lea eax, [ebp - 0xd34]
cmp dword [eax], ebx
jne 0x4375cc
mov ecx, dword [ebp - 0xd0c]
mov eax, dword [ebp - 0xd10]
mov edx, dword [ecx + 0x134]
lea edi, [edx + eax + 4]
mov eax, dword [edi]
cmp dword [eax - 4], 1
jle 0x43759c
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, edi
call fcn.00401840
mov edi, dword [edi]
push edi
lea edx, [ebp - 0x2a0]
push edx
lea eax, [ebp - 0x4a8]
push 0x58b914
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x4a8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4375f0
mov eax, dword [ebp - 0xd10]
mov edx, dword [ebp - 0xd0c]
mov esi, dword [edx + 0x134]
add eax, 8
mov dword [ebp - 0xd10], eax
add eax, esi
xor edi, edi
jmp 0x4374a0
call fcn.0040bea0
cmp eax, 0xa
jne 0x437609
call fcn.0040e2f0
mov ecx, str.SPOOLER
call fcn.0040e4e0
mov eax, dword [ebp - 0xd0c]
mov esi, dword [eax + 0x134]
mov eax, esi
mov dword [ebp - 0xd10], 0
mov eax, dword [eax]
mov ecx, 0x58a8c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43764e
test dx, dx
je 0x43764a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43764e
add eax, 4
add ecx, 4
test dx, dx
jne 0x437628
xor eax, eax
jmp 0x437653
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x437763
mov edi, dword [ebp - 0xd10]
mov ebx, dword [ebp - 0xd64]
add edi, esi
mov ecx, edi
lea eax, [ebp - 0xd68]
call fcn.0043b2c0
mov dword [ebp - 0xd84], eax
cmp eax, dword [ebp - 0xd64]
je 0x4376cf
mov eax, dword [eax + 0xc]
test eax, eax
je 0x436548
mov ecx, eax
mov eax, dword [edi]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4376be
test dx, dx
je 0x4376ba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4376be
add eax, 4
add ecx, 4
test dx, dx
jne 0x437698
xor eax, eax
jmp 0x4376c3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
js 0x4376cf
lea eax, [ebp - 0xd84]
jmp 0x4376e1
mov edx, dword [ebp - 0xd64]
mov dword [ebp - 0xd34], edx
lea eax, [ebp - 0xd34]
cmp dword [eax], ebx
jne 0x437741
mov eax, dword [ebp - 0xd0c]
mov edi, dword [eax + 0x134]
add edi, dword [ebp - 0xd10]
mov ebx, 1
mov eax, dword [edi]
cmp dword [eax - 4], ebx
jle 0x43770e
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, edi
call fcn.00401840
mov edx, dword [ebp - 0xd0c]
mov eax, dword [edx + 0x134]
mov ecx, dword [ebp - 0xd10]
mov esi, dword [edi]
lea edi, [eax + ecx + 4]
mov eax, dword [edi]
cmp dword [eax - 4], ebx
jle 0x437738
mov edx, dword [eax - 0xc]
push edx
mov ecx, edi
call fcn.00401840
mov edi, dword [edi]
mov ecx, esi
call fcn.004162a0
mov eax, dword [ebp - 0xd10]
mov ecx, dword [ebp - 0xd0c]
mov esi, dword [ecx + 0x134]
add eax, 8
mov dword [ebp - 0xd10], eax
add eax, esi
jmp 0x437621
cmp dword [0x5ceb20], 0
mov esi, dword [ebp - 0xd14]
je 0x437806
mov edx, dword [esi + 0x610]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x50
push 0x402
push edx
call edi
mov eax, dword [ebp - 0xd38]
mov ebx, dword [ebp - 0xd2c]
push eax
mov ecx, ebx
call fcn.0044babb
mov ecx, dword [esi + 0x610]
push 0
push 3
push 0x404
push ecx
call edi
cmp dword [0x5ceb20], 0
je 0x437806
mov edx, dword [esi + 0x610]
push 0
push 0
push 0x405
push edx
call edi
mov eax, dword [ebp - 0xd38]
push eax
mov ecx, ebx
call fcn.0044babb
cmp dword [0x5ceb20], 0
je 0x437806
mov ecx, dword [esi + 0x610]
push 0
push 0
push 0x405
push ecx
call edi
mov edx, dword [ebp - 0xd38]
push edx
mov ecx, ebx
call fcn.0044babb
mov ecx, dword [ebp - 0xd1c]
push esi
call fcn.00434970
mov dword [ebp - 0xd84], eax
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x437832
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd0c], esi
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xd30]
mov eax, dword [ecx + 0x114]
lea edi, [eax - 0x10]
lea ebx, [esi - 0x10]
cmp edi, ebx
je 0x43790d
cmp dword [ebx + 0xc], 0
jl 0x4378f7
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x4378f7
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x437897
cmp eax, dword [edi]
jne 0x437897
mov esi, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4378d3
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x4378b0
call fcn.00401830
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.005339f7
add esp, 0x10
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4378ec
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
add esi, 0x10
mov dword [ebp - 0xd0c], esi
jmp 0x43790d
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0xd0c]
call fcn.004016b0
mov esi, dword [ebp - 0xd0c]
cmp dword [ebp - 0xd58], 0
je 0x437a0d
cmp dword [ebp - 0xd84], 0
je 0x437a0d
mov ecx, 0x58f8c0
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437956
test dx, dx
je 0x437952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437956
add eax, 4
add ecx, 4
test dx, dx
jne 0x437930
xor eax, eax
jmp 0x43795b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x437a54
call fcn.0040dfd0
mov edi, eax
mov dword [ebp - 0xd58], edi
call fcn.0040fea0
test edi, edi
je 0x437a5e
test eax, eax
je 0x437a5e
push 0x80
lea ecx, [ebp - 0x98]
push 0
push ecx
call fcn.005373f0
mov edx, dword [ebp - 0xd30]
mov eax, dword [edx + 0xe8]
add esp, 0xc
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0xd90]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437a5e
mov eax, dword [ebp - 0xd90]
lea edx, [ebp - 0x98]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0xd90]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd90], 0
jmp 0x437a5e
mov ecx, 0x58f8c0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437a3a
test dx, dx
je 0x437a36
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437a3a
add eax, 4
add ecx, 4
test dx, dx
jne 0x437a14
xor eax, eax
jmp 0x437a3f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x437a54
push 0
xor ebx, ebx
call fcn.00411970
add esp, 4
mov dword [ebp - 0xd58], 1
cmp dword [0x5ceb20], 0
je 0x437a95
mov edx, dword [ebp - 0xd14]
mov eax, dword [edx + 0x610]
push 0
push 0
push 0x405
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xd38]
push ecx
mov ecx, dword [ebp - 0xd2c]
call fcn.0044babb
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0xdac], 0xa
je 0x437ab9
call fcn.0041cf40
mov dword [ebp - 0xdbc], eax
mov dword [ebp - 4], 0x10
jmp 0x437b6d
xor ecx, ecx
call fcn.0041ee60
mov dword [ebp - 0xda0], eax
mov dword [ebp - 4], 0x10
jmp 0x437b6d
cmp dword [0x5ceb20], 0
je 0x437ba4
mov edx, dword [ebp - 0xd14]
mov eax, dword [edx + 0x610]
push 0
push 0
push 0x405
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xd38]
push ecx
mov ecx, dword [ebp - 0xd2c]
call fcn.0044babb
cmp dword [ebp - 0xd74], 0
je 0x437bb8
call fcn.00421d40
mov dword [ebp - 0xda4], eax
cmp dword [0x5ceb20], 0
je 0x437bef
mov edx, dword [ebp - 0xd14]
mov eax, dword [edx + 0x610]
push 0
push 0
push 0x405
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xd38]
push ecx
mov ecx, dword [ebp - 0xd2c]
call fcn.0044babb
call fcn.00434d00
mov dword [ebp - 0xd84], eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0xf
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x437c1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0xd64]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [ebp - 0xdac]
lea esi, [ebp - 0xd68]
call fcn.0043b200
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0xd64]
push ecx
call fcn.004401b7
add esp, 4
mov edi, 1
mov esi, dword [ebp - 0xd14]
cmp dword [0x5ceb20], 0
je 0x437c88
mov ecx, dword [esi + 0x610]
push 0
push 0x64
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xd38]
mov ecx, dword [ebp - 0xd2c]
push edx
call fcn.0044babb
cmp dword [ebp - 0xd74], edi
jne 0x437f9f
call fcn.00418870
mov edi, dword [ebp - 0xd30]
mov ebx, eax
test ebx, ebx
jne 0x437df0
mov eax, dword [edi + 0x5e8]
mov ecx, str.CAPT
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437dca
test dx, dx
je 0x437cde
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437dca
add eax, 4
add ecx, 4
test dx, dx
jne 0x437cb4
xor eax, eax
jmp 0x437dcf
lea edx, [ebp - 0xd44]
push edx
lea ecx, [ebp - 0xdd0]
mov dword [ebp - 0xd44], edi
call fcn.00533d5a
push 0x5a7844
lea eax, [ebp - 0xdd0]
push eax
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.005372e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x437df0
cmp dword [edi + 0x62c], 0
je 0x437df0
call fcn.004228f0
test eax, eax
jne 0x437df0
mov dword [ebp - 0xd40], eax
cmp dword [ebp - 0xda0], 1
jne 0x437e2c
test ebx, ebx
jne 0x437f9f
cmp dword [ebp - 0xdb8], ebx
je 0x437f9f
mov eax, dword [edi + 0x140]
cmp dword [eax + 0x54], ebx
je 0x437f9f
call fcn.0040edb0
mov dword [ebp - 0xdb4], eax
jmp 0x437f9f
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x437e46
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd30], eax
mov edi, 0x58a8c8
shr edi, 0x10
mov byte [ebp - 4], 0x18
test edi, edi
jne 0x437e89
mov ecx, 0x58a8c8
movzx ebx, cx
push ebx
call fcn.00440235
test eax, eax
je 0x437e9b
push ebx
push eax
lea ecx, [ebp - 0xd30]
call fcn.00401350
jmp 0x437e9b
push 0
push 0x58a8c8
lea ecx, [ebp - 0xd30]
call fcn.004016b0
mov bl, 0x19
mov byte [ebp - 4], bl
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x437eba
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 0x1a
test edi, edi
jne 0x437ef5
mov ecx, 0x58a8c8
movzx edi, cx
push edi
call fcn.00440235
test eax, eax
je 0x437f07
push edi
push eax
lea ecx, [ebp - 0xd0c]
call fcn.00401350
jmp 0x437f07
push 0
push 0x58a8c8
lea ecx, [ebp - 0xd0c]
call fcn.004016b0
push 3
mov byte [ebp - 4], 0x1b
call fcn.00440235
test eax, eax
je 0x437f24
push 3
push eax
lea ecx, [ebp - 0xd0c]
call fcn.00401350
push 0x55
call fcn.00440235
test eax, eax
je 0x437f3d
push 0x55
push eax
lea ecx, [ebp - 0xd30]
call fcn.00401350
mov edi, dword [ebp - 0xd0c]
lea edx, [esi + 0x55c]
push edx
mov edx, dword [ebp - 0xd30]
push 0x30
push esi
mov ecx, edi
call fcn.004344a0
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437f79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xd30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437f9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp - 0xd8c], 1
je 0x437ffd
cmp dword [ebp - 0xda8], 0
je 0x437ffd
cmp dword [ebp - 0xd74], 0
je 0x437ffd
cmp dword [ebp - 0xd58], 0
je 0x437ffd
cmp dword [ebp - 0xdb4], 0
je 0x437ffd
cmp dword [ebp - 0xdbc], 0
je 0x437ffd
cmp dword [ebp - 0xd84], 0
je 0x437ffd
cmp dword [ebp - 0xda4], 0
je 0x437ffd
cmp dword [ebp - 0xd6c], 0
je 0x437ffd
cmp dword [ebp - 0xd40], 0
jne 0x438100
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x438017
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xd40], ebx
mov byte [ebp - 4], 0x1c
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x438047
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd6c], edi
push 0x21
mov byte [ebp - 4], 0x1d
call fcn.00440235
test eax, eax
je 0x43807c
push 0x21
push eax
lea ecx, [ebp - 0xd40]
call fcn.00401350
mov ebx, dword [ebp - 0xd40]
push 3
call fcn.00440235
test eax, eax
je 0x43809b
push 3
push eax
lea ecx, [ebp - 0xd6c]
call fcn.00401350
mov edi, dword [ebp - 0xd6c]
lea ecx, [esi + 0x55c]
push ecx
push 0x30
push esi
mov ecx, edi
mov edx, ebx
call fcn.004344a0
call fcn.00442c4d
mov eax, dword [eax + 4]
mov dword [eax + 0x148], 1
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0x1c
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4380e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438100
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0xb4]
push 0
push 0
push 0xb
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [ebp - 0xd80]
xor edi, edi
test ebx, ebx
jle 0x438157
nop
push edi
lea ecx, [esi + 0x94]
call fcn.00449e67
cmp word [eax], 0x10
jne 0x438152
push eax
call fcn.004401b7
mov edx, dword [esi + 0xb4]
add esp, 4
push 0
push edi
push 0x1008
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
dec edi
dec ebx
inc edi
cmp edi, ebx
jl 0x438120
mov eax, dword [esi + 0xb4]
push 0
push 1
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0xdb0]
push str.CUNINSTALLERDlg::beSilent
push ecx
call fcn.0040ac70
add esp, 0xc
mov byte [ebp - 4], 0x1e
call fcn.00442c4d
mov edi, dword [eax + 4]
mov edx, dword [edi + 0x140]
mov eax, dword [edx + 0x28]
push eax
push str.return___08x
lea eax, [ebp - 0xdb0]
push 2
push eax
call fcn.0040aed0
mov ecx, dword [edi + 0x140]
mov edi, dword [ecx + 0x28]
add esp, 0x10
lea ecx, [ebp - 0xdb0]
mov byte [ebp - 4], 9
call fcn.0040ae50
test edi, edi
je 0x438245
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4381e2
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd40], edi
push 0x38
mov byte [ebp - 4], 0x1f
call fcn.00440235
test eax, eax
je 0x438217
push 0x38
push eax
lea ecx, [ebp - 0xd40]
call fcn.00401350
mov edi, dword [ebp - 0xd40]
push 0
push 0
push esi
xor ecx, ecx
mov edx, edi
call fcn.004344a0
lea eax, [edi - 0x10]
mov byte [ebp - 4], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438245
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x58a8c8
lea ecx, [ebp - 0xd98]
push 2
push ecx
call fcn.0040aed0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0xd38]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x438281
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xd7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4382a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xd4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4382cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xd48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4382f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xd50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438319
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xd70]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43833f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xd54]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x438365
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xd1d]
mov byte [ebp - 4], 1
call fcn.0040aa10
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xd78]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43839a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xd98]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ae50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005337cb
mov esp, ebp
pop ebp
ret