Function at 0x402930
Capabilities:
Check if file exists
Copy file
Set registry value

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x70
mov dword [ebp - 0x2c], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ecx
mov esi, dword [ebp - 0x34]
cmp eax, ecx
je 0x402c43
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x402c38
mov edx, dword [esi + 0x1c]
mov edi, dword [ebx + 8]
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [ebp - 0x30], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0x30]
test eax, eax
jne 0x402c00
mov edx, dword [esi + 0x20]
mov edi, dword [ebx + 0xc]
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [ebp - 0x30], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0x30]
test eax, eax
jne 0x402cc0
mov edx, dword [esi + 0x24]
mov edi, dword [ebx + 0x10]
mov dword [esp], edx
mov dword [esp + 4], edi
mov dword [ebp - 0x30], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
mov edx, dword [ebp - 0x30]
test eax, eax
jne 0x402d80
mov eax, esi
mov dword [ebp - 0x34], esi
mov esi, dword [ebx + 4]
mov edi, dword [eax + 0x18]
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x402de0
mov eax, dword [ebp - 0x34]
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 0x4c], edi
cmp eax, 2
je 0x402dc0
cmp eax, 1
je 0x402d00
mov dword [esp + 4], str.amd64
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x402f40
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x28]
mov ebx, dword [eax + 0x28]
lea esi, [eax + 0x28]
mov dword [eax + 8], 1
cmp esi, ebx
je 0x402a6c
mov ecx, dword [ebp - 0x2c]
lea edx, [ebx + 8]
mov eax, edi
call fcn.00402930
test eax, eax
je 0x402bf0
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x402a51
test byte [section..data], 8
je 0x402afb
mov ebx, dword [ebp - 0x2c]
mov eax, str.__dryrun_
test ebx, ebx
mov ebx, 0x40a2be
cmovne ebx, eax
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x40421f
shr eax, 0x10
test eax, eax
je 0x40353d
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x4c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x402acf
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Installing_assembly__s_s_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ae0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x404064
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x402b2f
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x34]
mov ebx, dword [eax + 0x30]
lea ecx, [eax + 0x30]
cmp ebx, ecx
je 0x4043dd
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0xc]
call fcn.00402330
mov edi, eax
test eax, eax
je 0x4043fc
mov edx, dword [ebx + 8]
call fcn.00401e30
mov esi, eax
test eax, eax
je 0x402f28
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x30]
call fcn.00401e30
mov dword [ebp - 0x28], eax
test eax, eax
je 0x403348
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x402f80
test byte [section..data], 8
jne 0x403368
mov eax, esi
call fcn.00401d70
test eax, eax
jne 0x403240
mov dword [ebp - 0x2c], esi
test byte [section..data], 2
jne 0x403ffb
mov dword [esp], edi
mov edi, dword [ebp - 0x3c]
call edi
mov dword [esp], esi
call edi
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call edi
test byte [section..data], 2
jne 0x40349c
lea esi, [esi]
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 4], 0x40a06e
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40299b
mov dword [esp + 4], 0x40a06e
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x40299b
lea esi, [esi]
mov esi, dword [esi]
cmp dword [ebp - 0x28], esi
jne 0x402960
test byte [section..data], 1
je 0x402bf0
mov ebx, dword [ebx]
test ebx, ebx
je 0x40355f
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x404145
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x402c8e
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Assembly__s_not_found_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ae0
jmp 0x402bf0
mov dword [esp + 4], 0x40a06e
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4029bc
mov dword [esp + 4], 0x40a06e
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4029bc
jmp 0x402c38
test byte [section..data], 2
je 0x402bf0
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x404229
shr eax, 0x10
test eax, eax
je 0x403525
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x4c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x402d51
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Assembly__s_caused_circular_dependency_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x402bf0
mov dword [esp + 4], 0x40a06e
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4029dd
mov dword [esp + 4], 0x40a06e
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4029dd
jmp 0x402c38
test byte [section..data], 8
jne 0x403414
mov eax, 1
jmp 0x402bf2
mov dword [esp + 4], 0x40a06e
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4029fd
mov dword [esp + 4], 0x40a06e
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4029fd
test byte [section..data], 4
je 0x4029fd
mov eax, dword [ebp - 0x34]
mov esi, dword [eax + 0x18]
test esi, esi
je 0x4041df
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x40350d
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x30], 0x40a015
sub esp, 8
test eax, eax
jne 0x402e68
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov dword [ebp - 0x30], eax
mov esi, dword [ebx + 4]
test esi, esi
je 0x404200
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x404122
mov dword [esp + 4], 0xffffffff
mov edi, 0x40a015
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x402eab
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov edi, eax
mov ebx, dword [ebx]
test ebx, ebx
je 0x40415a
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x40410d
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x402eed
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Ignoring_version_difference_for__s__expected__s__found__s__n
mov dword [esp + 8], str.lookup_assembly
mov dword [esp + 0x18], ecx
mov dword [esp + 4], 0x408000
mov dword [esp], 2
call fcn.00401ae0
jmp 0x4029fd
mov dword [esp], edi
mov edi, dword [ebp - 0x3c]
call edi
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call edi
jmp 0x402bd9
test byte [section..data], 2
je 0x402bf0
mov dword [esp + 0xc], str.Cannot_install_amd64_assembly_in_32_bit_prefix_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x402bf0
mov dword [esp], eax
call dword [sym.imp.shlwapi.dll_PathFileExistsW]
sub esp, 4
test eax, eax
je 0x403f78
mov dword [esp], edi
mov edi, dword [ebp - 0x3c]
call edi
mov dword [esp], esi
call edi
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call edi
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x38]
cmp ebx, eax
jne 0x402b4b
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x38]
add eax, 0x38
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x38], ecx
cmp ecx, eax
je 0x4035ba
lea esi, [esi]
nop
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax + 8]
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcschr]
mov edi, eax
test eax, eax
je 0x4037ae
mov ecx, eax
mov eax, str.HKEY_CLASSES_ROOT
sub ecx, ebx
mov esi, ecx
sar esi, 1
nop
add eax, 2
cmp word [eax], 0
jne 0x403010
sub eax, str.HKEY_CLASSES_ROOT
cmp ecx, eax
je 0x403d28
mov eax, str.HKEY_CURRENT_CONFIG
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403030
sub eax, str.HKEY_CURRENT_CONFIG
cmp ecx, eax
je 0x403d50
mov eax, str.HKEY_CURRENT_USER
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403050
sub eax, str.HKEY_CURRENT_USER
cmp ecx, eax
je 0x403d80
mov eax, str.HKEY_LOCAL_MACHINE
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403070
sub eax, str.HKEY_LOCAL_MACHINE
cmp ecx, eax
je 0x403db0
mov eax, str.HKEY_USERS
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x403090
sub eax, str.HKEY_USERS
cmp ecx, eax
jne 0x403958
mov dword [esp + 8], esi
mov dword [esp + 4], str.HKEY_USERS
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
jne 0x403958
mov ebx, 0x80000003
test byte [section..data], 8
jne 0x403b28
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x403aa8
mov eax, dword [ebp - 0x38]
mov edi, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 0x30], eax
mov ecx, edi
cmp edi, eax
je 0x4035a7
mov eax, dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov esi, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
test byte [section..data], 8
jne 0x4035e0
mov dword [esp + 4], str.REG_SZ
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x403570
mov dword [esp + 4], str.REG_EXPAND_SZ
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4036a0
mov dword [esp + 4], str.REG_MULTI_SZ
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4036c0
mov dword [esp + 4], str.REG_DWORD
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4037c0
mov dword [esp + 4], str.REG_BINARY
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
je 0x4039e0
movzx eax, byte [section..data]
test al, 1
jne 0x4038d8
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x403887
lea esi, [esi]
test al, 2
je 0x402bf0
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4043be
shr eax, 0x10
test eax, eax
je 0x4043a6
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x4c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x40320c
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_install_registry_keys_for__s_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x402bf0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CopyFileExW]
sub esp, 0x18
test eax, eax
jne 0x402f94
mov dword [ebp - 0x2c], esi
test byte [section..data], 2
je 0x402bbc
mov eax, dword [ebp - 0x2c]
shr eax, 0x10
test eax, eax
je 0x404363
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0x2c]
mov ebx, 0x40a015
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x4032c7
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov ebx, eax
mov eax, dword [ebp - 0x28]
shr eax, 0x10
test eax, eax
je 0x40434b
mov dword [esp + 4], 0xffffffff
mov esi, dword [ebp - 0x28]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403303
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_copy__s_to__s_n
mov dword [esp + 8], str.install_files_copy
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
mov dword [esp], edi
mov edi, dword [ebp - 0x3c]
call edi
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
jmp 0x402bc7
mov dword [esp], edi
mov edi, dword [ebp - 0x3c]
call edi
mov dword [esp], esi
call edi
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call edi
jmp 0x402bd9
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x403484
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x40], 0x40a015
sub esp, 8
test eax, eax
jne 0x4033a3
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
shr eax, 0x10
test eax, eax
je 0x4040be
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x4033e0
mov eax, dword [ebp - 0x28]
mov edx, 0xffffffff
call fcn.004014a0
mov ecx, dword [ebp - 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Copying__s_____s_n
mov dword [esp + 8], str.install_files_copy
mov dword [esp + 4], 0x408000
mov dword [esp + 0x14], ecx
mov dword [esp], 3
call fcn.00401ae0
jmp 0x402b9d
mov eax, edi
test edi, edi
je 0x403555
shr eax, 0x10
test eax, eax
je 0x4041eb
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x4c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403457
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Assembly__s_already_installed_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ae0
jmp 0x402dcd
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016c0
mov dword [ebp - 0x40], eax
jmp 0x4033a3
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x404341
shr eax, 0x10
test eax, eax
je 0x40426a
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x4c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x4034e0
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_install_all_files_for__s_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x402bf0
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016c0
mov dword [ebp - 0x30], eax
jmp 0x402e68
mov eax, dword [ebp - 0x4c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x402d51
mov eax, dword [ebp - 0x4c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x402acf
mov eax, 0x40a00e
jmp 0x403457
mov eax, 0x40a00e
jmp 0x402c8e
mov eax, dword [ebp - 0x2c]
mov ecx, 1
mov edx, esi
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call fcn.00402530
test eax, eax
je 0x4037a3
mov esi, dword [esi]
mov edi, dword [ebp - 0x30]
cmp esi, edi
jne 0x403100
mov ebx, eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4040d8
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
cmp eax, ecx
jne 0x402fe0
test byte [section..data], 8
jne 0x404164
mov eax, dword [ebp - 0x34]
mov dword [eax + 8], 2
jmp 0x402dcd
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4038a8
mov eax, edi
shr eax, 0x10
test eax, eax
je 0x403818
mov dword [esp + 4], 0xffffffff
mov ebx, 0x40a015
mov dword [esp], edi
mov eax, dword [ebp - 0x40]
call eax
sub esp, 8
test eax, eax
jne 0x403622
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov ebx, eax
mov edi, dword [esi + 8]
test edi, edi
je 0x403835
mov eax, edi
shr eax, 0x10
test eax, eax
je 0x403800
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403665
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Setting_registry_key__s___s_n
mov dword [esp + 8], str.install_registry_value
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ae0
jmp 0x403113
mov eax, dword [ebp - 0x2c]
mov ecx, 2
mov edx, esi
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call fcn.00402530
jmp 0x403585
mov edx, dword [esi + 0x10]
test edx, edx
je 0x4038b8
movzx ecx, word [edx]
mov dword [ebp - 0x48], edx
test cx, cx
mov dword [ebp - 0x44], ecx
je 0x4038b8
movq xmm0, qword [0x40abc8]
movq qword [ebp - 0x1c], xmm0
mov dword [esp], pe_nt_image_headers32
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4037a3
mov ecx, dword [ebp - 0x44]
mov edi, dword [sym.imp.ucrtbase.dll_wcsstr]
cmp cx, 0x22
jne 0x403cef
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x44], esi
jmp 0x40376a
mov ecx, eax
mov edx, esi
lea eax, [ebp - 0x20]
sub ecx, esi
sar ecx, 1
call fcn.004019a0
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, 0x40a5da
call fcn.004019a0
movzx eax, word [ebx + 2]
test ax, ax
je 0x403c60
cmp ax, 0x2c
jne 0x403ca0
movzx eax, word [ebx + 4]
lea edx, [ebx + 4]
cmp ax, 0x22
jne 0x403ce0
lea esi, [edx + 2]
mov dword [esp + 4], 0x40a5d6
mov dword [esp], esi
call edi
mov ebx, eax
test eax, eax
jne 0x403720
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x20]
mov dword [esp], ebx
mov eax, dword [ebp - 0x3c]
call eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4038b8
cmp word [eax], 0
je 0x4038b8
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4040d6
movzx eax, byte [section..data]
jmp 0x4031c0
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4037e0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x403ba0
mov eax, 1
jmp 0x40358d
mov dword [esp + 4], edi
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x403665
mov dword [esp + 4], edi
mov dword [esp], 0x40a008
call fcn.004016c0
mov edi, dword [esi + 8]
mov ebx, eax
test edi, edi
jne 0x40362d
mov eax, 0x40a00e
jmp 0x403665
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x4038c7
test byte [section..data], 2
jne 0x403f00
mov dword [esp], ebx
mov eax, dword [ebp - 0x3c]
call eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
movzx eax, byte [section..data]
sub esp, 4
jmp 0x4031c0
mov ebx, 0x40a00e
jmp 0x403622
xor eax, eax
xor ebx, ebx
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x403840
mov dword [esp], ebx
mov eax, dword [ebp - 0x3c]
call eax
jmp 0x4037ee
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x403ee2
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x403de0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x40391b
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_registry_value_type__s_n
mov dword [esp + 8], str.install_registry_value
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ae0
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x4037ae
jmp 0x403887
movzx eax, byte [section..data]
test al, 1
je 0x4031c0
test ebx, ebx
je 0x4041d5
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x4040f8
mov dword [esp + 4], esi
mov dword [ebp - 0x28], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, 0x40a015
test ecx, ecx
jne 0x4039a4
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unknown_root_key__s_n
mov dword [esp + 8], str.split_registry_key
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ae0
movzx eax, byte [section..data]
jmp 0x4031c0
mov ebx, dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x1c], ax
test ebx, ebx
je 0x404139
movzx edx, word [ebx]
mov eax, ebx
test dx, dx
je 0x40409a
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x403a10
sub eax, ebx
mov dword [ebp - 0x48], edx
test al, 2
jne 0x4037a3
sar eax, 2
mov dword [ebp - 0x58], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x4037a3
mov edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x54], esi
mov esi, eax
mov edi, ecx
lea esi, [esi]
mov word [ebp - 0x20], dx
movzx eax, word [ebx + 2]
add esi, 1
add ebx, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcstoul]
mov byte [esi - 1], al
movzx edx, word [ebx]
test dx, dx
jne 0x403a50
mov esi, dword [ebp - 0x54]
mov edi, dword [ebp - 0x2c]
test edi, edi
je 0x403df5
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
jmp 0x4037ee
lea eax, [ebp - 0x24]
add edi, 2
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
jne 0x404282
mov eax, dword [ebp - 0x38]
mov edi, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 0x30], eax
mov ecx, edi
cmp edi, eax
jne 0x4030f6
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ecx
jmp 0x4035a7
mov eax, dword [ebp - 0x38]
mov esi, dword [eax + 8]
test esi, esi
je 0x403ff1
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x403ec3
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403b6e
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Processing_registry_key__s_n
mov dword [esp + 8], str.install_registry
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ae0
jmp 0x4030d5
lea ecx, [ebp - 0x20]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x4037ee
test byte [section..data], 2
je 0x403887
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x404307
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x40424b
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403c2d
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_set_registry_key__s_n
mov dword [esp + 8], str.install_registry_dword
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x403887
mov esi, dword [ebp - 0x44]
lea eax, [ebp - 0x20]
mov edx, 0x40a5da
mov ecx, 1
call fcn.004019a0
mov eax, dword [ebp - 0x1c]
mov edx, dword [esi + 0x10]
mov ebx, dword [ebp - 0x20]
add eax, eax
test edx, edx
je 0x4038bc
cmp word [edx], 0
je 0x4038bc
test ebx, ebx
jne 0x4038bc
jmp 0x4037a3
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x20]
test byte [section..data], 1
je 0x403786
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Error_while_parsing_REG_MULTI_SZ_string:_Expected_comma_but_got__c_n
mov dword [esp + 8], str.parse_multisz
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ae0
jmp 0x403786
mov esi, dword [ebp - 0x44]
test ax, ax
je 0x403c63
mov ebx, dword [ebp - 0x20]
test byte [section..data], 1
je 0x403786
mov dword [esp + 0xc], str.Error_while_parsing_REG_MULTI_SZ_string:_Garbage_at_end_of_string_n
mov dword [esp + 8], str.parse_multisz
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ae0
jmp 0x403786
mov dword [ebp - 0x28], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], str.HKEY_CLASSES_ROOT
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
je 0x403eb9
mov ecx, dword [ebp - 0x28]
jmp 0x403026
mov dword [ebp - 0x28], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], str.HKEY_CURRENT_CONFIG
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
je 0x403ed8
mov ecx, dword [ebp - 0x28]
jmp 0x403046
mov dword [ebp - 0x28], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], str.HKEY_CURRENT_USER
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
je 0x403eec
mov ecx, dword [ebp - 0x28]
jmp 0x403066
mov dword [ebp - 0x28], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], str.HKEY_LOCAL_MACHINE
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcsncmp]
test eax, eax
je 0x403ef6
mov ecx, dword [ebp - 0x28]
jmp 0x403086
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x40391b
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x14], eax
mov ebx, dword [ebp - 0x44]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 0x10], ebx
mov eax, dword [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
test eax, eax
je 0x403a94
test byte [section..data], 2
je 0x40387f
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x404392
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x40437d
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403e81
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_set_registry_key__s_n
mov dword [esp + 8], str.install_registry_binary
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
jmp 0x403887
mov ebx, 0x80000000
jmp 0x4030c8
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x403b6e
mov ebx, 0x80000005
jmp 0x4030c8
mov eax, 0x40a00e
jmp 0x40391b
mov ebx, 0x80000001
jmp 0x4030c8
mov ebx, 0x80000002
jmp 0x4030c8
mov esi, dword [esi + 8]
test esi, esi
je 0x404260
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x40420a
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403f43
mov edx, 0xffffffff
mov eax, esi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_set_registry_key__s_n
mov dword [esp + 8], str.install_registry_multisz
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
mov dword [esp], ebx
mov eax, dword [ebp - 0x3c]
call eax
jmp 0x403887
mov dword [ebp - 0x2c], esi
test byte [section..data], 2
je 0x402bbc
mov eax, dword [ebp - 0x28]
shr eax, 0x10
test eax, eax
je 0x404311
mov dword [esp + 4], 0xffffffff
mov ebx, dword [ebp - 0x28]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x403fc4
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Required_file__s_not_found_n
mov dword [esp + 8], str.install_files_copy
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x40332f
mov eax, 0x40a00e
jmp 0x403b6e
mov eax, dword [ebp - 0x2c]
shr eax, 0x10
test eax, eax
je 0x404233
mov dword [esp + 4], 0xffffffff
mov ebx, dword [ebp - 0x2c]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404037
mov edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_create_parent_directory_for__s_n
mov dword [esp + 8], str.install_files_copy
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x40332f
test byte [section..data], 2
je 0x402bf0
mov dword [esp + 0xc], str.Failed_to_get_assembly_source_directory_n
mov dword [esp + 8], str.install_files
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
jmp 0x402bd9
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x4037a3
mov dword [ebp - 0x58], 0
jmp 0x403a89
mov eax, dword [ebp - 0x28]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x4033e0
xor ebx, ebx
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push edx
test ebx, ebx
jne 0x4035a7
jmp 0x4037ae
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x4039a4
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x402eed
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016c0
mov edi, eax
jmp 0x402eab
mov dword [ebp - 0x44], 0
jmp 0x4040b2
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x402c8e
mov eax, 0x40a00e
jmp 0x402eed
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x40439c
shr eax, 0x10
test eax, eax
je 0x404329
mov dword [esp + 4], 0xffffffff
mov edi, dword [ebp - 0x4c]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x4041a8
mov edx, 0xffffffff
mov eax, edi
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Installation_of__s_finished_n
mov dword [esp + 8], str.install_assembly
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ae0
jmp 0x4035c7
mov eax, 0x40a00e
jmp 0x4039a4
mov dword [ebp - 0x30], 0x40a00e
jmp 0x402e68
mov dword [esp + 4], edi
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x403457
mov edi, 0x40a00e
jmp 0x402eab
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x403f43
mov eax, 0x40a00e
jmp 0x402acf
mov eax, 0x40a00e
jmp 0x402d51
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x404037
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x403c2d
mov eax, 0x40a00e
jmp 0x403f43
mov eax, dword [ebp - 0x4c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x4034e0
test byte [section..data], 2
je 0x402bf0
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x4043f2
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x4043c8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x4042d3
or edx, 0xffffffff
mov eax, ebx
call fcn.004014a0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_open_registry_key__s_n
mov dword [esp + 8], str.install_registry
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ae0
movzx eax, byte [section..data]
jmp 0x4031c0
mov eax, 0x40a00e
jmp 0x403c2d
mov eax, dword [ebp - 0x28]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x403fc4
mov eax, dword [ebp - 0x4c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x4041a8
mov eax, 0x40a00e
jmp 0x4034e0
mov eax, dword [ebp - 0x28]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x403303
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
mov ebx, eax
jmp 0x4032c7
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x403e81
mov eax, 0x40a00e
jmp 0x403e81
mov eax, 0x40a00e
jmp 0x4041a8
mov eax, dword [ebp - 0x4c]
mov dword [esp], 0x40a008
mov dword [esp + 4], eax
call fcn.004016c0
jmp 0x40320c
mov eax, 0x40a00e
jmp 0x40320c
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016c0
jmp 0x4042d3
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x3c], eax
call eax
jmp 0x402fc1
mov eax, 0x40a00e
jmp 0x4042d3
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
jmp 0x402bd9