Function at 0x402968
Capabilities:
Accept command line arguments
Check os version
Delete file
Delete registry value
Get common file path
Get file size
Persist via run registry key
Query environment variable
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Set current directory
Set registry value
Shutdown system
Terminate process

Disassembly:
sub esp, 0xf14
push ebx
push ebp
push esi
push edi
push 4
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ebx, ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax]
mov dword [esp + 0x38], eax
cmp cl, 0x22
jne 0x4029e3
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
mov dword [esp + 0x38], eax
je 0x4029b2
cmp cl, 0x22
jne 0x4029a1
cmp byte [eax], 0x22
jne 0x4029bc
inc eax
mov dword [esp + 0x38], eax
cmp byte [eax], 0x20
jne 0x4029cb
inc eax
cmp byte [eax], 0x20
je 0x4029c1
mov dword [esp + 0x38], eax
mov cl, byte [eax]
cmp cl, 0x2f
je 0x402a00
mov esi, eax
cmp cl, bl
je 0x4029f6
cmp cl, 0x3d
je 0x4029f6
mov cl, byte [esi + 1]
inc esi
jmp 0x4029d4
cmp cl, bl
je 0x4029bc
cmp cl, 0x20
je 0x4029bc
mov cl, byte [eax + 1]
inc eax
mov dword [esp + 0x38], eax
jmp 0x4029e3
cmp byte [esi], bl
jne 0x402a00
mov eax, esi
mov dword [esp + 0x38], eax
push eax
call fcn.00405a63
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x108]
push 0x100
push ecx
push eax
mov dword [0x408720], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0xa94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0xa90], bl
je 0x402a76
lea eax, [esp + 0xa90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0xa90]
lea ecx, [esp + 0xa90]
cmp eax, ecx
jbe 0x402a6e
cmp byte [eax], 0x5c
je 0x402a73
dec eax
jmp 0x402a5b
cmp byte [eax], 0x5c
jne 0x402a74
inc eax
mov byte [eax], bl
lea eax, [esp + 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [0x408478], eax
jge 0x402a9a
push ebx
call fcn.00404c1d
pop ecx
jmp 0x404b9f
call fcn.004028b0
push 0x10000
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x40871c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [0x408478]
mov dword [0x408708], eax
call fcn.0040505e
test eax, eax
pop ecx
jne 0x402a8e
cmp dword [0x408728], ebx
mov edi, dword [sym.imp.KERNEL32.dll__lread]
lea eax, [esp + 0xd24]
mov esi, 0x4084a0
mov dword [0x4086ac], eax
mov ebp, str.WiseInstaller
je 0x402dc5
push 0x24
push 0x4086e0
push dword [0x408478]
mov dword [esp + 0x38], 1
call edi
mov eax, dword [0x4086e4]
cmp eax, ebx
jge 0x402b26
neg eax
mov dword [0x4086e4], eax
mov dword [0x40847c], 1
push 1
push 0x408474
push dword [0x408478]
call edi
push 4
push 0x4086c0
push dword [0x408478]
call edi
movzx eax, byte [0x4086c0]
push eax
lea eax, [esp + 0x10c]
push eax
push dword [0x408478]
call edi
movzx eax, byte [0x4086c1]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [0x408478]
call edi
movzx eax, byte [0x4086c2]
push eax
lea eax, [esp + 0x614]
push eax
push dword [0x408478]
call edi
movzx eax, byte [0x4086c3]
push eax
lea eax, [esp + 0xb94]
push eax
push dword [0x408478]
call edi
push 0x13
push 0x4086c0
push dword [0x408478]
call edi
lea eax, [esp + 0x208]
mov dword [0x408464], eax
movzx eax, byte [0x4086c2]
push eax
push dword [0x4086ac]
push dword [0x408478]
call edi
movzx eax, byte [0x4086c3]
push eax
lea eax, [esp + 0xe28]
push eax
push dword [0x408478]
call edi
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [0x40872c], eax
movzx eax, byte [0x4086c4]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086c5]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086c6]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086c7]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086c8]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086c9]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086ca]
push eax
push esi
push dword [0x408478]
call edi
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x30], eax
movzx eax, byte [0x4086cb]
push eax
push esi
push dword [0x408478]
mov dword [esp + 0x54], eax
call edi
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x4c], eax
movzx eax, byte [0x4086cc]
push eax
push esi
push dword [0x408478]
mov dword [esp + 0x50], eax
call edi
lea eax, [esp + 0x68]
push 4
push eax
push dword [0x408478]
call edi
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x5c], eax
movzx eax, byte [0x4086cd]
push eax
push esi
push dword [0x408478]
mov dword [esp + 0x48], eax
call edi
lea eax, [esp + 0x64]
push 4
push eax
push dword [0x408478]
call edi
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x74], eax
movzx eax, byte [0x4086ce]
push eax
push esi
push dword [0x408478]
mov dword [esp + 0x4c], eax
call edi
lea eax, [esp + 0x6c]
push 4
push eax
push dword [0x408478]
call edi
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [esp + 0x40], 1
mov dword [esp + 0x60], eax
movzx eax, byte [0x4086d1]
mov dword [esp + 0x34], eax
jg 0x402d6c
cmp eax, 1
jle 0x402d76
mov dword [0x40847c], 1
push dword [esp + 0x34]
push esi
push dword [0x408478]
call edi
lea eax, [esp + 0x70]
push 4
push eax
push dword [0x408478]
call edi
cmp byte [0x4086d2], bl
jne 0x4033b4
movzx eax, byte [0x4086cf]
push eax
push esi
push dword [0x408478]
call edi
movzx eax, byte [0x4086d0]
push eax
push esi
push dword [0x408478]
call edi
jmp 0x4033d8
cmp byte [esp + 0x108], bl
mov dword [esp + 0x2c], ebx
mov dword [0x4086f4], ebx
mov dword [0x4086f0], ebx
mov dword [0x4086ec], ebx
mov dword [0x4086e4], ebx
mov byte [0x4086c0], bl
mov byte [0x4086c1], 8
mov byte [esp + 0xe24], bl
mov byte [esp + 0xd26], bl
mov byte [esp + 0xd25], bl
mov byte [esp + 0xd24], bl
je 0x4033f2
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x108]
lea ecx, [esp + 0x108]
cmp eax, ecx
jbe 0x402e3f
cmp byte [eax], 0x2e
je 0x402e48
dec eax
jmp 0x402e2c
cmp byte [eax], 0x2e
jne 0x4033d8
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeUpdateVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
jne 0x402ea0
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
call fcn.00405156
shl eax, 0x10
mov dword [0x4086ec], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x7c]
pop ecx
cmp al, bl
je 0x402ed3
cmp al, 0x2e
je 0x402ed3
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov al, byte [eax]
jmp 0x402ebf
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x402ee0
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00405156
or dword [0x4086ec], eax
pop ecx
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
je 0x402f04
cmp al, 0x2e
je 0x402f04
inc dword [esp + 0x10]
jmp 0x402ef0
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x402f11
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00405156
shl eax, 0x10
pop ecx
mov dword [0x4086f0], eax
mov eax, dword [esp + 0x10]
mov al, byte [eax]
cmp al, bl
je 0x402f37
cmp al, 0x2e
je 0x402f37
inc dword [esp + 0x10]
jmp 0x402f23
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x2e
jne 0x402f44
inc dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00405156
or dword [0x4086f0], eax
pop ecx
lea eax, [esp + 0x108]
push eax
push 0x100
push dword [0x4086ac]
push str.MS_Sans_Serif
push str.CharFont
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push ebx
push str.CharSet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x4086c0], al
lea eax, [esp + 0x108]
push eax
push 8
push str.CharSize
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov byte [0x4086c1], al
lea eax, [esp + 0x108]
push eax
push ebx
push str.WiseInitLangAlwaysPrompt
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x402fcd
or byte [0x4086c1], 0x80
push dword [0x4086ac]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x4086ac]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.ProductName
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
lea eax, [ecx + eax + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push str.Initializing
push str.WiseInitPrefix
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40307a
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x78], 0x20
je 0x40307a
lea eax, [esp + 0x78]
push 0x4079a4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.Wise_Installation
add dword [esp + 0x14], eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [esp + 0x10], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push str._Wizard...
push str.WiseInitSuffix
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], 0x5e
jne 0x4030e3
mov byte [esp + 0x78], 0x20
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x403125
mov dword [0x4086e4], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeSizeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40315d
lea eax, [esp + 0x78]
push eax
call fcn.00405156
pop ecx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.Runtime9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x403190
mov dword [0x4086f4], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x78]
push eax
call fcn.00405a63
pop ecx
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeSize9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4031f6
lea eax, [esp + 0x78]
push eax
call fcn.00405156
pop ecx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40322c
push 1
pop eax
mov dword [0x4086e4], eax
mov dword [0x40847c], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x40325f
mov dword [0x4086f4], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeSizeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x403297
lea eax, [esp + 0x78]
push eax
call fcn.00405156
pop ecx
mov dword [esp + 0x40], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.RuntimeSizeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x78], bl
je 0x4032cf
lea eax, [esp + 0x78]
push eax
call fcn.00405156
pop ecx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x7c]
push 0x100
push eax
push 0x408040
push str.ProductCode
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x614]
push 0x100
push eax
push 0x408040
push str.ProductVersion
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0xb94]
push 0x100
push eax
push 0x408040
push str.TransformMSI
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x108]
push eax
push ebx
push str.Remove_Previous
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x40335c
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x108]
push eax
push ebx
push str.DelayReboot
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [esp + 0x78], bl
mov byte [0x408474], al
je 0x404b9f
cmp byte [esp + 0x610], bl
je 0x404b9f
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x408040
push str.Language1
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x4084a0], bl
je 0x4033d8
push ebx
push sym.STUB32.EXE__LanguageDlg_16
push ebx
push 0x6f
push dword [0x408720]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
jne 0x4033d8
mov dword [0x40846c], 1
mov eax, dword [0x4086ec]
cmp eax, ebx
je 0x4033f2
and ax, 0
cmp eax, 0x20000
jge 0x4033f2
mov byte [0x408474], bl
cmp dword [0x40846c], ebx
jne 0x404b8f
cmp byte [esp + 0x78], bl
je 0x40343c
lea eax, [esp + 0x14]
push eax
push 0x2001b
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40343c
push str.WiseStubReboot
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x408720]
call fcn.00404bb3
test eax, eax
pop ecx
je 0x404b9f
push dword [0x408720]
call fcn.00404bb7
test eax, eax
pop ecx
je 0x404b9f
cmp dword [0x408728], ebx
je 0x4034bb
cmp dword [0x4086e8], ebx
je 0x4034bb
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
push 2
push ebx
push dword [0x408478]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x20]
mov dword [esp + 0x2c], eax
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x24]
cmp eax, dword [0x4086e8]
jne 0x402a8e
lea eax, [esp + 0xc90]
mov dword [esp + 0xc90], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esp + 0xca0], 2
push 0x100
push esi
sete al
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + 0x40849f], 0x5c
je 0x40350d
push 0x40784c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x40847c], ebx
je 0x40351c
push str.MSCOREE.DLL
jmp 0x403521
push str.MSI.DLL
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.00404c3b
add esp, 0xc
cmp dword [0x40847c], ebx
je 0x4035b2
cmp dword [esp + 0x58], 0x10000
jne 0x4035b2
cmp dword [esp + 0x50], 0xe790000
jne 0x4035b2
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + 0x40849f], 0x5c
je 0x40357f
push 0x40784c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Microsoft.NETFramework_v1.0.3705_aspnet_wp.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00404c3b
add esp, 0xc
test eax, eax
jne 0x4035b2
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x50], eax
cmp dword [esp + 0x28], ebx
je 0x4036ab
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 1
push eax
push 0x2001b
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4036ab
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x28]
push ebx
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
lea eax, [esp + 0x6a4]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push ebx
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x403697
cmp dword [esp + 0x24], 2
jne 0x40362d
cmp dword [esp + 0x10], 1
jbe 0x40365d
mov eax, 0x400
inc dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push ebx
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
lea eax, [esp + 0x6a4]
push eax
push dword [esp + 0x2c]
jmp 0x403611
lea eax, [esp + 0x690]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403697
push 1
push 0x408040
push 1
lea eax, [esp + 0x69c]
push ebx
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x403697
mov dword [esp + 0x1c], ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x1c], ebx
je 0x4035bc
mov eax, dword [0x4086ec]
cmp dword [esp + 0x58], eax
jb 0x4036e2
jne 0x4036cf
mov ecx, dword [esp + 0x50]
mov edx, dword [0x4086f0]
mov eax, 0xffff0000
and ecx, eax
and edx, eax
cmp ecx, edx
jb 0x4036e2
cmp dword [0x40847c], ebx
je 0x403722
mov eax, dword [0x4086f0]
cmp dword [esp + 0x50], eax
jae 0x403722
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4036fe
mov ecx, dword [esp + 0x3c]
mov edx, dword [0x4086e4]
add edx, ecx
test edx, edx
jg 0x4037d6
cmp dword [0x40847c], ebx
jne 0x4037d6
cmp eax, ebx
jne 0x403722
mov eax, dword [esp + 0x44]
mov ecx, dword [0x4086f4]
add ecx, eax
test ecx, ecx
jg 0x403838
cmp dword [0x408728], ebx
je 0x403746
mov eax, dword [0x4086f4]
mov ecx, dword [0x4086e4]
add eax, ecx
push 1
push eax
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp byte [0x408704], bl
jne 0x404b65
cmp dword [0x40870c], ebx
jne 0x404b79
cmp dword [0x408728], ebx
je 0x404043
cmp byte [0x4086c3], 1
jbe 0x404043
push ebx
push sym.STUB32.EXE__PasswordDlg_16
push ebx
push 0x6d
push dword [0x408720]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x404029
push dword [0x408464]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, byte [0x4086c3]
dec ecx
cmp eax, ecx
jne 0x403777
mov ecx, dword [0x408464]
mov dword [0x408710], 0x5bc25a
mov al, byte [ecx]
cmp al, bl
je 0x403fd7
cmp al, 0x61
jl 0x4037d3
cmp al, 0x7a
jg 0x4037d3
sub al, 0x20
mov byte [ecx], al
inc ecx
jmp 0x4037bd
cmp eax, ebx
je 0x403838
push 0xe0000000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
jne 0x403831
push 1
lea eax, [esp + 0x10c]
push str.AdminError
push eax
lea eax, [esp + 0x214]
push 5
push eax
call fcn.00405193
mov eax, dword [0x4086ac]
add esp, 0x14
cmp byte [eax], bl
je 0x403818
inc eax
jmp 0x403811
inc eax
push ebx
push eax
lea eax, [esp + 0x210]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
jmp 0x404ba0
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
cmp dword [0x408728], ebx
jne 0x4038c3
push 1
pop eax
cmp dword [esp + 0x40], eax
jg 0x4038c3
cmp dword [esp + 0x28], ebx
je 0x40385d
cmp dword [esp + 0x3c], eax
jmp 0x403861
cmp dword [esp + 0x44], eax
jg 0x4038c3
cmp dword [0x40847c], ebx
je 0x40389c
cmp dword [esp + 0x18], eax
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x408040
jne 0x403895
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x403c41
push str.RuntimeDotNet
jmp 0x403889
cmp dword [esp + 0x28], ebx
lea eax, [esp + 0x108]
push eax
push 0x100
push esi
push 0x408040
je 0x4038bc
push str.RuntimeNT
jmp 0x403889
push str.Runtime9X
jmp 0x403889
push esi
call fcn.00404be9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x403906
lea eax, [eax + 0x40849c]
push str..TMP
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403906
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..exe
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x402a8e
push 1
pop eax
cmp dword [esp + 0x40], eax
jle 0x403939
cmp dword [esp + 0x18], ebx
je 0x403980
cmp dword [esp + 0x34], eax
jle 0x403945
cmp dword [esp + 0x18], eax
je 0x403980
cmp dword [esp + 0x28], ebx
je 0x403976
cmp dword [esp + 0x3c], eax
jg 0x403980
cmp dword [0x40847c], ebx
jne 0x403be2
push 1
push dword [0x4086f4]
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
jmp 0x403be2
cmp dword [esp + 0x44], eax
jle 0x403bda
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x408728], ebx
je 0x403a67
cmp dword [0x40847c], ebx
je 0x4039c1
cmp dword [esp + 0x18], 1
jne 0x4039b3
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
jmp 0x4039e1
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
jmp 0x4039e1
cmp dword [esp + 0x28], ebx
je 0x4039d5
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
jmp 0x4039e1
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 1
push ebx
push dword [0x408478]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x14]
mov dword [esp + 0x24], eax
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
lea eax, [esp + 0x40c]
push dword [esp + 0x20]
push eax
push dword [0x408478]
call edi
push ebx
push dword [esp + 0x20]
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [0x40847c], ebx
je 0x403a4f
cmp dword [esp + 0x18], 1
jne 0x403a46
mov eax, dword [esp + 0x70]
jmp 0x403af6
mov eax, dword [esp + 0x6c]
jmp 0x403af6
cmp dword [esp + 0x28], ebx
je 0x403a5e
mov eax, dword [esp + 0x64]
jmp 0x403af6
mov eax, dword [esp + 0x68]
jmp 0x403af6
cmp dword [0x40847c], ebx
je 0x403ab4
cmp dword [esp + 0x18], 1
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x410]
push 0x100
push eax
push 0x408040
jne 0x403aa2
push str.RuntimeDotNetUpdate
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x34]
jmp 0x403af6
push str.RuntimeDotNet
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x40]
jmp 0x403af6
cmp dword [esp + 0x28], ebx
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x410]
push 0x100
push eax
push 0x408040
je 0x403ae6
push str.RuntimeNT
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x3c]
jmp 0x403af6
push str.Runtime9X
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x44]
mov dword [0x408730], eax
call fcn.0040591f
push ebx
push 0xfa
push 0x4d2
push dword [0x4086a4]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00404efa
lea eax, [esp + 0x308]
mov byte [esp + 0x308], bl
push eax
mov eax, dword [0x408730]
push ebx
push ebx
push eax
push eax
push 0x408714
lea eax, [esp + 0x424]
push dword [0x4086a4]
push esi
push eax
push 0x40846c
call sym.STUB32.EXE__t1_40
mov dword [esp + 0x14], eax
mov eax, dword [0x408714]
cmp eax, dword [0x408730]
jne 0x403b9c
push ebx
push ebx
push 3
push ebx
push 1
push closesocket
push esi
mov dword [0x408714], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x403b9c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x408714], eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x40846c], ebx
jne 0x403f3b
cmp dword [esp + 0x14], ebx
jl 0x403f3b
cmp dword [0x408714], 0xf4240
jl 0x403f3b
cmp dword [0x40847c], ebx
jne 0x403c41
cmp dword [esp + 0x28], ebx
push 1
je 0x403c2f
push dword [0x4086f4]
jmp 0x403c35
cmp dword [0x40847c], ebx
je 0x403bee
cmp dword [esp + 0x18], 1
mov eax, dword [0x4086e4]
jne 0x403bf3
mov eax, dword [0x4086f4]
push ebx
push eax
push dword [esp + 0x18]
call fcn.00404df0
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
jne 0x403f83
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x40846c], ebx
jne 0x403fcb
cmp dword [esp + 0x28], ebx
jne 0x403c41
cmp dword [0x40847c], ebx
jne 0x403c41
push 1
push dword [0x4086e4]
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [0x40847c]
mov dword [esp + 0x14], ebx
cmp eax, ebx
mov dword [esp + 0x10], str._q__r:n
je 0x403c6d
cmp dword [esp + 0x18], 1
mov dword [esp + 0x10], str._q:a
je 0x403c6d
mov dword [esp + 0x10], str._q:a__c:_Install__q_
cmp byte [0x408474], bl
je 0x403c81
cmp eax, ebx
jne 0x403c81
mov dword [esp + 0x10], str._c:_msiinst__delayrebootq_
cmp dword [0x408728], ebx
jne 0x403d1a
cmp eax, ebx
jne 0x403d1a
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x514]
push 0x80
push eax
push str._q__r:n
push str.InstMsi_CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x510]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403cd9
mov dword [esp + 0x14], 1
cmp byte [0x408474], bl
je 0x403d0f
lea eax, [esp + 0x510]
push str._q__r:n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403d0f
lea eax, [esp + 0x510]
push str._c:_msiinst__delayrebootq_
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x510]
mov dword [esp + 0x10], eax
call fcn.00405481
cmp dword [0x40847c], ebx
mov dword [esp + 0x1c], eax
je 0x403d8b
call fcn.0040591f
mov eax, dword [0x4086a4]
cmp eax, ebx
je 0x403d8b
push 0x3ef
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x403d51
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x70
push dword [0x4086a4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x403d6c
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 2
push dword [0x4086a4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x403d86
push ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.00405968
lea eax, [esp + 0x78]
push eax
push 1
push dword [esp + 0x18]
push esi
call fcn.00404ce7
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x403dba
call fcn.00405481
cmp dword [esp + 0x1c], eax
je 0x403dba
mov dword [esp + 0x10], 1
cmp dword [0x40847c], ebx
je 0x403df7
cmp dword [esp + 0x10], 0x661
jne 0x403df7
cmp dword [esp + 0x18], ebx
jne 0x403e30
call fcn.00404f8e
lea eax, [esp + 0x78]
push eax
push 1
push str._q:a
push esi
call fcn.00404ce7
add esp, 0x10
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x10], 0x800401fa
jne 0x403e30
call fcn.00404f8e
push str.The_Windows_Installer_2.0_runtime_can_only_be_installed_with_Windows_NT_Service_Pack_6_or_higher._Please_install_Windows_NT_Service_Pack_6_and_rerun_this_installation.
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x4086ac]
cmp byte [eax], bl
je 0x403e1e
inc eax
jmp 0x403e17
inc eax
push ebx
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x408728], ebx
jne 0x403e7a
mov eax, dword [0x40847c]
cmp eax, ebx
je 0x403e4e
cmp dword [esp + 0x40], 1
jle 0x403e4e
cmp dword [esp + 0x18], ebx
je 0x403e7a
cmp dword [esp + 0x28], ebx
je 0x403e5b
cmp dword [esp + 0x3c], 1
jg 0x403e7a
cmp eax, ebx
je 0x403e6d
cmp dword [esp + 0x34], 1
jle 0x403e6d
cmp dword [esp + 0x18], 1
je 0x403e7a
cmp dword [esp + 0x28], ebx
jne 0x403e81
cmp dword [esp + 0x44], 1
jle 0x403e81
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00404efa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404efa
cmp dword [esp + 0x10], ebx
je 0x403f05
cmp dword [esp + 0x14], ebx
jne 0x403f05
cmp byte [0x408474], bl
je 0x403eb4
mov dword [esp + 0x54], 1
jmp 0x403f05
cmp dword [esp + 0x24], ebx
jne 0x403f05
push 4
lea eax, [esp + 0x10c]
push str.Reboot
push eax
push 9
push esi
mov dword [esp + 0x38], 1
call fcn.00405193
mov eax, dword [0x4086ac]
add esp, 0x14
cmp byte [eax], bl
je 0x403ee8
inc eax
jmp 0x403ee1
inc eax
push 4
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x403eaa
call fcn.00404f8e
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x18], ebx
jne 0x403746
cmp dword [0x40847c], ebx
je 0x403746
cmp dword [0x4086f4], ebx
jne 0x403f2e
cmp dword [esp + 0x34], 1
jle 0x403746
mov dword [esp + 0x18], 1
jmp 0x403840
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x40846c], ebx
jne 0x404b9f
push 6
lea eax, [esp + 0x10c]
push str.Internet
push eax
push 0xa
push esi
call fcn.00405193
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x14
push 0x4079a4
push esi
call edi
lea eax, [esp + 0x308]
push eax
push esi
call edi
jmp 0x403fc5
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x408724], ebx
je 0x403fab
push 2
lea eax, [esp + 0x10c]
push str.CRCError
push eax
push 8
jmp 0x403fbc
push 3
lea eax, [esp + 0x10c]
push str.SpaceError
push eax
push 7
push esi
call fcn.00405193
add esp, 0x14
push esi
jmp 0x402a8f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404b9f
movzx eax, byte [0x4086c3]
dec eax
push eax
push dword [0x408464]
call fcn.00404fdd
pop ecx
mov eax, dword [0x408464]
pop ecx
movzx ecx, byte [0x4086c3]
dec ecx
mov dword [esp + 0x14], ecx
je 0x404017
lea ecx, [esp + 0xe24]
sub ecx, eax
mov dl, byte [eax]
cmp dl, byte [ecx + eax]
jne 0x404017
inc eax
dec dword [esp + 0x14]
jne 0x404009
xor eax, eax
cmp dword [esp + 0x14], ebx
sete al
cmp eax, ebx
jne 0x404043
jmp 0x403777
mov eax, dword [0x408480]
cmp eax, ebx
je 0x404039
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.004028ff
jmp 0x404622
cmp byte [esp + 0x78], bl
je 0x4041f6
cmp byte [esp + 0x610], bl
je 0x4041f6
cmp dword [esp + 0x2c], ebx
je 0x4041f6
push str.MSI.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x4041f6
push str.MsiGetProductInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MsiConfigureProductA
push dword [esp + 0x24]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [esp + 0x14], ebx
mov dword [esp + 0x24], eax
je 0x4041ec
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x100
push eax
lea eax, [esp + 0x694]
push eax
lea eax, [esp + 0x80]
push str.VersionString
push eax
call dword [esp + 0x24]
test eax, eax
jne 0x4041ec
cmp byte [esp + 0x690], bl
je 0x4041ec
lea eax, [esp + 0x610]
push eax
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4041ec
push 5
lea eax, [esp + 0x10c]
push str.ExistError
push eax
lea eax, [esp + 0x418]
push 6
push eax
call fcn.00405193
add esp, 0x14
cmp dword [0x408728], ebx
je 0x40413d
mov eax, dword [0x4086ac]
cmp byte [eax], bl
je 0x404136
inc eax
jmp 0x40412f
inc eax
mov dword [esp + 0x1c], eax
jmp 0x40416e
lea eax, [esp + 0x308]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x30c]
push 0x100
push eax
push 0x408040
push str.ProductName
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x610]
push eax
push ecx
lea ecx, [esp + 0x698]
push eax
push ecx
push eax
lea eax, [esp + 0x420]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x4086ac]
add esp, 0x1c
cmp byte [eax], bl
je 0x4041a3
inc eax
jmp 0x40419c
inc eax
push 0x104
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x4041dd
cmp dword [esp + 0x24], ebx
je 0x4040a8
push 2
lea eax, [esp + 0x7c]
push ebx
push eax
call dword [esp + 0x30]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4040a8
call fcn.004028ff
call fcn.00404f8e
jmp 0x404622
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x408728], ebx
je 0x404629
cmp dword [esp + 0x48], 1
jle 0x404376
push 1
push ebx
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push dword [esp + 0x34]
mov dword [esp + 0x54], eax
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
push dword [esp + 0x48]
push esi
push dword [0x408478]
call edi
push ebx
push dword [esp + 0x50]
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [0x408468]
mov byte [esp + 0x690], bl
cmp eax, ebx
je 0x40472c
push 1
pop ecx
cmp eax, ecx
mov dword [esp + 0x2c], ecx
jle 0x40429f
lea eax, [esp + 0x14]
push 4
push eax
push dword [0x408478]
call edi
push 1
push dword [esp + 0x18]
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__llseek]
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp eax, dword [0x408468]
jl 0x40426e
lea eax, [esp + 0x14]
push 4
push eax
push dword [0x408478]
call edi
lea eax, [esp + 0x690]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
cmp eax, ebx
jle 0x4042e5
lea eax, [esp + eax + 0x690]
push str..MST
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x690]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x690]
push 2
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x404547
mov al, 1
cmp al, byte [0x4086c3]
sbb eax, eax
neg eax
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.00404df0
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
je 0x404602
call dword [sym.imp.KERNEL32.dll__lclose]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x408724], ebx
je 0x4045d4
push 2
lea eax, [esp + 0x10c]
push str.CRCError
push eax
push 8
jmp 0x4045e5
lea eax, [esp + 0x48]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40445d
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x100
push eax
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
push str.CommonFilesDir
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404453
cmp byte [esp + 0x308], bl
je 0x404453
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x307], 0x5c
lea eax, [esp + eax + 0x307]
jne 0x4043f5
mov byte [eax], bl
lea eax, [esp + 0x308]
push str.Wise_Installation_Wizard_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb90], bl
mov eax, 0x4075d8
jne 0x404431
mov eax, 0x4075d4
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x30c]
sub ecx, 3
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x308]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x108], bl
je 0x4044e9
cmp byte [0x4084a0], bl
jne 0x4044f8
lea eax, [esp + 0x510]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + 0x510], bl
je 0x4044e9
lea eax, [esp + 0x510]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x50f], 0x5c
je 0x4044c4
lea eax, [esp + 0x510]
push 0x40784c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x510]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0x4084a0], bl
jne 0x4044f8
push esi
call fcn.00404be9
pop ecx
push esi
call fcn.004050ee
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [esp + 0x10], 0xffffffff
jne 0x404536
push esi
call fcn.00404be9
push esi
call fcn.004050ee
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll__lcreat]
push eax
call dword [sym.imp.KERNEL32.dll__lclose]
push 2
push esi
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [esp + 0x10], eax
jge 0x404553
push ebx
call fcn.00404c1d
pop ecx
jmp 0x404622
mov al, 1
cmp al, byte [0x4086c3]
sbb eax, eax
neg eax
push eax
push dword [0x4086f8]
push dword [esp + 0x18]
call fcn.00404df0
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
je 0x4045bf
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x408724], ebx
je 0x4045a2
push 2
lea eax, [esp + 0x10c]
push str.CRCError
push eax
push 8
jmp 0x4045b3
push 3
lea eax, [esp + 0x10c]
push str.SpaceError
push eax
push 7
push esi
call fcn.00405193
add esp, 0x14
push esi
jmp 0x404548
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x40846c], ebx
je 0x40424f
push esi
jmp 0x40461c
push 3
lea eax, [esp + 0x10c]
push str.SpaceError
push eax
push 7
lea eax, [esp + 0x6a0]
push eax
call fcn.00405193
add esp, 0x14
lea eax, [esp + 0x690]
push eax
jmp 0x404548
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [0x40846c], ebx
je 0x40472c
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
jmp 0x404ba0
lea eax, [esp + 0x108]
mov byte [esp + 0x690], bl
push eax
lea eax, [esp + 0x410]
push 0x100
push eax
push 0x408040
push str.ProductFile
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [0x408468]
cmp eax, ebx
je 0x4046d8
push eax
push str.LanguageFile_d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x694]
push 0x104
push eax
push 0x408040
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x4046d8
lea eax, [esp + eax + 0x68c]
push str..mst
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4046d8
lea eax, [esp + 0x690]
push eax
lea eax, [esp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esp + 0x690], bl
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.http:__
push esi
mov byte [0x4084a7], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40471d
lea eax, [esp + 0xa90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x40472c
lea eax, [esp + 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.00404f8e
mov eax, dword [esp + 0x38]
mov byte [esp + 0x208], bl
cmp byte [eax], bl
jne 0x4047b9
cmp dword [0x408728], ebx
je 0x404793
mov ebp, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push ebx
push dword [0x408478]
call ebp
push ebx
push dword [0x40872c]
mov dword [esp + 0x38], eax
push dword [0x408478]
call ebp
movzx eax, byte [0x4086c4]
push eax
lea eax, [esp + 0x20c]
push eax
push dword [0x408478]
call edi
push ebx
push dword [esp + 0x34]
push dword [0x408478]
call ebp
jmp 0x4047b9
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x20c]
push 0x100
push eax
push 0x408040
push str.CmdLine
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x690], bl
je 0x4047ee
lea eax, [esp + 0x690]
push eax
lea eax, [esp + 0x20c]
push str._TRANSFORMS__s_
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [esp + 0x38]
mov al, byte [edi]
cmp al, 0x2f
jne 0x404822
cmp byte [edi + 1], 0x2a
jne 0x404822
lea eax, [edi + 2]
cmp byte [eax], 0x20
jne 0x404809
inc eax
jmp 0x404801
lea ecx, [esp + 0x690]
push 0x200
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x404970
cmp byte [esp + 0x208], bl
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
je 0x404835
cmp al, bl
je 0x40485e
cmp al, bl
je 0x40484b
lea eax, [esp + 0x208]
push 0x200
push eax
push edi
call ebp
jmp 0x40485e
lea eax, [esp + 0x208]
push 0x407598
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dl, byte [esp + 0x208]
cmp dl, 0x2f
jne 0x4048a0
cmp byte [esp + 0x209], 0x2a
jne 0x4048a0
cmp byte [esp + 0x20a], 0x20
lea eax, [esp + 0x20a]
jne 0x40488b
inc eax
cmp byte [eax], 0x20
je 0x404885
lea ecx, [esp + 0x690]
push 0x200
push ecx
push eax
call ebp
jmp 0x404970
cmp dl, bl
lea eax, [esp + 0x208]
je 0x4048e5
mov cl, dl
cmp cl, 0x2f
jne 0x4048dd
mov cl, byte [eax + 1]
cmp cl, 0x49
je 0x4048e5
cmp cl, 0x69
je 0x4048e5
cmp cl, 0x4a
je 0x4048e5
cmp cl, 0x6a
je 0x4048e5
cmp cl, 0x58
je 0x4048e5
cmp cl, 0x78
je 0x4048e5
cmp cl, 0x41
je 0x4048e5
cmp cl, 0x61
je 0x4048e5
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4048ad
cmp byte [eax], bl
jne 0x404913
cmp dl, bl
je 0x404900
lea eax, [esp + 0x208]
push 0x4079a4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x208]
push 0x407598
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [esp + 0xb90], bl
lea eax, [esp + 0xb90]
jne 0x404925
mov eax, esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x698]
push str._s___s_
push eax
call edi
add esp, 0x10
cmp byte [esp + 0xb90], bl
je 0x404970
push esi
lea eax, [esp + 0x694]
push str._TRANSFORMS__s_
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x698]
push eax
call edi
add esp, 0xc
call fcn.00404efa
cmp dword [0x40870c], ebx
jne 0x404b79
cmp byte [esp + 0x690], bl
je 0x404b79
push 0x100
push esi
push dword [0x408720]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [esp + 0x694]
push str._WISE_SETUP_EXE_PATH__s_
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + eax + 0x698]
push eax
call edi
add esp, 0xc
cmp dword [esp + 0x54], ebx
je 0x404a73
cmp byte [0x408474], bl
jne 0x404a73
lea eax, [esp + 0x690]
push eax
push str.MSIEXEC
push str._s__s
push esi
call edi
lea eax, [esp + 0x88]
push esi
push eax
call fcn.004053ad
add esp, 0x18
lea eax, [esp + 0x30]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404a5b
lea eax, [esp + 0xfc]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [esp + 0x100]
push ebx
push eax
push ebx
push dword [esp + 0x44]
mov dword [esp + 0x110], 1
mov dword [esp + 0x11c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov dword [0x40870c], 1
jmp 0x404b79
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x40c]
push str.MSIEXEC
push eax
call esi
cmp dword [esp + 0x54], ebx
je 0x404b44
cmp byte [0x408474], bl
je 0x404b44
lea eax, [esp + 0x48]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404b31
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x104
push eax
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
push str.InstallerLocation
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404b27
cmp byte [esp + 0x308], bl
je 0x404b27
lea eax, [esp + 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x308]
push eax
lea eax, [esp + 0x410]
push eax
call esi
lea eax, [esp + 0x40c]
push str.MSIEXEC.EXE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x690]
push str._WISEDELAYEDREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x694]
push 1
push eax
lea eax, [esp + 0x418]
push eax
call fcn.00404ce7
add esp, 0x10
jmp 0x404b79
cmp dword [0x40870c], ebx
jne 0x404b79
call fcn.00404f8e
push ebx
call fcn.00404c1d
pop ecx
call fcn.00404f8e
call fcn.004028ff
push dword [0x408478]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x408480]
cmp eax, ebx
je 0x404b9f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]