Function at 0x40b980
Capabilities:
Create directory
Delete registry key
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45552d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x471df4]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x138], ebx
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esi + 0x5e0]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push eax
call ebp
mov edx, dword [esi + 0x5dc]
not edx
test dl, 0x40
je 0x40bd56
push str.InstallLocationsMRU
lea ecx, [esp + 0x14]
call fcn.0044a511
mov eax, dword [esp + 0x10]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x10]
push ecx
push 0x80000001
call fcn.0042ffc0
lea eax, [esi + 0x704]
push 0x104
push eax
push str.SearchLocation
push str.SoftwareMicrosoftWindowsCurrentVersionSysDM
push 0x80000002
call fcn.00430370
add esp, 0x1c
test eax, eax
je 0x40ba7c
mov edi, str.EMPTY
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
lea edi, [eax + 0x704]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, eax
lea ecx, [esi + 0x600]
push 0x104
push ecx
push str.SourcePath
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push 0x80000002
call fcn.00430370
mov eax, dword [esi + 0x18]
add esp, 0x14
cmp eax, 4
jne 0x40bb65
push str.OPTIONSINSTALL
lea ecx, [esp + 0x1c]
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x1c]
push edx
mov byte [esp + 0x138], 1
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x13c], 2
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 3
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 2
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 1
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ebx
push ecx
push str.SearchLocation
push str.SoftwareMicrosoftWindowsCurrentVersionSysDM
push 0x80000002
call fcn.004301e0
mov edx, dword [esp + 0x24]
push ebx
push edx
push str.SourcePath
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push 0x80000002
call fcn.004301e0
add esp, 0x28
jmp 0x40bd56
push str.OPTIONSCABS
lea ecx, [esp + 0x18]
call fcn.0044a442
mov esi, eax
lea eax, [esp + 0x28]
lea ecx, [esp + 0x1c]
push eax
mov byte [esp + 0x138], 4
call fcn.0044a442
push esi
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x140], 5
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 6
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 5
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 4
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], bl
call fcn.0044a3d4
mov edx, dword [esp + 0x10]
push ebx
push edx
push str.SearchLocation
push str.SoftwareMicrosoftWindowsCurrentVersionSysDM
push 0x80000002
call fcn.004301e0
mov eax, dword [esp + 0x24]
push ebx
push eax
push str.SourcePath
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push 0x80000002
call fcn.004301e0
add esp, 0x28
lea ecx, [esp + 0x14]
push str.OPTIONS
call fcn.0044a442
mov esi, eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x134], 7
push ecx
lea ecx, [esp + 0x20]
call fcn.0044a442
push esi
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x140], 8
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 9
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 8
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 7
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], bl
call fcn.0044a3d4
mov eax, dword [esp + 0x10]
push ebx
push eax
call ebp
push str.OPTIONSCABS
lea ecx, [esp + 0x18]
call fcn.0044a442
mov esi, eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x134], 0xa
push ecx
lea ecx, [esp + 0x20]
call fcn.0044a442
push esi
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x140], 0xb
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 0xc
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 0xb
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 0xa
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], bl
call fcn.0044a3d4
mov eax, dword [esp + 0x10]
push ebx
push eax
call ebp
cmp eax, ebx
je 0x40bd56
push str.SOFTWAREUIUCABSFLAG
push 0x80000002
call fcn.0042ffc0
push ebx
push 0x46ab28
push str.CabsFlag
push str.SOFTWAREUIUCABSFLAG
push 0x80000002
call fcn.004301e0
add esp, 0x1c
push str.DRVIDX.BIN
lea ecx, [esp + 0x28]
call fcn.0044a442
mov esi, eax
push str.INF_
lea ecx, [esp + 0x24]
mov byte [esp + 0x138], 0xd
call fcn.0044a442
mov edi, eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x134], 0xe
push ecx
lea ecx, [esp + 0x18]
call fcn.0044a442
push edi
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x140], 0xf
call fcn.0044a5b7
push esi
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x13c], 0x10
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 0x11
call fcn.0044a4c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 0x10
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 0xf
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 0xe
call fcn.0044a3d4
lea ecx, [esp + 0x20]
mov byte [esp + 0x134], 0xd
call fcn.0044a3d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x134], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x14]
push str.DRVDATA.BIN
call fcn.0044a442
mov esi, eax
push str.INF_
lea ecx, [esp + 0x20]
mov byte [esp + 0x138], 0x12
call fcn.0044a442
mov edi, eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x138], 0x13
call fcn.0044a442
push edi
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x13c], 0x14
push eax
call fcn.0044a5b7
push esi
mov byte [esp + 0x138], 0x15
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 0x16
call fcn.0044a4c1
lea ecx, [esp + 0x24]
mov byte [esp + 0x134], 0x15
call fcn.0044a3d4
lea ecx, [esp + 0x20]
mov byte [esp + 0x134], 0x14
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 0x13
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x134], 0x12
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], bl
call fcn.0044a3d4
mov edx, dword [esp + 0x10]
push edx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x134], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret