Function at 0x43d3a0
Capabilities:
Link many functions at runtime
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0a68
mov eax, dword fs:[0]
push eax
sub esp, 0x65c
mov eax, dword [0x64b4f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.00416770
mov ecx, eax
test ecx, ecx
je 0x43dd92
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x64c], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00523fd0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x654d5c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x5ea1c4
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.004166e0
mov edi, eax
mov dword [ebp - 0x62c], edi
cmp dword [edi], 0
jne 0x43d4da
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x43d650
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5e6154
push eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x5e6160
push dword [ecx]
mov dword [ecx + 4], eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x5e616c
push dword [ecx]
mov dword [ecx + 8], eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x5e617c
push dword [ecx]
mov dword [ecx + 0x10], eax
call edi
mov ecx, dword [ebp - 0x62c]
push 0x5e618c
push dword [ecx]
mov dword [ecx + 0x14], eax
call edi
mov edi, dword [ebp - 0x62c]
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x43d4da
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x43d650
cmp dword [edi + 4], 0
je 0x43d650
cmp dword [edi + 0xc], 0
je 0x43d650
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00523fd0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x654d5c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00416770
mov ecx, eax
test ecx, ecx
je 0x43dd9c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
mov byte [ebp - 4], 1
call fcn.00416770
mov ecx, eax
test ecx, ecx
je 0x43dda6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x62c]
call fcn.00407a70
test al, al
jne 0x43d5a9
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43d587
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x62c]
call fcn.00408e60
lea eax, [ebp - 0x630]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.00415730
mov edx, dword [ebp - 0x62c]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43d5e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov edi, esp
mov dword [ebp - 0x634], esp
call fcn.00416980
push eax
mov ecx, edi
call fcn.00407740
push ecx
mov edi, esp
mov byte [ebp - 4], 4
mov dword [ebp - 0x62c], edi
mov eax, dword [ebp - 0x630]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x62c], eax
call fcn.00407bb0
add esp, 4
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 1
call fcn.005aa1b0
mov edx, dword [ebp - 0x62c]
add esp, 8
mov byte [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43d650
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_class_CInstaller__class_CInstaller___void_.virtual_0], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0x638], 0x43c520
mov dword [ebp - 0x634], ebx
lea eax, [ebp - 0x63c]
mov byte [ebp - 4], 5
push eax
call fcn.00433290
add esp, 4
mov byte [ebp - 4], 0
call fcn.00434490
mov edi, eax
call fcn.00434510
mov ecx, eax
call fcn.00434680
mov ecx, dword [edi]
push dword [eax]
push edi
call dword [ecx + 0x24]
push eax
push str.install_type:_d__install_version:_s
call fcn.00438b40
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 6
push eax
call fcn.00433290
add esp, 0x10
mov byte [ebp - 4], 0
lea edi, [ebx + 4]
push edi
call fcn.00434510
mov ecx, eax
call fcn.00434690
push eax
call fcn.00449190
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 2
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 7
push eax
call fcn.00433290
mov edi, dword [edi]
lea ecx, [ebp - 0x640]
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.004498c0
push edi
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 8
call fcn.00449ea0
lea ecx, [ebp - 0x640]
call fcn.0044a1b0
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0
call fcn.004499d0
push str.remove_all_pending_files
call fcn.00438b40
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 3
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 9
push eax
call fcn.00433290
push str..tmp
push dword [ebx + 4]
lea edi, [ebx + 4]
mov byte [ebp - 4], 0
call fcn.00408b70
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 4
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xa
push eax
call fcn.00433290
push dword [edi]
mov byte [ebp - 4], 0
push str.remove_all_.tmp_files_in__s
call fcn.00438b40
push str.update
lea eax, [ebp - 0x630]
push edi
push eax
call fcn.00413e40
push dword [eax]
mov byte [ebp - 4], 0xb
call fcn.00408220
mov edx, dword [ebp - 0x630]
or edi, 0xffffffff
add esp, 0x2c
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43d844
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.update
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x630]
push eax
call fcn.00413e40
push dword [eax]
mov byte [ebp - 4], 0xc
push str.Delete_directory_recursively:__s
call fcn.00438b40
mov edx, dword [ebp - 0x630]
add esp, 0x14
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43d88d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 5
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xd
push eax
call fcn.00433290
add esp, 4
mov byte [ebp - 4], 0
mov ecx, ebx
call fcn.0043b0b0
and eax, 1
mov dword [ebp - 0x62c], eax
jne 0x43d8f2
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0x64c]
call fcn.00414110
mov esi, dword [ebp - 0x64c]
mov ecx, ebx
call fcn.0043b580
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x5d
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xe
push eax
call fcn.00433290
push dword [ebx + 4]
mov byte [ebp - 4], 0
call fcn.0044b7f0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x5e
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0xf
push eax
call fcn.00433290
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.00434490
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x64]
test al, 1
je 0x43d99e
call fcn.0041c300
mov ecx, eax
call fcn.00419730
mov dword [ebp - 0x630], 1
test eax, eax
je 0x43d9a8
mov dword [ebp - 0x630], 0
call fcn.00434490
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x64]
test al, 2
je 0x43d9cd
call fcn.0041c300
mov ecx, eax
call fcn.00419910
test eax, eax
jne 0x43d9cd
lea edi, [eax + 1]
jmp 0x43d9cf
xor edi, edi
push 0
call fcn.0041c300
mov ecx, eax
call fcn.00419bf0
neg eax
sbb eax, eax
inc eax
push eax
call fcn.0041c300
mov ecx, eax
call fcn.00419a10
neg eax
sbb eax, eax
inc eax
push eax
push edi
push dword [ebp - 0x630]
push ecx
mov edi, esp
mov dword [ebp - 0x634], edi
mov eax, dword [ebx + 4]
sub eax, 0x10
push eax
call fcn.00407bb0
add esp, 4
lea ecx, [ebp - 0x664]
add eax, 0x10
mov dword [edi], eax
call fcn.00435b30
lea ecx, [ebp - 0x664]
mov byte [ebp - 4], 0x10
call fcn.004366d0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x60
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x11
push eax
call fcn.00433290
add esp, 4
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x664]
call fcn.00435d10
call fcn.0041c300
mov ecx, eax
call fcn.00418fb0
test eax, eax
jne 0x43db11
lea eax, [ebp - 0x630]
mov ecx, ebx
push eax
call fcn.0043b910
push dword [ebp - 0x630]
mov byte [ebp - 4], 0x12
push 0x5eadb4
push 0x5e55e4
push 0x5eadb8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push str.autorun
call fcn.00438b40
add esp, 4
lea ecx, [ebp - 0x645]
call fcn.0044a390
push dword [ebx + 4]
lea ecx, [ebp - 0x645]
mov byte [ebp - 4], 0x13
call fcn.0044a3b0
lea ecx, [ebp - 0x645]
call fcn.0044a3a0
mov edx, dword [ebp - 0x630]
or eax, 0xffffffff
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43db11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, ebx
call fcn.0043c5e0
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x63c], 0x43c530
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], 0x62
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 0x14
push eax
call fcn.00433290
add esp, 4
mov byte [ebp - 4], 0x10
mov ecx, ebx
call fcn.0043ad80
mov ecx, ebx
call fcn.0043ec10
push 4
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0
push eax
push 4
push str.CertificateRevocation
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x43db96
push str.Ban_Check_Certificate_suc
jmp 0x43db9b
push str.Ban_Check_Certificate_fail
call fcn.00438b40
add esp, 4
call fcn.0041c300
mov eax, dword [eax + 0x40]
sub eax, 0x10
push eax
call fcn.00407bb0
add esp, 4
add eax, 0x10
mov dword [ebp - 0x630], eax
mov ecx, str.__fromnewinstall
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43dbeb
test dx, dx
je 0x43dbe7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43dbeb
add eax, 4
add ecx, 4
test dx, dx
jne 0x43dbc5
xor edi, edi
jmp 0x43dbf0
sbb edi, edi
or edi, 1
mov edx, dword [ebp - 0x630]
or eax, 0xffffffff
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43dc12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x43dc76
call fcn.0041c300
mov ecx, eax
call fcn.0041a130
test al, al
je 0x43dc76
push 0x208
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00523fd0
add esp, 0xc
lea eax, [ebp - 0x628]
push str.UtilsUnstHelper.exe
push dword [ebx + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.run_helper
call fcn.00438b40
add esp, 4
lea eax, [ebp - 0x628]
push 0xffffffffffffffff
push edi
push edi
push 1
push 1
push 0x5e68b0
push eax
call fcn.00447c90
mov ecx, ebx
call fcn.0043e490
test eax, eax
jne 0x43dc9d
push 0x14
push str.write_path_reg_fail
lea ecx, [ebp - 0x64c]
xor edi, edi
call fcn.00414110
mov esi, dword [ebp - 0x64c]
jmp 0x43dca3
mov edi, dword [ebp - 0x62c]
push str.install_end.
call fcn.00438b40
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x640], 0x43c500
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], edi
mov dword [ebp - 0x634], esi
lea eax, [ebp - 0x644]
mov byte [ebp - 4], 0x16
push eax
call fcn.00433290
push str.real_install_end.
mov byte [ebp - 4], 0x10
call fcn.00438b40
lea edi, [ebx + 0x78]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
add esp, 0xc
mov dword [ebp - 0x634], edi
test edi, edi
je 0x43dd10
mov eax, dword [edi]
push edi
call dword [eax]
mov ecx, dword [ebx + 0x68]
mov byte [ebp - 4], 0x17
test ecx, ecx
je 0x43dd21
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
push str.set_install_finish_event
call fcn.00438b40
add esp, 4
push dword [ebx + 0x94]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [ebp - 4], 0x18
test edi, edi
je 0x43dd48
mov eax, dword [edi]
push edi
call dword [eax + 4]
lea ecx, [ebp - 0x664]
call fcn.00435cc0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43dd72
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00465678
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00407a50
push 0x80004005
call fcn.00407a50
push 0x80004005
call fcn.00407a50
int3