Function at 0x4248c9
Capabilities:
Check for time delay via gettickcount
Create directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x9cc
push ebx
push esi
push edi
mov esi, ecx
push 0x4b069c
mov dword [ebp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0040c818
push 0x104
lea eax, [ebp - 0x958]
push eax
push 0x2711
push dword [0x4afe10]
xor ebx, ebx
mov byte [0x4afe9c], bl
call fcn.00432163
add esp, 0x10
lea ecx, [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov dword [0x4afe7c], ebx
mov dword [0x4afe80], ebx
mov dword [ebp + 0x30], 0x80000000
call fcn.0043717e
lea ecx, [ebp + 0x24]
call fcn.0043717e
push 0x49bff4
lea ecx, [ebp + 4]
mov dword [ebp - 0x14], ebx
call fcn.004419bc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x44], esi
mov dword [0x4afe70], eax
mov byte [0x4afe74], bl
mov dword [0x4afe78], ebx
call fcn.0040de7c
shrd eax, edx, 0x10
shr edx, 0x10
mov edx, 0x60000
cmp eax, edx
sbb cl, cl
inc cl
cmp eax, edx
mov dword [ebp - 0x30], eax
mov byte [ebp + 0x4f], cl
jb 0x424995
cmp eax, 0x6ffff
mov byte [ebp + 0x56], 1
jbe 0x424998
mov byte [ebp + 0x56], bl
lea ecx, [ebp + 0x58]
mov byte [ebp + 0x37], bl
mov byte [0x4afe9d], bl
call fcn.0043717e
push 7
pop ecx
xor eax, eax
mov esi, str._SystemRoot__
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x1c]
lea edi, [ebp - 0x88]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
push ebx
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0043eb92
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], eax
add eax, 0x1e
push eax
lea ecx, [ebp + 0x58]
call fcn.004371c5
cmp byte [ebp + 0x56], bl
jl 0x424a2a
push dword [ebp + 0x58]
lea ecx, [ebp - 0x1c]
call fcn.004419bc
push str.System32Drvload.exe
lea ecx, [ebp - 0x1c]
call fcn.004371ec
push dword [ebp - 0x1c]
call fcn.00482cde
neg eax
sbb al, al
pop ecx
lea ecx, [ebp - 0x1c]
and eax, 3
mov byte [ebp + 0x56], al
call fcn.00431c4c
mov al, byte [ebp + 0x56]
mov byte [ebp + 0x20], al
mov dword [ebp + 0x18], 1
mov byte [ebp + 0x67], bl
push dword [ebp + 0x7c]
inc byte [ebp + 0x67]
lea ecx, [ebp - 0x14]
mov byte [0x4afe75], bl
mov byte [ebp + 0x36], bl
call fcn.00441a80
mov eax, dword [ebp - 0x14]
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x6e], bl
mov dword [0x4afe98], ebx
mov dword [0x4afe78], ebx
mov byte [ebp + 0x13], 2
call fcn.0040c032
push 8
push dword [ebp + 0x70]
xor esi, esi
push str.listdev:
mov byte [ebp + 0x35], bl
mov byte [ebp + 0x55], 2
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x57], bl
mov byte [0x4afe96], bl
mov byte [0x4afe9e], bl
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], ebx
call fcn.00432c59
add esp, 0xc
test al, al
je 0x424af8
add dword [ebp + 0x70], 0x10
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
mov byte [ebp + 0x6f], 0x10
je 0x424acb
call fcn.00431c5f
test al, al
jne 0x424acb
mov eax, dword [ebp + 0x70]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x70]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x424ae4
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040c032
mov eax, dword [ebp - 0x20]
cmp word [eax], bx
je 0x425e13
xor edi, edi
cmp dword [ebp - 0x30], 0x60000
mov byte [ebp + 0x4e], 0xff
mov word [0x4afe88], bx
mov byte [0x4afe84], bl
jb 0x424b18
mov byte [ebp + 0x20], 3
mov eax, dword [ebp + 0x70]
cmp word [eax], 0x2a
jne 0x424fbd
push 8
lea eax, [ebp + 0x70]
push eax
push str.extract
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424b50
mov byte [0x4afe96], 1
mov byte [ebp + 0x55], 1
mov byte [ebp + 0x36], 1
jmp 0x424fa4
push 4
lea eax, [ebp + 0x70]
push eax
push 0x49bf8c
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x424b47
push 8
lea eax, [ebp + 0x70]
push eax
push str.nocheck
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424b8a
mov byte [0x4afe9e], 1
jmp 0x424fa4
push 7
lea eax, [ebp + 0x70]
push eax
push 0x49bf78
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424baa
mov byte [ebp + 0x57], 1
jmp 0x424fa4
push 7
lea eax, [ebp + 0x70]
push eax
push str.devcon
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424bcd
mov byte [0x4afe9c], 1
jmp 0x424fa4
push 9
lea eax, [ebp + 0x70]
push eax
push str.norescan
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424bed
mov byte [ebp + 0x57], 0xff
jmp 0x424fa4
push 6
lea eax, [ebp + 0x70]
push eax
push str.dummy
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424c10
mov byte [0x4afe74], 1
jmp 0x424fa4
push 4
lea eax, [ebp + 0x70]
push eax
push str.sub
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424c30
mov byte [ebp + 0x35], 1
jmp 0x424fa4
push 5
lea eax, [ebp + 0x70]
push eax
push str.self
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424c50
mov byte [ebp + 0x35], 2
jmp 0x424fa4
push 4
lea eax, [ebp + 0x70]
push eax
push str.7pe
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424c70
mov byte [ebp + 0x20], 3
jmp 0x424fa4
push 4
lea eax, [ebp + 0x70]
push eax
push str.7pe_
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x424fa4
push 8
lea eax, [ebp + 0x70]
push eax
push str.drvload
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424cad
mov al, byte [ebp + 0x56]
mov byte [ebp + 0x20], al
jmp 0x424fa4
push 6
lea eax, [ebp + 0x70]
push eax
push 0x49bf28
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424ccd
mov byte [ebp + 0x20], 0xc0
jmp 0x424fa4
push 9
lea eax, [ebp + 0x70]
push eax
push str.nnverify
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424ced
mov byte [ebp + 0x55], 1
jmp 0x424fa4
push 8
lea eax, [ebp + 0x70]
push eax
push str.rverify
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424d0c
mov byte [ebp + 0x55], bl
jmp 0x424fa4
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdevi
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424d32
mov al, byte [ebp + 0x6f]
and al, 0xf2
or al, 2
mov byte [ebp + 0x6f], al
jmp 0x424fa4
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdevc
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424d52
mov al, byte [ebp + 0x6f]
and al, 0xf4
or al, 4
jmp 0x424d2a
push 4
lea eax, [ebp + 0x70]
push eax
push str.All
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424d72
or byte [ebp + 0x6f], 0x20
jmp 0x424fa4
push 5
lea eax, [ebp + 0x70]
push eax
push 0x49bee8
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424d97
mov word [0x4afe88], 3
jmp 0x424fa4
push 4
lea eax, [ebp + 0x70]
push eax
push str.sys
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424dba
mov byte [0x4afe84], 1
jmp 0x424fa4
mov eax, dword [str.disverify]
push 0xa
lea ecx, [ebp + 0x70]
inc eax
push ecx
push eax
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424ddc
or byte [ebp + 0x6e], 1
jmp 0x424fa4
push 0xb
lea eax, [ebp + 0x70]
push eax
push dword [0x4ae2b4]
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424dfd
or byte [ebp + 0x6e], 3
jmp 0x424fa4
push 0xe
lea eax, [ebp + 0x70]
push eax
push dword [0x4ae2b0]
call fcn.00438eee
add esp, 0xc
test al, al
je 0x424e1e
or byte [ebp + 0x6e], 0x10
jmp 0x424fa4
push 7
push dword [ebp + 0x70]
push str.retid:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x424e81
mov ecx, dword [ebp + 0x70]
add ecx, 0xe
xor eax, eax
mov dword [ebp + 0x70], ecx
mov ax, word [ecx]
cmp ax, bx
je 0x424e5b
call fcn.00431c5f
test al, al
jne 0x424e5b
lea eax, [ebp + 4]
mov dword [ebp - 0x5c], ecx
mov dword [0x4afe70], eax
lea eax, [ebp + 0x70]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x424e74
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040c032
jmp 0x424fa4
push 0xa
push dword [ebp + 0x70]
push str.DevClass:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x424ebb
mov ecx, dword [ebp + 0x70]
add ecx, 0x14
xor eax, eax
mov dword [ebp + 0x70], ecx
mov ax, word [ecx]
cmp ax, bx
je 0x424e5b
call fcn.00431c5f
test al, al
jne 0x424e5b
mov dword [0x4afe78], ecx
jmp 0x424e5b
push 7
push dword [ebp + 0x70]
push str.DevID:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x424f39
add dword [ebp + 0x70], 0xe
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
je 0x424eec
call fcn.00431c5f
test al, al
jne 0x424eec
mov esi, dword [ebp + 0x70]
lea eax, [ebp + 0x70]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x424f05
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040c032
cmp esi, ebx
je 0x424fa4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x424f35
cmp word [esi + eax*2 - 2], 0x26
jne 0x424f31
mov word [esi + eax*2], bx
dec eax
cmp eax, ebx
jg 0x424f20
cmp eax, ebx
jg 0x424fa4
xor esi, esi
jmp 0x424fa4
push 9
push dword [ebp + 0x70]
push str.disable:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x424f58
add dword [ebp + 0x70], 2
mov byte [ebp + 0x4e], bl
jmp 0x424f72
push 8
push dword [ebp + 0x70]
push str.enable:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x424f9a
mov byte [ebp + 0x4e], 1
add dword [ebp + 0x70], 0x10
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
je 0x424e5b
call fcn.00431c5f
test al, al
jne 0x424e5b
mov edi, dword [ebp + 0x70]
jmp 0x424e5b
lea eax, [ebp + 0x70]
push eax
call fcn.00404807
pop ecx
mov eax, dword [ebp + 0x70]
cmp word [eax], 0x2a
je 0x424b25
cmp byte [ebp + 0x6e], bl
mov dword [ebp - 0x18], esi
jne 0x425e6d
cmp byte [ebp + 0x20], bl
setl al
dec al
and eax, dword [ebp + 0x20]
or byte [ebp + 0x4f], al
mov byte [0x4afe9d], al
mov al, byte [ebp + 0x6f]
and al, 0x10
mov byte [ebp + 0x6e], al
je 0x424fe3
cmp dword [ebp - 0x20], ebx
je 0x425e80
cmp byte [ebp + 0x4e], bl
jl 0x424ff0
cmp edi, ebx
jne 0x425e8c
cmp dword [ebp - 0x18], ebx
push 0x200010
setne al
lea ecx, [ebp + 0x38]
mov byte [0x4afe75], al
call fcn.00437072
mov eax, dword [ebp + 0x38]
push 8
add eax, 0x200000
push ebx
push eax
call fcn.004832e0
mov eax, dword [ebp + 0x38]
mov dword [ebp - 4], eax
add eax, 2
mov esi, eax
mov word [esi + 2], bx
mov word [esi], bx
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x7c], 0x1c
mov dword [ebp - 0x78], ebx
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x70]
xor ecx, ecx
add esp, 0xc
cmp word [eax], 0x24
mov dword [ebp - 0x10], ebx
sete cl
cmp ecx, ebx
mov dword [ebp + 0x3c], ecx
je 0x42506b
jmp 0x425060
inc dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp + 0x70], eax
cmp word [eax], 0x24
je 0x42505d
lea ecx, [ebp + 0x70]
call fcn.0040c032
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
push dword [ebp + 0x70]
call edi
cmp eax, ebx
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x40], ebx
je 0x4250c2
add dword [ebp + 0x48], 2
lea ecx, [ebp + 0x48]
mov word [eax], bx
call fcn.0040c032
push 0x2c
push dword [ebp + 0x48]
call edi
cmp eax, ebx
mov dword [ebp + 0x60], eax
je 0x4250b9
add dword [ebp + 0x60], 2
lea ecx, [ebp + 0x60]
mov word [eax], bx
call fcn.0040c032
push dword [ebp + 0x48]
call fcn.0040d1db
pop ecx
push dword [ebp + 0x70]
call fcn.0040d1db
cmp dword [ebp + 0x60], ebx
pop ecx
je 0x425100
push 0x2c
push dword [ebp + 0x60]
call edi
cmp eax, ebx
mov dword [ebp + 0x40], eax
je 0x4250f7
mov word [eax], bx
inc eax
inc eax
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x40], eax
call fcn.0040c032
push dword [ebp + 0x40]
call fcn.0040d1db
pop ecx
push dword [ebp + 0x60]
call fcn.0040d1db
pop ecx
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
je 0x4251a1
lea eax, [ebp + 0x70]
push 1
push eax
call fcn.0043e955
cmp eax, ebx
pop ecx
pop ecx
je 0x4251a1
cmp word [eax], 0x23
jne 0x4251a1
lea ecx, [ebp - 0x40]
call fcn.0043717e
push str..tmp.cab
push str.devi
push ebx
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.0040492a
add esp, 0x14
push str.__dd__len16M___
lea ecx, [ebp + 0xc]
call fcn.004419bc
push dword [ebp - 0x40]
lea ecx, [ebp + 0xc]
call fcn.004371ec
push 0x49be5c
lea ecx, [ebp + 0xc]
call fcn.004371ec
push dword [ebp + 0x70]
lea ecx, [ebp + 0xc]
call fcn.004371ec
mov ecx, dword [ebp + 0x1c]
push ebx
push dword [ebp + 0xc]
call fcn.00461b42
push dword [ebp - 0x40]
lea ecx, [ebp + 0x24]
call fcn.0040e408
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x70], eax
call fcn.00431c4c
lea ecx, [ebp - 0x40]
call fcn.00431c4c
push dword [ebp + 0x70]
call fcn.00482b55
pop ecx
push dword [ebp + 0x70]
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp byte [ebp + 0x36], bl
mov edi, eax
jne 0x4251e6
cmp dword [ebp - 0x50], ebx
jne 0x4251de
cmp edi, 4
jle 0x4251de
mov eax, dword [ebp + 0x70]
lea eax, [eax + edi*2 - 8]
push str..CAB
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4251e6
mov dword [ebp - 0x24], ebx
jmp 0x42526a
cmp byte [0x4afb91], 1
mov dword [ebp - 0x24], 1
mov eax, str.SysWow64
je 0x425200
mov eax, str.System32
mov ecx, dword [ebp - 8]
push 0x10
push eax
mov eax, dword [ebp + 0x58]
lea eax, [eax + ecx*2]
push eax
call fcn.00410b58
mov eax, dword [ebp + 0x58]
mov ecx, dword [ebp - 8]
push 0x1a
lea eax, [eax + ecx*2 + 0x10]
push str.cabinet.dll
push eax
call fcn.00410b58
push dword [ebp + 0x58]
call fcn.00482cde
add esp, 0x1c
test eax, eax
jne 0x42526a
push 0x63
lea ecx, [ebp - 0x58]
call fcn.0043719c
push dword [ebp + 0x58]
push str.__dd__bs1M__s_0__._33INDATA
push dword [ebp - 0x58]
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
push ebx
push dword [ebp - 0x58]
call fcn.00461b42
lea ecx, [ebp - 0x58]
call fcn.00431c4c
mov eax, dword [ebp + 0x60]
cmp eax, ebx
je 0x42527a
cmp word [eax], 0x2a
jne 0x42527a
mov dword [ebp + 0x60], ebx
cmp edi, 4
jle 0x42529d
mov eax, dword [ebp + 0x70]
lea eax, [eax + edi*2 - 8]
push 0x49a39c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42529d
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x4252a2
xor ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0x50], ebx
jne 0x4252ae
cmp eax, ebx
mov dword [ebp + 0x5c], ecx
jne 0x4252b1
mov dword [ebp + 0x5c], ebx
cmp dword [ebp - 0x10], ecx
je 0x4252d2
cmp eax, ebx
je 0x4252c4
cmp dword [ebp + 0x3c], ebx
je 0x4252c4
cmp dword [ebp + 0x60], ebx
jne 0x4252d2
cmp dword [ebp + 0x5c], ebx
je 0x4252ce
cmp dword [ebp + 0x3c], ebx
jne 0x4252d2
xor al, al
jmp 0x4252d4
mov al, 1
cmp dword [ebp + 0x5c], ebx
jne 0x4252e0
cmp al, bl
mov dword [ebp - 0x10], ebx
je 0x4252e3
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x60]
cmp edi, ebx
mov dword [ebp + 0x50], ebx
mov dword [0x4afe8c], ebx
mov dword [0x4afe90], ebx
mov word [0x4afe94], bx
je 0x425387
cmp word [edi], bx
je 0x425387
cmp dword [ebp - 0x10], ebx
jne 0x425387
push edi
lea ecx, [ebp + 0x50]
call fcn.00441a80
push dword [ebp + 0x50]
call fcn.00410df7
pop ecx
push ebx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x105
lea ecx, [ebp - 0x38]
call fcn.0043719c
push 0x104
push dword [ebp - 0x38]
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov eax, dword [ebp - 0x38]
cmp word [eax], bx
je 0x425359
mov ecx, dword [ebp + 0x50]
mov dword [ebp + 0x50], eax
mov dword [ebp - 0x38], ecx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi + eax*2 - 2], 0x5c
je 0x425377
push 0x497cfc
lea ecx, [ebp + 0x50]
call fcn.004371ec
mov eax, dword [ebp + 0x50]
lea ecx, [ebp - 0x38]
mov dword [0x4afe8c], eax
call fcn.00431c4c
cmp dword [ebp + 0x3c], ebx
jne 0x425399
cmp byte [ebp + 0x4f], bl
je 0x4253b4
cmp byte [0x4afe96], bl
jne 0x4253b4
cmp byte [0x4afe84], bl
jne 0x4253b4
cmp byte [ebp + 0x6e], bl
jne 0x4253b4
cmp byte [ebp + 0x55], 1
je 0x4253b4
lea ecx, [ebp + 0x30]
call fcn.0040e46a
cmp byte [ebp + 0x55], 2
jne 0x4253bd
mov dword [ebp + 0x30], ebx
cmp dword [ebp - 0x24], ebx
je 0x4253ee
mov eax, dword [ebp + 0x48]
cmp eax, ebx
je 0x4253ee
or dword [ebp + 0x68], 0xffffffff
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.00439fac
mov eax, dword [ebp + 0x68]
cmp eax, ebx
pop ecx
pop ecx
jle 0x4253ee
cmp eax, 0x14
jge 0x4253ee
mov byte [ebp + 0x13], al
cmp byte [ebp + 0x67], 1
jne 0x425443
cmp byte [0x4afe96], bl
jne 0x425443
movsx eax, byte [ebp + 0x57]
push eax
movsx eax, byte [0x4afe9e]
push eax
push dword [ebp + 0x3c]
movsx eax, byte [0x4afe9d]
push dword [ebp + 0x5c]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x43c]
push str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x43c]
push eax
push 0x49bd44
push dword [ebp + 0x1c]
call fcn.0040d391
add esp, 0x2c
cmp byte [ebp + 0x57], bl
jg 0x425480
cmp byte [ebp + 0x6f], bl
jne 0x425567
cmp byte [ebp + 0x57], bl
jl 0x42555b
cmp byte [0x4afe9d], bl
je 0x42555b
cmp dword [ebp + 0x5c], ebx
jne 0x425474
cmp dword [ebp + 0x3c], ebx
je 0x42555b
cmp byte [0x4afe9e], bl
jne 0x42555b
cmp byte [ebp + 0x67], 1
jne 0x42549b
push 0x497994
push 0x49bd2c
push dword [ebp + 0x1c]
call fcn.0040d391
add esp, 0xc
call fcn.0040e0b5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x68], ebx
call edi
add eax, 0x32
mov dword [ebp + 0x14], eax
call edi
mov ecx, dword [ebp + 0x14]
sub ecx, eax
cmp ecx, ebx
jle 0x425556
cmp byte [0x4ae290], bl
jle 0x425556
cmp ecx, ebx
jbe 0x425546
cmp ecx, 0x7d0
jbe 0x4254df
mov ecx, 0x3e8
jmp 0x4254e7
cmp ecx, 0x64
jbe 0x4254e7
push 0x64
pop ecx
push 0x4bf
push ecx
push ebx
lea eax, [ebp - 0xac]
push eax
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x425546
cmp dword [ebp + 0x68], ebx
jg 0x42550e
call edi
mov ecx, dword [ebp + 0x14]
sub ecx, eax
test ecx, ecx
jle 0x42554e
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42554e
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp + 0x68], ebx
jle 0x425546
dec dword [ebp + 0x68]
cmp byte [0x4ae290], bl
jg 0x4254fe
mov dword [ebp + 0x68], ebx
jmp 0x4254b1
cmp byte [ebp + 0x6f], bl
jne 0x425567
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
je 0x425f0a
lea ecx, [ebp + 0x28]
call fcn.0043717e
push dword [ebp + 0x70]
call fcn.0040f738
push ebx
lea ecx, [ebp + 0x28]
push ecx
push eax
mov dword [ebp + 0x70], eax
call fcn.0047675f
mov dword [ebp + 0x70], eax
add esp, 0x10
xor eax, eax
cmp byte [ebp + 0x6f], bl
je 0x42559b
test byte [ebp + 0x6f], 0x20
jne 0x42559b
push 2
pop eax
or eax, 4
push eax
push ebx
push ebx
push ebx
call dword [0x4afdcc]
cmp eax, 0xffffffff
mov dword [ebp + 0x68], eax
jne 0x4255bc
cmp dword [ebp + 0x5c], ebx
mov dword [ebp + 0x68], ebx
je 0x425f12
test byte [ebp + 0x6f], 4
push 0
pop eax
setne al
lea ecx, [ebp + 0x44]
inc eax
mov dword [ebp - 0x54], eax
call fcn.0043717e
push 0x3f
xor eax, eax
pop ecx
mov word [ebp - 0x2ac], bx
lea edi, [ebp - 0x2aa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
xor eax, eax
cmp byte [0x4afe96], bl
mov word [ebp - 0x1ac], bx
pop ecx
lea edi, [ebp - 0x1aa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x7c], 0x1c
jne 0x4257fd
cmp dword [ebp + 0x68], ebx
je 0x4257fd
mov eax, esi
sub eax, dword [ebp - 4]
mov dword [ebp + 0x5c], ebx
cmp eax, 0x200000
jge 0x4257fd
push 0x1c
pop edi
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
call dword [0x4afde0]
test eax, eax
je 0x4257fd
cmp byte [ebp + 0x6f], bl
je 0x4256ee
cmp dword [0x4afe78], ebx
je 0x42568b
push ebx
push 0x80
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
push dword [0x4afe78]
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4257ea
test byte [ebp + 0x6f], 2
je 0x4256ee
push ebx
push 0x80
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
cmp byte [ebp + 0x6e], bl
je 0x4256d1
mov eax, dword [ebp + 0x44]
cmp word [eax], bx
je 0x4256c5
push 0x497d7c
lea ecx, [ebp + 0x44]
call fcn.004371ec
lea eax, [ebp - 0x1ac]
push eax
jmp 0x42576b
cmp dword [ebp - 0x18], ebx
je 0x4256ee
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4257ea
mov eax, dword [0x4afdf0]
cmp eax, ebx
mov dword [ebp - 0x60], ebx
je 0x425712
push ebx
push dword [ebp - 0x68]
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp + 0x14]
push ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp + 0x14], 0x400
call eax
mov eax, dword [ebp - 4]
sub eax, esi
add eax, 0x200000
mov ecx, 0x800
cmp eax, ecx
mov word [esi + 2], bx
mov word [esi], bx
jle 0x42572e
mov eax, ecx
push ebx
push eax
push esi
push ebx
push dword [ebp - 0x54]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x68]
mov dword [ebp - 0x7c], edi
call dword [0x4afdd0]
cmp eax, ebx
mov dword [ebp - 0x7c], edi
je 0x4257ea
cmp byte [ebp + 0x6e], bl
je 0x425775
mov eax, dword [ebp + 0x44]
cmp word [eax], bx
je 0x42576a
push 0x497d7c
lea ecx, [ebp + 0x44]
call fcn.004371ec
push esi
lea ecx, [ebp + 0x44]
call fcn.004371ec
jmp 0x4257ea
push 4
push str.ACPI
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x4257ea
cmp byte [ebp + 0x67], 1
jne 0x42579f
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x4c]
push dword [ebp + 0x1c]
call fcn.0040d391
add esp, 0x10
xor eax, eax
mov ax, word [esi]
xor ecx, ecx
xor edx, edx
cmp ax, bx
je 0x4257e4
cmp ax, 0x26
jne 0x4257bc
movsx eax, byte [ebp + 0x13]
inc edx
cmp edx, eax
jge 0x4257c9
inc ecx
movzx eax, cx
mov ax, word [esi + eax*2]
cmp ax, bx
jne 0x4257ad
cmp cx, bx
jbe 0x4257e4
movzx eax, cx
mov word [esi - 2], cx
lea esi, [esi + eax*2]
jmp 0x4257dc
inc esi
inc esi
cmp word [esi], bx
jne 0x4257da
add esi, 4
test byte [ebp + 0x6f], 2
jne 0x4257fd
inc dword [ebp + 0x5c]
mov eax, esi
sub eax, dword [ebp - 4]
cmp eax, 0x200000
jl 0x425630
cmp byte [ebp + 0x6e], bl
jne 0x425f1e
cmp dword [ebp - 0x10], ebx
je 0x42581a
test byte [ebp + 0x6f], 2
je 0x42581a
mov dword [ebp - 0x20], 1
jmp 0x425857
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
je 0x425857
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 0x34]
mov edi, eax
mov eax, dword [ebp - 4]
mov word [eax], di
lea eax, [edi + 1]
push eax
push dword [ebp - 0x18]
push esi
call fcn.004047cb
lea esi, [esi + edi*2 + 2]
mov word [esi], bx
add esp, 0xc
inc esi
inc esi
mov word [esi + 4], bx
mov word [esi + 2], bx
push dword [ebp + 0x68]
mov word [esi - 2], bx
call dword [0x4afdd4]
cmp byte [0x4afe96], bl
jne 0x425881
push 0x497994
push 0x497d7c
push dword [ebp + 0x1c]
call fcn.0040d391
add esp, 0xc
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x58]
push 8
add edi, edi
add eax, edi
push 0x49bd18
push eax
call fcn.00410b58
add esp, 0xc
cmp dword [ebp - 0x10], ebx
jne 0x425f34
cmp dword [ebp + 0x68], ebx
je 0x4263b5
cmp byte [0x4afe96], bl
jne 0x4258d3
mov esi, dword [ebp - 4]
cmp word [esi], bx
je 0x4263c1
cmp dword [ebp - 0x50], ebx
jne 0x4263cd
cmp dword [ebp - 0x24], ebx
je 0x4263cd
mov eax, dword [0x4afe8c]
cmp eax, ebx
je 0x4258e6
cmp word [eax], 0x2a
jne 0x4259aa
cmp dword [ebp + 0x3c], ebx
mov cl, byte [0x4afe9d]
je 0x4258fd
cmp cl, bl
jne 0x425905
cmp byte [0x4afe84], bl
jne 0x425905
cmp cl, bl
jne 0x4259b2
lea ecx, [ebp - 0x2c]
call fcn.0043717e
push 0x49bd10
push str.devi
push ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.0040492a
add esp, 0x14
push 0x105
lea ecx, [ebp - 0x3c]
call fcn.0043719c
push 0x104
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov eax, dword [ebp - 0x3c]
cmp word [eax], bx
je 0x425954
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], ecx
push 0x497cfc
lea ecx, [ebp - 0x2c]
call fcn.004371ec
push dword [ebp - 0x2c]
lea ecx, [ebp + 0x2c]
call fcn.0040e408
cmp byte [0x4afe9d], bl
jne 0x425990
cmp byte [0x4afe84], bl
jne 0x425990
push eax
mov dword [0x4afe90], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x4afe94], ax
jmp 0x425995
mov dword [0x4afe8c], eax
lea ecx, [ebp - 0x3c]
call fcn.00431c4c
lea ecx, [ebp - 0x2c]
call fcn.00431c4c
mov eax, dword [0x4afe8c]
cmp byte [0x4afe9d], bl
je 0x4259cd
cmp byte [0x4afe96], bl
jne 0x4259cd
cmp eax, ebx
je 0x4259cd
cmp byte [0x4afe9e], bl
jne 0x4259cd
mov dword [ebp + 0x3c], 1
cmp byte [ebp + 0x37], bl
je 0x4259d9
xor eax, eax
mov dword [0x4afe8c], eax
cmp byte [0x4afe9e], bl
je 0x4259ed
cmp eax, ebx
je 0x4259ed
cmp dword [ebp + 0x40], ebx
je 0x4259ed
mov dword [ebp + 0x3c], ebx
movzx ecx, word [0x4afe88]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
shl ecx, 0x10
or eax, ecx
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x58]
push 0xa
add edi, eax
push str.INF_
push edi
call fcn.00410b58
add esp, 0xc
push 0x1040
lea ecx, [ebp - 0x1c]
call fcn.0043719c
xor eax, eax
mov dword [ebp - 0x74c], ebx
mov ecx, 0x93
lea edi, [ebp - 0x748]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x74c]
push eax
push dword [ebp + 0x70]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], ebx
call fcn.00482c3e
add esp, 0xc
cmp dword [ebp - 0x28], ebx
je 0x426430
push dword [ebp + 0x70]
lea ecx, [ebp]
call fcn.004419bc
lea eax, [ebp]
push eax
push dword [ebp + 0x70]
call fcn.00448935
pop ecx
pop ecx
push 0x497cfc
lea ecx, [ebp]
call fcn.004371ec
push str.DefaultInstall_132
lea ecx, [ebp + 8]
call fcn.004419bc
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push dword [ebp]
mov dword [ebp + 0x14], eax
call esi
cmp dword [ebp + 0x3c], ebx
mov ecx, eax
mov eax, dword [ebp]
mov dword [ebp - 0x34], ecx
mov word [eax + ecx*2], bx
jne 0x425ac5
cmp byte [0x4afe96], bl
mov dword [ebp + 0x60], 1
je 0x425ac8
mov dword [ebp + 0x60], ebx
mov eax, dword [0x4afe8c]
neg eax
sbb eax, eax
and eax, 0x20000
add eax, 0x10000
or dword [ebp + 0x5c], eax
jmp 0x425ae3
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov word [eax], bx
test byte [ebp - 0x74c], 0x10
mov dword [0x4afdf8], eax
mov dword [0x4afdfc], eax
mov dword [0x4afe98], ebx
jne 0x425d61
mov eax, dword [ebp]
mov word [eax + ecx*2], bx
lea eax, [ebp - 0x720]
push eax
lea ecx, [ebp]
call fcn.004371ec
push dword [ebp - 4]
push 0x41dc01
push ebx
push dword [ebp]
call dword [0x4afde4]
cmp dword [ebp + 0x3c], ebx
je 0x425c38
mov edi, dword [0x4afdfc]
cmp edi, dword [0x4afdf8]
jae 0x425c2f
add edi, 4
push edi
mov esi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp byte [ebp + 0x67], 1
lea edi, [edi + eax*2 + 2]
jle 0x425b71
push 0xffffffffffffffff
mov eax, esi
call fcn.0040dd7e
test eax, eax
pop ecx
jne 0x425c1f
cmp byte [0x4afe84], bl
mov dword [ebp + 0x48], 4
je 0x425b90
push dword [ebp + 0x5c]
push edi
call fcn.0041344b
pop ecx
pop ecx
jmp 0x425c1f
cmp byte [0x4afe9d], 3
je 0x425ba1
cmp byte [0x4afe9c], bl
je 0x425bd6
or dword [ebp + 0x48], 1
cmp byte [0x4afe9c], bl
je 0x425bb6
push esi
push edi
call fcn.0040df0a
jmp 0x425bc6
cmp byte [0x4afe9d], 3
jne 0x425bcb
push esi
push edi
call fcn.0040dfd0
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
cmp dword [ebp + 0x60], ebx
je 0x425c1f
test byte [ebp + 0x48], 2
jne 0x425bf4
push dword [ebp + 0x5c]
or dword [ebp + 0x48], 2
push edi
push esi
call fcn.0041335b
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x60], eax
je 0x425c1f
test byte [ebp + 0x48], 1
je 0x425ba1
test byte [ebp + 0x48], 4
jne 0x425c1f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov word [eax + ecx*2], bx
push edi
lea ecx, [ebp + 8]
call fcn.004371ec
push 0x100000
push dword [ebp + 8]
push ebx
push ebx
call fcn.0040e422
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 + 2]
jmp 0x425b3d
cmp dword [ebp + 0x3c], ebx
jne 0x425d61
cmp byte [0x4afe9e], bl
je 0x425d61
cmp dword [ebp + 0x40], ebx
je 0x425d61
mov eax, dword [0x4afe8c]
cmp eax, ebx
je 0x425d61
push eax
lea ecx, [ebp - 0xc]
call fcn.004419bc
push dword [ebp + 0x40]
lea ecx, [ebp - 0xc]
call fcn.004371ec
push dword [ebp - 0xc]
push 0x49bcbc
push dword [ebp + 0x1c]
call fcn.0040d391
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.0041d798
mov edi, eax
add esp, 0x14
cmp edi, ebx
mov esi, edi
jne 0x425c99
mov esi, 0x497994
cmp byte [0x4afe9d], 3
mov dword [ebp + 0x68], 4
je 0x425cb1
cmp byte [0x4afe9c], bl
je 0x425cf3
or dword [ebp + 0x68], 1
cmp byte [0x4afe9c], bl
je 0x425cc8
push esi
push dword [ebp - 0xc]
call fcn.0040df0a
jmp 0x425cda
cmp byte [0x4afe9d], 3
jne 0x425cdf
push esi
push dword [ebp - 0xc]
call fcn.0040dfd0
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], 2
jge 0x425d52
cmp dword [ebp + 0x60], ebx
je 0x425d52
test byte [ebp + 0x68], 2
jne 0x425d25
or dword [ebp + 0x68], 2
cmp edi, ebx
je 0x425d0d
push dword [ebp + 0x5c]
push dword [ebp - 0xc]
push edi
call fcn.0041335b
add esp, 0xc
mov dword [ebp + 0x60], eax
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], 2
jge 0x425d52
cmp edi, ebx
je 0x425d1f
cmp dword [ebp + 0x60], ebx
je 0x425d52
test byte [ebp + 0x68], 2
je 0x425cb1
test byte [ebp + 0x68], 4
jne 0x425d52
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov word [eax + ecx*2], bx
push dword [ebp - 0xc]
lea ecx, [ebp + 8]
call fcn.004371ec
push 0x100000
push dword [ebp + 8]
push ebx
push ebx
call fcn.0040e422
add esp, 0x10
cmp edi, ebx
je 0x425d59
mov word [edi], bx
lea ecx, [ebp - 0xc]
call fcn.00431c4c
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x28]
call fcn.004048d9
test eax, eax
jne 0x425ae0
lea ecx, [ebp - 0x28]
call fcn.00402baa
cmp dword [ebp + 0x60], ebx
mov eax, dword [ebp + 4]
mov word [eax], 0x5f
jne 0x425d90
mov dword [ebp + 0x18], ebx
cmp dword [ebp + 0x3c], ebx
je 0x426439
cmp dword [0x4afe8c], ebx
je 0x426439
cmp byte [0x4afe9d], 1
jne 0x426439
cmp byte [ebp + 0x37], bl
jne 0x426439
cmp dword [ebp + 0x40], ebx
jne 0x426439
lea ecx, [ebp + 8]
mov dword [0x4afe8c], ebx
mov byte [ebp + 0x37], 1
call fcn.00431c4c
lea ecx, [ebp]
call fcn.00431c4c
lea ecx, [ebp - 0x28]
call fcn.00402baa
lea ecx, [ebp - 0x1c]
call fcn.00431c4c
lea ecx, [ebp + 0x44]
call fcn.00431c4c
lea ecx, [ebp + 0x28]
call fcn.00431c4c
lea ecx, [ebp + 0x50]
call fcn.00431c4c
lea ecx, [ebp + 0x38]
call fcn.00431c4c
jmp 0x424a3a
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x48]
call fcn.0040e480
lea ecx, [ebp + 4]
call fcn.00431c4c
lea ecx, [ebp - 0x14]
call fcn.00431c4c
lea ecx, [ebp + 0x24]
call fcn.0041df1f
lea ecx, [ebp + 0x24]
call fcn.00431c4c
lea ecx, [ebp + 0x2c]
call fcn.0041df1f
lea ecx, [ebp + 0x2c]
call fcn.00431c4c
cmp dword [ebp + 0x30], ebx
jle 0x425e63
push ebx
push dword [ebp + 0x30]
call fcn.0047607f
pop ecx
pop ecx
mov ebx, 0x80070057
jmp 0x4264f0
xor eax, eax
mov al, byte [ebp + 0x6e]
and eax, 0x12
push eax
push ebx
call fcn.0047607f
pop ecx
pop ecx
jmp 0x425eb1
mov dword [ebp + 0x18], 0x80070057
jmp 0x426494
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040bf8a
push 0x100
push dword [eax]
movsx eax, byte [ebp + 0x4e]
push eax
call fcn.00432f70
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.00431c4c
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x48]
call fcn.0040e480
lea ecx, [ebp + 4]
call fcn.00431c4c
lea ecx, [ebp - 0x14]
call fcn.00431c4c
lea ecx, [ebp + 0x24]
call fcn.0041df1f
lea ecx, [ebp + 0x24]
call fcn.00431c4c
lea ecx, [ebp + 0x2c]
call fcn.0041df1f
lea ecx, [ebp + 0x2c]
call fcn.00431c4c
cmp dword [ebp + 0x30], ebx
jle 0x4264f0
push ebx
push dword [ebp + 0x30]
call fcn.0047607f
pop ecx
pop ecx
jmp 0x4264f0
mov dword [ebp + 0x18], ebx
jmp 0x426484
mov dword [ebp + 0x18], 1
jmp 0x42647c
push dword [ebp + 0x44]
mov ecx, dword [ebp + 0x1c]
push dword [ebp - 0x20]
call fcn.00436b54
mov dword [ebp + 0x18], ebx
jmp 0x426474
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x5c], ebx
jne 0x425fce
mov eax, dword [ebp - 4]
cmp word [eax], bx
jne 0x425fce
cmp byte [0x4afe9e], bl
jne 0x425fce
lea ecx, [ebp + 0x44]
call fcn.00431c4c
lea ecx, [ebp + 0x28]
call fcn.00431c4c
lea ecx, [ebp + 0x50]
call fcn.00431c4c
lea ecx, [ebp + 0x38]
call fcn.00431c4c
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x48]
call fcn.0040e480
lea ecx, [ebp + 4]
call fcn.00431c4c
lea ecx, [ebp - 0x14]
call fcn.00431c4c
lea ecx, [ebp + 0x24]
call fcn.0041df1f
lea ecx, [ebp + 0x24]
call fcn.00431c4c
lea ecx, [ebp + 0x2c]
call fcn.0041df1f
lea ecx, [ebp + 0x2c]
call fcn.00431c4c
cmp dword [ebp + 0x30], ebx
jle 0x425fc4
push ebx
push dword [ebp + 0x30]
call fcn.0047607f
pop ecx
pop ecx
mov ebx, 0x491
jmp 0x4264f0
mov esi, dword [ebp - 8]
lea eax, [esi + 4]
mov dword [ebp - 0x30], eax
add eax, 0x3c
push eax
lea ecx, [ebp - 8]
call fcn.0043719c
mov eax, dword [ebp + 0x58]
push 0x22
lea edi, [esi + esi]
add eax, edi
push str.System32DRIVERS
push eax
call fcn.00410b58
push dword [ebp + 0x58]
call fcn.00482b55
add esp, 0x10
test eax, eax
jne 0x426011
push ebx
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp + 0x58]
push 8
add eax, edi
push 0x49bd18
push eax
call fcn.00410b58
push dword [ebp + 0x58]
call fcn.00482b55
add esp, 0x10
test eax, eax
jne 0x42603c
push ebx
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp + 0x58]
push 0xa
add edi, eax
push str.INF_
push edi
call fcn.00410b58
movzx eax, word [0x4afe88]
shl eax, 0x10
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x4fc], ebx
mov ecx, 0x93
lea edi, [ebp - 0x4f8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4fc]
push eax
push dword [ebp + 0x70]
lea eax, [ebp + 0x20]
push eax
mov dword [ebp + 0x20], ebx
call fcn.00482c3e
add esp, 0x18
cmp dword [ebp + 0x20], ebx
jne 0x4260a5
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x18], 2
call fcn.00402baa
lea ecx, [ebp - 8]
jmp 0x42646f
push dword [ebp + 0x70]
lea ecx, [ebp + 0x68]
call fcn.004419bc
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
call fcn.00448935
pop ecx
pop ecx
push 0x497cfc
lea ecx, [ebp + 0x68]
call fcn.004371ec
mov esi, dword [ebp + 0x60]
cmp esi, ebx
je 0x4260d7
cmp word [esi], bx
jne 0x4260dc
mov esi, 0x49bc90
mov eax, dword [ebp + 0x48]
cmp eax, ebx
je 0x4260e8
cmp word [eax], bx
jne 0x4260ed
mov eax, str.DefaultInstall
push eax
lea ecx, [ebp + 0x40]
call fcn.004419bc
mov edi, 0x49825c
push edi
lea ecx, [ebp + 0x40]
call fcn.004371ec
push esi
lea ecx, [ebp + 0x40]
call fcn.004371ec
push edi
lea ecx, [ebp + 0x40]
call fcn.004371ec
push dword [ebp + 0x40]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
push dword [ebp + 0x68]
mov dword [ebp - 0x4c], eax
call edi
mov dword [ebp - 0x34], eax
test byte [ebp - 0x4fc], 0x10
jne 0x426306
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp - 0x34]
mov word [eax + ecx*2], bx
lea eax, [ebp - 0x4d0]
push eax
lea ecx, [ebp + 0x68]
call fcn.004371ec
mov esi, dword [ebp + 0x68]
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x54], esi
mov byte [ebp + 0x7f], bl
call fcn.0043717e
mov eax, dword [ebp - 8]
mov dword [ebp + 0x14], ebx
mov word [eax], bx
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0047675f
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
add esp, 0xc
sar eax, 1
cmp dword [ebp - 0x30], eax
jne 0x4261a6
push dword [ebp - 0x30]
push dword [ebp + 0xc]
push dword [ebp + 0x58]
call fcn.0040bf3e
add esp, 0xc
test al, al
je 0x4261a6
mov byte [ebp + 0x7f], 1
cmp dword [ebp - 0x20], ebx
je 0x4261b2
mov esi, dword [ebp - 0x18]
cmp esi, ebx
jne 0x4261c1
push dword [ebp + 0x68]
push dword [ebp - 4]
call fcn.0041d798
pop ecx
pop ecx
mov esi, eax
cmp byte [0x4afe9e], bl
jne 0x4261e1
cmp dword [ebp + 0x3c], ebx
jne 0x4261f4
cmp byte [ebp + 0x4f], bl
je 0x4261d8
cmp byte [ebp + 0x7f], bl
jne 0x4261f4
cmp esi, ebx
jne 0x4261f4
jmp 0x4262fe
push dword [ebp + 0x68]
push 0x49bcbc
push dword [ebp + 0x1c]
call fcn.0040d391
add esp, 0xc
cmp esi, ebx
mov edi, esi
jne 0x4261ff
mov edi, 0x497994
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x7c], 4
jne 0x42629d
cmp byte [0x4afe84], bl
je 0x426229
push dword [ebp - 0x24]
push dword [ebp + 0x68]
call fcn.0041344b
pop ecx
pop ecx
jmp 0x4262e8
cmp byte [0x4afe9d], 3
je 0x42623a
cmp byte [0x4afe9c], bl
je 0x426273
or dword [ebp + 0x7c], 1
cmp byte [0x4afe9c], bl
je 0x426251
push edi
push dword [ebp + 0x68]
call fcn.0040df0a
jmp 0x426263
cmp byte [0x4afe9d], 3
jne 0x426268
push edi
push dword [ebp + 0x68]
call fcn.0040dfd0
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
cmp dword [ebp + 0x5c], ebx
je 0x4262e8
test byte [ebp + 0x7c], 2
jne 0x426297
or dword [ebp + 0x7c], 2
cmp esi, ebx
je 0x426291
push dword [ebp - 0x24]
push dword [ebp + 0x68]
push esi
call fcn.0041335b
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x4262e8
test byte [ebp + 0x7c], 1
je 0x42623a
test byte [ebp + 0x7c], 4
jne 0x4262e8
cmp byte [0x4afe84], bl
jne 0x426217
cmp byte [0x4afe74], bl
jne 0x4262e8
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp - 0x4c]
push dword [ebp - 0x54]
mov word [eax + ecx*2], bx
lea ecx, [ebp + 0x40]
call fcn.004371ec
push ebx
push dword [ebp + 0x40]
push ebx
push ebx
call fcn.0040e422
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 0x5c], eax
jne 0x4262e8
cmp dword [0x4afe70], ebx
je 0x4262e8
call fcn.0040dda1
cmp esi, ebx
je 0x4262ef
mov word [esi], bx
mov eax, dword [ebp - 8]
cmp word [eax], bx
je 0x4262fe
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 0xc]
call fcn.00431c4c
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp + 0x20]
call fcn.004048d9
test eax, eax
jne 0x42612c
lea ecx, [ebp + 0x40]
call fcn.00431c4c
lea ecx, [ebp + 0x68]
call fcn.00431c4c
lea ecx, [ebp + 0x20]
call fcn.00402baa
lea ecx, [ebp - 8]
call fcn.00431c4c
lea ecx, [ebp + 0x44]
call fcn.00431c4c
lea ecx, [ebp + 0x28]
call fcn.00431c4c
lea ecx, [ebp + 0x50]
call fcn.00431c4c
lea ecx, [ebp + 0x38]
call fcn.00431c4c
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x48]
call fcn.0040e480
lea ecx, [ebp + 4]
call fcn.00431c4c
lea ecx, [ebp - 0x14]
call fcn.00431c4c
lea ecx, [ebp + 0x24]
call fcn.0041df1f
lea ecx, [ebp + 0x24]
call fcn.00431c4c
lea ecx, [ebp + 0x2c]
call fcn.0041df1f
lea ecx, [ebp + 0x2c]
call fcn.00431c4c
cmp dword [ebp + 0x30], ebx
jle 0x4263ad
push ebx
push dword [ebp + 0x30]
call fcn.0047607f
pop ecx
pop ecx
mov ebx, dword [ebp + 0x5c]
jmp 0x4264f0
mov dword [ebp + 0x18], 1
jmp 0x426474
mov dword [ebp + 0x18], 0x491
jmp 0x426474
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
dec ecx
cmp ecx, 1
jl 0x4263fa
mov eax, dword [ebp + 0x70]
lea edx, [eax + ecx*2]
xor eax, eax
mov ax, word [edx]
push eax
call fcn.0040c0aa
add esp, 4
test al, al
je 0x4263fa
mov word [edx], bx
dec ecx
cmp ecx, ebx
jge 0x426407
mov dword [ebp + 0x18], 0x80070057
jmp 0x426474
mov ecx, dword [ebp + 0x48]
cmp ecx, ebx
je 0x426415
cmp word [ecx], bx
jne 0x426415
xor ecx, ecx
xor eax, eax
mov al, byte [ebp + 0x35]
or eax, 0x10
push eax
push ecx
push esi
push dword [ebp + 0x70]
call fcn.0041d89f
add esp, 0x10
mov dword [ebp + 0x18], eax
jmp 0x426474
mov dword [ebp + 0x18], 2
jmp 0x426464
push 0x497994
push 0x497d7c
push dword [ebp + 0x1c]
mov dword [0x4afe8c], ebx
call fcn.0040d391
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00431c4c
lea ecx, [ebp]
call fcn.00431c4c
lea ecx, [ebp - 0x28]
call fcn.00402baa
lea ecx, [ebp - 0x1c]
call fcn.00431c4c
lea ecx, [ebp + 0x44]
call fcn.00431c4c
lea ecx, [ebp + 0x28]
call fcn.00431c4c
lea ecx, [ebp + 0x50]
call fcn.00431c4c
lea ecx, [ebp + 0x38]
call fcn.00431c4c
mov ecx, dword [ebp + 0x1c]
push ebx
call fcn.00449aab
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x48]
call fcn.0040e480
lea ecx, [ebp + 4]
call fcn.00431c4c
lea ecx, [ebp - 0x14]
call fcn.00431c4c
lea ecx, [ebp + 0x24]
call fcn.0041df1f
lea ecx, [ebp + 0x24]
call fcn.00431c4c
lea ecx, [ebp + 0x2c]
call fcn.0041df1f
lea ecx, [ebp + 0x2c]
call fcn.00431c4c
cmp dword [ebp + 0x30], ebx
jle 0x4264ed
push ebx
push dword [ebp + 0x30]
call fcn.0047607f
pop ecx
pop ecx
mov ebx, dword [ebp + 0x18]
mov eax, 0x4b069c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x74
leave
ret 4