Function at 0x401000
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get file attributes
Hash data with crc32
Query or enumerate registry value
Read .ini file
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc4
push ebx
push esi
xor ebx, ebx
push edi
mov byte [ebp - 0xac0], bl
mov dword [ebp - 8], ebx
call fcn.0040ac0b
mov edi, 0x100
push edi
call fcn.0040bf28
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop ecx
push edi
push eax
push dword [ebp + 8]
mov dword [0x4178ac], eax
call esi
push 1
push dword [0x4178ac]
call fcn.0040b02b
pop ecx
lea eax, [ebp - 0x64]
pop ecx
mov dword [ebp - 0x64], 1
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push edi
mov dword [0x417808], eax
call fcn.0040bf28
pop ecx
mov dword [0x417c08], eax
push edi
push eax
push dword [ebp + 8]
call esi
push 0x4141ec
push dword [0x417c08]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x417c08]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [eax + ecx - 3]
push eax
call esi
push 0x4000
call fcn.0040bf28
pop ecx
mov dword [0x417c5c], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0x18], 1
push eax
call esi
cmp byte [ebp - 0x5b4], bl
jne 0x401136
push dword [0x417c08]
lea eax, [ebp - 0x1b0]
push eax
call esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.0040b02b
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x1b1]
lea ecx, [ebp - 0x1b0]
cmp eax, ecx
jbe 0x401105
cmp byte [eax], 0x5c
je 0x40110a
dec eax
jmp 0x4010f3
cmp byte [eax], 0x5c
jne 0x40110b
inc eax
push str.INSTALL.LOG
push eax
call esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.0040b1ca
pop ecx
test eax, eax
pop ecx
jne 0x401136
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x5b4]
push eax
call esi
push 2
lea eax, [ebp - 0x5b4]
push 0x4141dc
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x4011da
lea eax, [ebp - 0x1b0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x6b4]
push eax
push 0x1a2b
lea eax, [ebp - 0x1b0]
push 0x4141d8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x6b4]
push 0x4141d4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x6b4]
sub ecx, 3
add eax, ecx
push eax
call esi
lea eax, [ebp - 0x2b4]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x6b4]
push ebx
push eax
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4011d7
lea eax, [ebp - 0x6b4]
push eax
call fcn.0040be18
pop ecx
mov dword [ebp - 0x18], ebx
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 5
push 0x6a
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 5
push 0x68
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 2
push 0x6a
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x6a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_LoadBitmapA]
cmp byte [ebp - 0x5b4], 0x2f
mov dword [0x417c0c], eax
lea eax, [ebp - 0x5b4]
mov dword [0x417c44], ebx
mov dword [ebp + 0x10], eax
jne 0x40137e
mov esi, dword [ebp + 0x10]
lea eax, [esi + 1]
mov dword [ebp - 4], eax
movsx eax, byte [eax]
push eax
call fcn.0040d031
cmp eax, 0x5a
mov eax, dword [ebp - 4]
pop ecx
jne 0x4012b8
cmp byte [eax], 0x7a
jne 0x40129f
cmp byte [esi + 2], 0x31
jne 0x401295
mov esi, eax
mov dword [0x417840], 1
mov dword [0x41789c], 1
inc esi
inc esi
mov dword [ebp + 0x10], esi
cmp byte [esi], 0x20
jne 0x401375
inc esi
cmp byte [esi], 0x20
je 0x4012ad
jmp 0x401364
movsx eax, byte [eax]
push eax
call fcn.0040d031
cmp eax, 0x41
pop ecx
jne 0x4012d3
mov dword [0x417c44], 1
jmp 0x40132e
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
push eax
call fcn.0040d031
cmp eax, 0x53
pop ecx
jne 0x4012f4
push 1
pop eax
mov dword [0x417858], eax
mov dword [0x417c44], eax
jmp 0x40132e
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
push eax
call fcn.0040d031
cmp eax, 0x52
pop ecx
jne 0x401312
mov dword [0x4178c0], 1
jmp 0x40132e
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
push eax
call fcn.0040d031
cmp eax, 0x55
pop ecx
jne 0x401332
mov dword [0x417ba4], 1
inc esi
inc esi
jmp 0x401364
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
push eax
call fcn.0040d031
cmp eax, 0x57
pop ecx
jne 0x40137e
mov eax, dword [ebp + 0x10]
lea esi, [eax + 2]
push esi
call fcn.0040d026
cmp byte [esi], 0x20
pop ecx
mov dword [0x4177d4], eax
mov dword [ebp + 0x10], esi
je 0x40136c
inc esi
cmp byte [esi], 0x20
jne 0x40135e
cmp byte [esi], 0x20
mov dword [ebp + 0x10], esi
jne 0x401375
inc esi
cmp byte [esi], 0x20
je 0x40136c
mov dword [ebp + 0x10], esi
cmp byte [esi], 0x2f
je 0x401263
mov esi, dword [ebp + 0x10]
cmp byte [esi], 0x20
jne 0x40138f
inc esi
cmp byte [esi], 0x20
je 0x401386
mov dword [ebp + 0x10], esi
cmp byte [esi], 0x22
jne 0x4013e5
inc esi
push esi
mov dword [ebp + 0x10], esi
call fcn.0040cf20
pop ecx
cmp eax, ebx
jle 0x4013b9
cmp byte [eax + esi], 0x22
je 0x4013ac
dec eax
jmp 0x40139f
add eax, esi
lea ecx, [eax + 1]
mov dword [0x417c10], ecx
mov byte [eax], bl
mov eax, dword [0x417c10]
cmp byte [eax], 0x20
jne 0x4013cb
inc eax
mov dword [0x417c10], eax
jmp 0x4013be
push eax
call fcn.0040cf20
test eax, eax
pop ecx
jne 0x4013dc
mov dword [0x417c10], ebx
push ebx
push esi
call fcn.0040b02b
pop ecx
pop ecx
push 0x20
push esi
call fcn.0040c57a
pop ecx
cmp eax, ebx
pop ecx
je 0x401427
cmp dword [0x41789c], ebx
jne 0x401427
mov byte [eax], bl
inc eax
mov dword [0x417c10], eax
cmp byte [eax], 0x22
jne 0x40140e
inc eax
mov dword [0x417c10], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
js 0x401427
mov ecx, dword [0x417c10]
add eax, ecx
cmp byte [eax], 0x22
jne 0x401427
mov byte [eax], bl
cmp dword [0x4177d4], ebx
je 0x401660
lea eax, [ebp - 0xbc4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xbc4]
push 1
push eax
call fcn.0040b02b
lea eax, [ebp - 0xbc4]
push eax
lea eax, [ebp - 0x9c0]
push str.SoftwareWise_SolutionsWise_Installation_SystemRepair_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp byte [ebp - 0x988], bl
lea eax, [ebp - 0x988]
je 0x401486
cmp byte [eax], 0x5c
jne 0x401481
mov byte [eax], 0x2f
inc eax
cmp byte [eax], bl
jne 0x401479
lea eax, [ebp - 8]
push eax
push 0x20019
lea eax, [ebp - 0x9c0]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401830
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x8bc]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4017ea
push 1
pop esi
cmp dword [ebp - 0x10], esi
jne 0x4015ad
lea eax, [ebp - 0x8bc]
push eax
call fcn.0040d026
cmp byte [ebp - 0x8bc], bl
pop ecx
mov dword [ebp - 0x48], eax
lea esi, [ebp - 0x8bc]
je 0x401535
cmp dword [0x41521c], 1
jle 0x40151d
movsx eax, byte [esi]
push 4
push eax
call fcn.0040cea8
pop ecx
pop ecx
jmp 0x40152c
movsx eax, byte [esi]
mov ecx, dword [str.________________________________H]
mov al, byte [ecx + eax*2]
and eax, 4
cmp eax, ebx
je 0x401535
inc esi
cmp byte [esi], bl
jne 0x401505
cmp byte [esi], 0x5c
jne 0x40153b
inc esi
lea ecx, [ebp - 0x1b4]
mov al, byte [esi]
cmp al, bl
je 0x401556
cmp al, 0x5c
jne 0x401550
cmp byte [esi + 1], al
je 0x401556
mov byte [ecx], al
inc ecx
inc esi
jmp 0x401541
cmp byte [esi], 0x5c
jne 0x4015c8
cmp byte [esi + 1], 0x5c
jne 0x4015c8
lea eax, [ebp - 0x44]
add esi, 2
push eax
push 0x20019
lea eax, [ebp - 0x1b4]
push ebx
push eax
mov eax, dword [ebp - 0x48]
mov byte [ecx], bl
push dword [eax*4 + 0x414030]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4015a4
cmp byte [esi], bl
je 0x4015c8
push ebx
lea eax, [ebp - 0x4c]
push ebx
push eax
push ebx
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4015c8
mov dword [ebp - 0x14], 1
jmp 0x4015c8
cmp dword [ebp - 0x10], 4
jne 0x4015c8
lea eax, [ebp - 0x8bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4015c8
mov dword [ebp - 0x14], esi
inc dword [ebp - 4]
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x8bc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
mov dword [ebp - 0xc], 0x208
push dword [ebp - 4]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4014db
cmp dword [ebp - 0x14], ebx
je 0x4017ea
lea eax, [ebp - 0x1b0]
push edi
push eax
push 0x4a
push dword [0x417bd4]
call fcn.0040b454
lea eax, [ebp - 0xdc4]
push 0x200
push eax
push 0x51
push dword [0x417bd4]
call fcn.0040b454
add esp, 0x20
lea eax, [ebp - 0x1b0]
push 3
push eax
lea eax, [ebp - 0xdc4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp al, 6
jne 0x401789
push 1
pop eax
mov dword [0x417c44], eax
mov dword [0x417ba4], eax
push dword [0x417c08]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ebx
push str.Start_Red
push str.Settings
call esi
push dword [0x417c08]
mov dword [0x417c20], eax
push ebx
push str.Start_Green
push str.Settings
call esi
push dword [0x417c08]
mov dword [0x417c24], eax
push 0xff
push str.Start_Blue
push str.Settings
call esi
push dword [0x417c08]
mov dword [0x417c28], eax
push ebx
push str.End_Red
push str.Settings
call esi
push dword [0x417c08]
sub eax, dword [0x417c20]
push ebx
push str.End_Green
push str.Settings
mov dword [0x417c2c], eax
call esi
push dword [0x417c08]
sub eax, dword [0x417c24]
push ebx
push str.End_Blue
push str.Settings
mov dword [0x417c30], eax
call esi
push dword [0x417c08]
sub eax, dword [0x417c28]
push 1
push str.No_Background
push str.Settings
mov dword [0x417c34], eax
call esi
mov dword [0x4177f4], eax
call fcn.0040b824
push 0x8000
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x4178d0]
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
cmp eax, ebx
mov dword [0x4178d8], 0xffffff
je 0x401804
push dword [ebp + 8]
call eax
test eax, eax
je 0x4017fe
cmp dword [0x4177f0], 1
mov eax, dword [0x417838]
jne 0x401771
cmp eax, ebx
jne 0x40177e
cmp eax, ebx
jne 0x40177e
push dword [ebp + 8]
call dword [0x41783c]
push 0xf
call esi
mov dword [0x4178d8], eax
jmp 0x401804
cmp al, 7
je 0x4017ea
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x8bc]
push eax
push ebx
push dword [ebp - 8]
mov edi, 0x208
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x4017ea
lea eax, [ebp - 0x8bc]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc dword [ebp - 4]
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x8bc]
mov dword [ebp - 0xc], edi
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4017b4
jmp 0x40178d
push dword [ebp - 8]
call fcn.0040c72a
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401830
mov dword [0x4178d0], ebx
push 0xf
call esi
cmp dword [ebp + 0xc], ebx
mov dword [0x4178d8], eax
jne 0x40181f
push dword [ebp + 8]
call fcn.004023e7
test eax, eax
pop ecx
je 0x401830
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00402446
pop ecx
test eax, eax
pop ecx
jne 0x401837
xor eax, eax
jmp 0x4023e0
push 0x400
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x417868], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x417828], eax
push 1
mov dword [eax], ebx
pop eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x40186e
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x401870
shr ecx, 1
dec edx
jne 0x40185f
mov edx, dword [0x417828]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, edi
jl 0x40185a
push edi
call fcn.0040bf28
push edi
mov dword [0x417be0], eax
call fcn.0040bf28
push edi
mov dword [0x4178b4], eax
push dword [0x417be0]
push 0x19
push dword [0x417bd4]
call fcn.0040b454
push edi
push dword [0x4178b4]
push 0x3b
push dword [0x417bd4]
call fcn.0040b454
mov esi, 0x104
push esi
call fcn.0040bf28
mov dword [0x417c40], eax
add esp, 0x2c
mov byte [eax], bl
lea eax, [ebp + 0xc]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40193e
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], esi
push eax
lea eax, [ebp - 0x4c]
push dword [0x417c40]
push eax
push ebx
push str.ProgramFilesDir
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [0x417c40]
jne 0x401933
cmp byte [eax], bl
je 0x401935
push eax
call fcn.0040bdf6
cmp eax, dword [0x417c40]
pop ecx
jbe 0x401935
mov byte [eax - 1], bl
jmp 0x401935
mov byte [eax], bl
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x41789c], ebx
je 0x401b3f
mov eax, dword [ebp + 0x10]
cmp byte [eax], bl
je 0x401b3f
push ebx
push 0x3e8
push 0x206a
mov dword [0x417bf4], 1
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
test eax, eax
je 0x4019a1
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40197c
cmp dword [0x417bf4], ebx
jne 0x40197c
push 0x206a
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_KillTimer]
push dword [ebp + 0x10]
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x2b4]
push 0x20
push eax
call fcn.0040c57a
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4019e2
mov byte [esi], bl
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x2b5], 0x5c
je 0x401a06
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x2b5]
lea ecx, [ebp - 0x2b4]
cmp eax, ecx
jbe 0x401a2c
cmp byte [eax], 0x5c
je 0x401a31
dec eax
jmp 0x401a1a
cmp byte [eax], 0x5c
jne 0x401a33
mov byte [eax], bl
lea eax, [ebp - 0x2b4]
push ebx
push eax
call fcn.004099d7
pop ecx
cmp esi, ebx
pop ecx
je 0x401a68
inc esi
cmp byte [esi], bl
je 0x401a68
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x5c
lea eax, [eax + esi - 1]
jne 0x401a5f
mov byte [eax], bl
push ebx
push esi
call fcn.004099d7
pop ecx
pop ecx
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
test eax, eax
je 0x401aa4
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
jmp 0x401a81
push dword [0x417c0c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeResource]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
lea eax, [ebp - 0x2b4]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x417c54]
cmp eax, ebx
je 0x401ae6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x4178b0]
cmp eax, ebx
je 0x401af6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [0x417840], ebx
je 0x4023dd
mov eax, dword [0x4177f0]
cmp eax, 1
je 0x401b1e
cmp eax, ebx
je 0x401b1e
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x4023dd
lea eax, [ebp - 0x3b4]
push eax
call fcn.0040cb94
pop ecx
lea eax, [ebp - 0x3b4]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4023dd
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x3b4], bl
cmp byte [eax], bl
jne 0x401c1c
push 0x4c
lea eax, [ebp - 0xb0]
push ebx
push eax
call fcn.0040ce50
mov eax, dword [0x4177d0]
push edi
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x4b4]
push eax
push 1
push dword [0x417bd4]
mov dword [ebp - 0xb0], 0x4c
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x7c], 0x1000
call fcn.0040b454
add esp, 0x1c
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x4b3]
push str.install.log
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 0x10]
push str.INSTALL.LOG
mov byte [eax + ecx + 1], bl
lea eax, [ebp - 0x4b4]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x94], eax
call fcn.0040c463
lea eax, [ebp - 0xb0]
push eax
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x401c2c
push dword [ebp - 0x94]
jmp 0x401c1f
push dword [ebp + 0x10]
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x3b4], bl
je 0x401ca8
lea eax, [ebp - 0x3b4]
push 0x5c
push eax
call fcn.0040c57a
pop ecx
test eax, eax
pop ecx
jne 0x401ca8
lea eax, [ebp - 0x1b0]
push edi
push eax
call fcn.0040cd2e
pop ecx
lea eax, [ebp - 0x1b0]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x1b1], 0x5c
je 0x401c80
lea eax, [ebp - 0x1b0]
push 0x4140ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3b4]
push eax
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call fcn.0040bf28
mov dword [0x417bf0], eax
mov dword [esp], 0x4000
call fcn.0040bf28
mov dword [esp], 0x4000
push ebx
push eax
mov dword [0x4177b8], eax
call fcn.0040ce50
push edi
call fcn.0040bf28
push 0x400
mov dword [0x417cc0], eax
call fcn.0040bf28
push edi
mov dword [0x4178a4], eax
call fcn.0040bf28
push esi
mov dword [0x417900], eax
call fcn.0040bf28
push 0x200
mov dword [0x417888], eax
call fcn.0040bf28
push edi
mov dword [0x417c04], eax
call fcn.0040bf28
push esi
mov dword [0x417bc4], eax
call fcn.0040bf28
push esi
mov dword [0x417bec], eax
call fcn.0040bf28
mov esi, 0x200
mov dword [0x417c4c], eax
push esi
call fcn.0040bf28
push esi
push ebx
push eax
mov dword [0x4178e0], eax
call fcn.0040ce50
push 0x2ee00
call fcn.0040bf28
add esp, 0x40
mov esi, 0xfa00
mov dword [0x417830], eax
push esi
call fcn.0040bf28
push esi
mov dword [0x417c58], eax
call fcn.0040bf28
push esi
mov dword [0x41784c], eax
call fcn.0040bf28
push esi
mov dword [0x4177dc], eax
call fcn.0040bf28
push esi
mov dword [0x417848], eax
call fcn.0040bf28
push esi
mov dword [0x4177e8], eax
call fcn.0040bf28
push 0x2ee00
mov dword [0x4178f8], eax
call fcn.0040bf28
push esi
mov dword [0x417814], eax
call fcn.0040bf28
push 0x2ee00
mov dword [0x417910], eax
call fcn.0040bf28
push 0x2ee00
mov dword [0x417bc8], eax
call fcn.0040bf28
push esi
mov dword [0x417894], eax
call fcn.0040bf28
mov dword [0x417884], eax
push esi
call fcn.0040bf28
push esi
mov dword [0x417898], eax
call fcn.0040bf28
push esi
mov dword [0x417cd8], eax
call fcn.0040bf28
push 0x1000
mov dword [0x4177e4], eax
call fcn.0040bf28
push edi
mov dword [0x4177e0], eax
push dword [0x417bc4]
push 0x19
push dword [0x417bd4]
call fcn.0040b454
add esp, 0x4c
push 0x200
push dword [0x417c04]
push 0x44
push dword [0x417bd4]
call fcn.0040b454
add esp, 0x10
cmp byte [ebp - 0x3b4], bl
je 0x4020fc
push 0x7f02
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x3b4]
push eax
call fcn.00404260
pop ecx
pop ecx
push dword [ebp + 0x10]
test eax, eax
jne 0x4020fa
call esi
cmp dword [0x417c44], ebx
mov ecx, 0x3e8
je 0x401ea8
mov dword [0x41780c], ecx
mov byte [0x417ba0], 0xb
cmp dword [0x417ba4], ebx
mov eax, dword [0x4177d4]
je 0x401ecd
mov edx, eax
mov byte [0x417ba0], 0xb
neg edx
sbb edx, edx
and edx, 9
add edx, ecx
mov dword [0x41780c], edx
cmp dword [0x417858], ebx
jne 0x401f82
cmp eax, ebx
jne 0x401ee2
call fcn.0040c463
push ebx
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_EnableWindow]
push ebx
push sym.UNWISE32.EXE__ItemDlg_16
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x4177d0]
push eax
push 0x6a
push dword [0x417bd4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp dword [0x417c44], ebx
mov dword [0x4177c8], eax
jne 0x401f82
cmp dword [0x417874], ebx
jne 0x4020a0
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [0x4177ec], ebx
jne 0x401f82
push 1
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
test eax, eax
je 0x401f7a
lea eax, [ebp - 0x40]
push eax
push dword [0x4177c8]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x401f41
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401f41
cmp dword [0x417874], ebx
je 0x401f39
cmp dword [0x417874], ebx
jne 0x4020a0
push 0x4140ec
call fcn.0040cca8
xor esi, esi
cmp dword [0x417834], ebx
pop ecx
mov dword [ebp + 0x10], ebx
je 0x402014
push str.SFC.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x402014
push str.SRSetRestorePoint
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x402014
push dword [0x417bf0]
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x100], 0x64
mov dword [ebp - 0xfc], ebx
push str.Uninstall__s
push eax
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
jne 0x402014
xor esi, esi
cmp dword [0x41780c], 0x3f1
je 0x40203f
cmp dword [0x4177d4], ebx
je 0x402030
cmp dword [0x41787c], ebx
jne 0x40203f
lea eax, [ebp - 0x3b4]
push eax
call fcn.004082fa
pop ecx
jmp 0x402044
call fcn.00407267
push ebx
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
cmp esi, ebx
je 0x402092
cmp dword [0x417874], ebx
mov dword [ebp - 0x100], 0x65
je 0x402073
mov dword [ebp - 0xfc], 0xd
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x100]
push eax
call esi
cmp dword [ebp + 0x10], ebx
je 0x4020a0
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x417840], ebx
je 0x4020df
cmp dword [0x417858], ebx
jne 0x4020f3
xor eax, eax
cmp dword [0x4177f0], ebx
setne al
push eax
push dword [0x417bc4]
push dword [0x417c04]
push dword [0x4177c8]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4020df
mov dword [0x417840], ebx
cmp dword [0x417858], ebx
jne 0x4020f3
push dword [0x4177c8]
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.0040b8e3
jmp 0x4020fc
call esi
mov eax, dword [0x4177cc]
cmp eax, ebx
je 0x40210c
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
test eax, eax
je 0x402148
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
jmp 0x402125
mov eax, dword [0x4178a8]
cmp eax, ebx
je 0x402156
push dword [ebp + 8]
call eax
cmp dword [0x417ccc], ebx
je 0x402184
lea eax, [ebp - 0x2b4]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x2b4]
push ebx
push eax
push 0x2001
push 0x1000
call dword [0x417ccc]
mov eax, dword [0x41788c]
cmp eax, ebx
je 0x402194
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [0x417c0c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeResource]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov eax, dword [0x417868]
cmp eax, ebx
je 0x4021d1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x417868]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x417840], ebx
je 0x4021f4
mov eax, dword [0x4177f0]
cmp eax, 1
je 0x4021e7
cmp eax, ebx
jne 0x4021f4
lea eax, [ebp - 0x3b4]
push eax
call fcn.0040cb94
pop ecx
mov eax, dword [0x417c54]
cmp eax, ebx
je 0x402204
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x4178a0]
cmp eax, ebx
je 0x402214
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x18], ebx
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
je 0x40229d
cmp dword [0x417874], ebx
jne 0x40235f
lea eax, [ebp - 0x2b4]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [0x4177f0], ebx
mov edi, dword [sym.imp.KERNEL32.dll_OpenFile]
je 0x40225f
lea eax, [ebp - 0x138]
push 0x200
push eax
lea eax, [ebp - 0x2b4]
push eax
call edi
lea eax, [ebp - 0x2b4]
push 0x4141ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x2b4]
sub ecx, 3
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x138]
push 0x200
push eax
lea eax, [ebp - 0x2b4]
push eax
call edi
jmp 0x40235f
lea eax, [ebp - 0x4b4]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x4b4]
push ebx
push eax
call fcn.0040b02b
cmp dword [0x417840], ebx
pop ecx
pop ecx
mov byte [ebp + 8], bl
je 0x402307
cmp dword [0x4177f0], 2
jne 0x4022e2
lea eax, [ebp + 8]
push 0x4140bc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402307
cmp dword [0x417bcc], ebx
je 0x402307
cmp dword [0x417874], ebx
jne 0x402307
lea eax, [ebp + 8]
push 0x4140bc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x417840], ebx
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x2b4]
push str._s__z_s__s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
cmp dword [0x417bcc], ebx
je 0x402352
cmp dword [0x417874], ebx
jne 0x402352
lea eax, [ebp - 0x2b4]
push 5
push eax
call esi
jmp 0x40235f
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.0040bfb1
mov eax, dword [0x4178b0]
cmp eax, ebx
je 0x402374
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [0x417840], ebx
je 0x4023b5
mov eax, dword [0x4177f0]
cmp eax, 1
je 0x4023aa
cmp eax, ebx
je 0x4023aa
cmp dword [ebp - 0x18], ebx
jne 0x4023b5
cmp dword [0x417bcc], ebx
je 0x40239f
cmp dword [0x417874], ebx
je 0x4023b5
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x4023b5
lea eax, [ebp - 0x3b4]
push 5
push eax
call esi
cmp dword [0x4177d4], ebx
je 0x4023c6
push dword [ebp - 8]
call fcn.0040c72a
pop ecx
cmp dword [ebp - 8], ebx
je 0x4023d4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
leave
ret 0x10