Function at 0x420030
Capabilities:
Check if file exists
Check os version
Create process on windows
Delete registry value
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x13c8]
mov eax, 0x13c8
call fcn.006197b0
push 0xffffffffffffffff
push 0x63c274
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x74f8a0]
xor eax, ebp
mov dword [ebp + 0x13c4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044b490
call fcn.00448a70
mov ecx, ebx
call fcn.00418cb0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], edi
push 0x754a28
call fcn.00416160
mov eax, dword [0x754a28]
push eax
push 0x66fea8
push 0x754a2c
call fcn.00402f70
add esp, 0x10
mov dword [ebp - 0xc8], 0x400
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp + 0xf84]
push edx
push edi
push edi
push str.szCustomUserAgent
mov eax, dword [0x754bec]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x420106
lea ecx, [ebp + 0xf84]
push ecx
push 0x66fea8
push 0x754a28
call fcn.00402f70
add esp, 0xc
mov ecx, ebx
call fcn.0041cd70
mov ecx, ebx
call fcn.004101f0
cmp dword [0x754bdc], edi
jne 0x4201d8
mov dword [ebp - 0x30], 0x40
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp + 0x1384]
push eax
push 0
push 0
push str.idmvers
mov ecx, dword [0x754bec]
push ecx
call esi
test eax, eax
jne 0x4201ce
mov edx, dword [0x754da4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420157
sub eax, esi
push eax
push edx
lea edx, [ebp + 0x1384]
push edx
call fcn.006197db
add esp, 0xc
test eax, eax
je 0x42018e
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x42018e
cmp byte [eax + 0x51], 0
jne 0x42018e
mov dword [0x754bdc], 1
push 8
push str.v6.35b09
lea eax, [ebp + 0x1384]
push eax
call fcn.0061caaf
add esp, 0xc
test eax, eax
je 0x4201c2
push 8
push str.v6.35b10
lea ecx, [ebp + 0x1384]
push ecx
call fcn.0061caaf
add esp, 0xc
test eax, eax
jne 0x4201d8
mov dword [0x754be0], 1
jmp 0x4201d8
mov dword [0x754bdc], 1
cmp dword [0x754bc8], edi
je 0x420201
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4201f7
cmp byte [eax + 0x51], 0
jne 0x4201f7
cmp dword [0x754bdc], edi
je 0x420201
call fcn.00414b90
call fcn.00410380
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420218
cmp byte [eax + 0x51], 0
jne 0x420218
cmp dword [0x754bdc], edi
je 0x420229
push 1
call fcn.004699a0
push 0
call fcn.0046fc50
add esp, 8
call fcn.0041b9e0
xor esi, esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], esi
mov dword [ebp + 0xec0], 0x94
lea edx, [ebp + 0xec0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x420290
cmp dword [ebp + 0xed0], 2
jne 0x420290
mov esi, 1
mov dword [ebp - 0x34], esi
cmp dword [ebp + 0xec4], 6
jb 0x420290
mov dword [ebp - 0x28], esi
push 0x80000001
call fcn.00412ba0
push 0x80000002
call fcn.00412ba0
add esp, 8
mov dword [ebp - 0x40], 4
test esi, esi
je 0x4203dd
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.EnableDriver
mov edx, dword [0x754bec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4202ca
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov esi, 1
mov dword [ebp - 0xb4], esi
lea edx, [ebp - 0x1c]
push edx
push 0x20019
push 0
push 0x66fe18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420333
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.AdvIntDriverEnabled2
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420329
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xb4], esi
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], esi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
jne 0x420392
mov dword [ebp - 0x40], 4
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push str.bVistaAdvInt
mov edx, dword [0x754bec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x42038f
mov eax, 1
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0x4c], eax
push 4
lea edx, [ebp - 0x4c]
push edx
push 4
push 0
push str.bVistaAdvInt
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x420392
mov dword [ecx + 0x1c], esi
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x1c], ebx
je 0x4203dd
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
call fcn.00410540
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov dword [ebp - 0x38], edi
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
sete bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x58], 1
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push 0
push str.EnableDriver
mov edx, dword [0x754bec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x4203fc
cmp byte [eax + 0x51], 0
jne 0x42040b
cmp dword [0x754bdc], 0
je 0x42048d
cmp byte [eax + 0x51], 0
jne 0x42040b
cmp dword [0x754bdc], 0
je 0x420445
lea ecx, [ebp - 0x18]
call fcn.004fb170
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004fb1d0
test eax, eax
je 0x420439
lea ecx, [ebp - 0x18]
call fcn.004fb190
test eax, eax
jne 0x420439
push 1
lea ecx, [ebp - 0x18]
call fcn.004fb7a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004fb180
mov dword [ebp - 0x2c], 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.DebugFlags
mov edx, dword [0x754bec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42048d
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push str.DebugFlags
mov ecx, dword [0x754bec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x4206b8
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x18]
call fcn.004fb170
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004fb1d0
test eax, eax
jne 0x420628
xor edi, edi
cmp dword [0x754bd4], edi
jne 0x4204db
push edi
lea ecx, [ebp - 0x18]
call fcn.004fb7a0
lea ecx, [ebp - 0x18]
call fcn.004fb310
lea ecx, [ebp - 0x18]
call fcn.004fb2c0
mov dword [ebp - 0x20], edi
mov dword [ebp + 0xf54], edi
mov dword [ebp + 0xf5c], edi
xor edx, edx
mov word [ebp + 0xf58], dx
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.0041ee40
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 0xf54]
push ecx
mov ecx, esi
call fcn.00413b40
test eax, eax
je 0x4205bb
mov ebx, dword [ebp - 0x20]
cmp ebx, 1
je 0x4205bb
xor esi, esi
mov dword [ebp - 0xc0], esi
mov edx, dword [ebp - 0x14]
cmp esi, dword [edx + 0x28]
jge 0x4205bb
mov edi, edx
add edi, 0x20
push esi
mov ecx, edi
call fcn.0045b250
mov eax, dword [eax]
cmp ebx, dword [eax + 8]
jne 0x420622
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
push esi
mov ecx, edi
call fcn.0045b250
mov eax, dword [eax]
add eax, 0x14
cmp ebx, dword [eax + 8]
jge 0x4205bb
mov eax, dword [ebp + 0xf54]
test eax, eax
je 0x420579
mov dword [ebp - 0x1c], eax
jmp 0x420582
lea ecx, [ebp + 0xf58]
mov dword [ebp - 0x1c], ecx
push esi
mov ecx, edi
call fcn.0045b250
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d1a0
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
push edx
push eax
call fcn.0061d58a
add esp, 8
test eax, eax
jne 0x42061c
push esi
mov ecx, edi
call fcn.0045b250
push ebx
mov ecx, dword [eax]
add ecx, 0x14
call fcn.0040d1a0
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], eax
jne 0x4205ee
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
mov dword [ebp - 0xbc], eax
push 4
lea edx, [ebp - 0xbc]
push edx
push 4
push eax
push str.AdvancedIntegration
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, dword [ebp - 0x14]
call fcn.0041f940
mov dword [0x754a24], 1
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xf54]
call fcn.00401210
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x70]
jmp 0x4206a9
inc ebx
jmp 0x420552
inc esi
jmp 0x420526
cmp dword [ebp - 0x28], 0
je 0x4206ac
call fcn.00511720
mov esi, eax
test esi, esi
je 0x4206a9
mov dword [ebp - 0xc4], 4
lea ecx, [ebp - 0xc4]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push str.StEnableBFEMsg
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42069f
mov dword [ebp - 0x3c], 1
push 4
lea ecx, [ebp - 0x3c]
push ecx
push 4
push 0
push str.StEnableBFEMsg
mov edx, dword [0x754bec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
push 0
push esi
push 0x411780
call fcn.005f7aaa
jmp 0x4206a9
xor ebx, ebx
mov dword [ebp - 0x70], ebx
xor edi, edi
mov dword [ebp - 0x38], edi
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004fb180
cmp dword [esi + 0x1c], 0
je 0x420a78
test ebx, ebx
je 0x420a58
xor esi, esi
mov dword [ebp - 0x54], esi
cmp dword [ebp - 0x34], esi
je 0x420a22
push esi
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.0041be50
cmp dword [ebp - 0x28], esi
jne 0x420724
push 1
mov ecx, ebx
call fcn.0041aa10
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [0x754a20], 1
mov ecx, ebx
test edi, edi
je 0x420715
call fcn.00416e40
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x420a1e
call fcn.00410480
xor edi, edi
mov dword [ebp - 0x38], edi
jmp 0x420a1e
mov dword [ebp + 0xf78], esi
mov dword [ebp + 0xf80], esi
xor eax, eax
mov word [ebp + 0xf7c], ax
mov byte [ebp - 4], 4
mov eax, dword [0x754c5c]
cmp eax, esi
jne 0x42074b
mov eax, 0x754c60
push esi
push str.Uninstall.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xf78]
call fcn.00402320
mov eax, dword [ebx + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420844
cmp dword [0x754bdc], esi
jne 0x420844
cmp byte [eax + 0x29], 0
je 0x420844
mov edi, 1
mov dword [ebx + 0x4c], edi
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebx + 4]
call fcn.0040dc30
test eax, eax
je 0x420a07
push 0x3c
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.00618760
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
cmp eax, esi
je 0x4207e7
mov dword [ebp - 0xa0], eax
jmp 0x4207f3
lea ecx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x42083c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], edi
jmp 0x420a07
push 0x3c
push esi
lea ecx, [ebp - 0xb0]
push ecx
call fcn.00618760
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
cmp eax, esi
je 0x420886
mov dword [ebp - 0xa0], eax
jmp 0x420892
lea edx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], esi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], 0x6738e8
mov eax, dword [ebp + 0xf78]
cmp eax, esi
jne 0x4208d0
lea eax, [ebp + 0xf7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420a07
mov eax, dword [ebp + 0xf78]
cmp eax, esi
jne 0x4208f0
lea eax, [ebp + 0xf7c]
push esi
push eax
mov ecx, ebx
call fcn.00416d10
test al, al
je 0x420a07
lea eax, [ebp - 0xb0]
push eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call esi
test eax, eax
je 0x420a01
mov dword [ebp - 0x54], 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call ebx
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x420945
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x54], ecx
mov dword [0x754a20], 1
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040dc30
test eax, eax
je 0x420a07
push 0x3c
push 0
lea ecx, [ebp - 0xb0]
push ecx
call fcn.00618760
add esp, 0xc
mov dword [ebp - 0xb0], 0x3c
mov dword [ebp - 0xac], 0x40
mov dword [ebp - 0xa4], str.open
mov eax, dword [ebp + 0xf78]
test eax, eax
je 0x4209ad
mov dword [ebp - 0xa0], eax
jmp 0x4209b9
lea edx, [ebp + 0xf7c]
mov dword [ebp - 0xa0], edx
xor eax, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 3
mov dword [ebp - 0x90], eax
call edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x9c], str._uninstlsp
lea eax, [ebp - 0xb0]
push eax
call esi
test eax, eax
je 0x4209f8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x78]
push ecx
call ebx
mov dword [ebp - 0x44], 1
jmp 0x420a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x38], edi
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf78]
call fcn.00401210
mov esi, dword [ebp - 0x54]
test esi, esi
jne 0x420a29
mov dword [ebp - 0x24], 0
xor edx, edx
test esi, esi
setne dl
mov dword [ebp - 0xcc], edx
push 4
lea eax, [ebp - 0xcc]
push eax
push 4
push 0
push str.lastintres
mov ecx, dword [0x754bec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0x34], 0
je 0x420a78
test edi, edi
je 0x420a6b
mov ecx, esi
call fcn.00416e40
jmp 0x420a78
cmp dword [ebp - 0x28], 0
jne 0x420a78
mov ecx, esi
call fcn.00410480
mov eax, dword [esi + 0x48]
cmp byte [eax + 0x4f], 0
jne 0x420a90
cmp byte [eax + 0x51], 0
jne 0x420a90
cmp dword [0x754bdc], 0
je 0x420a97
mov ecx, esi
call fcn.0041d300
cmp dword [ebp - 0x34], 0
je 0x420aa6
mov dword [ebp - 0x24], 0
jmp 0x420aac
cmp dword [ebp - 0x24], 0
jne 0x420af9
mov dword [ebp - 0x74], 4
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push str.NeedChAfRb
mov ecx, dword [0x754bec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420d17
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], esi
push str.NeedChAfRb
mov edx, dword [0x754bec]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420d17
push str.NeedChAfRb
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x20]
push edx
push ebx
push ebx
push str.ClChIDMRes
mov eax, dword [0x754bec]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x420b3f
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push str.ClChIERes
mov eax, dword [0x754bec]
push eax
call edi
test eax, eax
jne 0x420b6b
mov esi, dword [ebp - 0x20]
cmp esi, 1
je 0x420b74
cmp ebx, 1
jne 0x420d17
mov edi, 1
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x30]
call fcn.004fb170
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x30]
call fcn.004fb3f0
cmp esi, edi
jne 0x420ba9
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420ba9
xor edi, edi
mov dword [ebp - 0x48], edi
cmp ebx, 1
jne 0x420bbd
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420bbd
mov dword [ebp - 0x48], 0
jmp 0x420bc5
test edi, edi
jne 0x420cb7
push 0x50030
mov eax, dword [0x756000]
push eax
mov ecx, dword [0x756010]
push ecx
push 0
call fcn.0046f4c0
add esp, 0x10
mov edi, dword [ebp - 0x14]
lea ecx, [edi + 4]
call fcn.0040eeb0
mov dword [ebp - 0x18], 0
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.AdvancedIntegration
mov eax, dword [0x754bec]
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
mov dword [edi + 0x1c], 0
lea ecx, [ebp - 0x4c]
call fcn.004fb170
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp - 0x4c]
call fcn.004fb3f0
mov eax, 1
mov dword [ebp - 0x48], eax
cmp esi, eax
jne 0x420c4c
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x420c4c
xor eax, eax
mov dword [ebp - 0x48], eax
mov esi, 1
cmp dword [ebp - 0x58], esi
jne 0x420c65
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x420c65
mov dword [ebp - 0x48], 0
jmp 0x420c69
test eax, eax
jne 0x420ca6
mov dword [ebp - 0x18], esi
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push str.NeedSnRpAfRb
mov ecx, dword [0x754bec]
push ecx
call ebx
push 0x50030
mov edx, dword [0x756000]
push edx
mov eax, dword [0x756014]
push eax
push 0
call fcn.0046f4c0
add esp, 0x10
push esi
call fcn.004116b0
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c]
call fcn.004fb180
jmp 0x420d0b
push 0x50000
cmp dword [ebp - 0x2c], 1
jne 0x420cd2
mov ecx, dword [0x756000]
push ecx
mov edx, dword [0x756040]
push edx
jmp 0x420cdf
mov eax, dword [0x756000]
push eax
mov ecx, dword [0x756018]
push ecx
push 0
call fcn.0046f4c0
add esp, 0x10
mov dword [ebp - 0x18], 1
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push 0
push str.AdvancedIntegration
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004fb180
cmp dword [ebp - 0x60], 0
jne 0x420d61
mov dword [ebp - 0x5c], 4
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x74]
push edx
push 0
push 0
push str.NeedSnRpAfRb
mov eax, dword [0x754bec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420d83
mov esi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
push str.NeedSnRpAfRb
mov ecx, dword [0x754bec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x420d83
push 0
lea ecx, [ebp]
call fcn.005276a0
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.005ee341
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.004156e0
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.004106a0
push 1
mov ecx, edi
call fcn.0041be50
mov ecx, edi
call fcn.00569f30
xor ebx, ebx
test eax, eax
jne 0x420dc5
push ebx
push ebx
call fcn.004176f0
push ebx
push ebx
mov ecx, edi
call fcn.00417790
push ebx
push ebx
mov ecx, edi
call fcn.0041d290
push ebx
push ebx
mov ecx, edi
call fcn.00417750
mov ecx, edi
cmp dword [edi + 0x1c], ebx
je 0x420dd5
push 1
call fcn.00415580
jmp 0x420de6
call fcn.00410da0
test eax, eax
jne 0x420de6
push ebx
mov ecx, edi
call fcn.0041f940
cmp dword [0x754bdc], ebx
je 0x420df5
mov ecx, edi
call fcn.0041f3f0
cmp dword [ebp - 0x34], ebx
je 0x4210e9
lea esi, [edi + 4]
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.0040dc30
test eax, eax
je 0x420f57
cmp dword [ebp - 0x28], ebx
jne 0x420e30
mov ecx, esi
call fcn.0040eeb0
mov dword [ebp - 0x44], 1
jmp 0x4210ee
mov dword [ebp + 0xf6c], ebx
mov dword [ebp + 0xf74], ebx
xor ecx, ecx
mov word [ebp + 0xf70], cx
mov byte [ebp - 4], 8
mov eax, dword [0x754c5c]
cmp eax, ebx
jne 0x420e57
mov eax, 0x754c60
push ebx
push str.Uninstall.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xf6c]
call fcn.00402320
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420e7e
lea eax, [ebp + 0xf70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420f48
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420e9e
lea eax, [ebp + 0xf70]
push ebx
push eax
mov ecx, edi
call fcn.00416d10
test al, al
je 0x420f48
push 0x3c
push ebx
lea edx, [ebp - 0x108]
push edx
call fcn.00618760
add esp, 0xc
mov dword [ebp - 0x108], 0x3c
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
mov eax, dword [ebp + 0xf6c]
cmp eax, ebx
jne 0x420eef
lea eax, [ebp + 0xf70]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], str._uninstlsp
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x420f41
push 0xffffffffffffffff
mov edx, dword [ebp - 0xd0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf6c]
call fcn.00401210
cmp dword [ebp - 0x28], ebx
je 0x4210e9
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x420f85
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x420fc0
call fcn.004475d0
neg eax
sbb eax, eax
and eax, 0x100
add eax, 0x20019
lea ecx, [ebp - 0x5c]
push ecx
push eax
push ebx
push str.SYSTEMCurrentControlSetServicesIDMTDI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4210e9
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xf60], ebx
mov dword [ebp + 0xf68], ebx
xor eax, eax
mov word [ebp + 0xf64], ax
mov byte [ebp - 4], 9
mov eax, dword [0x754c5c]
cmp eax, ebx
jne 0x420fe7
mov eax, 0x754c60
push ebx
push str.Uninstall.exe
push eax
push 0x66fde0
lea ecx, [ebp + 0xf60]
call fcn.00402320
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
jne 0x42100e
lea eax, [ebp + 0xf64]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4210da
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
jne 0x42102e
lea eax, [ebp + 0xf64]
push 1
push eax
mov ecx, edi
call fcn.00416d10
test al, al
je 0x4210da
push 0x3c
push ebx
lea ecx, [ebp + 0x1388]
push ecx
call fcn.00618760
add esp, 0xc
mov dword [ebp + 0x1388], 0x3c
mov dword [ebp + 0x138c], 0x40
mov dword [ebp + 0x1394], str.open
mov eax, dword [ebp + 0xf60]
cmp eax, ebx
je 0x421082
mov dword [ebp + 0x1398], eax
jmp 0x42108e
lea edx, [ebp + 0xf64]
mov dword [ebp + 0x1398], edx
mov dword [ebp + 0x13a0], ebx
mov dword [ebp + 0x13a4], 3
mov dword [ebp + 0x13a8], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp + 0x1390], eax
mov dword [ebp + 0x139c], str._uninsttdi
lea eax, [ebp + 0x1388]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4210da
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x13c0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xf60]
call fcn.00401210
cmp dword [ebp - 0x44], ebx
je 0x421109
push 0x50030
mov edx, dword [0x755fe4]
push edx
mov eax, dword [0x756038]
push eax
push ebx
call fcn.0046f4c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x13c4]
xor ecx, ebp
call fcn.0061807e
add ebp, 0x13c8
mov esp, ebp
pop ebp
ret