Function at 0x41a3c0
Capabilities:
Delete registry key
Get installed programs

Disassembly:
pop edi
pop esi
pop ebx
ret
int3
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df8b4
mov eax, dword fs:[0]
push eax
sub esp, 0xf68
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xf64], eax
call fcn.0047337c
test al, al
je 0x41a41a
loopne 0x41a40b
hlt
int3
pushfd
test dword [ecx], ebx
outsd dx, dword [esi]
mov bh, 0x19
jnp 0x41a3b1
scasb al, byte es:[edi]
ja 0x41a407
retf 0x725d
call fcn.0047355f
test al, al
je 0x41a439
add dl, byte [esi + 0x35]
stc
in al, 0xa7
mov eax, 0xbe194025
mov cl, 0x83
xor dh, cl
sar edx, cl
lahf
jecxz 0x41a3bb
pushfd
sub eax, 0x59097e8
add byte [eax + eax*8 - 0x6240e78c], al
jecxz 0x41a490
call fcn.004734d5
test al, al
je 0x41a45a
mov edi, 0x64ae39d
push es
pushfd
das
jbe 0x41a423
adc byte [eax + 0x28], ch
push edi
xor eax, 0x88f1a947
push 0xebd48a73
call fcn.00473925
test al, al
je 0x41a47d
mov byte [ebx + 0x3e], bl
jo 0x41a4de
wait
xor byte [edx + 0x53164cf0], al
sbb dl, byte [eax - 0x519fb3d2]
in al, 0x5e
xor eax, 0x7bb00aa0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
add byte [ebp - 0xf537b], cl
call dword [eax + 0x68]
aas
add byte [edi], cl
add byte [edx], ch
add byte [eax + 0x28], ch
cmpsd dword [esi], dword es:[edi]
pop esi
add byte [eax + 1], ch
add byte [eax], al
add bh, 0x85
lodsb al, byte [esi]
invalid
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xf54], 0
call esi
test eax, eax
jne 0x41a4c8
push 0x5e8b28
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00473811
test al, al
je 0x41a4eb
and dword [edx - 0x7eaff1f], edi
popal
pop edx
lea esp, [esi - 0x50]
invalid
xchg esp, eax
popal
cmp byte [edi], dl
sub edx, dword [edi]
and eax, 0x800c358b
pop esi
add al, ch
jp 0x41a482
call fcn.0047396a
test al, al
je 0x41a505
add eax, 0x74c08400
adc dword [ecx - 0xc489389], edx
xchg ecx, eax
ja 0x41a563
mov bh, 0xf3
sub dh, byte [edi - 0xab5f82a]
jmp 0xa469e7da
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0xf54], 0
push 0
push eax
mov dword [ebp - 0xf5c], 0
mov dword [ebp - 0xf58], 0
mov dword [ebp - 0xf60], 0
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call esi
mov ebx, eax
call fcn.004732ad
test al, al
je 0x41a57d
add byte [eax + eax*8 + 0x1bb11574], al
mov cl, 0x1b
out dx, eax
in al, dx
daa
invalid
xchg ebp, eax
in eax, dx
imul byte [ebp + 5]
adc al, 0x4f
lahf
clc
mov dword [0x91c0e8e7], eax
add eax, 0x74c08400
sbb al, 0x79
ljmp 0x2c96
call fcn.00473742
test al, al
je 0x41a5a2
jns 0x41a572
add byte [ebx], ch
or edx, dword [eax]
xchg esi, eax
sub al, 0x34
retf 0xaf6c
test ebx, ebx
jne 0x41b370
call fcn.0047355f
test al, al
je 0x41a5c8
sbb dword [esi - 0x15dbce2b], edx
shr dword [ecx - 0x44], 0x5f
pop ebp
or ch, byte [ecx + edi*4]
mov ebp, ss
je 0x41a5f6
jne 0x41a621
push ds
push 0
lea eax, [ebp - 0xf60]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e8b28
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41a605
push dword [ebp - 0xf54]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x41b370
invalid
call fcn.0047337c
test al, al
je 0x41a62c
pop ds
lds esp, [ebx + 0x5d9c7dda]
bound ecx, qword [esi]
ror byte [edx + 0x1e], 0x3f
adc eax, 0x235afbac
loope 0x41a5d8
mov dh, 0xdb
inc ecx
pop esi
fild dword [ecx + 0x5e]
shl dword [esi - 0x2d4a4ca0], 1
mov cl, 0xe8
jmp 0x8441abc0
call fcn.0047351a
test al, al
je 0x41a647
adc eax, 0x169e2b7f
mov eax, 0xda250b99
adc al, 0x38
push edi
aaa
push ds
loop 0x41a6c5
pop esi
call fcn.004022d0
mov ecx, eax
call fcn.00471187
push eax
lea ecx, [ebp - 0xea8]
call fcn.00403b30
cmp dword [ebp - 0xe94], 8
lea ecx, [ebp - 0xea8]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0xea8]
std
invalid
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41a680
call fcn.004736fd
test al, al
je 0x41a6b8
loopne 0x41a676
wait
cli
dec esp
sub al, byte [edx - 0xe9b9ce5]
dec esp
cld
hlt
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.InstallPath
push dword [ebp - 0xf60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xf60]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xf54]
call ebx
mov dword [ebp - 0xf54], 0
call fcn.004737cc
test al, al
je 0x41a722
into
cmp edx, edx
sub dword [edi - 0x69], ebx
inc eax
and byte ds:[esi + 0x69bf49b3], 0x9a
int1
call fcn.004735e9
test al, al
je 0x41a742
mul dl
mov ds, word [edi + ebp*2]
mov ebp, 0x566293ad
pop ecx
ret 0x1ec4
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
push str.softwareMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b352
call fcn.004732ad
test al, al
je 0x41a781
adc dword [ecx - 0x38], 0xffffffdf
test eax, 0x4fa6b259
xor eax, ecx
push ecx
test eax, 0xe8ef2bc8
arpl word [esi - 0x3f7bfffb], cx
call fcn.004735e9
test al, al
je 0x41a79a
in eax, 0x22
pushfd
adc eax, dword [eax + 0x3cda0111]
cmp eax, 0xee94ea73
sub dword [ecx + 0x58b0ee8], esp
add byte [eax + eax*8 + 0x14361874], al
cmp cl, byte [edi]
call fcn.004732ad
test al, al
je 0x41a7bb
adc al, 0x3a
or al, 0xe7
adc dword [esi + 0x1d], ebx
xchg ebp, eax
pop ebx
add ah, byte [esi - 0x2e93e60b]
loopne 0x41a7e1
ror ch, 1
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
mov eax, dword [0xa4858df4]
invalid
lea eax, [ebp - 0xf5c]
push eax
push 0xf003f
push 0
push str.Uninstall
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xf74], eax
call fcn.0047362e
test al, al
je 0x41a809
dec ecx
mov es, word [0x74c08400]
and byte [ebp + 0x743a8058], ch
lodsd eax, dword [esi]
pop eax
cmp byte [edx], 0x74
mov ah, 0x7c
invalid
int3
call fcn.0047351a
test al, al
je 0x41a829
arpl word [eax - 0x59ca76fe], si
mov al, byte [0x56974996]
in eax, dx
ja 0x41a7ff
sbb eax, 0xdbb5d1df
invalid
call fcn.004733c1
test al, al
je 0x41a849
sub byte [ebp + 0x75], dh
mov eax, 0x3f6a946
or dword [ebp - 4], edx
push edi
adc al, 0x7c
add eax, 0x5021ddaf
adc dl, byte [ecx - 0x427c8051]
invalid
cmp dword [ebp - 0xf74], 0
je 0x41a88f
push 0
lea eax, [ebp - 0xf5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Uninstall
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41a88f
push dword [ebp - 0xf54]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x41b352
call fcn.0047337c
test al, al
je 0x41a8b2
test eax, 0x86d6d93d
push edi
xchg ebp, eax
invalid
call fcn.004736b8
test al, al
je 0x41a8cc
popfd
retf
call fcn.00473742
test al, al
je 0x41a8ec
mov byte [ebx - 0x108fa644], bl
cmp al, 0x93
cmc
hlt
push 0
lea eax, [ebp - 0xf58]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e8b28
push dword [ebp - 0xf5c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41a929
push dword [ebp - 0xf5c]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x41b352
call fcn.00473856
test al, al
je 0x41a944
lds ebx, [ebp + 0x7b]
pop ebx
cld
push esi
sub byte [esi + 0xad1bd7d], al
nop
movsd dword es:[edi], dword [esi]
sub byte [edi + 0x86862f6], bl
add al, byte [eax]
add byte [ebp - 0x82f7b], cl
jmp [edx]
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0xe48]
push 0
push eax
call fcn.004830b0
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.004830b0
add esp, 0x48
call fcn.00473337
test al, al
je 0x41a9df
dec esp
test eax, 0xcbeebc6e
frstor dword [esi - 0x6532c16d]
fcomp st(6)
cmp byte [ebx + esi*2 + 0x3c], al
wait
invalid
int3
call fcn.00473673
test al, al
je 0x41aa01
mov al, byte [0x90d0197b]
jmp 0x41a9da
call fcn.00473490
test al, al
je 0x41aa22
push ecx
mov dword [0x6e0f27ce], eax
outsb dx, byte [esi]
push eax
jae 0x41a9b6
sar ah, cl
jmp 0x6c15ffad
push str.1.0.1.5
lea ecx, [ebp - 0xf08]
call fcn.00403b30
push 0x5e8a44
lea ecx, [ebp - 0xe90]
mov byte [ebp - 4], 1
call fcn.00403b30
mov ebx, dword [ebp - 0xf64]
lea ecx, [ebp - 0xf38]
push ebx
mov byte [ebp - 4], 2
call fcn.00403b30
mov byte [ebp - 4], 3
call fcn.0047344b
test al, al
je 0x41aa79
jno 0x41aadf
cmp byte [ecx - 0x5a1de809], dh
retf
cmp dword [ebp - 0xf28], 0
je 0x41ab8b
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xf38]
push eax
lea ecx, [ebp - 0xf08]
call fcn.00402530
mov dword [ebp - 0xf70], 0
mov dword [ebp - 0xf6c], 0
mov dword [ebp - 0xf68], 0
push 0x5ea810
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 4
call fcn.00403b30
push ebx
lea ecx, [ebp - 0xf50]
mov byte [ebp - 4], 5
call fcn.00403b30
lea eax, [ebp - 0xf70]
mov byte [ebp - 4], 6
test dword [eax - 0x39000010], edx
inc ebp
cld
push es
push eax
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xf50]
push eax
call fcn.00457acc
add esp, 0xc
lea ecx, [ebp - 0xf50]
call fcn.00448f80
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 4
call fcn.00448f80
mov ecx, dword [ebp - 0xf6c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0xf70]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 4
jne 0x41ab7c
clc
add al, 0x75
aas
lea eax, [ebp - 0xe90]
cmp eax, esi
je 0x41ab53
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00402530
push 0x5ea810
lea ecx, [ebp - 0xe90]
call fcn.0040aae0
mov eax, dword [ebp - 0xf70]
lea ecx, [ebp - 0xe90]
push 0xffffffffffffffff
add eax, 0x18
push 0
push eax
call fcn.00405600
jo 0x41ab5e
invalid
lea ecx, [ebp - 0xf70]
mov byte [ebp - 4], 3
call fcn.00405a30
invalid
call fcn.00473925
test al, al
je 0x41abaf
mov word [0x75a7e06f], fs
loope 0x41ab39
test byte [ecx], bl
invalid
call fcn.004732f2
test al, al
je 0x41abd0
test al, 5
test sp, bp
xchg ebp, eax
mov eax, 0xc7dd2ffc
xchg esp, eax
jns 0x41ab80
in eax, 1
adc eax, 0xd269c6be
loop 0x41ab6b
call fcn.004739af
test al, al
je 0x41abed
add eax, 0x74c08400
adc al, 0x9e
sahf
xor byte [ebp + 0x5e], dl
push 0x57
mov dl, 0xae
xor dword [edi], 0xfb9b49f6
jbe 0x41abd3
pop ebp
sbb cl, byte [edi + 0x15dee8]
add byte [ecx - 0xf637b], cl
push dword [ebx]
rol bh, 0x85
mov ah, 0xf1
invalid
call fcn.0041c1d0
mov dword [ebp - 0xf64], eax
xor eax, eax
mov dword [ebp - 0xe4c], 7
mov dword [ebp - 0xe50], 0
mov word [ebp - 0xe60], ax
mov dword [ebp - 0xe64], 7
mov dword [ebp - 0xe68], eax
mov word [ebp - 0xe78], ax
mov byte [ebp - 4], 8
call fcn.00473856
test al, al
je 0x41ac58
xchg dword [edx + 0x481b8185], esi
aam 0xb
clc
arpl word [eax - 0x7d], di
out dx, eax
mov byte [edx], ch
pop ecx
sub eax, 0xc317e5ca
or ebx, dword [edi + 0x7a]
sbb al, 0xc6
push ebx
xchg esp, edx
jbe 0x41ac41
call fcn.00473337
test al, al
fiadd dword [esi - 0x3f7bfffb]
je 0x41ac7d
fdiv st(2)
push ss
push es
les ecx, [ecx]
cmp esp, dword [ebx - 0x3a]
xchg edi, eax
mov bl, ch
iretd
call fcn.004733c1
test al, al
je 0x41ac9c
xor eax, 0x90dd3f5a
mov eax, 0xf0ba127e
aad 0xcd
or dword [edx + 0x650ca9d6], esp
mov edi, 0x9d8b16bf
pushfd
invalid
mov ebx, dword [ebp - 0xf64]
test ebx, ebx
je 0x41acf0
mov eax, dword [ebx]
lea ecx, [ebp - 0xec0]
push ecx
mov ecx, ebx
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0xe60]
call fcn.00403d40
lea ecx, [ebp - 0xec0]
call fcn.00448f80
mov eax, dword [ebx]
lea ecx, [ebp - 0xec0]
push ecx
mov ecx, ebx
call dword [eax + 0x30]
push eax
lea ecx, [ebp - 0xe78]
call fcn.00403d40
lea ecx, [ebp - 0xec0]
call fcn.00448f80
cmp dword [ebp - 0xe50], 0
jne 0x41ad09
push 0x5e9d38
lea ecx, [ebp - 0xe60]
call fcn.00403dc0
call fcn.0047337c
test al, al
je 0x41ad29
cmpsb byte [esi], byte es:[edi]
mov al, byte [0x6924c792]
push esp
test byte [ecx + 0x467e2ed4], cl
adc dword [ebp + 0x30], ebx
mov ch, 0x66
in al, 0xef
out dx, eax
insb byte es:[edi], dx
add eax, 0xf198bd83
invalid
cmp dword [ebp - 0xe68], 0
jne 0x41ad42
push 0x5ea814
lea ecx, [ebp - 0xe78]
call fcn.00403dc0
nop
invalid
call fcn.00473925
test al, al
je 0x41ad64
arpl word [ebx], cx
dec ebx
sbb eax, dword [eax]
inc ebx
movsb byte es:[edi], byte [esi]
jge 0x41ad3f
sub byte [eax], bl
popfd
add dword [esi + 0x4ad9add5], esp
cdq
inc ebp
xor dword [eax + ebp*2 - 0x7f], 0x8994e892
add eax, 0x74c08400
sbb dword [esi + 0x6a179305], edi
call fcn.004736fd
test al, al
je 0x41ad86
mov esi, 0x6a179305
les edi, [ebp + 0x64]
xchg esp, eax
add eax, 0x3000a548
dec ebx
jge 0x41ad85
in eax, dx
jnp 0x41ada5
cmp eax, 0xa27853fb
mov byte [0x5ea85468], al
add byte [ebp - 0xe5f73], cl
invalid
push 0x5ea854
lea ecx, [ebp - 0xe60]
call fcn.0040aae0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xe90]
push eax
lea ecx, [ebp - 0xe60]
call fcn.00405600
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0xef0]
call fcn.00403b30
push 0x5e9634
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 9
call fcn.0040aae0
call fcn.004732ad
test al, al
je 0x41adfa
invalid
inc esi
inc ebp
cld
or eax, ebp
or ch, bh
invalid
inc eax
lodsb al, byte [esi]
dec eax
sub ebp, dword [esp]
sbb edx, eax
test eax, 0x2358baef
cmp ebp, 0x261b3fb3
out dx, al
mov dh, 0xa7
cmpsb byte [esi], byte es:[edi]
push esp
imul al
inc ebx
mov dword [0x74c08400], eax
pop ss
call fcn.00473742
test al, al
je 0x41ae1a
arpl word [ecx - 0x15], bp
push esp
pop esp
and edx, ebp
je 0x41adce
test eax, 0x198b92ba
adc dword [edx + 0x6b], ebp
mov dl, 0xb9
jns 0x41ada5
bound edi, qword [edx + 0x5848ee8]
add byte [eax + eax*8 - 0x74b6e88c], al
and byte [eax], 0x3f
mov eax, dword [0x453426de]
call fcn.004732ad
test al, al
je 0x41ae3a
dec ecx
mov eax, dword [edx - 0x215ec0e0]
xor al, 0x45
add byte [ebx + 0x67da8947], ch
sti
dec ebx
and dh, 0xd2
inc ecx
sub al, 0x91
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0xed8]
call fcn.00403b30
push 0x5ea858
lea ecx, [ebp - 0xed8]
mov byte [ebp - 4], 0xa
call fcn.0040aae0
call fcn.0047362e
test al, al
je 0x41ae8f
je 0x41ae3c
dec dword [ebx + 0x6283e8c8]
add eax, 0x8d8d5000
sub cl, dh
invalid
and bl, al
sbb dword [ebp + 0x231279f4], 0x2b0796b3
xor bl, bh
mov ebp, 0x8d8c19f1
wait
mov al, 0x6e
sti
sbb ebx, dword [0xad2d655b]
inc esp
pop ss
xchg edi, eax
call fcn.0047351a
test al, al
je 0x41aeaf
out 0xc5, eax
mov bl, al
iretd
call fcn.004733c1
test al, al
je 0x41aecf
xor edi, ebp
daa
push edx
or cl, byte [esi + 0x199f1894]
mov byte [ecx - 0x38], ah
shr edi, cl
push esp
add al, 0xc1
clc
dec eax
invalid
push 0x5e9d38
lea ecx, [ebp - 0xf20]
call fcn.00403b30
cmp dword [ebp - 0xedc], 8
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x830]
cmovae ecx, dword [ebp - 0xef0]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41af00
cmp dword [ebp - 0xe4c], 8
lea ecx, [ebp - 0xe60]
lea edx, [ebp - 0x420]
cmovae ecx, dword [ebp - 0xe60]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41af30
cmp dword [ebp - 0xec4], 8
lea ecx, [ebp - 0xed8]
lea edx, [ebp - 0x628]
cmovae ecx, dword [ebp - 0xed8]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41af60
cmp dword [ebp - 0xf0c], 8
lea ecx, [ebp - 0xf20]
lea edx, [ebp - 0xc40]
cmovae ecx, dword [ebp - 0xf20]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41af90
cmp dword [ebp - 0xe64], 8
lea ecx, [ebp - 0xe78]
lea edx, [ebp - 0xe48]
cmovae ecx, dword [ebp - 0xe78]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41afc0
cmp dword [ebp - 0xef4], 8
lea ecx, [ebp - 0xf08]
lea edx, [ebp - 0xa38]
cmovae ecx, dword [ebp - 0xf08]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41aff0
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b010
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push 0x5ea874
push dword [ebp - 0xf58]
call eax
call fcn.0047337c
test al, al
je 0x41b067
shl dword [ebx - 0x4df3af29], cl
in eax, 0x6b
sub dl, byte [ecx + 0x734f6600]
fst st(7)
das
das
dec eax
sar bl, cl
imul eax, dword [eax], 0xe83327ae
test byte [0x74c08400], al
push ss
call fcn.0047355f
test al, al
je 0x41b086
bound ebp, qword [edx]
js 0x41b079
jo 0x41b08b
jmp 0xfe42b8a7
add esi, edi
les ebx, [edx]
stosb byte es:[edi], al
std
cmp ah, dl
xchg dword [eax], esp
invalid
call fcn.004734d5
test al, al
je 0x41b0a7
xor dword [ebp - 0x28fe8457], ecx
lodsb al, byte [esi]
xchg edi, eax
mov bh, 0xad
ret
call fcn.00473925
test al, al
je 0x41b0ca
pushfd
loop 0x41b122
sbb dword [edx + 0x4c64a670], 0xffffff8a
jmp 0xa3be803f
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b0d3
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0xf58]
call esi
call fcn.00473811
test al, al
je 0x41b12b
arpl word [esi], dx
into
in eax, dx
xchg esi, eax
push 0xffffffffffffffdd
push esi
mov byte [eax + 0x5e], bl
scasb al, byte es:[edi]
leave
mov edx, 0x119ada95
mov ecx, 0x10358b0b
adc dword [ecx + 0x10358b0b], edi
sbb byte [esi], 0xe8
cmp cl, byte [eax - 0x3f7bfffb]
call fcn.0047396a
test al, al
je 0x41b145
inc ecx
pop esp
lodsd eax, dword [esi]
invalid
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b150
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x830]
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0xf58]
call esi
call fcn.004732ad
test al, al
je 0x41b19d
push ax
xchg esi, eax
jbe 0x41b1d9
or ecx, edi
mov ch, 0xe1
lodsd eax, dword [esi]
insb byte es:[edi], dx
cmp byte [ebx*4 + 0x5fed2304], dh
inc ebp
xchg ecx, eax
call fcn.00473742
test al, al
je 0x41b1c8
or eax, ebp
dec eax
arpl word [ebx - 0x17a0e502], si
inc edi
push cs
xor byte [edx], ch
outsd dx, dword [esi]
ret 0x2b68
lea ecx, [ebp - 0xa38]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b1d1
sal byte [ebp - 0xb], 0x2b
retf 0xf9d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xa38]
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0xf58]
call esi
call fcn.0047355f
test al, al
je 0x41b224
adc edi, dword [edi]
sub ah, byte [ebx]
stosb byte es:[edi], al
add dh, 0x6b
insd dword es:[edi], dx
ret
lea ecx, [ebp - 0xc40]
lea edx, [ecx + 2]
nop dword [eax]
add cl, byte [edi]
pop ds
add byte [esi - 0x75], ah
add dword [ebx - 0x7a99fd3f], eax
sal byte [ebp - 0xb], 0x2b
retf 0xf9d1
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b230
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0xf58]
call esi
call fcn.0047362e
test al, al
je 0x41b279
test ebp, edi
and dh, byte [esi + 0x52cbca93]
jmp 0x41b22c
call fcn.004736b8
test al, al
je 0x41b2a1
mov byte [0x16758f32], al
insd dword es:[edi], dx
jmp 0x6620f880
lea ecx, [ebp - 0xe48]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b2b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xe48]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push 0
push str.URLInfoAbout
push dword [ebp - 0xf58]
call eax
push dword [ebp - 0xf58]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xf5c]
call ebx
lea ecx, [ebp - 0xf20]
call fcn.00448f80
lea ecx, [ebp - 0xed8]
call fcn.00448f80
lea ecx, [ebp - 0xef0]
call fcn.00448f80
lea ecx, [ebp - 0xe78]
call fcn.00448f80
lea ecx, [ebp - 0xe60]
call fcn.00448f80
lea ecx, [ebp - 0xf38]
call fcn.00448f80
lea ecx, [ebp - 0xe90]
call fcn.00448f80
lea ecx, [ebp - 0xf08]
call fcn.00448f80
mov eax, dword [ebp - 0xe94]
cmp eax, 8
jb 0x41b370
inc eax
lea ecx, [ebp - 0xea8]
push eax
push dword [ebp - 0xea8]
call fcn.00402750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4