Function at 0x406860
Capabilities:
Delete file
Get common file path
Get file size
Move file
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43204f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7a8
mov eax, dword [0x442184]
mov dword [esp + 0x7a0], eax
push ebx
push esi
push edi
mov edx, ecx
mov dword [esp + 0x1c], edx
xor eax, eax
mov byte [esp + 0x38], 0
mov ecx, 0x40
lea edi, [esp + 0x39]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x140], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x141]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
stosb byte es:[edi], al
call fcn.00403760
lea edx, [esp + 0x140]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4068d4
push 0x103
lea eax, [esp + 0x3c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x34], esi
je 0x406948
test esi, esi
je 0x406948
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 2
push 0
mov edi, eax
push esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esp + 0x30], eax
jne 0x40696d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x7b4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x7ac]
call fcn.00417188
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 4
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esp + 0x20], eax
je 0x406f0c
mov esi, dword [eax + edi - 4]
cmp esi, edi
ja 0x406f0c
mov dl, byte [eax + esi + 8]
add esi, 8
inc esi
lea ebx, [eax + esi]
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
push eax
sub edi, esi
push edi
mov edi, dword [esp + 0x24]
push ebx
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.004097a0
test eax, eax
jne 0x406bd4
lea ecx, [esp + 0xc]
call fcn.00401760
mov eax, dword [ebp + 8]
cmp eax, 1
mov dword [esp + 0x7bc], 0
jne 0x406a4f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x4353b0
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Msg_CheckFileError_Setup
mov byte [esp + 0x7c8], 1
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Public
mov byte [esp + 0x7cc], 2
call fcn.004053e0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [edi + 0x14c]
mov byte [esp + 0x7cc], 0
call fcn.0040b530
mov byte [esp + 0x7bc], 3
jmp 0x406b21
cmp eax, 2
jne 0x406ab9
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x435364
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Msg_CheckFileError_Update
mov byte [esp + 0x7c8], 4
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Public
mov byte [esp + 0x7cc], 5
call fcn.004053e0
mov ecx, dword [edi + 0x14c]
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x7cc], 0
call fcn.0040b530
mov byte [esp + 0x7bc], 6
jmp 0x406b21
cmp eax, 3
jne 0x406b3c
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x435320
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.Msg_CheckFileError_Uninstall
mov byte [esp + 0x7c8], 7
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Public
mov byte [esp + 0x7cc], 8
call fcn.004053e0
mov ecx, dword [edi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x7cc], 0
call fcn.0040b530
mov byte [esp + 0x7bc], 9
lea ecx, [esp + 0xc]
push eax
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x7bc], 0
call fcn.004015e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x4352f8
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push str.IDERROR
mov byte [esp + 0x7c8], 0xa
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Public
mov byte [esp + 0x7cc], 0xb
call fcn.004053e0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [edi + 0x14c]
mov byte [esp + 0x7cc], 0
call fcn.0040b530
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
push 0
push edx
push eax
mov ecx, edi
mov byte [esp + 0x7c8], 0xc
call fcn.004274bd
lea ecx, [esp + 0x18]
call fcn.004015e0
lea ecx, [esp + 0xc]
mov dword [esp + 0x7bc], 0xffffffff
call fcn.004015e0
jmp 0x406f0c
cmp esi, dword [esp + 0x14]
ja 0x406f0c
mov eax, dword [ebx + 4]
test eax, eax
jle 0x406f04
xor eax, eax
mov byte [esp + 0x390], 0
mov ecx, 0x40
lea edi, [esp + 0x391]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x498], 0
mov ecx, 0x40
lea edi, [esp + 0x499]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x248], 0
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x249]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x498]
push ecx
push 0
push 0
stosw word es:[edi], ax
push 0x25
push 0
mov dword [esp + 0x2c], 0
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x406f0c
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x394]
push str._sSetup.ini
push eax
add esi, 8
call fcn.004170ff
mov ecx, dword [ebx + 4]
push ecx
lea edx, [esp + 0x48]
push 0x4352dc
push edx
call fcn.004170ff
add esp, 0x18
lea eax, [esp + 0x390]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str.ItemCount
push str.Setup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 4]
xor ebx, ebx
test eax, eax
jle 0x406f04
mov eax, dword [esp + 0x20]
lea edi, [eax + esi]
mov eax, dword [esp + 0x14]
add esi, 0x24
cmp esi, eax
mov dword [esp + 0xc], edi
ja 0x406f0c
lea eax, [edi + 4]
push 0x4352d0
push eax
call fcn.00417196
add esp, 8
test eax, eax
je 0x406ee8
cmp dword [ebp + 8], 3
je 0x406ee8
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x49c]
push ecx
lea edx, [esp + 0x250]
push 0x434b64
push edx
call fcn.004170ff
lea eax, [edi + 4]
push str.MFC71.dll
push eax
call fcn.00417196
add esp, 0x18
test eax, eax
je 0x406d46
lea eax, [edi + 4]
push str.msvcr71.dll
push eax
call fcn.00417196
add esp, 8
test eax, eax
jne 0x406d5f
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x248]
push eax
call fcn.004030e0
test eax, eax
jne 0x406ee8
lea ecx, [esp + 0x248]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.004030e0
test eax, eax
je 0x406e3e
xor eax, eax
mov byte [esp + 0x5a0], 0
mov ecx, 0x81
lea edi, [esp + 0x5a1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x5a0]
push edx
push 0
stosb byte es:[edi], al
push 0x4351e4
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x250]
push edx
call edi
push 4
push 0
lea eax, [esp + 0x148]
push eax
call edi
push ebx
lea ecx, [esp + 0x3c]
push str.Item_d1
push ecx
call fcn.004170ff
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
lea edx, [esp + 0x390]
push edx
lea eax, [esp + 0x24c]
push eax
lea ecx, [esp + 0x40]
push ecx
push str.Setup
call edi
push ebx
lea edx, [esp + 0x3c]
push str.Item_d2
push edx
call fcn.004170ff
add esp, 0xc
lea eax, [esp + 0x390]
push eax
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x40]
push edx
push str.Setup
call edi
jmp 0x406e71
push ebx
lea eax, [esp + 0x3c]
push str.Item_d1
push eax
call fcn.004170ff
add esp, 0xc
lea ecx, [esp + 0x390]
push ecx
lea edx, [esp + 0x24c]
push edx
lea eax, [esp + 0x40]
push eax
push str.Setup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x406f6f
test edi, edi
je 0x406f6f
mov eax, dword [esp + 0xc]
push 0
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x20], 0
mov ecx, dword [eax]
push ecx
add edx, esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x406f93
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
cmp eax, dword [ecx]
jne 0x406f93
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
mov eax, dword [esp + 0x14]
add esi, ecx
cmp esi, eax
ja 0x406f04
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 4]
inc ebx
cmp ebx, ecx
jl 0x406cc1
mov dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x406f28
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x30]
push edx
call esi
mov edi, dword [esp + 0x2c]
cmp edi, 1
jne 0x406f68
cmp dword [ebp + 8], 3
je 0x406f68
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x98]
test eax, eax
je 0x406f53
mov ecx, esi
call fcn.004059e0
mov ecx, esi
call fcn.00403000
mov ecx, esi
call fcn.00405940
mov ecx, esi
call fcn.00403ef0
mov eax, edi
jmp 0x40694a
mov eax, dword [esp + 0xc]
add eax, 4
push str.DesPdm.dll
push eax
call fcn.0041b63a
add esp, 8
test eax, eax
jne 0x406f0c
mov edx, dword [esp + 0xc]
mov ecx, dword [edx]
jmp 0x406eea
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406f0c