Function at 0x40c076
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
lea edi, [ebp - 0x3b]
lea esi, str.InstallHinfSection_DefaultInstall
mov ecx, 0x23
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
push 0x100
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 8], eax
or eax, eax
jne 0x40c11c
or eax, eax
je 0x40c0ce
push eax
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c0dd
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c0e8
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c0f7
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c106
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c115
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push 0x100
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0x10], eax
or eax, eax
jne 0x40c18e
cmp dword [ebp - 8], eax
je 0x40c140
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c14f
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c15a
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c169
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c178
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c187
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push 0x200
call sub.CRTDLL.DLL_malloc
add esp, 4
mov ebx, eax
or ebx, ebx
jne 0x40c1ff
cmp dword [ebp - 8], ebx
je 0x40c1b1
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c1c0
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c1cb
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c1da
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c1e9
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c1f8
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push 0x200
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x40c271
cmp dword [ebp - 8], eax
je 0x40c223
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c232
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c23d
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c24c
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c25b
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c26a
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push 0x200
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0x14], eax
or eax, eax
jne 0x40c2e3
cmp dword [ebp - 8], eax
je 0x40c295
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c2a4
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c2af
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c2be
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c2cd
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c2dc
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push 0x200
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 4], eax
or eax, eax
jne 0x40c355
cmp dword [ebp - 8], eax
je 0x40c307
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c316
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c321
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c330
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c33f
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c34e
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push dword [ebp + 8]
push ebx
call fcn.00411b78
push 0x41ff04
call fcn.004111db
push 0x41ff04
push dword [ebp - 4]
call fcn.00411b78
push str..INF
push dword [ebp + 8]
call fcn.00410e38
add esp, 0xc
xor edx, edx
cmp eax, edx
setne dl
inc edx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c398
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40c3b9
push 0x4215ec
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x200
push dword [ebp - 4]
push 0x4215c4
push ebx
call fcn.00410f00
push 1
push 0x200
push dword [ebp - 4]
push 0x4215c0
push ebx
call fcn.00410f00
push 0x100
push dword [ebp - 8]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0x200
push dword [ebp - 8]
push 0x4215bc
push ebx
call fcn.00410f00
push 0x7c
push ebx
call sub.CRTDLL.DLL_strchr
add esp, 0x44
or eax, eax
je 0x40c437
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c41b
mov byte [eax + ebx + 1], 0
push 0x7c
push ebx
call sub.CRTDLL.DLL_strchr
add esp, 8
mov byte [eax], 0
jmp 0x40c459
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c43c
mov byte [eax + ebx + 1], 0
lea ecx, [ebx]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c44d
mov byte [eax + ebx + 2], 0
push ebx
call fcn.004111db
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdc], eax
cmp eax, 1
je 0x40c47c
cmp eax, 2
je 0x40c653
jmp 0x40c77e
push dword [ebp - 0xc]
push dword [ebp - 4]
push ebx
call sub.SHELL32.DLL_FindExecutableA
mov dword [ebp - 0xd4], eax
cmp eax, 0x20
jg 0x40c50e
push 0x10
mov eax, dword [0x420318]
add eax, 0x10
push eax
push dword [0x413110]
push dword [0x41fefc]
call sub.USER32.DLL_MessageBoxA
cmp dword [ebp - 8], 0
je 0x40c4c0
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c4cf
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c4da
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c4e9
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c4f8
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c507
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x40c7d6
push 0x100
push dword [ebp - 0x10]
push ebx
call sub.KERNEL32.DLL_GetShortPathNameA
push 0x100
mov eax, dword [ebp - 0xc]
push eax
push eax
call sub.KERNEL32.DLL_GetShortPathNameA
push dword [ebp - 0x10]
call sub.CRTDLL.DLL__strupr
push dword [ebp - 0xc]
call sub.CRTDLL.DLL__strupr
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_strstr
add esp, 0x10
or eax, eax
je 0x40c571
push ebx
push dword [ebp - 0xc]
call fcn.00411b78
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c55b
lea eax, [eax + ebx + 1]
push eax
push dword [ebp - 0x14]
call fcn.00411b78
jmp 0x40c5bf
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c576
lea eax, [eax + ebx + 1]
push eax
pop ecx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c586
cmp eax, 0
je 0x40c5b6
lea ecx, [ebx]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c597
lea eax, [eax + ebx + 1]
push eax
push ebx
push str._s__s
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x40c5bf
push ebx
push dword [ebp - 0x14]
call fcn.00411b78
push 0
push dword [0x41fefc]
call sub.USER32.DLL_ShowWindow
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.0040c7db
add esp, 0xc
or eax, eax
je 0x40c641
cmp dword [ebp - 8], 0
je 0x40c5f2
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c601
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c60c
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c61b
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c62a
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c639
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
inc eax
jmp 0x40c7d6
push 5
push dword [0x41fefc]
call sub.USER32.DLL_ShowWindow
jmp 0x40c77e
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c658
push str..ntx86
lea eax, [eax + ebx + 1]
push eax
call sub.CRTDLL.DLL__stricmp
add esp, 8
cmp eax, 0
je 0x40c689
lea ecx, [ebx]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c67b
mov byte [eax + ebx + 1], 0
jmp 0x40c6a7
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c68e
push 0x4215ad
lea eax, [eax + ebx + 1]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
mov dword [ebp - 0xcf], 0x94
lea eax, [ebp - 0xcf]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov eax, dword [ebp - 0xbf]
mov dword [ebp - 0xe0], eax
cmp eax, 1
je 0x40c6d5
cmp eax, 2
je 0x40c6ec
jmp 0x40c712
push ebx
lea eax, [ebp - 0x3b]
push eax
push str.rundll.exe_setupx.dll__s132__s
push dword [ebp - 8]
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x40c712
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c6f1
push ebx
lea eax, [eax + ebx + 1]
push eax
lea eax, [ebp - 0x3b]
push eax
push str.rundll32.exe_setupapi.dll__s_s132__s
push dword [ebp - 8]
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
push 5
push dword [ebp - 8]
call sub.KERNEL32.DLL_WinExec
cmp eax, 0x1f
jbe 0x40c77e
cmp dword [ebp - 8], 0
je 0x40c732
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x40c741
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c74c
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c75b
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c76a
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c779
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
inc eax
jmp 0x40c7d6
cmp dword [ebp - 8], 0
je 0x40c78d
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x10], 0
je 0x40c79c
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
pop ecx
or ebx, ebx
je 0x40c7a7
push ebx
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0xc], 0
je 0x40c7b6
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 0x14], 0
je 0x40c7c5
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_free
pop ecx
cmp dword [ebp - 4], 0
je 0x40c7d4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret