Function at 0x412d50
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b60b
mov eax, dword fs:[0]
push eax
mov eax, 0x1554
call fcn.0043d9d0
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - reloc.USER32.dll_PeekMessageA], esi
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push 0x208
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push 0x208
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
mov dword [ebp - reloc.USER32.dll_PeekMessageA], 0
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
push 0x104
call fcn.0040fe30
add esp, 4
cmp word [ebp + eax*2 - 0x21a], 0x5c
jne 0x412e16
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x4137b2
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x412e7e
cmp dword [0x48608c], 6
jb 0x412e7e
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041dae0
test eax, eax
je 0x412e7e
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x412e7e
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041cdd0
test eax, eax
jne 0x412e7e
push ecx
mov ecx, esi
call fcn.004128e0
mov edi, eax
test edi, edi
jne 0x412e77
cmp dword [esi + reloc.USER32.dll_PeekMessageA], eax
je 0x412e77
push 0x473b5c
push 0x473b70
mov ecx, esi
call fcn.00412780
mov eax, edi
jmp 0x413796
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00427070
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, reloc.USER32.dll_PeekMessageA
je 0x413769
test al, 0x10
je 0x413769
push ecx
push 0x473b98
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 8
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x412ef5
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x412ef5
push 0x41
push str.Install
mov ecx, 8
call fcn.0041d5f0
push eax
mov ecx, esi
call fcn.00425c10
cmp eax, 1
jne 0x413794
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x413102
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
lea eax, reloc.USER32.dll_PeekMessageA
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, reloc.USER32.dll_PeekMessageA
push ecx
mov ecx, edx
call fcn.00426f80
add esp, 4
mov edi, 0x481a50
nop dword [eax + eax]
push 0x473bc4
push dword [edi]
call fcn.00449cd6
neg eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
sbb ebx, ebx
add esp, 4
inc ebx
push dword [edi]
call fcn.0041f690
add esp, 8
cmp dword [ebp - reloc.USER32.dll_PeekMessageA], 0
je 0x413056
lea eax, reloc.USER32.dll_PeekMessageA
mov ecx, esi
push eax
push dword [edi]
call fcn.00412bd0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004278c0
add esp, 8
test eax, eax
jne 0x412fd0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00427570
add esp, 4
test eax, eax
je 0x4132ec
test ebx, ebx
je 0x4130a2
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
cmp word [eax], 0x3a
je 0x4130a2
push eax
push dword [edi]
call fcn.00449cd6
add esp, 8
test eax, eax
je 0x4130a2
push ecx
push dword [esi + 0x1e0]
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004278c0
add esp, 0x10
test eax, eax
jne 0x4130a2
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00427570
add esp, 4
jmp 0x41309a
push ecx
push dword [edi]
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00427380
add esp, 0xc
test eax, eax
jne 0x4130a2
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00427110
test eax, eax
je 0x4132ec
add edi, 4
cmp edi, str.TLIB_XXVAL_STATUS_k_Gm
jne 0x412f40
mov eax, 0x4819c8
mov edi, 0x4819b0
xor ebx, ebx
cmp eax, edi
sbb eax, eax
and eax, 0xfffffffa
add eax, 6
mov esi, eax
nop dword [eax]
push ecx
push dword [edi]
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 8
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc ebx
lea edi, [edi + 4]
cmp ebx, esi
jne 0x4130d0
mov esi, dword [ebp - reloc.USER32.dll_PeekMessageA]
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x413212
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
xor edi, edi
mov ecx, dword [esi + reloc.USER32.dll_PeekMessageA]
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
mov dword [ebp - reloc.USER32.dll_PeekMessageA], ecx
mov dword [ebp - reloc.USER32.dll_PeekMessageA], 0
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
test ecx, ecx
je 0x413212
lea ebx, reloc.USER32.dll_PeekMessageA
mov dword [ebp - reloc.USER32.dll_PeekMessageA], edi
nop
lea edx, reloc.USER32.dll_PeekMessageA
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x413170
test edi, edi
jne 0x413196
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push dword [ebx]
call fcn.004148e0
test eax, eax
jne 0x4131cb
lea ecx, reloc.USER32.dll_PeekMessageA
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4131a0
sub ecx, edx
lea eax, reloc.USER32.dll_PeekMessageA
sar ecx, 1
push 0x473bf0
push 0x473c0c
lea eax, [eax + ecx*2]
push eax
call fcn.00410120
add esp, 0xc
mov eax, dword [ebp - reloc.USER32.dll_PeekMessageA]
cmp dword [ebp + eax - reloc.USER32.dll_PeekMessageA], 0
je 0x4131f2
sub esp, 0xc
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00426db0
add esp, 0xc
inc edi
lea ebx, reloc.USER32.dll_PeekMessageA
lea eax, [edi*4]
add ebx, eax
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
mov ecx, dword [ebx]
test ecx, ecx
jne 0x413160
push 0
push 0x80000001
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422000
push ecx
push 0x473c14
lea ecx, reloc.USER32.dll_PeekMessageA
mov dword [ebp - 4], 0
call fcn.004221c0
test eax, eax
je 0x4134be
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 8
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
push 0x473c48
call fcn.0041f690
add esp, 8
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
je 0x413359
push 0
push 0x473c64
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422220
test eax, eax
je 0x413359
push ecx
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push 0x473c78
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422510
test eax, eax
je 0x41334e
lea ecx, reloc.USER32.dll_PeekMessageA
lea eax, reloc.USER32.dll_PeekMessageA
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41333b
test dx, dx
je 0x4132e8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41333b
add eax, 4
add ecx, 4
test dx, dx
jne 0x4132c6
xor eax, eax
jmp 0x413340
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
je 0x413325
push 5
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push 0x473be0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push 0x473be4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004147b0
jmp 0x413794
mov ecx, 7
call fcn.0041d5f0
push eax
lea eax, reloc.USER32.dll_PeekMessageA
jmp 0x41378c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41334e
mov dword [esi + reloc.USER32.dll_PeekMessageA], 1
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004222e0
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
je 0x4134b3
push 1
push 0x473c84
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422220
test eax, eax
je 0x4134b3
push 0x473c98
push str.DisplayName
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004226b0
push ecx
push 0x473cb8
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
lea ecx, reloc.USER32.dll_PeekMessageA
add esp, 8
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4133c0
mov eax, dword [0x473ccc]
mov dword [ecx], eax
mov eax, dword [0x473cd0]
mov dword [ecx + 4], eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push str.UninstallString
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004226b0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push str.DisplayIcon
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004226b0
call fcn.00410040
push eax
push str.DisplayVersion
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422580
push str.H.Shirouzu__FastCopy_Lab__LLC.
push str.Publisher
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422580
sub esp, 8
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422300
mov ecx, 0xf
call fcn.0041d780
push eax
push str.HelpLink
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422580
mov ecx, 0x10
call fcn.0041d780
push eax
push str.URLUpdateInfo
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422580
mov ecx, 0x11
call fcn.0041d780
push eax
push str.URLInfoAbout
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422580
push str.pub_setup_fastcopy.jp
push str.Comments
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422580
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004222e0
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004222e0
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
je 0x413511
sub esp, 0xc
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422060
test eax, eax
je 0x413511
push 1
push 0x473d94
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422220
test eax, eax
je 0x413511
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push str.Path
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422660
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004222e0
call fcn.0041dad0
test eax, eax
mov eax, dword [0x48608c]
je 0x4135ae
cmp eax, 0xa
ja 0x413544
jne 0x4135ae
mov ecx, dword [0x486090]
test ecx, ecx
jne 0x413544
cmp dword [0x486094], 0x55f0
jb 0x4135ae
push 0x38
lea eax, reloc.USER32.dll_PeekMessageA
mov dword [ebp - reloc.USER32.dll_PeekMessageA], 0x3c
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push str.ReRegisterSparsePackage
push str.FastEx11.dll
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push 0x473e00
push eax
call fcn.00410120
add esp, 0x14
mov dword [ebp - 0x147c], 0x473e18
lea eax, reloc.USER32.dll_PeekMessageA
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x48608c]
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
je 0x413602
mov eax, dword [esi + reloc.USER32.dll_PeekMessageA]
lea edi, reloc.USER32.dll_PeekMessageA
cmp word [eax], 0x3a
je 0x4135e1
push ecx
lea edi, reloc.USER32.dll_PeekMessageA
push eax
lea edx, reloc.USER32.dll_PeekMessageA
mov ecx, edi
call fcn.0041f690
add esp, 8
push 5
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push str._UPDATED
push edi
push 0x473e48
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41374e
cmp eax, 6
jb 0x4136e0
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041dae0
test eax, eax
je 0x4136e0
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
mov dword [ebp - reloc.USER32.dll_PeekMessageA], 0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push 0x104
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [esi + reloc.USER32.dll_PeekMessageA]
test ecx, ecx
je 0x413682
lea edx, reloc.USER32.dll_PeekMessageA
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x413670
jmp 0x4136c6
push 0x208
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push eax
call fcn.0043ffb0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ecx
push dword [ebp - 0x14cc]
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 8
push dword [esi + 0x1e8]
lea edx, reloc.USER32.dll_PeekMessageA
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004137c0
add esp, 4
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x41374e
cmp dword [ebp - reloc.USER32.dll_PeekMessageA], 0
mov eax, 9
mov ecx, 3
cmovne ecx, eax
call fcn.0041d5f0
push esi
push eax
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.004154f0
push 0
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00427d80
cmp eax, 1
jne 0x413743
push 5
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push str._INSTALL
lea eax, reloc.USER32.dll_PeekMessageA
push eax
push 0x473e70
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00415560
push 0
mov ecx, esi
call fcn.004147b0
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.00422040
mov eax, 1
jmp 0x413796
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x41377b
cmp dword [esi + reloc.USER32.dll_PeekMessageA], 0
jne 0x413794
mov ecx, 6
call fcn.0041d5f0
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
mov ecx, esi
call fcn.00412780
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c755
mov esp, ebp
pop ebp
ret
call fcn.0043cc7a
int3