Function at 0x40cad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x416444], eax
push 3
mov eax, dword [str._nWindows_XP_2003_TextMode_Setup_MassStorage_Addon_Generator_Ver._11.11.17.1_n_C__2011__Andrew_Bendus_aka_Mr.dUSHA__Poltava__Ukraine._n_n]
push eax
call fcn.00406110
cmp dword [ebp + 8], 1
jne 0x40cb10
push 1
call fcn.00408750
jmp 0x40d162
mov dword [0x426d7c], 0x1c
mov dword [0x426d80], 2
mov dword [0x426d84], 5
mov dword [0x426d88], 1
xor ecx, ecx
mov word [0x426d8c], cx
xor edx, edx
mov word [0x426d8e], dx
mov dword [ebp - 0x10], 1
jmp 0x40cb5c
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge 0x40ce5a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
movsx edx, byte [ecx]
cmp edx, 0x2d
jne 0x40ce38
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
push 0x415e08
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x411468
push 0x415e08
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
movsx eax, byte [edx + 1]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x41
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x19
ja case.0x40cbdf.4
mov edx, dword [ebp - 0x1c]
movzx eax, byte [edx + 0x40d1ac]
jmp dword [eax*4 + 0x40d168]
mov byte [0x4272cd], 1
jmp case.0x40cbdf.4
mov byte [0x414b80], 0
jmp case.0x40cbdf.4
push 0x41146c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40cc26
mov byte [0x4272c7], 1
jmp case.0x40cbdf.4
push str.W2K3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40cc5b
mov dword [0x426d88], 2
mov dword [0x414b84], 2
jmp case.0x40cbdf.4
push str.W2K3ONLY
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40cc97
mov dword [0x426d88], 2
mov dword [0x414b84], 2
mov byte [0x4272c2], 1
jmp case.0x40cbdf.4
jmp case.0x40cbdf.4
push 0x411484
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40ccc9
mov ecx, 9
mov word [0x426d8c], cx
jmp case.0x40cbdf.4
push 0x411488
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne case.0x40cbdf.19
mov byte [0x4272c6], 1
jmp case.0x40cbdf.4
mov byte [0x4272bc], 1
jmp case.0x40cbdf.4
push 0x41148c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
add ecx, 1
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40cd1e
jmp case.0x40cbdf.4
movzx edx, byte [0x4272bf]
test edx, edx
je 0x40cd35
push 2
call fcn.00408750
jmp 0x40d162
mov byte [0x4272c0], 1
jmp case.0x40cbdf.4
movzx eax, byte [0x4272c0]
test eax, eax
je 0x40cd58
push 2
call fcn.00408750
jmp 0x40d162
mov byte [0x4272bf], 1
jmp case.0x40cbdf.4
mov byte [0x4272c3], 1
push 0x411490
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40cd93
mov byte [0x4272c4], 1
jmp case.0x40cbdf.4
jmp case.0x40cbdf.4
mov byte [0x4272c5], 1
jmp case.0x40cbdf.4
mov byte [0x4272c8], 1
jmp case.0x40cbdf.4
mov byte [0x4272c9], 1
jmp case.0x40cbdf.4
mov byte [0x4272ca], 1
jmp case.0x40cbdf.4
mov byte [0x4272cb], 1
jmp case.0x40cbdf.4
mov byte [0x4272c6], 1
mov byte [0x4272c3], 1
mov byte [0x4272c5], 1
mov byte [0x4272c7], 1
jmp case.0x40cbdf.4
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 8]
jge 0x40ce17
cmp dword [ebp - 0xc], 0
jne 0x40ce17
push 0x416758
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
call fcn.0040d540
mov dword [ebp - 0xc], eax
jmp case.0x40cbdf.4
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jge case.0x40cbdf.4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 8], ecx
jmp 0x40ce55
cmp dword [ebp - 0xc], 0
jne 0x40ce55
push 0x416758
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.0040d540
mov dword [ebp - 0xc], eax
jmp 0x40cb53
movzx edx, byte [0x4272c4]
test edx, edx
je 0x40ce7a
mov byte [0x4272c6], 0
mov byte [0x4272c5], 0
mov byte [0x4272c7], 0
cmp dword [ebp - 0xc], 0
jne 0x40ce8c
push 3
call fcn.00408750
jmp 0x40d162
push 0x416758
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
sub eax, 0x416758
mov dword [0x4272f8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.0040a7d0
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x415f10
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x416754], eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x4271b8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
push 0
push 0x4272d4
mov ecx, dword [str._SourceDisksFiles__r_n_r_n_HardwareIdsDatabase__r_n_r_n_SCSI.Load__r_n_r_n_BusExtenders.Load__r_n_r_n_SCSI__r_n_r_n_BusExtenders__r_n_r_n_PnpInterface__r_n]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [str._SourceDisksFiles__r_n_r_n_HardwareIdsDatabase__r_n_r_n_SCSI.Load__r_n_r_n_BusExtenders.Load__r_n_r_n_SCSI__r_n_r_n_BusExtenders__r_n_r_n_PnpInterface__r_n]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [0x4272c3]
test edx, edx
je 0x40cf71
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x416860
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x416b74], eax
push 0
push 0x4272d4
mov eax, dword [str._Version__r_nSignature____Windows_NT___r_n_r_n_DefaultInstall__r_nAddReg__r_n_r_n]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [str._Version__r_nSignature____Windows_NT___r_n_r_n_DefaultInstall__r_nAddReg__r_n_r_n]
push ecx
mov edx, dword [0x416b74]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x416758
call fcn.0040c820
push 0x416758
call fcn.0040c9a0
movzx eax, byte [0x4272c3]
test eax, eax
je 0x40cfc5
push 0
push 0x4272d4
mov ecx, dword [str._r_n_r_n_Strings__r_nServices__SYSTEMCurrentControlSetServices_r_nCriticalDatabase__SYSTEMCurrentControlSetControlCriticalDeviceDatabase_r_n_r_n]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [str._r_n_r_n_Strings__r_nServices__SYSTEMCurrentControlSetServices_r_nCriticalDatabase__SYSTEMCurrentControlSetControlCriticalDeviceDatabase_r_n_r_n]
push edx
mov eax, dword [0x416b74]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x416b74]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [0x4272c1]
test edx, edx
jne 0x40cfdf
movzx eax, byte [0x4272cd]
test eax, eax
je 0x40d115
movzx ecx, byte [0x4272cc]
test ecx, ecx
jne 0x40d113
push 0x426fa8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00408d50
movzx edx, byte [0x4272c3]
test edx, edx
je 0x40d00e
call fcn.00407400
movzx eax, byte [0x4272c4]
test eax, eax
je 0x40d029
push 0x4271b8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40d108
call fcn.004087c0
movzx ecx, byte [0x4272c6]
test ecx, ecx
je 0x40d03e
call fcn.00406ba0
movzx edx, byte [0x4272c7]
test edx, edx
je 0x40d04e
call fcn.004061f0
call fcn.004061d0
movzx eax, byte [0x4272bd]
test eax, eax
je 0x40d0ae
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x416340
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
push 0
push 0x4272d4
mov ecx, dword [str._Echo_Off_r_nSetLocal_EnableExtensions_EnableDelayedExpansion_r_n_r_nEcho_Compressing_MassStorage_drivers..._r_n_r_nIf_Not_Exist___1FilesForceCopy__MD___1FilesForceCopy__r_n_r_nIf_Exist___1Drivers____r_nFor___K_In____1Drivers.sys___Do___r_nSet_V__xK_r_nIf___V_____Set_V._r_nSet_V_V:0_3___r_nEcho___nxK_r_nIf_Exist___1FilesForceCopy__nK_V___DEL__F__Q___1FilesForceCopy__nK_V___r_nMakeCab__D_CompressionMemory21__D_CompressionTypeLZX__L___1FilesForceCopy_____K____nul__r_nRD__S__Q___1Drivers___r_n_r_nEcho_MassStorage_drivers_successful_compressed__r_n]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [str._Echo_Off_r_nSetLocal_EnableExtensions_EnableDelayedExpansion_r_n_r_nEcho_Compressing_MassStorage_drivers..._r_n_r_nIf_Not_Exist___1FilesForceCopy__MD___1FilesForceCopy__r_n_r_nIf_Exist___1Drivers____r_nFor___K_In____1Drivers.sys___Do___r_nSet_V__xK_r_nIf___V_____Set_V._r_nSet_V_V:0_3___r_nEcho___nxK_r_nIf_Exist___1FilesForceCopy__nK_V___DEL__F__Q___1FilesForceCopy__nK_V___r_nMakeCab__D_CompressionMemory21__D_CompressionTypeLZX__L___1FilesForceCopy_____K____nul__r_nRD__S__Q___1Drivers___r_n_r_nEcho_MassStorage_drivers_successful_compressed__r_n]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [0x4272be]
test edx, edx
je 0x40d108
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x416968
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
push 0
push 0x4272d4
mov eax, dword [str.set_WorkDir_1_r_n_r_n_Echo_Off_r_nREG.EXE_LOAD_HKLMSETUPREG__I386_SETUPREG.HIV___nul_r_nREG.EXE_IMPORT__WorkDir__setupreg.reg___nul_r_nREG.EXE_UNLOAD_HKLMSETUPREG___nul_r_nIF_EXIST___I386_SETUPREG.HIV.LOG__DEL__F__A:H___I386_SETUPREG.HIV.LOG__r_nIF_EXIST___I386_SETUPREG.HIV.blf__DEL__F__A:H___I386_SETUPREG.HIV.blf__r_nIF_EXIST___I386_SETUPREG.HIV.regtrans_ms__DEL__F__A:H___I386_SETUPREG.HIV.regtrans_ms__r_n]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [str.set_WorkDir_1_r_n_r_n_Echo_Off_r_nREG.EXE_LOAD_HKLMSETUPREG__I386_SETUPREG.HIV___nul_r_nREG.EXE_IMPORT__WorkDir__setupreg.reg___nul_r_nREG.EXE_UNLOAD_HKLMSETUPREG___nul_r_nIF_EXIST___I386_SETUPREG.HIV.LOG__DEL__F__A:H___I386_SETUPREG.HIV.LOG__r_nIF_EXIST___I386_SETUPREG.HIV.blf__DEL__F__A:H___I386_SETUPREG.HIV.blf__r_nIF_EXIST___I386_SETUPREG.HIV.regtrans_ms__DEL__F__A:H___I386_SETUPREG.HIV.regtrans_ms__r_n]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x426fa8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40d141
push 0x4271b8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x416860
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x416238
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x426fa8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x416754]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [0x4272c1]
push edx
call fcn.00408420
push 0
call fcn.00408750
mov esp, ebp
pop ebp
ret