Function at 0x402cc0
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10658
call fcn.005a4260
mov eax, dword [0x66dd68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 1
push edi
mov byte [0x6758c8], bl
call fcn.00408985
test eax, eax
jne 0x402cf8
push 0x80004005
call fcn.00402920
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, str.wWinMain
lea esi, [eax + 0x10]
mov dword [ebp - 0x10624], esi
test ecx, 0xffff0000
jne 0x402d35
mov edx, ecx
movzx edi, dx
push edi
call fcn.0040881f
test eax, eax
je 0x402d4b
push edi
push eax
lea ecx, [ebp - 0x10624]
call fcn.00402470
jmp 0x402d45
push str.wWinMain
lea ecx, [ebp - 0x10624]
call fcn.00406ba0
mov esi, dword [ebp - 0x10624]
cmp dword [esi - 4], ebx
jle 0x402d65
mov eax, dword [esi - 0xc]
push eax
lea ecx, [ebp - 0x10624]
call fcn.004026d0
mov esi, dword [ebp - 0x10624]
mov ecx, esi
call fcn.00401500
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xfffe
lea ecx, [ebp - 0x1061c]
push 0
push ecx
call fcn.005a28d0
add esp, 0xc
push 0x630498
lea ecx, [ebp - 0x1062c]
call fcn.00402b60
push 0x630498
lea ecx, [ebp - 0x10630]
call fcn.00402b60
push 0x630498
lea ecx, [ebp - 0x10634]
call fcn.00402b60
push 0x630498
lea ecx, [ebp - 0x10638]
call fcn.00402b60
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.005a28d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402eeb
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e21
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x10630]
call fcn.004029a0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e50
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
lea ecx, [ebp - 0x20c]
cmp eax, ecx
jbe 0x402e88
cmp word [eax], 0x5c
je 0x402e88
xor edx, edx
mov word [eax], dx
sub eax, 2
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x402e70
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e91
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x1062c]
call fcn.004029a0
mov eax, dword [ebp - 0x1062c]
push eax
lea ecx, [ebp - 0x10634]
push 0x6304a8
push ecx
call fcn.00402120
mov edx, dword [ebp - 0x1062c]
push str.PPUninstall.log
push edx
lea eax, [ebp - 0x10638]
push str._s_s
push eax
call fcn.00402120
add esp, 0x1c
call fcn.00408985
test eax, eax
jne 0x402efe
push 0x80004005
call fcn.00402920
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp - 0x1062c]
push ecx
lea edx, [ebp - 0x10624]
add eax, 0x10
push str.The_application_is_running_from:__s
push edx
mov dword [ebp - 0x10624], eax
call fcn.00402120
add esp, 8
lea eax, [ebp - 0x10624]
mov dword [ebp - 0x10620], esp
mov ecx, esp
push eax
call fcn.00401f30
call fcn.004011e0
mov ecx, dword [ebp - 0x10630]
push ecx
lea edx, [ebp - 0x10624]
push str.The_full_exe_path_is:__s
push edx
call fcn.00402120
add esp, 0xc
lea eax, [ebp - 0x10624]
mov dword [ebp - 0x10620], esp
mov ecx, esp
push eax
call fcn.00401f30
call fcn.004011e0
mov ecx, dword [ebp - 0x10634]
push ecx
lea edx, [ebp - 0x10624]
push str.The_full_ini_path_is:__s
push edx
call fcn.00402120
add esp, 0xc
lea eax, [ebp - 0x10624]
mov dword [ebp - 0x10620], esp
mov ecx, esp
push eax
call fcn.00401f30
call fcn.004011e0
add esp, 4
xor edi, edi
call fcn.00405670
push ecx
mov ecx, esp
mov dword [ebp - 0x10620], esp
test eax, eax
jne 0x4030e6
push str.User_is_not_Admin
call fcn.00402b60
call fcn.004011e0
add esp, 4
push str.wWinMain
lea ecx, [ebp - 0x10620]
call fcn.00406c30
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 4], ebx
jle 0x402ffd
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, esi
call fcn.004026d0
mov ecx, dword [esi]
call fcn.00401670
mov eax, dword [ebp - 0x10620]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403026
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10624]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403048
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10638]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40306a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10634]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40308c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1062c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059d9f6
mov esp, ebp
pop ebp
ret 0x10
push str.User_is_Admin
call fcn.00402b60
call fcn.004011e0
add esp, 4
push 0x630498
lea ecx, [ebp - 0x10628]
call fcn.00402b60
mov ecx, dword [ebp - 0x1062c]
push ecx
lea edx, [ebp - 0x10628]
push 0x6304a8
push edx
call fcn.00402120
mov eax, dword [ebp - 0x10628]
add esp, 0xc
cmp dword [eax - 4], ebx
jle 0x403143
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x10628]
call fcn.004026d0
mov eax, dword [ebp - 0x10628]
push eax
lea ecx, [ebp - 0x1061c]
push 0x7fff
push ecx
call fcn.0059e3f7
mov eax, dword [ebp - 0x10628]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0059e180
add esp, 0x14
test eax, eax
js 0x403645
mov ecx, dword [ebp - 0x10628]
cmp eax, dword [ecx - 8]
jg 0x403645
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x10628]
xor edx, edx
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x1061c]
call fcn.004057b0
test al, al
jne 0x4032ed
push ecx
mov ecx, esp
mov dword [ebp - 0x10620], esp
push str.The_ini_file_doesnt_exist
call fcn.00402b60
call fcn.004011e0
add esp, 4
push str.wWinMain
lea ecx, [ebp - 0x10620]
call fcn.00406c30
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 4], ebx
jle 0x4031e0
mov edx, dword [eax - 0xc]
push edx
mov ecx, esi
call fcn.004026d0
mov ecx, dword [esi]
call fcn.00401670
mov eax, dword [ebp - 0x10620]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403209
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10628]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40322b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10624]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40324d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10638]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40326f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10634]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403291
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4032b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1062c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4032d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059d9f6
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
mov ecx, str.uninstall
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40331b
test dx, dx
je 0x403317
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40331b
add eax, 4
add ecx, 4
test dx, dx
jne 0x4032f5
xor eax, eax
jmp 0x403320
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40343c
call fcn.00405b80
push 0xa
lea ecx, [ebp - 0x10658]
mov byte [ebp - 0x10620], al
call fcn.00409775
mov ecx, dword [ebp - 0x10620]
push ecx
lea edx, [ebp - 0x10658]
push edx
call fcn.00403650
lea eax, [ebp - 0x10658]
push eax
call fcn.00403d70
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4033ff
push ecx
mov ecx, esp
mov dword [ebp - 0x10620], esp
push str.Uninstall_products_was_not_successfull.
call fcn.00402b60
call fcn.004011e0
add esp, 4
call fcn.00408985
test eax, eax
jne 0x40339a
push 0x80004005
call fcn.00402920
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
push edi
lea ecx, [ebp - 0x10620]
add eax, 0x10
push str.Uninstall_products_retval:__u
push ecx
mov dword [ebp - 0x10620], eax
call fcn.00402120
add esp, 8
lea edx, [ebp - 0x10620]
mov dword [ebp - 0x1063c], esp
mov ecx, esp
push edx
call fcn.00401f30
call fcn.004011e0
mov eax, dword [ebp - 0x10620]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4033ff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10630]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
push ecx
call esi
mov edx, dword [ebp - 0x10634]
push 4
push 0
push edx
call esi
mov eax, dword [ebp - 0x10638]
push 4
push 0
push eax
call esi
lea ecx, [ebp - 0x10658]
call fcn.00409913
jmp 0x403517
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.005a28d0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.005a28d0
add esp, 0x18
lea edx, [ebp - 0x61c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x61c]
push eax
push str._sPPUninstall.ini
lea ecx, [ebp - 0x414]
push 0x104
push ecx
call fcn.0059e515
mov eax, dword [ebp - 0x10634]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
add esp, 0x10
push 0
lea edx, [ebp - 0x414]
push edx
push eax
call esi
lea edx, [ebp - 0x61c]
push edx
push str._sPPUninstall.exe
lea eax, [ebp - 0x414]
xor ecx, ecx
push 0x104
push eax
mov word [ebp - 0x414], cx
call fcn.0059e515
mov edx, dword [ebp - 0x10630]
add esp, 0x10
push 0
lea ecx, [ebp - 0x414]
push ecx
push edx
call esi
push 5
push 0
push str.uninstall
lea eax, [ebp - 0x414]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.wWinMain
lea ecx, [ebp - 0x10620]
call fcn.00406c30
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 4], ebx
jle 0x40353b
mov ecx, dword [eax - 0xc]
push ecx
mov ecx, esi
call fcn.004026d0
mov ecx, dword [esi]
call fcn.00401670
mov eax, dword [ebp - 0x10620]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403564
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10628]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403586
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10624]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4035a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10638]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4035ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10634]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4035ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10630]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40360e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1062c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403630
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059d9f6
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00402920
int3