Function at 0x403197
Capabilities:
Copy file
Create process on windows
Get common file path
Hide graphical window
Set current directory
Terminate process

Disassembly:
push ebp
mov ecx, 0x405a20
mov ebp, esp
mov edx, 0x924
sub esp, 0x5c
mov dword [ebp - 8], 1
push ebx
push esi
push edi
call fcn.0040126b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push section..Shared
mov dword [0x405a20], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
jne 0x4035b2
mov esi, 0xff
mov edi, 0x406350
push esi
mov eax, dword [0x405a20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401425
push edi
mov edi, 0x405210
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, edi
mov edi, 0x406f60
call fcn.0040155d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x405610
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0x405410
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
cmp byte [eax + 0x406f5f], 0x5c
jne 0x403248
push edi
call esi
mov byte [eax + 0x406f5f], 0
mov edi, 0x405610
push edi
call esi
cmp byte [eax + 0x40560f], 0x5c
jne 0x403263
push edi
call esi
mov byte [eax + 0x40560f], 0
mov edi, 0x406f60
mov ecx, 0x405610
mov edx, edi
call fcn.00401000
test eax, eax
je 0x403284
push 0x40520c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x406950
call esi
mov byte [ebp - 1], al
test al, al
jne 0x403329
lea edx, [ebp - 8]
mov edi, 0x406350
mov ecx, edi
call fcn.0040139f
cmp eax, 0xffffffff
mov esi, eax
jne 0x4032bf
push edi
push str.Dont_open__s
push 0x1001
call fcn.0040127e
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp - 8]
push ebx
sub eax, 0x100
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x406350
mov edx, 0x405610
push 0x100
mov ecx, esi
call fcn.004013e7
cmp byte [0x40570e], bl
je 0x40330c
mov eax, 0xfe
cmp byte [eax + 0x405610], 0
je 0x403304
dec eax
test eax, eax
jg 0x4032f6
add eax, 0x405611
push eax
jmp 0x403311
push str.uninstal.ini
mov edx, 0x405210
mov ecx, 0x406b50
call fcn.00401188
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403339
push 0x406950
push 0x406b50
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
mov esi, 0x13880
mov ecx, esi
mov dword [0x405a14], ebx
call fcn.004011fc
mov ecx, esi
mov dword [0x405a10], eax
mov dword [0x406340], 1
mov dword [0x406d54], ebx
call fcn.004011fc
mov ecx, 0x30d40
mov dword [0x406d50], eax
call fcn.004011fc
mov esi, 0x40620c
mov dword [0x406338], eax
mov dword [0x40633c], eax
call fcn.00401a21
mov ecx, 0xa
call fcn.004015a6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov ecx, 0x30
call fcn.004015a6
push eax
push str._s__s
push 0x40628c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x406204]
mov dword [0x40630c], eax
mov eax, dword [0x406200]
shl eax, 3
add eax, dword [0x406204]
sub eax, 8
cmp byte [ebp - 1], bl
mov dword [0x406310], eax
jne 0x4034f7
cmp dword [0x40500c], ebx
jne 0x40340d
push esi
mov ecx, 0x2b
call fcn.004015a6
push eax
push 2
call fcn.0040127e
add esp, 0xc
cmp eax, 6
jne 0x403533
push str.guninst.exe
mov edx, 0x406f60
mov esi, 0x405610
mov edi, 0x406350
mov ecx, esi
call fcn.00401188
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403450
push esi
mov ecx, 0x24
push edi
call fcn.004015a6
push eax
push 0x1001
call fcn.0040127e
add esp, 0x10
push 0x406b50
mov eax, 0x4051d4
cmp dword [0x40500c], 0
jne 0x403468
mov eax, 0x405020
push eax
mov esi, 0x406550
push 0x405610
push str.__s___s__s_
push esi
mov edi, 0x44
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov ecx, 1
call fcn.00402588
lea ecx, [ebp - 0x5c]
mov edx, edi
call fcn.0040126b
mov dword [ebp - 0x5c], edi
call fcn.004018e0
lea eax, [ebp - 0x18]
lea edi, [ebp - 0x5c]
push eax
push edi
xor eax, eax
push eax
push eax
push 0x4000020
push 1
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4034d8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403533
push 0x406550
mov ecx, 0x31
call fcn.004015a6
push eax
push 0x1001
call fcn.0040127e
add esp, 0xc
jmp 0x403533
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x406f60
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [0x40500c], 0
je 0x40351c
xor ecx, ecx
call fcn.00402588
jmp 0x403533
push 0
mov eax, dword [0x405a20]
push 0x403151
push 0
push 0x65
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, 0x406d50
call fcn.0040120d
mov ecx, 0x406338
call fcn.0040120d
mov ecx, 0x405a10
call fcn.0040120d
mov ecx, 0x406208
xor ebx, ebx
call fcn.0040120d
mov ecx, 0x406204
call fcn.0040120d
mov ecx, 0x405a28
call fcn.0040120d
cmp byte [ebp - 1], bl
je 0x4035a8
push ebx
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x405610
mov edi, 0x405210
push 1
push 4
call esi
push ebx
push edi
push 1
push 0x10
call esi
push ebx
push edi
push 0x1001
push 0x1000
call esi
call fcn.004017bb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [section..rdata]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push 6
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret