Function at 0x40ab8c
Capabilities:
Delete file
Get common file path
Get file size
Move file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40c
mov dword [0x422730], eax
mov dword [0x421b94], 1
push ebx
push ebp
push esi
push edi
mov ebp, 0x420e88
push str.InstallFactory
push ebp
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov dl, 0x2d
mov eax, dword [esp + 0x428]
mov cl, byte [eax]
cmp cl, dl
jne 0x40b122
cmp byte [eax + 1], 0x49
jne 0x40b038
mov esi, str.IFBG
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x104
add eax, 2
push esi
mov edi, 0x421630
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x40aed4
lea eax, [esp + 0x14]
push eax
push 0x41aa60
push 1
push ebx
push 0x41aa50
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40ac50
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x41aa70
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x40ac46
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call fcn.004080a6
test eax, eax
jne 0x40ac61
or ebx, 0xffffffff
jmp 0x40adb2
push 0x10000
push edi
call fcn.004018e5
pop ecx
cmp eax, ebx
pop ecx
mov dword [0x421524], eax
jne 0x40ac87
call fcn.004082c3
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40b545
push 0x402251
call fcn.004018d1
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileSize]
pop ecx
mov ecx, dword [0x421524]
cmp byte [ecx + 0x10c], 1
jne 0x40acbe
push ebx
push dword [ecx + 0x118]
call edi
mov ecx, dword [0x421524]
cmp dword [ecx + 0x104], eax
ja 0x40acde
cmp byte [ecx + 0x10c], 1
jbe 0x40ace1
push ebx
push dword [ecx + 0x118]
call edi
mov ecx, dword [0x421524]
cmp dword [ecx + 0x108], eax
jbe 0x40ace1
push ecx
jmp 0x40ad07
push str.IFII
call fcn.00403131
test eax, eax
pop ecx
je 0x40ad01
mov edi, 0x421734
push edi
call fcn.00403276
cmp eax, 0xffffffff
pop ecx
jne 0x40ad12
push dword [0x421524]
call fcn.00402157
pop ecx
jmp 0x40ac77
push edi
push esi
push 0x422a9c
push 0x423224
push str.Title
push str.General
call fcn.0040c615
push edi
push ebx
push str.Language
push str.General
call fcn.0040c68e
add esp, 0x28
mov dword [0x421b94], eax
cmp eax, ebx
mov eax, str.Installation_of__s
jne 0x40ad54
mov eax, 0x419340
push 0x422a9c
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push esi
push 0x420d70
push 0x423224
push str.WizardStamp
push str.Window
call fcn.0040c615
add esp, 0x24
lea eax, [esp + 0x18]
push ebp
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x40adbf
push ebx
push 0xf120
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push dword [0x421524]
call fcn.00402157
pop ecx
call fcn.004082c3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x40aedc
call fcn.00403533
test eax, eax
jne 0x40add7
push 0x30
push ebp
push str.This_install_file_was_corrupted_or_truncated__Cant_extract_wizard_bitmap.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0040356d
test eax, eax
jne 0x40adef
push 0x30
push ebp
push str.This_install_file_was_corrupted_or_truncated__Cant_extract_license_information_file.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004035c1
test eax, eax
jne 0x40ae07
push 0x30
push ebp
push str.This_install_file_was_corrupted_or_truncated__Cant_extract_information_file.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.00412e80
mov eax, dword [esp + 0x42c]
add esp, 0xc
mov dword [esp + 0x24], 0x30
mov dword [esp + 0x28], 3
push 0x41f
mov dword [esp + 0x30], 0x40762b
push dword [0x422730]
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
cmp ax, bx
mov dword [esp + 0x20], eax
jne 0x40aee9
mov eax, dword [0x4210f8]
cmp eax, ebx
je 0x40ae91
push eax
call fcn.00412e70
pop ecx
mov dword [0x4210f8], ebx
mov eax, dword [0x421984]
cmp eax, ebx
je 0x40aea7
push eax
call fcn.00412e70
pop ecx
mov dword [0x421984], ebx
mov eax, dword [0x42130c]
cmp eax, ebx
je 0x40aebd
push eax
call fcn.00412e70
pop ecx
mov dword [0x42130c], ebx
push dword [0x421524]
call fcn.00402157
pop ecx
call fcn.004082c3
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0040807c
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 0x10
push edi
push esi
push 0x42311c
push ebx
push str.Header
push str.Background
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.0040c615
add esp, 0x18
test eax, eax
je 0x40af2e
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [esp + 0x14], eax
call esi
push 1
mov dword [esp + 0x18], eax
pop eax
mov dword [0x421980], eax
jmp 0x40af33
mov eax, dword [0x421980]
push ebx
push dword [esp + 0x424]
neg eax
push ebx
push ebx
push dword [esp + 0x24]
sbb eax, eax
push dword [esp + 0x24]
and ax, 0xd8f1
add eax, 0x270f
push eax
push eax
movzx eax, word [esp + 0x40]
push 0x10ca0000
push ebp
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [0x4221f4], eax
je 0x40ae7b
push 1
pop esi
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4221f4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebx
push ebx
lea eax, [esp + 0x5c]
mov dword [0x423118], esi
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push eax
call esi
test eax, eax
je 0x40afda
lea eax, [esp + 0x54]
push eax
push dword [0x421310]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40afd0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [esp + 0x5c]
push ebx
push eax
jmp 0x40af9f
mov eax, dword [0x4210f8]
cmp eax, ebx
je 0x40aff0
push eax
call fcn.00412e70
pop ecx
mov dword [0x4210f8], ebx
mov eax, dword [0x421984]
cmp eax, ebx
je 0x40b006
push eax
call fcn.00412e70
pop ecx
mov dword [0x421984], ebx
mov eax, dword [0x42130c]
cmp eax, ebx
je 0x40b01c
push eax
call fcn.00412e70
pop ecx
mov dword [0x42130c], ebx
push dword [0x421524]
call fcn.00402157
pop ecx
call fcn.004082c3
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40b49d
cmp cl, dl
jne 0x40b122
cmp byte [eax + 1], 0x69
jne 0x40b122
mov esi, 0x104
add eax, 2
push esi
mov edi, 0x423010
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
push esi
push 0x422df8
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
call fcn.0040249a
test eax, eax
jne 0x40b07a
call fcn.0040ab73
push edi
call fcn.0040c415
xor ebx, ebx
pop ecx
test eax, eax
je 0x40b0f1
push edi
push esi
push 0x422a9c
push 0x423224
push str.Title
push str.General
call fcn.0040c615
push edi
push ebx
push str.Language
push str.General
call fcn.0040c68e
add esp, 0x28
mov dword [0x421b94], eax
cmp eax, ebx
mov eax, str.Installation_of__s
jne 0x40b0c9
mov eax, 0x419340
push 0x422a9c
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push 0x405cc6
push ebx
push 0x422
push dword [0x422730]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea eax, [esp + 0x174]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push ebx
mov eax, dword [esp + 0x42c]
push eax
mov byte [eax], 0x7e
lea eax, [esp + 0x17c]
push eax
call fcn.0040cb52
add esp, 0xc
jmp 0x40b6b2
cmp cl, 0x7e
jne 0x40b2a2
cmp byte [eax + 1], 0x69
jne 0x40b2a2
mov esi, 0x104
add eax, 2
push esi
mov edi, 0x423010
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
push edi
call fcn.0040c415
test eax, eax
pop ecx
jne 0x40b165
push 0x10
push ebp
push str.Install_information_file_not_found._n_nAborting_installation.
push 0
jmp 0x40b358
push edi
push esi
push 0x422a9c
push 0x423224
push str.Title
push str.General
call fcn.0040c615
xor ebx, ebx
push edi
push ebx
push str.Language
push str.General
call fcn.0040c68e
add esp, 0x28
mov dword [0x421b94], eax
cmp eax, ebx
mov eax, str.Installation_of__s
jne 0x40b1a9
mov eax, 0x419340
push 0x422a9c
push eax
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
push esi
push 0x420d70
push 0x423224
mov ebp, str.Window
push str.WizardStamp
push ebp
call fcn.0040c615
push edi
push esi
mov esi, 0x421a90
push esi
push ebx
push str.WizardBitmap
push ebp
call fcn.0040c615
add esp, 0x3c
test eax, eax
je 0x40b274
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40b26d
mov ebp, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 2
push ebx
push ebx
push edi
call ebp
push ebx
push ebx
push ebx
push edi
mov dword [0x421ba4], eax
call ebp
push dword [0x421ba4]
call fcn.00412ed8
cmp eax, ebx
pop ecx
mov dword [0x4210f8], eax
je 0x40b266
push dword [0x421ba4]
push eax
push edi
call fcn.0040caf8
add esp, 0xc
test eax, eax
jne 0x40b266
mov eax, dword [0x4210f8]
cmp eax, ebx
je 0x40b266
push eax
call fcn.00412e70
pop ecx
mov dword [0x4210f8], ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [0x420e80], 1
call fcn.00406067
mov eax, dword [0x4210f8]
cmp eax, ebx
je 0x40b6b2
push eax
call fcn.00412e70
pop ecx
mov dword [0x4210f8], ebx
jmp 0x40b6b2
cmp cl, dl
jne 0x40b4f6
cmp byte [eax + 1], 0x55
jne 0x40b4b3
mov esi, 0x104
add eax, 2
push esi
mov edi, 0x42183c
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
push edi
call fcn.0040c415
test eax, eax
pop ecx
jne 0x40b2e2
push 0x10
push ebp
push str.Uninstall_information_file_not_found._n_nAborting_uninstallation.
jmp 0x40b15e
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40b30e
call fcn.0040a78d
jmp 0x40aed9
lea eax, [esp + 0x278]
push 9
push eax
push dword [esp + 0x18]
call fcn.0040caf8
add esp, 0xc
test eax, eax
jne 0x40b32e
push dword [esp + 0x10]
jmp 0x40b394
lea eax, [esp + 0x278]
push str.IFUI0207
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x40b363
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x10
push ebp
push str.Uninstall_information_file_has_wrong_signature._n_nAborting_uninstallation.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40aed9
push esi
push 0x422a9c
push dword [esp + 0x18]
call fcn.0040caf8
add esp, 0xc
test eax, eax
je 0x40b328
push 1
push 0x421b94
push dword [esp + 0x18]
call fcn.0040caf8
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
jne 0x40b3a4
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.0040a7a2
jmp 0x40aed9
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
push 0x422a9c
push ebp
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
cmp dword [0x421b94], ebx
mov eax, str._uninstall
jne 0x40b3c9
mov eax, 0x41eaec
push eax
push ebp
push esi
call fcn.0040baef
add esp, 0xc
cmp dword [0x421b94], ebx
mov eax, str.This_will_uninstall__s_from_your_computer._n_nContinue_uninstallation_
jne 0x40b3e6
mov eax, str._s__
push 0x422a9c
push eax
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x278]
push 0x124
push ebp
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x40b6b2
cmp dword [0x421b94], ebx
je 0x40b43e
push str.Uninstallation_of
push ebp
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x422a9c
push ebp
push esi
call fcn.0040baef
add esp, 0xc
call fcn.0040a7b7
test eax, eax
je 0x40aed9
push 0x80
push edi
call fcn.0040c3bf
mov ebp, dword [sym.imp.KERNEL32.DLL_MoveFileA]
pop ecx
pop ecx
mov esi, 0x42230c
push esi
push edi
call ebp
push ebx
push 0x40a2f4
push ebx
push 0x428
push dword [0x422730]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
jne 0x40b491
push edi
push esi
call ebp
push 3
push edi
call fcn.0040c3bf
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call fcn.0040ab26
cmp dword [0x422624], ebx
je 0x40b6b2
call fcn.00402678
jmp 0x40b6b2
cmp cl, dl
jne 0x40b4f6
cmp byte [eax + 1], 0x75
jne 0x40b4f6
mov esi, 0x104
add eax, 2
push esi
push eax
push 0x422a9c
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
push esi
push 0x422df8
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
call fcn.0040249a
test eax, eax
jne 0x40b4ec
call fcn.0040ab73
call fcn.0040a20f
jmp 0x40b6b2
mov esi, 0x104
mov edi, 0x421630
push esi
xor ebx, ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x278]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, 0x10000
cmp dword [esp + 0x298], eax
jne 0x40b543
push 0x30
push ebp
push str.This_file__InstallFactory_install_uninstall_module_V2.70__must_be_invoked_with_proper_command_line_argument.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40b6b2
jae 0x40b54f
call fcn.00408091
jmp 0x40aed9
lea eax, [esp + 0x70]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push esi
lea eax, [esp + 0x74]
push str.IFinst27.exe
push eax
call fcn.0040c26a
pop ecx
pop ecx
push eax
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
push ebx
push 0x80
push 2
push ebx
push 1
lea eax, [esp + 0x84]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40b65b
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x40b5d9
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x40aed4
push 0x10000
call fcn.00412ed8
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x40b60c
push 0x10000
push eax
push dword [esp + 0x1c]
call fcn.0040caf8
add esp, 0xc
test eax, eax
jne 0x40b61d
push dword [esp + 0x10]
call fcn.00412e70
pop ecx
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push ebp
call esi
jmp 0x40b5c9
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x10000
push dword [esp + 0x14]
push ebp
call fcn.0040cb25
add esp, 0xc
test eax, eax
push dword [esp + 0x10]
jne 0x40b64c
call fcn.00412e70
pop ecx
jmp 0x40b5c2
call fcn.00412e70
pop ecx
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40b66f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x40b66f
cmp eax, 0x20
jne 0x40aed4
lea eax, [esp + 0x174]
push 0x41ea64
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x174]
push edi
push eax
push esi
call fcn.0040baef
lea eax, [esp + 0x180]
push ebx
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0040cb52
add esp, 0x18
test eax, eax
je 0x40aed4
xor eax, eax
jmp 0x40aedc