Function at 0x401aa6
Capabilities:
Accept command line arguments
Check os version
Create directory
Create process on windows
Delete directory
Delete file
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc7c
mov eax, dword [esp + 0xc90]
mov dword [0x406008], eax
call fcn.00401905
mov dword [0x408300], eax
mov dword [esp], section..data
call sub.KERNEL32.dll_GetVersionExW
push ecx
mov dword [esp + 8], 0x405192
mov dword [esp + 4], 0x4051a0
mov dword [esp], 0x40600c
call sub.USER32.dll_wsprintfW
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], str.Run_installer_as_administrator
mov dword [esp], 0x407a0c
call sub.KERNEL32.dll_lstrcpynW
sub esp, 0xc
call sub.KERNEL32.dll_GetCommandLineW
mov dword [esp + 0xc78], eax
mov word [0x407b0c], 0
mov esi, eax
lea ebx, [esp + 0x89a]
lea edi, [esp + 0xc78]
jmp 0x401d2e
mov dword [esp + 4], 0x405206
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpW
push edx
push edx
test eax, eax
je 0x401baa
mov dword [esp + 4], 0x40520c
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpW
push ebp
push ebp
test eax, eax
je 0x401baa
mov dword [esp + 4], 0x405212
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpW
push ecx
push ecx
test eax, eax
je 0x401baa
mov dword [esp + 4], 0x405218
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpW
push edx
push edx
test eax, eax
je 0x401baa
mov dword [esp + 4], str.__help
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpW
push ebp
push ebp
test eax, eax
jne 0x402888
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x40600c
mov dword [esp + 4], str.Usage:_n___ConEmuSetup___p:x86__adm____p:x64__adm_____msi_args___n___ConEmuSetup___e_:_extract_path______p:x86___p:x64__nExample__run_x64_auto_update_as_administrator_:_n___ConEmuSetup__p:x64_adm__qr
mov dword [esp], 0
call sub.USER32.dll_MessageBoxW
sub esp, 0x10
mov ebx, 1
jmp 0x402879
mov eax, dword [esp + 0x89c]
cmp ax, 0x65
je 0x401bee
cmp ax, 0x45
jne 0x401c4a
mov byte [0x4082fc], 1
cmp word [esp + 0x89e], 0x3a
jne 0x401d2e
mov eax, dword [esp + 0x8a0]
test ax, ax
je 0x401d2e
cmp ax, 0x22
je 0x401c23
lea eax, [esp + 0x8a0]
jmp 0x401c2a
lea eax, [esp + 0x8a2]
mov dword [esp + 8], 0xec
mov dword [esp + 4], eax
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_lstrcpynW
sub esp, 0xc
jmp 0x401d2e
mov dword [esp + 8], 8
mov dword [esp + 4], str._p:x
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x401d1e
call fcn.00401650
mov byte [0x4082fe], al
mov dword [esp + 4], 0x4053c8
lea ebx, [esp + 0x8a2]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpiW
push edi
push edi
mov dword [esp + 0x28], 0x65
test eax, eax
je 0x401d52
mov dword [esp + 4], str.86_adm
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpiW
push esi
push esi
test eax, eax
jne 0x401ccd
mov al, byte [0x4082fe]
xor eax, 1
mov byte [0x4082fd], al
mov dword [esp + 0x28], 0x65
jmp 0x401d52
mov dword [esp + 4], 0x4053dc
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpiW
push ecx
push ecx
mov dword [esp + 0x28], 0x66
test eax, eax
je 0x401d52
mov dword [esp + 4], str.64_adm
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpiW
push edx
push edx
test eax, eax
jne 0x401d4a
mov al, byte [0x4082fe]
xor eax, 1
mov byte [0x4082fd], al
mov dword [esp + 0x28], 0x66
jmp 0x401d52
cmp ax, 0x2d
jne 0x401d27
mov dword [esp + 0xc78], esi
jmp 0x401d4a
mov esi, dword [esp + 0xc78]
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00401965
test eax, eax
je 0x401b38
mov dword [esp + 0x28], 0
cmp byte [0x4082fc], 0
jne 0x4022bb
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], str.Choose_version_to_install
mov dword [esp], 0x40610c
call sub.KERNEL32.dll_lstrcpynW
sub esp, 0xc
mov word [esp + 0x448], 0
lea edi, [esp + 0xbe4]
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xbe4], 0x80000002
mov dword [esp + 0xbe8], 0x405424
mov dword [esp + 0xbec], 0x405444
mov byte [esp + 0xbf0], 1
mov dword [esp + 0xbf4], 0x80000002
mov dword [esp + 0xbf8], 0x40545a
mov dword [esp + 0xbfc], 0x405444
mov dword [esp + 0xc04], 0x80000002
mov dword [esp + 0xc08], 0x405484
mov dword [esp + 0xc0c], 0x405444
mov dword [esp + 0xc14], 0x80000002
mov dword [esp + 0xc18], 0x4054a0
mov dword [esp + 0xc1c], 0x405444
lea eax, [esp + 0xbe8]
mov dword [esp + 0x18], eax
xor esi, esi
lea edx, [esp + 0x690]
mov dword [esp + 0x1c], edx
mov edi, dword [esp + 0x18]
mov ebp, dword [edi]
mov ebx, dword [edi - 4]
lea eax, [esp + 0xc74]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.ADVAPI32.DLL_RegOpenKeyExW
sub esp, 0x14
test eax, eax
je 0x401ea5
lea edx, [esp + 0xc74]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20219
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.ADVAPI32.DLL_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x401f6f
mov ecx, 0x20a
xor eax, eax
mov edi, dword [esp + 0x1c]
rep stosb byte es:[edi], al
mov dword [esp + 0xc70], 0x208
lea eax, [esp + 0xc70]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x690]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc74]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0xc74]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push ebp
test ebx, ebx
jne 0x401f6f
cmp word [esp + 0x690], 0
je 0x401f6f
shl esi, 4
mov esi, dword [esp + esi + 0xbf0]
lea edi, [esp + 0x690]
mov dword [esp + 4], edi
lea ebx, [esp + 0x448]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyW
push edi
push edi
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push ecx
mov dword [esp + 0xc70], eax
dec eax
cmp word [esp + eax*2 + 0x448], 0x5c
jne 0x401f80
mov word [esp + eax*2 + 0x448], 0
jmp 0x401f80
inc esi
add dword [esp + 0x18], 0x10
cmp esi, 4
jne 0x401e3c
xor esi, esi
cmp word [esp + 0x448], 0
jne 0x401fe4
mov dword [esp + 8], 0x104
lea ebx, [esp + 0x448]
mov dword [esp + 4], ebx
mov dword [esp], str.ProgramFiles
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push edx
test eax, eax
jle 0x401fca
mov edx, 0x4054d4
cmp word [esp + eax*2 + 0x446], 0x5c
jne 0x401fcf
mov edx, 0x4054e4
mov dword [esp + 4], edx
lea eax, [esp + 0x448]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatW
push eax
push eax
mov edx, str.Current
mov eax, esi
test al, al
jne 0x401ff4
mov edx, str.Default
lea eax, [esp + 0x448]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x405192
mov dword [esp + 4], str._s_x86_n_s_installation_folder_is_n_s
mov dword [esp], 0x406a0c
call sub.USER32.dll_wsprintfW
cmp dword [0x408300], 0
je 0x4022ad
mov word [esp + 0x448], 0
lea edi, [esp + 0xba4]
mov ecx, 0x10
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xba4], 0x80000002
mov dword [esp + 0xba8], 0x405424
mov dword [esp + 0xbac], 0x40555a
mov byte [esp + 0xbb0], 1
mov dword [esp + 0xbb4], 0x80000002
mov dword [esp + 0xbb8], 0x40545a
mov dword [esp + 0xbbc], 0x40555a
mov dword [esp + 0xbc4], 0x80000002
mov dword [esp + 0xbc8], 0x405484
mov dword [esp + 0xbcc], 0x40555a
mov dword [esp + 0xbd4], 0x80000002
mov dword [esp + 0xbd8], 0x4054a0
mov dword [esp + 0xbdc], 0x40555a
lea esi, [esp + 0xba8]
mov dword [esp + 0x18], 0
lea ebp, [esp + 0x690]
lea edx, [esp + 0xc74]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [esi - 4]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x4021d9
mov ecx, 0x20a
mov edi, ebp
rep stosb byte es:[edi], al
mov dword [esp + 0xc70], 0x208
lea eax, [esp + 0xc70]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc74]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
mov ebx, eax
mov eax, dword [esp + 0xc74]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
test ebx, ebx
jne 0x4021d9
cmp word [esp + 0x690], 0
je 0x4021d9
shl dword [esp + 0x18], 4
mov eax, dword [esp + 0x18]
mov esi, dword [esp + eax + 0xbb0]
mov dword [esp + 4], ebp
lea ebx, [esp + 0x448]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyW
push edi
push edi
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push ecx
mov dword [esp + 0xc70], eax
dec eax
cmp word [esp + eax*2 + 0x448], 0x5c
jne 0x4021ed
mov word [esp + eax*2 + 0x448], 0
jmp 0x4021ed
inc dword [esp + 0x18]
add esi, 0x10
cmp dword [esp + 0x18], 4
jne 0x4020e8
xor esi, esi
cmp word [esp + 0x448], 0
jne 0x402251
mov dword [esp + 8], 0x104
lea ebx, [esp + 0x448]
mov dword [esp + 4], ebx
mov dword [esp], str.ProgramW6432
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push edx
test eax, eax
jle 0x402237
mov edx, 0x4054d4
cmp word [esp + eax*2 + 0x446], 0x5c
jne 0x40223c
mov edx, 0x4054e4
mov dword [esp + 4], edx
lea eax, [esp + 0x448]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatW
push eax
push eax
mov edx, str.Current
mov eax, esi
test al, al
jne 0x402261
mov edx, str.Default
lea eax, [esp + 0x448]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x405192
mov dword [esp + 4], str._s_x64_n_s_installation_folder_is_n_s
mov dword [esp], 0x40720c
call sub.USER32.dll_wsprintfW
mov dword [esp + 8], 0x40610c
mov dword [esp + 4], str._s_n_nPress__Yes__to_install_x64_version_nPress__No__to_install_x86_version
mov dword [esp], 0x40620c
call sub.USER32.dll_wsprintfW
jmp 0x4023a4
mov word [0x40720c], 0
jmp 0x4023a4
cmp word [0x407b0c], 0
lea ebx, [esp + 0x690]
je 0x4022d9
mov dword [esp + 4], 0x407b0c
mov dword [esp], ebx
jmp 0x402317
mov dword [esp + 4], ebx
mov dword [esp], 0xf7
call sub.KERNEL32.dll_GetTempPathW
push eax
push eax
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push ebp
lea ebx, [ebx + eax*2]
mov dword [esp + 4], 0x4054e4
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyW
push edi
push edi
mov dword [esp + 4], 0x405192
lea eax, [ebx + 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcpyW
push esi
push esi
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], str.Choose_version_to_extract
mov dword [esp], 0x40610c
call sub.KERNEL32.dll_lstrcpynW
sub esp, 0xc
lea ebx, [esp + 0x690]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x405192
mov dword [esp + 4], str._s_x86_nExtract_installation_files_to_n_s
mov dword [esp], 0x406a0c
call sub.USER32.dll_wsprintfW
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x405192
mov dword [esp + 4], str._s_x64_nExtract_installation_files_to_n_s
mov dword [esp], 0x40720c
call sub.USER32.dll_wsprintfW
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40610c
mov dword [esp + 4], str._s_n_nPress__Yes__to_extract_x64_version_nPress__No__to_extract_x86_version_n_n_s
mov dword [esp], 0x40620c
call sub.USER32.dll_wsprintfW
cmp dword [esp + 0x28], 0
jne 0x4023b4
call fcn.0040172b
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
sub eax, 0x65
mov ebx, 1
cmp eax, 1
ja 0x402879
cmp byte [0x4082fc], 0
je 0x4023f7
cmp word [0x407b0c], 0
je 0x4023f7
mov dword [esp + 4], 0
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_CreateDirectoryW
push ebx
push ebx
jmp 0x4024eb
mov dword [esp + 4], 0x407b0c
mov dword [esp], 0xde
call sub.KERNEL32.dll_GetTempPathW
push ecx
push ecx
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_lstrlenW
push edx
lea ebx, [eax + eax + 0x407b0c]
mov dword [esp + 4], 0x4054e4
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyW
push ebp
push ebp
add ebx, 0xc
mov dword [esp + 4], 0x405192
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyW
push edi
push edi
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenW
push esi
lea esi, [ebx + eax*2]
mov dword [esp + 4], 0
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_CreateDirectoryW
push ebx
push ebx
test eax, eax
jne 0x4024eb
lea edi, [esp + 0xc60]
mov ecx, 4
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc60]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
push ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
movzx eax, word [esp + 0xc6c]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0xc6a]
mov dword [esp + 0xc], eax
movzx eax, word [esp + 0xc68]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__02i_02i_02i_i
mov dword [esp], esi
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], 0
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_CreateDirectoryW
push edx
push edx
test eax, eax
jne 0x4024eb
inc ebx
cmp ebx, 0x64
jne 0x40248e
jmp 0x40289f
mov eax, 0x405802
cmp dword [esp + 0x28], 0x65
je 0x4024fc
mov eax, 0x4057fa
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x405192
mov dword [esp + 8], 0x407b0c
mov dword [esp + 4], str._sConEmu._s._s.msi
mov dword [esp], 0x407ce4
call sub.USER32.dll_wsprintfW
mov dword [esp + 8], 0x407b0c
mov dword [esp + 4], str._sConEmu.cab
mov dword [esp], 0x407eec
call sub.USER32.dll_wsprintfW
cmp byte [0x4082fc], 0
jne 0x402556
cmp dword [0x404004], 5
ja 0x4028bf
mov word [0x4080f4], 0
xor esi, esi
mov dword [esp + 4], 0x407ce4
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call fcn.004013d3
mov ebx, eax
or edi, 0xffffffff
test eax, eax
jne 0x402594
mov dword [esp + 4], 0x407eec
mov dword [esp], 0x67
call fcn.004013d3
mov edi, eax
xor edx, edx
mov eax, esi
test al, al
je 0x4025b9
or edx, 0xffffffff
test edi, edi
jne 0x4025b9
mov dword [esp + 4], 0x4080f4
mov dword [esp], 0x68
call fcn.004013d3
mov edx, eax
mov eax, edi
or eax, ebx
or eax, edx
je 0x40260e
mov dword [esp], 0x407ce4
call sub.KERNEL32.dll_DeleteFileW
push eax
mov dword [esp], 0x407eec
call sub.KERNEL32.dll_DeleteFileW
push eax
cmp word [0x4080f4], 0
je 0x4025f2
mov dword [esp], 0x4080f4
call sub.KERNEL32.dll_DeleteFileW
push eax
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_RemoveDirectoryW
push eax
test ebx, ebx
jne 0x402879
mov ebx, edi
jmp 0x402879
cmp byte [0x4082fc], 0
je 0x40265d
mov dword [esp + 8], 0x407b0c
mov dword [esp + 4], str.Installation_files_was_extracted_successfully_n_s
lea ebx, [esp + 0x38]
mov dword [esp], ebx
call sub.USER32.dll_wsprintfW
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x40600c
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxW
sub esp, 0x10
xor ebx, ebx
jmp 0x402879
lea edi, [esp + 0xc24]
mov ecx, 0xf
rep stosd dword es:[edi], eax
mov dword [esp + 0xc24], 0x3c
mov dword [esp + 0xc28], 0x140
mov dword [esp + 0xc30], 0x405130
cmp dword [0x404004], 5
jbe 0x40269e
cmp byte [0x4082fd], 0
jne 0x4026b9
mov dword [esp + 0xc34], 0x407ce4
mov eax, dword [esp + 0xc78]
mov dword [esp + 0xc38], eax
jmp 0x40272c
mov dword [esp + 0xc34], 0x4080f4
mov dword [esp], 0x407ce4
call sub.KERNEL32.dll_lstrlenW
push ebp
mov ebx, eax
mov edx, dword [esp + 0xc78]
xor eax, eax
test edx, edx
je 0x4026e9
mov dword [esp], edx
call sub.KERNEL32.dll_lstrlenW
push edi
lea eax, [eax + ebx + 0x40]
shl eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [esp + 0xc78]
test eax, eax
jne 0x402709
mov eax, 0x4058b0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x407ce4
mov dword [esp + 4], str._i___s___s
mov dword [esp], ebx
call sub.USER32.dll_wsprintfW
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], 0x407b0c
mov dword [esp + 0xc40], 1
lea eax, [esp + 0xc24]
mov dword [esp], eax
call sub.SHELL32.DLL_ShellExecuteExW
push esi
test eax, eax
jne 0x402772
mov dword [esp + 8], 0x407ce4
mov dword [esp + 4], 0x4058c8
mov dword [esp], 0x14
jmp 0x402834
mov eax, dword [esp + 0xc5c]
test eax, eax
jne 0x402799
mov dword [esp + 8], 0x407ce4
mov dword [esp + 4], 0x4058c8
mov dword [esp], 0x15
jmp 0x402834
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
push ebx
push ebx
mov dword [esp + 0xc70], 0
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
push ecx
lea eax, [esp + 0xc70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
push edx
push edx
test eax, eax
je 0x4027f9
mov eax, dword [esp + 0xc70]
test eax, eax
je 0x4027f5
cmp eax, 0x642
jne 0x4027f9
xor ebx, ebx
jmp 0x40283b
mov eax, dword [esp + 0xc70]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4058f0
lea ebx, [esp + 0xaa4]
mov dword [esp], ebx
call sub.USER32.dll_wsprintfW
mov dword [esp + 8], 0x407ce4
mov dword [esp + 4], ebx
mov eax, dword [esp + 0xc70]
add eax, 0x64
mov dword [esp], eax
call fcn.00401330
mov ebx, eax
mov dword [esp], 0x407ce4
call sub.KERNEL32.dll_DeleteFileW
push eax
mov dword [esp], 0x407eec
call sub.KERNEL32.dll_DeleteFileW
push ebp
cmp word [0x4080f4], 0
je 0x40286c
mov dword [esp], 0x4080f4
call sub.KERNEL32.dll_DeleteFileW
push edi
mov dword [esp], 0x407b0c
call sub.KERNEL32.dll_RemoveDirectoryW
push esi
mov eax, ebx
add esp, 0xc7c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ax, word [esp + 0x89a]
cmp ax, 0x2f
jne 0x401d18
jmp 0x401bdb
mov dword [esp + 8], 0x407b0c
mov dword [esp + 4], str.Cant_create_temp_folder_n_s
mov dword [esp], 0xa
call fcn.00401330
mov ebx, eax
jmp 0x402879
mov dword [esp + 8], 0x407b0c
mov dword [esp + 4], str._sConEmuSetup.exe
mov dword [esp], 0x4080f4
call sub.USER32.dll_wsprintfW
mov esi, 1
jmp 0x402561