Function at 0x40eb30
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
sub esp, 0xc5c
lea eax, [esp + 0x25c]
push ebx
push ebp
push esi
push edi
push 0x40f700
push 0x100
push 8
push eax
call fcn.004018a0
lea ecx, [esp + 0xc70]
call fcn.004055c0
mov ecx, dword [esp + 0xc70]
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
mov eax, dword [esp + 0xc70]
mov ebp, dword [eax - 8]
cmp ebp, 0x100
jge 0x40f579
mov edx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
xor ecx, ecx
cmp edx, 1
jg 0x40eb97
mov edx, dword [eax - 4]
test edx, edx
jge 0x40ebe5
test ebp, ebp
jle 0x40eb9d
mov ecx, ebp
push ecx
lea ecx, [esp + 0xc74]
call fcn.00405530
test eax, eax
jne 0x40ebb2
xor ebx, ebx
jmp 0x40ebe7
mov edi, dword [esp + 0xc70]
lea ecx, [ebp + ebp + 2]
mov edx, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc74]
mov dword [eax - 8], ebp
call fcn.00405590
mov eax, dword [esp + 0xc70]
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov dword [esp + 0x26c], 0
call ebp
lea eax, [eax + eax + 0xc]
push eax
call fcn.00533086
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
mov esi, eax
push 0x5482f0
push esi
mov dword [esi], 0
mov word [esi], 0
call edi
push ebx
push esi
call edi
push 0x5482f0
push esi
call edi
push 0x5482f0
push esi
call edi
push 0x5482f0
push esi
call edi
push 0x5482f0
push esi
call edi
push esi
call ebp
push esi
call ebp
mov edi, eax
lea ecx, [edi + edi*2]
push ecx
call fcn.00533086
lea edi, [esi + edi*2]
add esp, 4
xor ebp, ebp
cmp esi, edi
mov dword [eax], 0
mov ebx, eax
mov ecx, esi
jae 0x40ecad
cmp word [ecx], 0x22
jne 0x40ec7d
xor edx, edx
test ebp, ebp
sete dl
mov ebp, edx
test ebp, ebp
je 0x40ec8c
cmp word [ecx], 0x20
jne 0x40ec8c
mov word [ecx], 9
add ecx, 2
cmp ecx, edi
jb 0x40ec6e
cmp esi, edi
jae 0x40ecad
mov cx, word [esi]
cmp cx, 0x22
je 0x40eca6
mov word [eax], cx
add eax, 2
add esi, 2
cmp esi, edi
jb 0x40ec97
push ebx
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebp, [ebx + eax*2 - 2]
mov edi, ebx
cmp ebx, ebp
mov esi, ebx
jae 0x40ed43
cmp word [edi], 0x20
jne 0x40ed3c
push esi
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x40ed39
mov eax, dword [esp + 0x268]
push 0x5482ec
push esi
mov dword [esp + eax*8 + 0x274], esi
mov ecx, dword [esp + 0x270]
mov dword [esp + ecx*8 + 0x278], 0
call fcn.0053225f
add esp, 8
test eax, eax
je 0x40ed23
mov ecx, dword [esp + 0x268]
lea edx, [eax + 2]
mov dword [esp + ecx*8 + 0x270], edx
mov word [eax], 0
mov eax, dword [esp + 0x268]
inc eax
cmp eax, 0x100
mov dword [esp + 0x268], eax
jge 0x40ed43
lea esi, [edi + 2]
add edi, 2
cmp edi, ebp
jb 0x40ecc5
cmp ebx, ebp
mov eax, ebx
jae 0x40ed66
cmp word [eax], 0xa
jne 0x40ed54
mov word [eax], 0x20
cmp word [eax], 9
jne 0x40ed5f
mov word [eax], 0x20
add eax, 2
cmp eax, ebp
jb 0x40ed49
mov eax, dword [esp + 0x268]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
test eax, eax
jle 0x40ed9d
lea edi, [esp + 0x26c]
mov edx, dword [edi]
push edx
push str._install
call ebx
test eax, eax
je 0x40edd4
mov eax, dword [esp + 0x268]
inc esi
add edi, 8
cmp esi, eax
jl 0x40ed80
xor edi, edi
test eax, eax
jle 0x40f475
lea esi, [esp + 0x26c]
mov eax, dword [esi]
push eax
push str._uninstall
call ebx
test eax, eax
je 0x40ef43
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40edae
jmp 0x40f475
mov eax, dword [esp + 0x268]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
test eax, eax
jle 0x40eebb
lea esi, [esp + 0x26c]
mov eax, dword [esi]
push eax
push str.forall
call ebx
test eax, eax
je 0x40ee14
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40edf2
jmp 0x40eebb
call fcn.0040e900
test eax, eax
jne 0x40eeb1
mov eax, dword [esp + 0xc70]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x40ee43
mov dword [ecx], eax
mov ecx, dword [esp + 0xc74]
add ecx, 0xfffffff4
push ecx
call ebp
jmp 0x40ee58
mov edx, dword [0x547570]
mov dword [ecx], edx
mov eax, dword [esp + 0xc74]
push eax
call fcn.00405920
call fcn.0040e6b0
add esp, 4
test eax, eax
je 0x40eeb1
mov eax, dword [esp + 0xc70]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40f007
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f007
mov edx, dword [esp + 0xc70]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
mov dword [0x5550a8], 1
call fcn.00502920
mov eax, dword [esp + 0xc70]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x40eee2
mov dword [ecx], eax
mov eax, dword [esp + 0xc74]
add eax, 0xfffffff4
push eax
call ebp
jmp 0x40eef7
mov edx, dword [0x547570]
mov dword [ecx], edx
mov eax, dword [esp + 0xc74]
push eax
call fcn.00405920
call fcn.0040e9b0
mov edx, dword [0x547574]
mov esi, eax
mov eax, dword [esp + 0xc74]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40ef36
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40ef36
mov edx, dword [esp + 0xc70]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
mov eax, dword [esp + 0x268]
xor edi, edi
test eax, eax
jle 0x40ef7a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea esi, [esp + 0x26c]
mov ecx, dword [esi]
push ecx
push str._uninstall
call ebx
test eax, eax
je 0x40ef80
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40ef5d
xor edi, edi
xor eax, eax
jmp 0x40ef96
mov edi, dword [esp + edi*8 + 0x270]
test edi, edi
jne 0x40ef8f
xor eax, eax
jmp 0x40ef96
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, 0x555090
call fcn.00405870
mov edx, dword [0x555090]
mov eax, dword [edx - 8]
test eax, eax
je 0x40f017
call fcn.00502920
lea ecx, [esp + 0x38]
call fcn.00524330
mov dword [esp + 0x38], 0x541a14
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
lea eax, [esp + 0x38]
lea ecx, [esp + 0x40]
push eax
push ecx
push 0x55f3b0
call fcn.0040f710
mov edx, dword [0x55f3b8]
push 0
push 0x4141a0
push esi
push 0xd6
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [esp + 0xc70]
call fcn.00405700
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
lea ecx, [esp + 0x38]
call fcn.00524330
mov eax, dword [0x547570]
mov dword [esp + 0x38], 0x541a14
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
mov edx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
cmp edx, 1
mov ecx, 0x105
jg 0x40f04a
cmp dword [eax - 4], ecx
jge 0x40f08b
mov ebp, dword [eax - 8]
cmp ebp, ecx
jle 0x40f053
mov ecx, ebp
push ecx
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
je 0x40f08b
mov edi, dword [esp + 0x10]
lea ecx, [ebp + ebp + 2]
mov eax, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov dword [ecx - 8], ebp
call fcn.00405590
mov eax, dword [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
call fcn.004055c0
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x40f110
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x40f0de
mov edx, dword [0x547574]
add eax, 0xfffffff4
cmp eax, edx
jne 0x40f0e5
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x40f0f5
mov eax, dword [ecx - 8]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00405870
jmp 0x40f110
lea ecx, [esp + 0x24]
call fcn.004124c0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x547570]
lea edx, [esp + 0xa6c]
push 0x100
push edx
push 0x80
mov dword [esp + 0x24], ecx
call fcn.00412380
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x40f150
lea edx, [esp + 0xa6c]
lea ecx, [esp + 0x18]
push edx
call fcn.00405920
jmp 0x40f19e
push 0x1ff
lea ecx, [esp + 0x1c]
mov esi, 0x200
call fcn.00413470
test eax, eax
je 0x40f193
push esi
push eax
push 0x80
call fcn.00412380
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x40f193
add esi, 0x100
lea ecx, [esp + 0x18]
lea edx, [esi - 1]
push edx
call fcn.00413470
test eax, eax
jne 0x40f167
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.00405bb0
mov eax, dword [0x547570]
mov ecx, 0x547f14
test ecx, ecx
mov dword [esp + 0x2c], eax
jne 0x40f1b4
xor eax, eax
jmp 0x40f1bb
push 0x547f14
call edi
mov ecx, dword [esp + 0x18]
push ecx
mov edx, dword [ecx - 8]
lea ecx, [esp + 0x30]
push edx
push 0x547f14
push eax
call fcn.004059f0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
call fcn.00405440
lea ecx, [esp + 0x2c]
call fcn.00405700
mov ecx, dword [0x547570]
mov edx, str._uninstall.exe
test edx, edx
mov dword [esp + 0x20], ecx
jne 0x40f201
xor eax, eax
jmp 0x40f208
push str._uninstall.exe
call edi
push str._uninstall.exe
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [eax - 8]
push eax
call fcn.004059f0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
call fcn.00405440
lea ecx, [esp + 0x20]
call fcn.00405700
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.00413070
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea eax, [esp + 0x10]
push eax
call fcn.004b9eb0
lea ecx, [esp + 0x2c]
push ecx
call fcn.004b7e30
add esp, 8
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push 0x548270
push edx
push 0x547f14
push eax
call fcn.00412eb0
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00412d60
push eax
lea ecx, [esp + 0x2c]
call fcn.00413070
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x1c]
call fcn.00405700
lea edx, [esp + 0x28]
push edx
call fcn.004b9eb0
mov eax, dword [0x554e0c]
mov ecx, 0x81
mov dword [esp + 0x60], eax
xor eax, eax
lea edi, [esp + 0x64]
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x5c]
push 0x104
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
mov edx, dword [0x547570]
push 0
lea ecx, [esp + 0x60]
push eax
push ecx
mov dword [esp + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40f3b7
push 0x5476d0
lea ecx, [esp + 0x18]
call fcn.00405730
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x34]
push 3
push ecx
call fcn.004bd990
add esp, 8
lea edx, [esp + 0x28]
push eax
push edx
call fcn.00412c10
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00412c10
push eax
lea ecx, [esp + 0x34]
call fcn.00412800
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x2c]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
mov ecx, dword [esp + 0x30]
push 0x10
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x30]
call fcn.00405700
lea ecx, [esp + 0x28]
call fcn.00405700
lea ecx, [esp + 0x18]
call fcn.00405700
lea ecx, [esp + 0x24]
call fcn.00405700
lea ecx, [esp + 0x10]
call fcn.00405700
jmp 0x40effb
push 0x55df8c
lea ecx, [esp + 0x38]
call fcn.00405440
lea edx, [esp + 0x28]
mov ecx, 0x55df8c
push edx
call fcn.00412800
push 0
push 0x547ccc
call fcn.00519e40
add esp, 8
mov esi, eax
lea eax, [esp + 0x34]
mov ecx, 0x55df8c
push eax
call fcn.00412800
push 0x54826c
lea ecx, [esp + 0x18]
call fcn.00405730
test esi, esi
mov esi, 0x548150
jne 0x40f410
mov esi, str.open
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x28]
push str._runas__uninstall_
push eax
call fcn.00412eb0
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00412c10
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push 5
push edx
push eax
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x34]
call fcn.00405700
jmp 0x40f385
mov edx, dword [0x554e0c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x5c], edx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x60]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00412590
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004136e0
cmp eax, 0xffffffff
jne 0x40f4d2
push 0x2f
lea ecx, [esp + 0x14]
call fcn.004136e0
cmp eax, 0xffffffff
je 0x40f570
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call fcn.00413710
lea ecx, [esp + 0x10]
call fcn.004055c0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
push 0
push str.install
lea ecx, [esp + 0x18]
call fcn.00405c70
test eax, eax
jge 0x40f52f
push 0
push str.inst_all
lea ecx, [esp + 0x18]
call fcn.00405c70
test eax, eax
jge 0x40f52f
push 0
push str.setup
lea ecx, [esp + 0x18]
call fcn.00405c70
test eax, eax
jl 0x40f570
call fcn.00502920
push ecx
lea eax, [esp + 0xc74]
mov ecx, esp
push eax
call fcn.00405440
call fcn.0040e9b0
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00405700
lea ecx, [esp + 0xc70]
call fcn.00405700
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
lea ecx, [esp + 0x10]
call fcn.00405700
lea ecx, [esp + 0xc70]
call fcn.00405700
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc5c
ret