Function at 0x40eda0
Capabilities:
Check os version
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0040f3b0
mov dword [0x4677e8], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push str.S_1_16_8192
call fcn.0041fd80
add esp, 4
mov dword [0x4670c8], eax
push str.S_1_16_4096
call fcn.0041fd80
add esp, 4
mov dword [0x4670c4], eax
call fcn.00437c40
test eax, eax
jne 0x40edf7
xor eax, eax
jmp 0x40f393
push 0x5ada20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0x417570
call fcn.00417140
add esp, 8
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0xa8], ecx
cmp dword [ebp - 0xa8], 0x400
jae 0x40ee2d
jmp 0x40ee32
call fcn.0043920a
mov edx, dword [ebp - 0xa8]
mov byte [edx + 0x5ada60], 0
cmp dword [ebp + 0x10], 0
je 0x40ee54
mov eax, dword [ebp + 0x10]
push eax
push 0x5ada60
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._help
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
jne 0x40ee80
push 0x46832c
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40ee9d
push 0x30
push 0x467800
mov ecx, dword [str._help_or____t_t_t_tThis_help_message_r_n_ShowMinimized_t_t_tRun_minimized_r_n_ShowMaximized_t_t_tRun_maximized_r_n_Extract:_pck_file____ToDir:_directory___t_t_tExtracts_the_contents_of_the_package_file___if_not_specified___to_a_subdirectory_called_._setup32_r_n_List:_pck_file___Out:_txt_file__t_tWrites_the_content_description_of_the_package_file_to_the_text_file_r_n_AddDir:_directory____Pck:____pck_file___tAdds_recursively_the_directory_and_its_relative_location_to_the_package_file_r_n____pck_file___filename_with_wildcards__tAdds_the_files_and_their_relative_locaction_to_the_package_r_nin_case__pck_file__is_prepended_with_a____the_package_is_cleaned_before_adding_r_n_Cfg:_cfg_file__t_t_tUse__cfg_file__instead_of_default_setup.cfg_r_n_Pck:_pck_file__t_t_tUse__pck_file__instead_of_default_setup.pck_r_n_UnInst:_cfg_file__t_t_tUse__cfg_file__run_as_uninstaller._Means_delete_the__cfg_file__r_n_ShowTrace_t_t_tShow_trace_textboxes_before_executing_a_command_r_n_Fulllog_t_t_ttraces_also_each_line_of_setup.cfg_to_log_file_r_n_SilentMode_t_truns_the_setup_in_automated_mode_set_SETUP32_AUTO_r_n_ExReg:_regtree___ToFil:_filename__tExports_a_Registry_Tree_to_a_CFG_file_format_r_nEnvironment_Variable_SETUP32_FULLLOG_could_be_set_before_starting_the_setup_r_nEnvironment_Variable_SETUP32_AUTO_could_be_set_before_starting_the_setup_r_nEnvironment_Variable_SETUP32_NEWASKPATH_could_be_set_before_starting_the_setup_r_n]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40f393
push str._ShowTrace
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40eebd
mov dword [0x4736cc], 1
push str._SilentMode
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40eedd
mov dword [0x4736d4], 1
push str._SilentModeX
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40eefd
mov dword [0x4736d4], 2
push str.SETUP32_AUTO
call fcn.00439775
add esp, 4
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x40ef3a
mov edx, dword [ebp - 0x9c]
movsx eax, byte [edx]
test eax, eax
je 0x40ef3a
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.004396d4
add esp, 4
mov dword [0x4736d4], eax
push str.SETUP32_NEWASKPATH
call fcn.00439775
add esp, 4
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x40ef77
mov edx, dword [ebp - 0x9c]
movsx eax, byte [edx]
test eax, eax
je 0x40ef77
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.004396d4
add esp, 4
mov dword [0x4683a8], eax
push str._FullLog
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40ef97
mov dword [0x4736d0], 1
push str.SETUP32_FULLLOG
call fcn.00439775
add esp, 4
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x40efd4
mov edx, dword [ebp - 0x9c]
movsx eax, byte [edx]
test eax, eax
je 0x40efd4
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.004396d4
add esp, 4
mov dword [0x4736d0], eax
push str._ShowMinimized
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40eff3
mov dword [ebp + 0x14], 2
jmp 0x40f02d
push str._ShowMaximized
push 0x5ada60
call fcn.00414420
add esp, 8
test eax, eax
je 0x40f012
mov dword [ebp + 0x14], 3
jmp 0x40f02d
push 0x5ada60
call fcn.0041ecb0
add esp, 4
test eax, eax
je 0x40f02d
mov eax, 1
jmp 0x40f393
mov dword [ebp - 0x98], 0x94
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40f072
cmp dword [ebp - 0x88], 2
jne 0x40f05d
mov dword [ebp - 0xa4], 1
jmp 0x40f067
mov dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [0x4736c8], eax
call fcn.00415890
mov ecx, dword [ebp + 8]
mov dword [0x5ada44], ecx
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x467a10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x467a14], eax
call fcn.00411610
cmp dword [ebp + 0xc], 0
jne 0x40f169
mov dword [ebp - 0xd0], 3
mov dword [ebp - 0xcc], sym.SETUP.exe_WndProc
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc0], edx
push str.SETUP
mov eax, dword [0x5ada44]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x5ada40], eax
mov ecx, dword [0x5ada40]
mov dword [ebp - 0xbc], ecx
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0xb8], eax
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], str.Setup
cmp dword [0x5ada40], 0
jne 0x40f15c
push str.NORMAL
mov edx, dword [0x5ada44]
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x5ada40], eax
mov eax, dword [0x5ada40]
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0xd0]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Setup
push str.Setup
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jne 0x40f1b4
xor eax, eax
jmp 0x40f393
mov eax, dword [ebp - 0xa0]
mov dword [0x474a64], eax
mov ecx, dword [0x5ada44]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
call fcn.0041c780
add esp, 8
test eax, eax
jne 0x40f1fa
push str.InitCopy_failed._May_be_setup.cfg_is_missing_r_n
call fcn.004145f0
add esp, 4
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
jmp 0x40f393
call fcn.00416690
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xfffffffffffffff0
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x5ade60], eax
mov ecx, dword [ebp + 0x14]
push ecx
push str.ShowWindow__u_r_n
call fcn.004145f0
add esp, 8
cmp dword [ebp + 0x14], 0xa
je 0x40f259
cmp dword [ebp + 0x14], 1
je 0x40f259
cmp dword [ebp + 0x14], 1
je 0x40f259
cmp dword [ebp + 0x14], 4
je 0x40f259
cmp dword [ebp + 0x14], 5
je 0x40f259
cmp dword [ebp + 0x14], 8
jne 0x40f268
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00414c00
add esp, 4
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [0x4670c8], 0
je 0x40f296
cmp dword [0x4670c8], 0xffffffff
je 0x40f296
push str.Medium_IntegrityLevel_token_available__S_1_16_8192__r_n
call fcn.004145f0
add esp, 4
jmp 0x40f2a3
push str.Medium_IntegrityLevel_token_NOT_available_r_n
call fcn.004145f0
add esp, 4
cmp dword [0x4670c4], 0
je 0x40f2c4
cmp dword [0x4670c4], 0xffffffff
je 0x40f2c4
push str.Low_IntegrityLevel_token_available__S_1_16_4096__r_n
call fcn.004145f0
add esp, 4
jmp 0x40f2d1
push str.Low_IntegrityLevel_token_NOT_available_r_n
call fcn.004145f0
add esp, 4
push 0
push 0
push 0
lea ecx, [ebp - 0xec]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40f304
lea edx, [ebp - 0xec]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40f2d1
cmp dword [0x4670c8], 0
je 0x40f323
cmp dword [0x4670c8], 0xffffffff
je 0x40f323
mov ecx, dword [0x4670c8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4670c8], 0xffffffff
cmp dword [0x4670c4], 0
je 0x40f34c
cmp dword [0x4670c4], 0xffffffff
je 0x40f34c
mov edx, dword [0x4670c4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4670c4], 0xffffffff
call fcn.00419230
call fcn.00437200
cmp dword [0x474a6c], 1
jle 0x40f374
push 0x5ad220
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5ada20
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00437cf0
push 1
push str.STP_EXITVALUE
call fcn.00428f30
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret 0x10