Function at 0x403315
Capabilities:
Copy file
Create process on windows
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x73c
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
xor eax, eax
mov edi, 0x408248
mov ebx, 0x408240
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xb8], ebx
call fcn.00405da0
mov esi, 0x40823c
push 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x9c], ebx
call fcn.00405da0
push 0
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x80], ebx
call fcn.00405da0
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], ebx
call fcn.00405da0
push 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], ebx
call fcn.00405da0
push 0
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x17c], ebx
call fcn.00405da0
push 1
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x190], esi
call fcn.00405da0
and byte [ebp - 0x524], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x523]
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x32c]
mov dword [ebp - 0x330], edx
mov dword [ebp - 0x5c], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x58], edx
call fcn.00404440
mov edi, dword [ebp - 0xc]
push 0x40
mov dword [ebp - 0x1b0], edi
lea eax, [edi + 4]
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.004072b0
add esp, 0xc
push str.D:is6Code_5EXTSetup_setup.cpp
add edi, 0x4c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA_1]
push 0
push dword [ebp - 4]
call fcn.00407620
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x403a2d
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x22d], 0
je 0x4034ae
lea eax, [ebp - 0x1f0]
push 0x40
push eax
mov eax, dword [ebp - 0x1b0]
add eax, 4
push eax
call fcn.004072b0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0040444b
lea ecx, [ebp - 0x58]
call fcn.0040645e
lea ecx, [ebp - 0x5c]
call fcn.0040645e
jmp 0x403a6c
mov edi, 0x408248
push 0
push str.InstallShieldEngine6Intel_32_
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x10c], ebx
call fcn.00405fb4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 0x120], esi
call fcn.00404460
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.004042ff
add esp, 0xc
lea ecx, [ebp - 0xcc]
push eax
call fcn.00406176
lea ecx, [ebp - 0x228]
call fcn.004060b3
lea ecx, [ebp - 0x260]
call fcn.004060b3
lea ecx, [ebp - 0x120]
call fcn.004060b3
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0xcc]
push eax
call fcn.00405c2c
lea eax, [ebp - 0x2ec]
push 0
push eax
call fcn.00403acb
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xb0]
call fcn.00406176
lea ecx, [ebp - 0x2ec]
call fcn.004060b3
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0xb0]
push eax
call fcn.00405c2c
lea eax, [ebp - 0x244]
lea ecx, [ebp - 0xb0]
push eax
call fcn.00403ed1
push eax
lea ecx, [ebp - 0x94]
call fcn.00406176
lea ecx, [ebp - 0x244]
call fcn.004060b3
xor eax, eax
cmp dword [ebp - 0x84], eax
je 0x4035ae
push dword [ebp - 0x84]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x4035c4
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0x94]
push eax
call fcn.00406176
push 0
push 0x40a348
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x14c], edi
mov dword [ebp - 0x144], ebx
call fcn.00405fb4
lea eax, [ebp - 0x158]
mov dword [ebp - 0x158], esi
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.004042ff
add esp, 0xc
lea ecx, [ebp - 0x78]
push eax
call fcn.00403f89
lea ecx, [ebp - 0x2d0]
call fcn.004060b3
lea ecx, [ebp - 0x158]
call fcn.004060b3
push 0
push str.IKernel.exe
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x128], ebx
call fcn.00405fb4
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], esi
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.004042ff
add esp, 0xc
lea ecx, [ebp - 0x4c]
push eax
call fcn.00406176
lea ecx, [ebp - 0x298]
call fcn.004060b3
lea ecx, [ebp - 0x13c]
call fcn.004060b3
push 0
push str.IKernel.ex_
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x160], ebx
call fcn.00405fb4
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x174], esi
call fcn.004066f7
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x174]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push ecx
mov eax, dword [eax + 0x24c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004043e0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
call fcn.004066f7
mov eax, dword [ebp - 4]
push 0
push dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb al, al
lea ecx, [ebp - 0x20c]
inc al
mov byte [ebp - 0xd], al
call fcn.004060b3
lea ecx, [ebp - 0x174]
call fcn.004060b3
cmp byte [ebp - 0xd], 0
je 0x40372b
push 0x209
call dword [sym.imp.KERNEL32.dll_GetLastError_1]
mov ecx, dword [ebp - 0xc]
push eax
call fcn.00405a4a
lea ecx, [ebp - 0x4c]
call fcn.004066f7
push 0x80
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x3d0]
lea ecx, [ebp - 0x4c]
push eax
mov dword [ebp - 0x20], 0x104
call fcn.00403c96
mov ecx, eax
mov dword [ebp - 8], ecx
call fcn.004066f7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x4c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3f8]
push eax
call fcn.00403c96
mov ecx, eax
mov dword [ebp - 8], ecx
call fcn.004066f7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3a8]
push eax
call fcn.00403c96
mov ecx, eax
mov dword [ebp - 8], ecx
call fcn.004066f7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x4c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x358]
push eax
call fcn.00403d1f
mov ecx, eax
mov dword [ebp - 8], ecx
call fcn.004066f7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x380]
push eax
call fcn.00403d1f
mov ecx, eax
mov dword [ebp - 8], ecx
call fcn.004066f7
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x524]
push ecx
mov eax, dword [eax + 4]
push dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
push 0
call sub.VERSION.dll_VerInstallFileA
lea ecx, [ebp - 0x380]
mov dword [ebp - 4], eax
call fcn.004060b3
lea ecx, [ebp - 0x358]
call fcn.004060b3
lea ecx, [ebp - 0x3a8]
call fcn.004060b3
lea ecx, [ebp - 0x3f8]
call fcn.004060b3
lea ecx, [ebp - 0x3d0]
call fcn.004060b3
mov eax, dword [ebp - 4]
test al, 1
je 0x4038d8
mov dword [ebp - 0xf8], edi
xor edi, edi
lea eax, [ebp - 0x524]
push edi
push eax
lea ecx, [ebp - 0x104]
mov dword [ebp - 0xf0], ebx
call fcn.00405fb4
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0x104], esi
call fcn.00403c96
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.004042ff
mov esi, eax
add esp, 0xc
mov ecx, esi
call fcn.004066f7
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA_1]
lea ecx, [ebp - 0x27c]
call fcn.004060b3
lea ecx, [ebp - 0x420]
call fcn.004060b3
lea ecx, [ebp - 0x104]
call fcn.004060b3
mov eax, dword [ebp - 4]
jmp 0x4038da
xor edi, edi
cmp eax, edi
je 0x403979
test al, 4
jne 0x403979
test al, 0x80
mov dword [ebp - 4], eax
jne 0x4038f6
test ah, 4
je 0x4038fd
mov dword [ebp - 4], 0x20
test ah, 2
je 0x403909
mov dword [ebp - 4], 5
test ah, 1
je 0x403915
mov dword [ebp - 4], 0x70
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x30]
push eax
push 0x9012
mov ecx, ebx
call fcn.00405a71
lea ecx, [ebp - 0xcc]
call fcn.00403bbb
mov esi, eax
mov ecx, esi
call fcn.004066f7
push dword [esi + 4]
lea ecx, [ebp - 0x30]
call fcn.00406c28
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x628]
lea ecx, [ebx + 0x580]
push eax
call fcn.00401b83
push 0x22e
mov ecx, ebx
push dword [ebp - 4]
call fcn.00405a4a
lea eax, [ebp - 0x2b4]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00403c01
push eax
lea ecx, [ebp - 0xe8]
call fcn.00406176
lea ecx, [ebp - 0x2b4]
call fcn.004060b3
push 1
push str.__RegServer
lea ecx, [ebp - 0x1ac]
call fcn.00405e29
mov esi, dword [ebp - 0x19c]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push esi
lea ecx, [ebp - 0xd8]
call fcn.0040171c
lea ecx, [ebp - 0x1ac]
call fcn.004060b3
lea ecx, [ebp - 0xe8]
call fcn.004066f7
push dword [ebp - 0xe4]
lea eax, [ebp - 0x73c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA_1]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x330], 0x44
push eax
lea eax, [ebp - 0x330]
push eax
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x73c]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA_1]
push 0x2710
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x403a41
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + 0x574]
push eax
push 0x9009
call fcn.00405a71
lea eax, [ebp - 0x1f0]
push 0x40
push eax
mov eax, dword [ebp - 0x1b0]
add eax, 4
push eax
call fcn.004072b0
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0040444b
lea ecx, [ebp - 0x5c]
call fcn.004032ee
lea ecx, [ebp - 0xe8]
call fcn.004060b3
lea ecx, [ebp - 0x190]
call fcn.004060b3
lea ecx, [ebp - 0x4c]
call fcn.004060b3
lea ecx, [ebp - 0x78]
call fcn.004060b3
lea ecx, [ebp - 0x94]
call fcn.004060b3
lea ecx, [ebp - 0xb0]
call fcn.004060b3
lea ecx, [ebp - 0xcc]
call fcn.004060b3
lea ecx, [ebp - 0x2c]
call fcn.004016cb
push dword [ebp - 0x30]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret