Function at 0x40ecd0
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
sub esp, 0xc5c
lea eax, [esp + 0x25c]
push ebx
push ebp
push esi
push edi
push 0x40f8a0
push 0x100
push 8
push eax
call fcn.004018a0
lea ecx, [esp + 0xc70]
call fcn.004055c0
mov ecx, dword [esp + 0xc70]
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
mov eax, dword [esp + 0xc70]
mov ebp, dword [eax - 8]
cmp ebp, 0x100
jge 0x40f719
mov edx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
xor ecx, ecx
cmp edx, 1
jg 0x40ed37
mov edx, dword [eax - 4]
test edx, edx
jge 0x40ed85
test ebp, ebp
jle 0x40ed3d
mov ecx, ebp
push ecx
lea ecx, [esp + 0xc74]
call fcn.00405530
test eax, eax
jne 0x40ed52
xor ebx, ebx
jmp 0x40ed87
mov edi, dword [esp + 0xc70]
lea ecx, [ebp + ebp + 2]
mov edx, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc74]
mov dword [eax - 8], ebp
call fcn.00405590
mov eax, dword [esp + 0xc70]
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov dword [esp + 0x26c], 0
call ebp
lea eax, [eax + eax + 0xc]
push eax
call fcn.00532596
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
mov esi, eax
push 0x5472e0
push esi
mov dword [esi], 0
mov word [esi], 0
call edi
push ebx
push esi
call edi
push 0x5472e0
push esi
call edi
push 0x5472e0
push esi
call edi
push 0x5472e0
push esi
call edi
push 0x5472e0
push esi
call edi
push esi
call ebp
push esi
call ebp
mov edi, eax
lea ecx, [edi + edi*2]
push ecx
call fcn.00532596
lea edi, [esi + edi*2]
add esp, 4
xor ebp, ebp
cmp esi, edi
mov dword [eax], 0
mov ebx, eax
mov ecx, esi
jae 0x40ee4d
cmp word [ecx], 0x22
jne 0x40ee1d
xor edx, edx
test ebp, ebp
sete dl
mov ebp, edx
test ebp, ebp
je 0x40ee2c
cmp word [ecx], 0x20
jne 0x40ee2c
mov word [ecx], 9
add ecx, 2
cmp ecx, edi
jb 0x40ee0e
cmp esi, edi
jae 0x40ee4d
mov cx, word [esi]
cmp cx, 0x22
je 0x40ee46
mov word [eax], cx
add eax, 2
add esi, 2
cmp esi, edi
jb 0x40ee37
push ebx
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebp, [ebx + eax*2 - 2]
mov edi, ebx
cmp ebx, ebp
mov esi, ebx
jae 0x40eee3
cmp word [edi], 0x20
jne 0x40eedc
push esi
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x40eed9
mov eax, dword [esp + 0x268]
push 0x5472dc
push esi
mov dword [esp + eax*8 + 0x274], esi
mov ecx, dword [esp + 0x270]
mov dword [esp + ecx*8 + 0x278], 0
call fcn.0053176f
add esp, 8
test eax, eax
je 0x40eec3
mov ecx, dword [esp + 0x268]
lea edx, [eax + 2]
mov dword [esp + ecx*8 + 0x270], edx
mov word [eax], 0
mov eax, dword [esp + 0x268]
inc eax
cmp eax, 0x100
mov dword [esp + 0x268], eax
jge 0x40eee3
lea esi, [edi + 2]
add edi, 2
cmp edi, ebp
jb 0x40ee65
cmp ebx, ebp
mov eax, ebx
jae 0x40ef06
cmp word [eax], 0xa
jne 0x40eef4
mov word [eax], 0x20
cmp word [eax], 9
jne 0x40eeff
mov word [eax], 0x20
add eax, 2
cmp eax, ebp
jb 0x40eee9
mov eax, dword [esp + 0x268]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
test eax, eax
jle 0x40ef3d
lea edi, [esp + 0x26c]
mov edx, dword [edi]
push edx
push str._install
call ebx
test eax, eax
je 0x40ef74
mov eax, dword [esp + 0x268]
inc esi
add edi, 8
cmp esi, eax
jl 0x40ef20
xor edi, edi
test eax, eax
jle 0x40f615
lea esi, [esp + 0x26c]
mov eax, dword [esi]
push eax
push str._uninstall
call ebx
test eax, eax
je 0x40f0e3
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40ef4e
jmp 0x40f615
mov eax, dword [esp + 0x268]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
test eax, eax
jle 0x40f05b
lea esi, [esp + 0x26c]
mov eax, dword [esi]
push eax
push str.forall
call ebx
test eax, eax
je 0x40efb4
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40ef92
jmp 0x40f05b
call fcn.0040eaa0
test eax, eax
jne 0x40f051
mov eax, dword [esp + 0xc70]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x40efe3
mov dword [ecx], eax
mov ecx, dword [esp + 0xc74]
add ecx, 0xfffffff4
push ecx
call ebp
jmp 0x40eff8
mov edx, dword [0x546560]
mov dword [ecx], edx
mov eax, dword [esp + 0xc74]
push eax
call fcn.00405920
call fcn.0040e850
add esp, 4
test eax, eax
je 0x40f051
mov eax, dword [esp + 0xc70]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40f1a7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f1a7
mov edx, dword [esp + 0xc70]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
mov dword [0x554038], 1
call fcn.00501d40
mov eax, dword [esp + 0xc70]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x40f082
mov dword [ecx], eax
mov eax, dword [esp + 0xc74]
add eax, 0xfffffff4
push eax
call ebp
jmp 0x40f097
mov edx, dword [0x546560]
mov dword [ecx], edx
mov eax, dword [esp + 0xc74]
push eax
call fcn.00405920
call fcn.0040eb50
mov edx, dword [0x546564]
mov esi, eax
mov eax, dword [esp + 0xc74]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40f0d6
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f0d6
mov edx, dword [esp + 0xc70]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
mov eax, dword [esp + 0x268]
xor edi, edi
test eax, eax
jle 0x40f11a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea esi, [esp + 0x26c]
mov ecx, dword [esi]
push ecx
push str._uninstall
call ebx
test eax, eax
je 0x40f120
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40f0fd
xor edi, edi
xor eax, eax
jmp 0x40f136
mov edi, dword [esp + edi*8 + 0x270]
test edi, edi
jne 0x40f12f
xor eax, eax
jmp 0x40f136
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, 0x554020
call fcn.00405870
mov edx, dword [0x554020]
mov eax, dword [edx - 8]
test eax, eax
je 0x40f1b7
call fcn.00501d40
lea ecx, [esp + 0x38]
call fcn.0040f8f0
mov dword [esp + 0x38], 0x540a14
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
lea eax, [esp + 0x38]
lea ecx, [esp + 0x40]
push eax
push ecx
push 0x55e2f8
call fcn.0040f8b0
mov edx, dword [0x55e300]
push 0
push 0x414350
push esi
push 0xd6
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [esp + 0xc70]
call fcn.00405700
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
lea ecx, [esp + 0x38]
call fcn.0040f8f0
mov eax, dword [0x546560]
mov dword [esp + 0x38], 0x540a14
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
mov edx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
cmp edx, 1
mov ecx, 0x105
jg 0x40f1ea
cmp dword [eax - 4], ecx
jge 0x40f22b
mov ebp, dword [eax - 8]
cmp ebp, ecx
jle 0x40f1f3
mov ecx, ebp
push ecx
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
je 0x40f22b
mov edi, dword [esp + 0x10]
lea ecx, [ebp + ebp + 2]
mov eax, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov dword [ecx - 8], ebp
call fcn.00405590
mov eax, dword [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
call fcn.004055c0
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x40f2b0
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x40f27e
mov edx, dword [0x546564]
add eax, 0xfffffff4
cmp eax, edx
jne 0x40f285
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x40f295
mov eax, dword [ecx - 8]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00405870
jmp 0x40f2b0
lea ecx, [esp + 0x24]
call fcn.00412670
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x546560]
lea edx, [esp + 0xa6c]
push 0x100
push edx
push 0x80
mov dword [esp + 0x24], ecx
call fcn.00412530
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x40f2f0
lea edx, [esp + 0xa6c]
lea ecx, [esp + 0x18]
push edx
call fcn.00405920
jmp 0x40f33e
push 0x1ff
lea ecx, [esp + 0x1c]
mov esi, 0x200
call fcn.00413620
test eax, eax
je 0x40f333
push esi
push eax
push 0x80
call fcn.00412530
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x40f333
add esi, 0x100
lea ecx, [esp + 0x18]
lea edx, [esi - 1]
push edx
call fcn.00413620
test eax, eax
jne 0x40f307
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.00405bb0
mov eax, dword [0x546560]
mov ecx, 0x546f04
test ecx, ecx
mov dword [esp + 0x2c], eax
jne 0x40f354
xor eax, eax
jmp 0x40f35b
push 0x546f04
call edi
mov ecx, dword [esp + 0x18]
push ecx
mov edx, dword [ecx - 8]
lea ecx, [esp + 0x30]
push edx
push 0x546f04
push eax
call fcn.004059f0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
call fcn.00405440
lea ecx, [esp + 0x2c]
call fcn.00405700
mov ecx, dword [0x546560]
mov edx, str._uninstall.exe
test edx, edx
mov dword [esp + 0x20], ecx
jne 0x40f3a1
xor eax, eax
jmp 0x40f3a8
push str._uninstall.exe
call edi
push str._uninstall.exe
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [eax - 8]
push eax
call fcn.004059f0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
call fcn.00405440
lea ecx, [esp + 0x20]
call fcn.00405700
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.00413220
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea eax, [esp + 0x10]
push eax
call fcn.004b8df0
lea ecx, [esp + 0x2c]
push ecx
call fcn.004b6ee0
add esp, 8
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push 0x547260
push edx
push 0x546f04
push eax
call fcn.00413060
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00412f10
push eax
lea ecx, [esp + 0x2c]
call fcn.00413220
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x1c]
call fcn.00405700
lea edx, [esp + 0x28]
push edx
call fcn.004b8df0
mov eax, dword [0x553d9c]
mov ecx, 0x81
mov dword [esp + 0x60], eax
xor eax, eax
lea edi, [esp + 0x64]
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x5c]
push 0x104
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
mov edx, dword [0x546560]
push 0
lea ecx, [esp + 0x60]
push eax
push ecx
mov dword [esp + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40f557
push 0x5466c0
lea ecx, [esp + 0x18]
call fcn.00405730
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x34]
push 3
push ecx
call fcn.004bc8d0
add esp, 8
lea edx, [esp + 0x28]
push eax
push edx
call fcn.00412dc0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00412dc0
push eax
lea ecx, [esp + 0x34]
call fcn.004129b0
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x2c]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
mov ecx, dword [esp + 0x30]
push 0x10
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x30]
call fcn.00405700
lea ecx, [esp + 0x28]
call fcn.00405700
lea ecx, [esp + 0x18]
call fcn.00405700
lea ecx, [esp + 0x24]
call fcn.00405700
lea ecx, [esp + 0x10]
call fcn.00405700
jmp 0x40f19b
push 0x55ced8
lea ecx, [esp + 0x38]
call fcn.00405440
lea edx, [esp + 0x28]
mov ecx, 0x55ced8
push edx
call fcn.004129b0
push 0
push 0x546cbc
call fcn.005191e0
add esp, 8
mov esi, eax
lea eax, [esp + 0x34]
mov ecx, 0x55ced8
push eax
call fcn.004129b0
push 0x54725c
lea ecx, [esp + 0x18]
call fcn.00405730
test esi, esi
mov esi, 0x547140
jne 0x40f5b0
mov esi, str.open
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x28]
push str._runas__uninstall_
push eax
call fcn.00413060
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.00412dc0
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push 5
push edx
push eax
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x1c]
call fcn.00405700
lea ecx, [esp + 0x20]
call fcn.00405700
lea ecx, [esp + 0x14]
call fcn.00405700
lea ecx, [esp + 0x34]
call fcn.00405700
jmp 0x40f525
mov edx, dword [0x553d9c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x5c], edx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x60]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00412740
push 0x5c
lea ecx, [esp + 0x14]
call fcn.00413890
cmp eax, 0xffffffff
jne 0x40f672
push 0x2f
lea ecx, [esp + 0x14]
call fcn.00413890
cmp eax, 0xffffffff
je 0x40f710
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call fcn.004138c0
lea ecx, [esp + 0x10]
call fcn.004055c0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
push 0
push str.install
lea ecx, [esp + 0x18]
call fcn.00405c70
test eax, eax
jge 0x40f6cf
push 0
push str.inst_all
lea ecx, [esp + 0x18]
call fcn.00405c70
test eax, eax
jge 0x40f6cf
push 0
push str.setup
lea ecx, [esp + 0x18]
call fcn.00405c70
test eax, eax
jl 0x40f710
call fcn.00501d40
push ecx
lea eax, [esp + 0xc74]
mov ecx, esp
push eax
call fcn.00405440
call fcn.0040eb50
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00405700
lea ecx, [esp + 0xc70]
call fcn.00405700
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
lea ecx, [esp + 0x10]
call fcn.00405700
lea ecx, [esp + 0xc70]
call fcn.00405700
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc5c
ret