Function at 0x403950
Capabilities:
Get common file path
Set file attributes
Terminate process

Disassembly:
mov eax, 0x9f5f0
call fcn.00404650
push ebx
push ebp
push esi
push edi
mov edi, 0x40cf40
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x21c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.zlibpw.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
lea ecx, [esp + 0x14]
push 0x40c5d0
push ecx
call fcn.0040463c
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x10], edi
jne 0x403a38
push 0x10
push str.File_may_already_be_in_use_or_insufficient_permision.
push str.Cannot_open_zlibpw.dll___install_incomplete
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.00404547
lea edx, [esp + 0x21c]
push 0x40b140
push edx
call fcn.0040463c
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x403a6d
push 0x10
push str.ERROR
push str.Cannot_open_Setup.exe
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.00404547
push 0
push 0xef9c
push ebp
call fcn.004049e4
add esp, 0xc
push ebp
call fcn.004049ca
add esp, 4
cmp eax, 0x4d
jne 0x403a7d
push ebp
call fcn.004049ca
add esp, 4
cmp eax, 0x5a
jne 0x403a7d
mov esi, 2
mov byte [esp + 0x320], 0x4d
mov byte [esp + 0x321], al
push ebp
call fcn.004049ca
add esp, 4
cmp al, 0x4d
mov byte [esp + esi + 0x320], al
jne 0x403ade
cmp esi, 0x19c18
jle 0x403ade
push ebp
inc esi
call fcn.004049ca
add esp, 4
cmp al, 0x5a
mov byte [esp + esi + 0x320], al
je 0x403ae1
inc esi
jmp 0x403aad
dec esi
push edi
push esi
lea eax, [esp + 0x328]
push 1
push eax
call fcn.004048c0
mov ecx, dword [esp + 0x20]
mov edi, eax
push ecx
call fcn.004044c4
add esp, 0x14
cmp edi, esi
jge 0x403b16
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x9f5f0
ret
lea edx, [esp + 0x14]
push 0x80
push edx
call ebx
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SeeLogUninstall.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [esp + 0x14]
push 0x40c5d0
push ecx
call fcn.0040463c
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
mov esi, 2
mov byte [esp + 0x320], 0x4d
mov byte [esp + 0x321], 0x5a
push ebp
call fcn.004049ca
add esp, 4
cmp al, 0x4d
mov byte [esp + esi + 0x320], al
jne 0x403be2
cmp esi, 0x9c18
jle 0x403be2
push ebp
inc esi
call fcn.004049ca
add esp, 4
cmp al, 0x5a
mov byte [esp + esi + 0x320], al
je 0x403be5
inc esi
jmp 0x403bb1
dec esi
push edi
push esi
lea edx, [esp + 0x328]
push 1
push edx
call fcn.004048c0
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.004044c4
add esp, 0x14
cmp edi, esi
jge 0x403c1a
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x9f5f0
ret
lea ecx, [esp + 0x14]
push 0x80
push ecx
call ebx
mov edi, dword [esp + 0x9f604]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._seelog.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [esp + 0x14]
push 0x40c5d0
push ecx
call fcn.0040463c
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x10], edi
jne 0x403cbe
push 0x10
push str.File_may_already_be_in_use.
push str.Cannot_open_SeeLog.exe___install_incomplete
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.00404547
mov esi, 2
mov byte [esp + 0x320], 0x4d
mov byte [esp + 0x321], 0x5a
push ebp
call fcn.004049ca
add esp, 4
cmp al, 0x49
mov byte [esp + esi + 0x320], al
jne 0x403d26
push ebp
inc esi
call fcn.004049ca
add esp, 4
cmp al, 0x54
mov byte [esp + esi + 0x320], al
jne 0x403d26
push ebp
inc esi
call fcn.004049ca
add esp, 4
cmp al, 0x53
mov byte [esp + esi + 0x320], al
jne 0x403d26
push ebp
inc esi
call fcn.004049ca
add esp, 4
cmp al, 0x46
mov byte [esp + esi + 0x320], al
je 0x403d29
inc esi
jmp 0x403cd3
add esi, 0xfffffffd
push edi
push esi
lea edx, [esp + 0x328]
push 1
push edx
call fcn.004048c0
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.004044c4
add esp, 0x14
cmp edi, esi
jge 0x403d60
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x9f5f0
ret
lea ecx, [esp + 0x14]
push 0x80
push ecx
call ebx
push 1
push 0xfffffffffffffffc
push ebp
call fcn.004049e4
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x80
rep movsb byte es:[edi], byte [esi]
mov edi, str.help_seelog.chm
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [esp + 0x14]
push 0x40c5d0
push ecx
call fcn.0040463c
push ebp
push 0xe640
lea edx, [esp + 0x330]
push 1
push edx
mov esi, eax
call fcn.004047d8
push esi
push 0xe640
lea eax, [esp + 0x340]
push 1
push eax
call fcn.004048c0
push esi
mov edi, eax
call fcn.004044c4
add esp, 0x2c
cmp edi, 0xe640
jge 0x403e39
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x9f5f0
ret
lea ecx, [esp + 0x14]
push 0x80
push ecx
call ebx
lea edx, [esp + 0x118]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.clog.ttf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.GDI32.dll_RemoveFontResourceA]
lea ecx, [esp + 0x14]
push 0x80
push ecx
call ebx
lea edx, [esp + 0x14]
push 0x40c5d0
push edx
call fcn.0040463c
mov esi, eax
push ebp
push 0x2cac
lea eax, [esp + 0x330]
push 1
push eax
call fcn.004047d8
push esi
push 0x2cac
lea ecx, [esp + 0x340]
push 1
push ecx
call fcn.004048c0
push esi
mov edi, eax
call fcn.004044c4
add esp, 0x2c
cmp edi, 0x2cac
jge 0x403f23
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x9f5f0
ret
lea edx, [esp + 0x14]
push 0x80
push edx
call ebx
mov edi, dword [esp + 0x9f604]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._sample.txt
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [esp + 0x14]
push 0x40c5d0
push ecx
call fcn.0040463c
push ebp
push 0xb2
lea edx, [esp + 0x330]
push 1
push edx
mov esi, eax
call fcn.004047d8
push esi
push 0xb2
lea eax, [esp + 0x340]
push 1
push eax
call fcn.004048c0
push esi
mov edi, eax
call fcn.004044c4
add esp, 0x2c
cmp edi, 0xb2
jge 0x403fef
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x9f5f0
ret
lea ecx, [esp + 0x14]
push 0x80
push ecx
call ebx
push ebp
call fcn.004044c4
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9f5f0
ret