Function at 0x403315
Capabilities:
Copy file
Create process on windows
Create process suspended
Delete file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
xor eax, eax
mov edi, 0x408250
mov ebx, 0x408248
push eax
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xc8], ebx
call fcn.00405f80
mov esi, 0x408244
push 0
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xac], ebx
call fcn.00405f80
push 0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x90], ebx
call fcn.00405f80
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], ebx
call fcn.00405f80
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], ebx
call fcn.00405f80
push 0
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1cc], edi
mov dword [ebp - 0x1c4], ebx
call fcn.00405f80
push 0
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1b0], edi
mov dword [ebp - 0x1a8], ebx
call fcn.00405f80
push 1
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x1bc], esi
call fcn.00405f80
and byte [ebp - 0x5d0], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x5cf]
or dword [ebp - 8], 0xffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x3d8]
mov dword [ebp - 0x3dc], edx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
mov byte [ebp - 9], 1
call fcn.004026f9
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00404620
mov edi, dword [ebp - 0x14]
lea eax, [edi + 4]
push 0x40
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x224], edi
push eax
call fcn.004074b0
add esp, 0xc
add edi, 0x4c
push str.D:is6CodeXTSetup_setup.cpp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push dword [ebp - 4]
call fcn.00407820
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x403c45
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x22d], 0
je 0x403502
lea eax, [ebp - 0x264]
push 0x40
push eax
mov eax, dword [ebp - 0x224]
add eax, 4
push eax
call fcn.004074b0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040462b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x408258
call fcn.00402756
lea ecx, [ebp - 8]
call fcn.0040694c
lea ecx, [ebp - 0x58]
call fcn.0040663e
lea ecx, [ebp - 0x5c]
call fcn.0040663e
xor esi, esi
jmp 0x403bdb
mov edi, 0x408250
push 0
push str.InstallShieldEngine6Intel_32_
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xe4], ebx
call fcn.00406194
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x344]
push eax
mov dword [ebp - 0xf8], esi
call fcn.00404669
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.004044df
add esp, 0xc
lea ecx, [ebp - 0xdc]
push eax
call fcn.00406356
lea ecx, [ebp - 0x360]
call fcn.00406293
lea ecx, [ebp - 0x344]
call fcn.00406293
lea ecx, [ebp - 0xf8]
call fcn.00406293
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xdc]
push eax
call fcn.00405e0c
push 0
push str.IKernel.exe
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x170], ebx
call fcn.00406194
lea eax, [ebp - 0x184]
mov dword [ebp - 0x184], esi
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x37c]
push eax
call fcn.004044df
add esp, 0xc
lea ecx, [ebp - 0x3c]
push eax
call fcn.00406356
lea ecx, [ebp - 0x37c]
call fcn.00406293
lea ecx, [ebp - 0x184]
call fcn.00406293
lea ecx, [ebp - 0x3c]
call fcn.004068d7
push dword [ebp - 0x38]
lea ecx, [ebp - 0x220]
call fcn.0040737a
test al, al
je 0x4036f8
push 0
push str.data1.hdr
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x138], ebx
call fcn.00406194
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14c]
push ecx
mov dword [ebp - 0x14c], esi
mov eax, dword [eax + 0x24c]
push eax
lea eax, [ebp - 0x398]
push eax
call fcn.004045c0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
call fcn.004068d7
mov eax, dword [ebp - 4]
push 0
push 0x80
push 3
mov eax, dword [eax + 4]
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp dword [ebp - 8], eax
mov dword [ebp - 4], eax
je 0x40368e
lea ecx, [ebp - 8]
call fcn.0040694c
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x398]
call fcn.00406293
lea ecx, [ebp - 0x14c]
call fcn.00406293
cmp dword [ebp - 8], 0xffffffff
je 0x4036f8
lea eax, [ebp - 0x20]
push 0
push eax
lea eax, [ebp - 0x9d8]
push 0x1ed
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4036f8
mov eax, dword [ebp - 0x214]
and dword [ebp - 0x7c], 0
and dword [ebp - 0x84], 0
cmp dword [ebp - 0x883], eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x87f]
jg 0x4036f8
jl 0x4036f4
cmp edx, ecx
ja 0x4036f8
and byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x403ad4
lea eax, [ebp - 0x2f0]
push 0
push eax
call fcn.00403cab
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xc0]
call fcn.00406356
lea ecx, [ebp - 0x2f0]
call fcn.00406293
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xc0]
push eax
call fcn.00405e0c
lea eax, [ebp - 0x29c]
lea ecx, [ebp - 0xc0]
push eax
call fcn.004040b1
push eax
lea ecx, [ebp - 0xa4]
call fcn.00406356
lea ecx, [ebp - 0x29c]
call fcn.00406293
xor eax, eax
cmp dword [ebp - 0x94], eax
je 0x403777
push dword [ebp - 0x94]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x40378d
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xa4]
push eax
call fcn.00406356
push 0
push 0x40a33c
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x100], ebx
call fcn.00406194
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], esi
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.004044df
add esp, 0xc
lea ecx, [ebp - 0x78]
push eax
call fcn.00404169
lea ecx, [ebp - 0x328]
call fcn.00406293
lea ecx, [ebp - 0x114]
call fcn.00406293
push 0
push str.IKernel.ex_
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x11c], ebx
call fcn.00406194
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x130], esi
call fcn.004068d7
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push ecx
mov eax, dword [eax + 0x24c]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.004045c0
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
call fcn.004068d7
mov eax, dword [ebp - 4]
push 0
push dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb al, al
lea ecx, [ebp - 0x2b8]
inc al
mov byte [ebp - 0x15], al
call fcn.00406293
lea ecx, [ebp - 0x130]
call fcn.00406293
cmp byte [ebp - 0x15], 0
je 0x403894
push 0x230
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.00405c2a
lea ecx, [ebp - 0x3c]
call fcn.004068d7
push 0x80
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x454]
lea ecx, [ebp - 0x3c]
push eax
mov dword [ebp - 0x4c], 0x104
call fcn.00403e76
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.004068d7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00403e76
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.004068d7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x47c]
push eax
call fcn.00403e76
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.004068d7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00403eff
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.004068d7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x404]
push eax
call fcn.00403eff
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.004068d7
lea ecx, [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x5d0]
push ecx
mov eax, dword [eax + 4]
push dword [ebp - 4]
push dword [ebp - 0x84]
push dword [ebp - 0x7c]
push dword [ebp - 0x20]
push eax
push 0
call sub.VERSION.dll_VerInstallFileA
lea ecx, [ebp - 0x404]
mov dword [ebp - 4], eax
call fcn.00406293
lea ecx, [ebp - 0x4a4]
call fcn.00406293
lea ecx, [ebp - 0x47c]
call fcn.00406293
lea ecx, [ebp - 0x42c]
call fcn.00406293
lea ecx, [ebp - 0x454]
call fcn.00406293
mov eax, dword [ebp - 4]
test al, 1
je 0x403a44
lea eax, [ebp - 0x5d0]
push 0
push eax
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x154], ebx
call fcn.00406194
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4cc]
push eax
mov dword [ebp - 0x168], esi
call fcn.00403e76
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.004044df
mov esi, eax
add esp, 0xc
mov ecx, esi
call fcn.004068d7
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x2d4]
call fcn.00406293
lea ecx, [ebp - 0x4cc]
call fcn.00406293
lea ecx, [ebp - 0x168]
call fcn.00406293
mov eax, dword [ebp - 4]
test eax, eax
je 0x403ad4
test al, 4
jne 0x403ad4
test al, 0x80
mov ebx, eax
jne 0x403a5f
test ah, 4
je 0x403a62
push 0x20
pop ebx
test ah, 2
je 0x403a6a
push 5
pop ebx
test ah, 1
je 0x403a72
push 0x70
pop ebx
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push eax
push 0x9012
mov ecx, edi
call fcn.00405c51
lea ecx, [ebp - 0xdc]
call fcn.00403d9b
mov esi, eax
mov ecx, esi
call fcn.004068d7
push dword [esi + 4]
lea ecx, [ebp - 0x48]
call fcn.00406e1e
push eax
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x7e8]
lea ecx, [edi + 0x580]
push eax
call fcn.00401b83
push 0x255
push ebx
mov ecx, edi
call fcn.00405c2a
lea eax, [ebp - 0x30c]
lea ecx, [ebp - 0x3c]
push eax
call fcn.00403de1
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00406356
lea ecx, [ebp - 0x30c]
call fcn.00406293
push 1
push str.__RegServer
lea ecx, [ebp - 0x280]
call fcn.00406009
mov esi, dword [ebp - 0x270]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push esi
lea ecx, [ebp - 0x190]
call fcn.0040171c
lea ecx, [ebp - 0x280]
call fcn.00406293
lea ecx, [ebp - 0x1a0]
call fcn.004068d7
push dword [ebp - 0x19c]
lea eax, [ebp - 0x6e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x5c]
xor esi, esi
push eax
lea eax, [ebp - 0x3dc]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6e4]
push esi
push eax
push esi
mov dword [ebp - 0x3dc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x2710
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x264]
push 0x40
push eax
mov eax, dword [ebp - 0x224]
add eax, 4
push eax
call fcn.004074b0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040462b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x408258
call fcn.00402756
cmp dword [ebp - 8], 0xffffffff
je 0x403bd3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.004032ee
lea ecx, [ebp - 0x1a0]
call fcn.00406293
lea ecx, [ebp - 0x1bc]
call fcn.00406293
lea ecx, [ebp - 0x1d8]
call fcn.00406293
lea ecx, [ebp - 0x3c]
call fcn.00406293
lea ecx, [ebp - 0x78]
call fcn.00406293
lea ecx, [ebp - 0xa4]
call fcn.00406293
lea ecx, [ebp - 0xc0]
call fcn.00406293
lea ecx, [ebp - 0xdc]
call fcn.00406293
lea ecx, [ebp - 0x44]
call fcn.004016cb
push dword [ebp - 0x48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + 0x574]
push eax
push 0x9009
call fcn.00405c51
lea eax, [ebp - 0x264]
push 0x40
push eax
mov eax, dword [ebp - 0x224]
add eax, 4
push eax
call fcn.004074b0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040462b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x408258
call fcn.00402756
cmp dword [ebp - 8], 0xffffffff
je 0x403ca4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 8], 0xffffffff
mov esi, edi
jmp 0x403bd3