Function at 0x413ca0
Capabilities:
Check if file exists
Copy file
Enumerate files on windows
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5882c4
mov eax, dword fs:[0]
push eax
sub esp, 0x8e4
mov eax, dword [0x5f50fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x8c0], ebx
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x8cc], 5
mov dword [ebp - 0x8c8], 0xa
call fcn.00415e60
mov ecx, ebx
call fcn.00416550
test byte [ebx + 0x18], 2
je 0x413d30
lea esi, [ebx + 0x4d8]
push 5
mov ecx, esi
call fcn.0041a780
test esi, esi
jne 0x413d1d
xor eax, eax
jmp 0x413d20
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 8], 0
je 0x413d80
lea eax, [ebp - 0x87c]
mov dword [ebp - 0x87c], 0
push eax
lea ecx, [ebx + 0x998]
call fcn.0040b350
mov edi, eax
test edi, edi
je 0x413d80
xor esi, esi
nop word [eax + eax]
mov eax, dword [ebp - 0x87c]
mov ecx, ebx
add eax, 0x208
add eax, esi
push eax
call fcn.004150d0
add esi, 0x828
sub edi, 1
jne 0x413d60
push 0
lea edi, [ebx + 0x998]
mov dword [ebp - 0x89c], 0
push str._InstallBeforeCall_
lea eax, [ebp - 0x89c]
mov dword [ebp - 0x894], edi
push eax
mov ecx, edi
call fcn.00408d50
mov esi, 1
test eax, eax
je 0x413e03
push dword [ebx + 0xc]
lea ecx, [ebp - 0x8cc]
push 0
push ecx
push dword [ebp - 0x89c]
mov ecx, ebx
push eax
call fcn.0040f630
push dword [ebp - 0x89c]
cmp eax, 0x643
jne 0x413dec
mov ecx, edi
call fcn.0040b990
mov eax, 0x643
jmp 0x4148bb
xor ecx, ecx
cmp eax, 0xbc2
cmove ecx, esi
mov dword [ebp - 0x890], ecx
mov ecx, edi
call fcn.0040b990
test byte [ebx + 0x18], 2
je 0x413e33
lea esi, [ebx + 0x4d8]
push 0xa
mov ecx, esi
call fcn.0041a780
test esi, esi
jne 0x413e20
xor eax, eax
jmp 0x413e23
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x898]
mov ecx, edi
push eax
call fcn.0040c640
push 1
lea eax, [ebp - 0x8c4]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.0040c330
mov eax, dword [ebp - 0x8c4]
mov byte [ebp - 4], 1
test eax, eax
je 0x4148d7
push eax
push dword [ebp - 0x898]
call fcn.0056e381
add esp, 8
or esi, 0xffffffff
mov ecx, ebx
push 1
push dword [ebp - 0x898]
test eax, eax
jne 0x413f1b
call fcn.00410260
push 0
lea eax, [ebp - 0x8ac]
mov ecx, edi
push eax
call fcn.0040c330
mov esi, eax
lea eax, [ebp - 0x88c]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0040d160
push dword [esi]
lea ecx, [ebx + 0xe4a0]
mov byte [ebp - 4], 3
push dword [eax]
call fcn.0041c790
mov edx, dword [ebp - 0x88c]
or esi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413eee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x8ac]
mov eax, esi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413f0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x87c], 1
jmp 0x413f2a
call fcn.00410260
mov dword [ebp - 0x87c], 0
lea eax, [ebp - 0x880]
mov dword [ebp - 0x880], 0
push eax
mov ecx, edi
call fcn.00409130
mov dword [ebp - 0x888], eax
test eax, eax
je 0x41433d
push dword [ebp - 0x898]
mov ecx, ebx
call fcn.0040fcf0
cmp dword [ebp - 0x87c], 0
je 0x413fd0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00568420
add esp, 0xc
lea eax, [ebp - 0x88c]
mov ecx, edi
push eax
call fcn.0040d160
push dword [eax]
lea eax, [ebp - 0x218]
push str._sCanon
push 0x104
push eax
call fcn.00402f80
mov edx, dword [ebp - 0x88c]
add esp, 0x10
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413fc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.0040fcf0
call fcn.00423a43
mov ecx, eax
test ecx, ecx
je 0x4148e1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x87c], eax
lea eax, [ebp - 0x88c]
mov byte [ebp - 4], 4
push eax
mov ecx, edi
call fcn.0040cf40
push dword [eax]
lea eax, [ebp - 0x87c]
mov byte [ebp - 4], 5
push str._s.cab
push eax
call fcn.00406e60
mov edx, dword [ebp - 0x88c]
add esp, 0xc
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41403a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x878]
push eax
push dword [ebp - 0x87c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x88c], eax
cmp eax, 0xffffffff
jne 0x41406a
push dword [ebp - 0x880]
mov ecx, edi
call fcn.0040b990
jmp 0x4143ba
call fcn.00423a43
mov ecx, eax
test ecx, ecx
je 0x4148eb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x8bc], eax
mov byte [ebp - 4], 6
call fcn.00423a43
mov ecx, eax
test ecx, ecx
je 0x4148f5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x880]
mov byte [ebp - 4], 7
mov dword [ebp - 0x8e4], 0
mov dword [ebp - 0x8e0], 0xa
mov dword [ebp - 0x8d8], 0xa
mov dword [ebp - 0x8d4], 0x55
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x8ec], ebx
mov dword [ebp - 0x8dc], 0
jmp 0x414109
lea edi, [ebx + 0x998]
or esi, 0xffffffff
lea eax, [ebp - 0x8d0]
mov ecx, edi
push eax
call fcn.0040cf40
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 8
push ecx
push dword [eax]
lea eax, [ebp - 0x8bc]
push str._s_s
push eax
call fcn.00406e60
mov edx, dword [ebp - 0x8d0]
add esp, 0x10
mov byte [ebp - 4], 7
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414159
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x884]
mov ecx, edi
push eax
call fcn.0040c970
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 9
push ecx
push dword [eax]
lea eax, [ebp - 0x8b8]
push str._s_s
push eax
call fcn.00406e60
mov edx, dword [ebp - 0x884]
add esp, 0x10
mov byte [ebp - 4], 7
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4141a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x8b8]
mov edi, dword [ebp - 0x8bc]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x8ac], eax
test eax, eax
je 0x4141e4
lea eax, [ebp - 0x8f0]
push eax
push 0x40ef40
push 0
push esi
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
mov dword [ebp - 0x8ac], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4141ff
test al, 1
je 0x4141ff
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x8ac], 0
je 0x414370
lea eax, [ebp - 0x878]
push eax
push dword [ebp - 0x88c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x414100
push dword [ebp - 0x88c]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x8dc], 0
mov ecx, 1
push dword [ebp - 0x880]
mov eax, dword [ebp - 0x890]
push dword [ebp - 0x888]
cmovne eax, ecx
mov ecx, ebx
mov dword [ebp - 0x890], eax
call fcn.00419070
test eax, eax
je 0x414370
lea eax, [ebp - 0x628]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x55
push 0xa
push dword [ebp - 0x8e4]
mov ecx, ebx
push dword [ebp - 0x880]
push dword [ebp - 0x888]
call fcn.0040fec0
test eax, eax
je 0x4142b1
cmp eax, 0xbc2
jne 0x414370
mov dword [ebp - 0x890], 1
push dword [ebp - 0x880]
mov ecx, ebx
push dword [ebp - 0x888]
call fcn.00415c60
push dword [ebp - 0x880]
test eax, eax
jne 0x414376
lea ecx, [ebx + 0x998]
call fcn.0040b990
lea edx, [esi - 0x10]
mov byte [ebp - 4], 6
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4142fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x414316
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x87c]
mov eax, esi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414337
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edi, [ebx + 0x998]
test byte [ebx + 0x18], 2
je 0x4143fc
lea ecx, [ebx + 0x4d8]
push 0x55
call fcn.0041a780
push 0x5cfa60
lea ecx, [ebx + 0x4d8]
call fcn.0041a6a0
lea eax, [ebx + 0x4d8]
test eax, eax
jne 0x4143e9
jmp 0x4143ec
push dword [ebp - 0x880]
mov ecx, dword [ebp - 0x894]
call fcn.0040b990
lea edx, [esi - 0x10]
mov byte [ebp - 4], 6
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41439f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4143ba
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x87c]
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41447d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 0x643
jmp 0x414876
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x8a0]
mov dword [ebp - 0x8a0], 0
push eax
mov ecx, edi
call fcn.00409cb0
test eax, eax
je 0x41443b
push 0x5a
push 0x55
push dword [ebp - 0x8a0]
mov ecx, ebx
push eax
call fcn.00416ed0
mov ecx, edi
push dword [ebp - 0x8a0]
test eax, eax
jne 0x414478
call fcn.0040b990
mov ecx, ebx
call fcn.004160b0
lea eax, [ebp - 0x8a4]
mov dword [ebp - 0x8a4], 0
push eax
mov ecx, edi
call fcn.00409980
test eax, eax
je 0x41448c
push dword [ebp - 0x8a4]
mov ecx, ebx
push eax
call fcn.00417ca0
mov ecx, edi
push dword [ebp - 0x8a4]
test eax, eax
je 0x414487
call fcn.0040b990
mov edi, 0x643
jmp 0x414876
call fcn.0040b990
mov ecx, edi
call fcn.0040dd10
test eax, eax
je 0x414530
push 1
lea eax, [ebp - 0x87c]
mov dword [ebp - 0x87c], 0
push eax
mov ecx, edi
call fcn.0040abc0
mov dword [ebp - 0x884], eax
test eax, eax
je 0x414530
lea eax, [ebp - 0x888]
mov ecx, edi
push eax
call fcn.0040c190
push 0x5f
push 0x5a
push dword [ebp - 0x87c]
mov ecx, ebx
mov byte [ebp - 4], 0xa
push dword [ebp - 0x884]
push dword [ebp - 0x888]
call fcn.00417ef0
mov ecx, edi
push dword [ebp - 0x87c]
test eax, eax
je 0x41450a
call fcn.0040b990
mov edx, dword [ebp - 0x888]
jmp 0x4143c0
call fcn.0040b990
mov edx, dword [ebp - 0x888]
mov eax, esi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414530
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.0040dd80
test eax, eax
je 0x4145e4
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00568420
add esp, 0xc
lea eax, [ebp - 0x884]
mov ecx, edi
push eax
call fcn.0040c640
push dword [eax]
lea eax, [ebp - 0x218]
push str._suninst.isu
push 0x104
push eax
call fcn.00402f80
mov edx, dword [ebp - 0x884]
add esp, 0x10
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41459b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4145c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x218]
lea eax, [ebx + 0xe4a0]
push ecx
push str.FILE
mov ecx, eax
mov dword [ebp - 0x87c], eax
call fcn.0041c380
jmp 0x4145f0
lea eax, [ebx + 0xe4a0]
mov dword [ebp - 0x87c], eax
test byte [ebx + 0x18], 2
je 0x414620
lea ecx, [ebx + 0x4d8]
push 0x5f
call fcn.0041a780
lea eax, [ebx + 0x4d8]
test eax, eax
je 0x414610
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push str._InstallAfterCall_
lea eax, [ebp - 0x8a8]
mov dword [ebp - 0x8cc], 0x5f
push eax
mov ecx, edi
mov dword [ebp - 0x8c8], 0x63
mov dword [ebp - 0x8a8], 0
call fcn.00408d50
test eax, eax
je 0x4146af
push dword [ebx + 0xc]
lea ecx, [ebp - 0x8cc]
push 0
push ecx
push dword [ebp - 0x8a8]
mov ecx, ebx
push eax
call fcn.0040f630
push dword [ebp - 0x8a8]
cmp eax, 0x643
jne 0x41468f
mov ecx, edi
call fcn.0040b990
mov edi, 0x643
jmp 0x414876
mov ecx, dword [ebp - 0x890]
cmp eax, 0xbc2
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x890], ecx
mov ecx, edi
call fcn.0040b990
push 1
push str._UninstallBeforeCall_
lea eax, [ebp - 0x8b0]
mov dword [ebp - 0x8b0], 0
push eax
mov ecx, edi
call fcn.00408d50
mov dword [ebp - 0x884], eax
test eax, eax
je 0x414737
mov ebx, dword [ebp - 0x87c]
xor esi, esi
mov edi, eax
mov ecx, dword [ebp - 0x8b0]
add ecx, esi
push dword [ecx + 0x41c]
lea eax, [ecx + 0x208]
push 0
push dword [ecx + 0x418]
push dword [ecx + 0x414]
push dword [ecx + 0x410]
push eax
push ecx
mov ecx, ebx
call fcn.0041cd50
add esi, 0x420
sub edi, 1
jne 0x4146e2
push dword [ebp - 0x8b0]
mov edi, dword [ebp - 0x894]
mov ecx, edi
call fcn.0040b990
mov ebx, dword [ebp - 0x8c0]
push 1
push str._UninstallAfterCall_
lea eax, [ebp - 0x8b4]
mov dword [ebp - 0x8b4], 0
push eax
mov ecx, edi
call fcn.00408d50
mov dword [ebp - 0x884], eax
test eax, eax
je 0x4147c5
mov ebx, dword [ebp - 0x87c]
xor esi, esi
mov edi, eax
nop word [eax + eax]
mov ecx, dword [ebp - 0x8b4]
add ecx, esi
push dword [ecx + 0x41c]
lea eax, [ecx + 0x208]
push 1
push dword [ecx + 0x418]
push dword [ecx + 0x414]
push dword [ecx + 0x410]
push eax
push ecx
mov ecx, ebx
call fcn.0041cd50
add esi, 0x420
sub edi, 1
jne 0x414770
mov ebx, dword [ebp - 0x8c0]
push dword [ebp - 0x8b4]
lea edi, [ebx + 0x998]
mov ecx, edi
call fcn.0040b990
test byte [ebx + 0x18], 2
je 0x4147f5
lea esi, [ebx + 0x4d8]
push 0x63
mov ecx, esi
call fcn.0041a780
test esi, esi
jne 0x4147e2
xor eax, eax
jmp 0x4147e5
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x884]
mov ecx, edi
push eax
call fcn.0040d3c0
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.00415950
mov edx, dword [ebp - 0x884]
or esi, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414834
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test byte [ebx + 0x18], 2
je 0x414864
add ebx, 0x4d8
push 0x64
mov ecx, ebx
call fcn.0041a780
test ebx, ebx
jne 0x414851
xor eax, eax
jmp 0x414854
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x890], 0
je 0x414874
mov edi, 0xbc2
jmp 0x414876
xor edi, edi
mov edx, dword [ebp - 0x8c4]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414897
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x898]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4148b9
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005663a7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406af0
push 0x80004005
call fcn.00406af0
push 0x80004005
call fcn.00406af0
push 0x80004005
call fcn.00406af0
int3