Function at 0x406600
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427d66
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x438130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [edi + 0x20]
call fcn.00418200
push eax
lea ecx, [ebp - 0x14]
call fcn.004061f0
push dword [edi + 0x24]
mov dword [ebp - 4], 0
call fcn.00418200
push eax
lea ecx, [ebp - 0x18]
call fcn.004061f0
mov eax, dword [0x43a9c4]
mov byte [ebp - 4], 1
test al, 1
jne 0x406687
or eax, 1
mov dword [0x43a9c4], eax
mov ecx, 0x43a990
mov byte [ebp - 4], 2
call fcn.004077e0
push 0x429090
call fcn.00418853
add esp, 4
mov byte [ebp - 4], 1
mov ecx, 0x43a990
call fcn.00408c40
test eax, eax
je 0x4066b6
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 4
push str.InstallerJob:_file_s_params_s
push eax
call fcn.00407b90
add esp, 0x10
mov eax, dword [ebp - 0x14]
or ebx, 0xffffffff
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x406a77
cmp ecx, 0x104
jg 0x406a77
mov ecx, dword [ebp - 0x18]
cmp dword [ecx - 0xc], 0x104
jg 0x406a77
cmp dword [edi + 0x38], ebx
je 0x406a77
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401380
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x1c]
test eax, eax
mov ecx, ebx
sete byte [ebp - 0xe]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406720
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xe], 0
je 0x40676d
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406a7c
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push str.InstallerJob:___s__not_found__0x_x_
push eax
mov dword [ebp - 0x1c], 0xfffffffe
call fcn.00407b90
add esp, 0x10
jmp 0x406a7c
push dword [ebp - 0x14]
call fcn.00405d40
add esp, 4
test al, al
jne 0x4067f0
mov eax, dword [ebp - 0x14]
mov ecx, 0x43aa20
push 1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0xc8
push 2
push 1
call fcn.0040f5a0
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x4067c9
push dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push str.InstallerJob:___s__is_not_signed.
push eax
mov dword [ebp - 0x24], 0xffffffff
call fcn.00407b90
add esp, 0xc
push dword [0x43acc0]
push 0
push 0x42d824
push 0
push 0
push 0x200
push 0x42b12c
call fcn.00401fb0
mov esi, eax
jmp 0x406a7c
push str.Skype_Technologies_SA
push dword [ebp - 0x14]
call fcn.00405e00
add esp, 8
test al, al
jne 0x406890
push str.Skype_Software_Sarl
push dword [ebp - 0x14]
call fcn.00405e00
add esp, 8
test al, al
jne 0x406890
mov eax, dword [ebp - 0x14]
mov ecx, 0x43aa20
push 1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0xc8
push 2
push 1
call fcn.0040f5a0
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406869
push dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push str.InstallerJob:___s__has_invalid_signature.
push eax
mov dword [ebp - 0x24], 0xffffffff
call fcn.00407b90
add esp, 0xc
push dword [0x43acc0]
push 0
push 0x42d824
push 0
push 0
push 0x200
push 0x42b12c
call fcn.00401fb0
mov esi, eax
jmp 0x406a7c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], 0x42b240
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 3
push eax
push dword [edi + 0x38]
call fcn.0040cc60
add esp, 8
test al, al
jne 0x40690a
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406a6d
push esi
push dword [edi + 0x38]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push str.InstallerJob:_failed_to_GetUserTokenFromSessionId__d__0x_x_
push eax
mov dword [ebp - 0x24], 0xfffffffe
call fcn.00407b90
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.004062d0
jmp 0x406a7c
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004174f0
mov esi, eax
add esp, 8
test esi, esi
js 0x406a6d
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406968
cmp byte [ebp - 0xd], 0
mov ecx, str.system
mov dword [ebp - 0x28], eax
mov eax, str.normal
cmove eax, ecx
mov dword [ebp - 0x24], 2
push eax
push dword [edi + 0x38]
lea eax, [ebp - 0x28]
push str.InstallerJob:_run_installer_in_session__d_as__s_user.
push eax
call fcn.00407b90
add esp, 0x10
cmp byte [ebp - 0xd], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
je 0x4069ce
lea eax, [ebp - 0x38]
push eax
call fcn.0040aa80
add esp, 0xc
test al, al
jne 0x406a1a
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406a6d
push esi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push str.InstallerJob:_failed_to_CreateElevatedProcessAsConsoleUser__0x_x_
push eax
mov dword [ebp - 0x24], 0xfffffffe
call fcn.00407b90
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.004062d0
jmp 0x406a7c
push dword [edi + 0x38]
call fcn.0040a920
add esp, 0xc
test al, al
jne 0x406a1a
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406a6d
push esi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push str.InstallerJob:_failed_to_CreateElevatedProcessAsLocalSystemUser__0x_x_
push eax
mov dword [ebp - 0x24], 0xfffffffe
call fcn.00407b90
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.004062d0
jmp 0x406a7c
push 4
push 0
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406a6b
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x406a6d
push esi
push dword [edi + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push str.InstallerJob:_failed_to_move_file__s__0x_x_
push eax
mov dword [ebp - 0x24], 0xfffffffe
call fcn.00407b90
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.004062d0
jmp 0x406a7c
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.004062d0
jmp 0x406a7c
mov esi, 0x80070057
mov edx, dword [ebp - 0x18]
mov ecx, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406a9c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x14]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x406abd
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret