Function at 0x404e40
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46caa1
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push esi
push edi
mov eax, dword [0x495574]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp + 8]
call fcn.004143a0
mov edx, 0x8664
mov dword [ebp - 0x28], eax
cmp cx, dx
je 0x404ec1
mov edx, 0xaa64
cmp cx, dx
je 0x404eb8
push eax
push str.Error:_unspported_platform__s
push dword [ebp + 0xc]
call fcn.00403a80
add esp, 0xc
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x51bee0
jmp 0x404ec8
mov dword [ebp - 0x14], 0x4adee0
lea ecx, [ebp - 0x20]
call fcn.0040e910
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
call fcn.0040e070
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x404f29
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x4051c8
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4051c8
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
call fcn.00437bed
mov ecx, eax
test ecx, ecx
je 0x4051d1
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x471758
jne 0x4051db
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
lea edx, [edi + 1]
mov dword [ebp - 0x24], 1
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
test edx, edx
js 0x4051e2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x404f97
push edx
lea ecx, [ebp + 8]
call fcn.00404670
mov esi, dword [ebp + 8]
lea edx, [edi + 1]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp edi, 0xffffffff
jne 0x404fb2
push dword [esi - 8]
push esi
call fcn.004541f2
add esp, 8
mov edi, eax
test edi, edi
js 0x4051e2
cmp edi, dword [esi - 8]
jg 0x4051e2
mov dword [esi - 0xc], edi
lea ecx, [ebp - 0x10]
xor eax, eax
mov edx, esi
mov word [esi + edi*2], ax
push dword [ebp - 0x1c]
call fcn.0040e2b0
add esp, 4
or edi, 0xffffffff
mov byte [ebp - 4], 5
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x405023
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x471758
jne 0x4051ec
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4051ec
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x28]
test edx, edx
jne 0x40502e
xor ecx, ecx
jmp 0x405042
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405033
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x10]
call fcn.00403d30
push 4
push str..exe
lea ecx, [ebp - 0x10]
call fcn.00403d30
mov edx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00404c90
push 0x44
mov byte [ebp + 0xb], al
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0044e9c0
or dword [ebp - 0x58], 1
add esp, 0x10
cmp byte [ebp + 0xb], 0
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x84], 0x44
mov word [ebp - 0x54], ax
movups xmmword [ebp - 0x40], xmm0
je 0x405106
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405106
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x40]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x18]
jmp 0x405118
mov ecx, dword [ebp + 0xc]
push 0x33
push str.Error:_cannot_start_64_bit_version_of_the_installer
call fcn.004041d0
or esi, 0xffffffff
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x40515f
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, 0x471758
jne 0x4051f3
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4051f3
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4051b5
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, 0x471758
jne 0x4051fc
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4051fc
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
jmp 0x404f29
push 0x80004005
call fcn.00404830
call edx
jmp 0x404f5f
push 0x80070057
call fcn.00404830
call edx
jmp 0x405023
mov ecx, edx
call edi
jmp 0x40515f
mov ecx, edx
call edi
jmp 0x4051b5