Function at 0x4025bc
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
push edi
mov dword [ebp - 0x574], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
jne 0x402622
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xa30], eax
push 0
push str.Error
push str.Cannot_open_self.
push dword [ebp + 0xc]
call sub.USER32.DLL_MessageBoxA
mov eax, 0xffffffff
jmp 0x402b5c
push 2
push 0
push 0
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
push 1
push 0
push 0
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xa2c], eax
sub dword [ebp - 0xa2c], 8
push 0
push 0
push dword [ebp - 0xa2c]
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 0x574]
push edi
push 8
lea edi, [ebp - 0xa24]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0xa20], 0x2222
je 0x4026ad
push 0
push str.Error
push str.Not_linked_with_install_package.
push dword [ebp + 0xc]
call sub.USER32.DLL_MessageBoxA
mov eax, 0xffffffff
jmp 0x402b5c
push 0
push 0
push dword [ebp - 0xa24]
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 0x574]
push edi
push 0x254
lea edi, [ebp - 0x918]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
lea edi, [ebp - 0x8c8]
push edi
push 0x3eb
push dword [ebp + 0xc]
call sub.USER32.DLL_SetDlgItemTextA
lea edi, [ebp - 0x908]
push edi
push dword [ebp + 0xc]
call sub.USER32.DLL_SetWindowTextA
lea edi, [ebp - 0x8c8]
push edi
push 0x404530
call sub.CRTDLL.DLL_strcpy
add esp, 8
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_CloseHandle
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
jne 0x402776
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 0xa30], eax
push 0
push str.Error
push str.Cannot_open_self.
push dword [ebp + 0xc]
call sub.USER32.DLL_MessageBoxA
mov eax, 0xffffffff
jmp 0x402b5c
push 2
push 0
push 0
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
push 1
push 0
push 0
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xa28], eax
sub dword [ebp - 0xa28], 8
push 0
push 0
push dword [ebp - 0xa28]
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 0x574]
push edi
push 8
lea edi, [ebp - 0xa24]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
cmp dword [ebp - 0xa20], 0x2222
je 0x402801
push 0
push str.Error
push str.Not_linked_with_install_package.
push dword [ebp + 0xc]
call sub.USER32.DLL_MessageBoxA
mov eax, 0xffffffff
jmp 0x402b5c
push 0
push 0
push dword [ebp - 0xa24]
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edi, [ebp - 0x574]
push edi
push 0x254
lea edi, [ebp - 0x918]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 0x6c4], 0
jmp 0x402868
push 0
lea edi, [ebp - 0x574]
push edi
push 0x248
lea edi, [ebp - 0xc78]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
inc dword [ebp - 0x6c4]
mov edi, dword [ebp - 0x90c]
cmp dword [ebp - 0x6c4], edi
jb 0x402842
mov dword [ebp - 0x6c4], 0
jmp 0x4028a5
push 0
lea edi, [ebp - 0x574]
push edi
push 0x40
lea edi, [ebp - 0xa1c]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
inc dword [ebp - 0x6c4]
mov edi, dword [ebp - 0x910]
cmp dword [ebp - 0x6c4], edi
jb 0x402882
push 1
push 0
push 0
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0x91c], 0
jmp 0x402b39
push 0
lea edi, [ebp - 0x574]
push edi
push 0x44
lea edi, [ebp - 0x6c0]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
mov dword [ebp - 0x67c], 0
jmp 0x402b21
push 0
lea edi, [ebp - 0x574]
push edi
push 0x104
lea edi, [ebp - 0x570]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
lea edi, [ebp - 0x678]
push edi
lea edi, [ebp - 0x570]
push edi
call fcn.00401ec0
add esp, 8
mov dword [ebp - 0x46c], 0
jmp 0x402b09
push 0
lea edi, [ebp - 0x574]
push edi
push 0x360
lea edi, [ebp - 0x360]
push edi
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_ReadFile
lea edi, [ebp - 0x120]
push edi
lea edi, [ebp - 0x120]
push edi
call fcn.00401ec0
add esp, 8
lea edi, [ebp - 0x678]
push edi
lea edi, [ebp - 0x464]
push edi
call sub.CRTDLL.DLL_strcpy
add esp, 8
push 0x405683
lea edi, [ebp - 0x464]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x360]
push edi
lea edi, [ebp - 0x464]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
test dword [ebp - 0x1c], 0x80
je 0x402af1
lea edi, [ebp - 0x464]
push edi
call sub.KERNEL32.DLL_DeleteFileA
push dword [ebp + 0xc]
push dword [ebp - 0x468]
lea edi, [ebp - 0x464]
push edi
lea edi, [ebp - 0x360]
push edi
call fcn.0040337a
add esp, 0x10
cmp eax, 0
jne 0x402a14
push 1
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
jmp 0x402b03
lea edi, [ebp - 0x464]
push edi
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0xa38], 0
jne 0x402a42
push 0
push str.Error
push str.unable_to_load_module.
push 0
call sub.USER32.DLL_MessageBoxA
push str.ClearInstallerHook
push dword [ebp - 0xa38]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 0
jne 0x402a79
push 0
push str.Error
push str.unable_to_find_hook_function.
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x402b03
lea edi, [ebp - 0xa78]
push edi
push 0
push 0x3f2
call dword [ebp - 0xa34]
add esp, 0xc
cmp eax, 0
je 0x402ac3
mov edi, dword [ebp - 0xa38]
mov dword [0x404308], edi
mov edi, dword [ebp - 0xa34]
mov dword [0x40463c], edi
lea edi, [ebp - 0x464]
push edi
push 0x404420
call sub.CRTDLL.DLL_strcpy
add esp, 8
jmp 0x402b03
mov edi, dword [ebp - 0xa38]
mov dword [0x404414], edi
mov edi, dword [ebp - 0xa34]
mov dword [0x404304], edi
lea edi, [ebp - 0x464]
push edi
push 0x404310
call sub.CRTDLL.DLL_strcpy
add esp, 8
jmp 0x402b03
push 1
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_SetFilePointer
inc dword [ebp - 0x46c]
mov edi, dword [ebp - 0x470]
cmp dword [ebp - 0x46c], edi
jb 0x40294a
inc dword [ebp - 0x67c]
mov edi, dword [ebp - 0x680]
cmp dword [ebp - 0x67c], edi
jb 0x402905
inc dword [ebp - 0x91c]
mov edi, dword [ebp - 0x910]
cmp dword [ebp - 0x91c], edi
jb 0x4028d9
push dword [ebp - 0x468]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x918]
pop edi
leave
ret