Function at 0x406860
Capabilities:
Copy file
Create process on windows
Get disk size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [0x424008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x4036d0
push dword [0x425188]
push 0x71
push dword [0x425184]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x406b0c
push 0xff
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0040bcd0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x72c], ax
mov byte [ebp - 0x72a], al
lea eax, [ebp - 0x72c]
push 2
push 0x425854
push eax
call fcn.0040d140
add esp, 0xc
cmp byte [ebp - 0x72b], 0x3a
je 0x406920
push 0x425854
lea eax, [ebp - 0x110]
push 0x421480
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x42564c
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x738]
push eax
push 0
lea eax, [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x406963
mov edx, dword [ebp - 0x738]
mov eax, dword [ebp - 0x734]
mov ecx, dword [ebp - 0x740]
shrd edx, eax, 0x14
mov eax, dword [ebp - 0x73c]
shrd ecx, eax, 0x14
jmp 0x40696f
mov ecx, dword [ebp - 0x744]
mov edx, dword [ebp - 0x748]
mov eax, dword [0x425524]
xor edi, edi
mov esi, dword [eax*8 + 0x425528]
mov eax, dword [eax*8 + 0x42552c]
cmp edi, eax
ja 0x4069b1
jb 0x40698e
cmp ecx, esi
jae 0x4069b1
push eax
push esi
push edx
push ecx
push 0x425854
lea eax, [ebp - 0x110]
push 0x4214a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
jmp 0x4068f7
cmp byte [0x425958], 0
lea eax, [ebp - 0x318]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x42564c
je 0x4069d2
push 0x425958
jmp 0x4069d7
push 0x425548
push 0x425854
push str._s_s_s
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x406a5b
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x520]
push 0x4214fc
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x520]
push 0x24
push 0x42564c
push eax
push dword [0x425188]
call ebx
cmp eax, 6
jne 0x406b0c
lea ecx, [ebp - 0x318]
call fcn.00408150
test eax, eax
jne 0x406a5b
push 0x30
push 0x42564c
push 0x421530
push dword [0x425188]
jmp 0x406b0a
mov eax, dword [0x425180]
test eax, eax
je 0x406a71
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x425180], edi
push str.Setup.exe
push 0x42520c
lea eax, [ebp - 0x420]
push 0x420870
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x110]
cmp byte [0x425958], 0
push str.Setup.exe
push 0x42564c
je 0x406aac
push 0x425958
jmp 0x406ab1
push 0x425548
push 0x425854
push str._s_s_s_s
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x110]
push 0
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
lea eax, [ebp - 0x110]
jne 0x406b1f
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x728]
push 0x421420
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x728]
push 0x30
push 0x42564c
push eax
push 0
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00406580
lea edi, [ebp - 0x318]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x406b37
mov ax, word [0x420894]
lea ecx, [ebp - 0x318]
mov word [edi], ax
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x406b51
mov eax, dword [str.Setup.exe]
mov dword [ecx], eax
mov eax, dword [0x420e94]
mov dword [ecx + 4], eax
mov ax, word [0x420e98]
mov word [ecx + 8], ax
lea ecx, [ebp - 0x318]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x406b80
mov eax, dword [str._Install]
mov edx, 0x42520c
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x4215d0]
mov dword [ecx + 4], eax
mov ax, word [0x4215d4]
mov word [ecx + 8], ax
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x406bb0
lea edi, [ebp - 0x318]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406bc0
mov ecx, edx
lea eax, [ebp - 0x318]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 5
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x406bfb
push 0x30
push 0x42564c
push 0x42138c
jmp 0x406b08
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aa0f
mov esp, ebp
pop ebp
ret