Function at 0x40e0e0
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Delete registry key
Get file attributes
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba62a
mov eax, dword fs:[0]
push eax
sub esp, 0x52c
mov eax, dword [0x6877f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x104
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x474], 0
push 0
push eax
call fcn.0058db90
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0058db90
push 0x104
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.0058db90
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x480], esi
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x478], ebx
push 0x104
lea eax, [ebp - 0x424]
mov dword [ebp - 4], ebx
push ebx
push eax
mov byte [ebp - 0x46d], bl
call fcn.0058db90
lea eax, [ebp - 0x424]
push 0x103
push eax
call fcn.0059c13d
add esp, 0x38
mov byte [ebp - 4], 1
cmp byte [0x68defe], 1
jne 0x40e283
mov ecx, 0x68df38
call fcn.00403070
push 0x68e44c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e1d5
push 0x68e44c
mov ecx, 0x68df38
call fcn.004044e0
cmp byte [0x68defc], 0
jne 0x40e1f8
push ecx
mov ecx, 0x68df38
call fcn.00403130
test eax, eax
je 0x40e1f8
push 0x68e85c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ecx
mov ecx, 0x68df38
call fcn.00403010
push 0x68e140
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e239
push 0x68e140
push str.common.Cleanup_common.PathToOutputResult:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push 0x68e140
call fcn.004044e0
cmp byte [0x68defc], 0
jne 0x40eaaf
push ecx
mov ecx, 0x68df38
call fcn.00403190
push 0x68e348
push str.common.Cleanup_common.PathToInstalledComponents:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push 0x68e348
call fcn.004044e0
mov dword [ebp - 4], 0
jmp 0x40eb01
cmp byte [0x68defc], 0
jne 0x40e2d5
cmp byte [0x68df00], 1
jne 0x40e29f
mov ecx, 0x68df38
call fcn.00405ad0
push 0x671cd4
push str.Providers
push str.SystemCurrentControlSetServicesCtesHostSvc
lea eax, [ebp - 0x21c]
push 0x671ce4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x21c]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x672210
push 0x672210
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x40e360
push 0x671cd4
push str.Providers
push str.SystemCurrentControlSetServicesCtesHostSvc
lea eax, [ebp - 0x21c]
push 0x671ce4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x474]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x21c]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e360
push dword [ebp - 0x474]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40e360
lea eax, [ebp - 0x21c]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x672210
push 0x672210
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40e383
push 0
push ecx
mov ecx, 0x68df38
call fcn.00405900
jmp 0x40e3ab
push 0x672204
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40e3ab
push 0x672204
call fcn.0040d840
push 0x672204
push 0x672210
call fcn.004041c0
cmp byte [0x68defd], 0
je 0x40e3de
push 0x671c3e
call fcn.004054e0
test eax, eax
je 0x40e3de
call fcn.00405e20
movzx ecx, byte [ebp - 0x46d]
test eax, eax
mov edx, 1
cmove ecx, edx
mov byte [ebp - 0x46d], cl
push 0
push 0x671c3e
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0xf
mov byte [ebp - 0x46c], 0
call fcn.0040a020
mov byte [ebp - 4], 2
cmp dword [ebp - 0x45c], 0
je 0x40e444
push 0x671c3e
call fcn.0040d840
test eax, eax
jne 0x40e444
push 0x671c3e
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40e444
push 0x671c3e
push 0x671c3e
call fcn.004041c0
push 0
push 0x671c3e
lea ecx, [ebp - 0x46c]
call fcn.0040a020
cmp dword [ebp - 0x45c], 0
je 0x40e469
push 0x671c3e
call fcn.0040d840
push 0x671c3e
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40e7ab
cmp byte [0x68defc], 0
jne 0x40e7ab
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0xf
mov byte [ebp - 0x454], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x43c]
push 0
push 0x671c3e
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0xf
mov byte [ebp - 0x43c], 0
call fcn.0040a020
mov dword [ebp - 0x538], 0x672380
mov dword [ebp - 0x528], 0x67234c
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
push 0
lea eax, [ebp - 0x520]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x538]
mov dword [ebp - 0x474], 1
call fcn.0040a7e0
lea eax, [ebp - 0x528]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x528]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x52c], eax
mov eax, dword [ebp - 0x538]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0x53c], eax
mov dword [ebp - 4], 9
mov eax, dword [ebp - 0x538]
push 3
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x538]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x53c], eax
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x520]
call fcn.0040a600
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x428]
cmp edx, 0x10
jb 0x40e5f1
mov ecx, dword [ebp - 0x43c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e5e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee1b
push edx
push ecx
call fcn.00575155
add esp, 8
push 0x3b
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x538]
push eax
call fcn.0040d050
add esp, 0xc
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x40e67c
lea eax, [ebp - 0x454]
push eax
cmp ebx, edi
je 0x40e632
mov ecx, edi
call fcn.00406fb0
add edi, 0x18
mov dword [ebp - 0x47c], edi
jmp 0x40e650
push edi
lea ecx, [ebp - 0x480]
call fcn.00410640
mov ebx, dword [ebp - 0x478]
mov edi, dword [ebp - 0x47c]
mov esi, dword [ebp - 0x480]
cmp dword [ebp - 0x440], 0x10
lea eax, [ebp - 0x454]
cmovae eax, dword [ebp - 0x454]
push eax
push str.preuninstall.push_back:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
jmp 0x40e5f1
mov ecx, edi
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 3
jne 0x40e762
push ecx
mov ecx, 0x68df38
call fcn.00403190
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x40e6af
mov eax, dword [esi]
push eax
push 0x68e348
lea eax, [ebp - 0x118]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esi + 0x18]
cmp dword [esi + 0x2c], 0x10
jb 0x40e6d6
mov ecx, dword [esi + 0x18]
push ecx
push 0x68e348
lea eax, [ebp - 0x320]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x320]
push 0
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40e762
cmp dword [esi + 0x44], 0x10
lea ecx, [esi + 0x30]
jb 0x40e716
mov ecx, dword [ecx]
cmp dword [esi + 0x2c], 0x10
lea eax, [esi + 0x18]
jb 0x40e721
mov eax, dword [eax]
push ecx
push eax
push 0x68e348
push str._s_s__s
lea eax, [ebp - 0x320]
push 0x104
push eax
call fcn.00402f90
lea eax, [ebp - 0x320]
push eax
push str.run_cmd:__s
push 0x68df38
call fcn.00406510
add esp, 0x24
push 0x1388
push eax
call fcn.00405840
lea ecx, [ebp - 0x538]
call fcn.00404060
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x440]
cmp edx, 0x10
jb 0x40e7ab
mov ecx, dword [ebp - 0x454]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e7a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee20
push edx
push ecx
call fcn.00575155
add esp, 8
push 0
push 0x671c3e
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0xf
mov byte [ebp - 0x43c], 0
call fcn.0040a020
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x42c], 0
je 0x40e845
push ecx
push 0x671c3e
mov ecx, 0x68df38
call fcn.00405eb0
push ecx
mov ecx, 0x68df38
call fcn.00403190
push 0x671c3e
push 0x68e348
lea eax, [ebp - 0x118]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x118]
push eax
push str.DeleteFile_EXTERNAL_APP:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
push 0x671c3e
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40e8b4
push ecx
push 0x671c3e
mov ecx, 0x68df38
call fcn.00405eb0
push ecx
mov ecx, 0x68df38
call fcn.00403190
push 0x671c3e
push 0x68e348
lea eax, [ebp - 0x118]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x118]
push eax
push str.DeleteFile_EXTERNAL_COMPONENTS:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
push ecx
mov ecx, 0x68df38
call fcn.00403010
push 0x68e140
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e8f5
push 0x68e140
push str.common.Cleanup_common.PathToOutputResult:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push 0x68e140
call fcn.004044e0
push ecx
mov ecx, 0x68df38
call fcn.00403190
push 0x68e348
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ea33
push 0x68e348
lea eax, [ebp - 0x118]
push str._sTemp
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e964
lea eax, [ebp - 0x118]
push eax
push str.common.Cleanup_Temp:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push eax
call fcn.004044e0
push 0x68e348
lea eax, [ebp - 0x118]
push str._sLogs
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e9b4
lea eax, [ebp - 0x118]
push eax
push str.common.Cleanup_Logs:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push eax
call fcn.004044e0
push 0x68e348
lea eax, [ebp - 0x118]
push str._simages
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ea04
lea eax, [ebp - 0x118]
push eax
push str.common.Cleanup_images:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push eax
call fcn.004044e0
cmp byte [0x68defc], 0
jne 0x40ea33
push 0x68e348
push str.common.Cleanup_common.PathToInstalledComponents:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push 0x68e348
call fcn.004044e0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x428]
cmp edx, 0x10
jb 0x40ea71
mov ecx, dword [ebp - 0x43c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ea67
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee25
push edx
push ecx
call fcn.00575155
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x458]
cmp edx, 0x10
jb 0x40eaaf
mov ecx, dword [ebp - 0x46c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eaa5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee2a
push edx
push ecx
call fcn.00575155
add esp, 8
mov dword [ebp - 4], 0
jmp 0x40eb01
cmp byte [0x68defc], 0
jne 0x40eb99
mov byte [ebp - 4], 0xe
cmp byte [0x68defe], 0
jne 0x40eb92
push ecx
mov ecx, 0x68df38
call fcn.00403190
mov dword [ebp - 0x474], 3
push 0x68e348
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40eb92
push 0x68e348
push str.common.Cleanup_common.PathToInstalledComponents1:__s
push 0x68df38
call fcn.00406510
add esp, 0xc
mov ecx, 0x68df38
push 0x68e348
call fcn.004044e0
push 0x68e348
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40eb92
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
test eax, eax
jg 0x40eb30
mov dword [ebp - 4], 0
cmp byte [ebp - 0x424], 0
je 0x40ebc7
lea eax, [ebp - 0x424]
push eax
call fcn.0059b6a7
lea eax, [ebp - 0x424]
push eax
push str._chdir:__s
push 0x68df38
call fcn.00406510
add esp, 0x10
cmp byte [ebp - 0x46d], 0
je 0x40ec84
lea eax, [ebp - 0x118]
push str.shutdown__r__f__t_2
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea eax, [ebp - 0x118]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
test esi, esi
je 0x40ec7a
lea eax, [ebp - 0x480]
push eax
push edi
push esi
call fcn.00410910
sub ebx, esi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40ec70
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee2f
jmp 0x40ec70
push ecx
push esi
call fcn.00575155
add esp, 8
mov eax, 1
jmp 0x40edfd
cmp byte [0x68defc], 0
jne 0x40ebf8
cmp byte [0x68def8], 0
jne 0x40ec9f
call fcn.004064d0
cmp byte [0x68defe], 0
je 0x40ed7f
mov ecx, 0x68df38
call fcn.00403070
test eax, eax
jne 0x40ed17
test esi, esi
je 0x40ed10
lea eax, [ebp - 0x480]
push eax
push edi
push esi
call fcn.00410910
sub ebx, esi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40ed06
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee2f
push ecx
push esi
call fcn.00575155
add esp, 8
xor eax, eax
jmp 0x40edfd
push 1
push ecx
push 0x68e44c
call fcn.004032f0
mov dword [ebp - 0x474], eax
test esi, esi
je 0x40edfd
lea eax, [ebp - 0x480]
push eax
push edi
push esi
call fcn.00410910
sub ebx, esi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40eded
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40eded
jmp 0x40ee2f
push ecx
mov ecx, 0x68df38
call fcn.00403190
test eax, eax
je 0x40ecba
push 1
push ecx
push 0x68e348
call fcn.004032f0
mov dword [ebp - 0x474], eax
test esi, esi
je 0x40edfd
lea eax, [ebp - 0x480]
push eax
push edi
push esi
call fcn.00410910
sub ebx, esi
mov eax, 0x2aaaaaab
imul ebx
add esp, 0xc
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x40eded
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ee2f
push ecx
push esi
call fcn.00575155
mov eax, dword [ebp - 0x474]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00574c7a
mov esp, ebp
pop ebp
ret 8
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
call fcn.0059b248
int3