Function at 0x403e80
Capabilities:
Delete file
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b5ba
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437ae4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ecx, dword [0x43bb98]
xor edi, edi
cmp ecx, edi
je 0x403ec5
mov eax, dword [ecx]
mov edx, dword [eax + 0x164]
push 1
call edx
push 0x42fd24
lea ecx, [esp + 0x1c]
call fcn.00401590
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x7c], edi
call fcn.00404410
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x403f96
push str.Setup.dat
lea ecx, [esp + 0x28]
push 0x43bba0
push ecx
call fcn.004059c0
add esp, 0xc
lea ecx, [esp + 0x44]
mov byte [esp + 0x78], 1
call fcn.00407e0f
lea ecx, [esp + 0x58]
mov byte [esp + 0x78], 2
call fcn.00407e0f
lea edx, [esp + 0x44]
mov byte [esp + 0x78], 3
push edx
lea esi, [esp + 0x30]
lea ecx, [esp + 0x28]
mov dword [esp + 0x30], edi
call fcn.00402130
mov esi, eax
cmp esi, edi
je 0x403fd4
cmp dword [0x43bb9c], edi
jne 0x403f57
mov eax, dword [esp + 0x2c]
mov dword [0x43bb9c], eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x7c], 1
call fcn.004043b0
mov byte [esp + 0x78], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403fbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00407d39
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x403fee
push 0x80004005
call fcn.00401230
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
push str.Setup.exe
mov byte [esp + 0x7c], 4
mov ecx, dword [0x43bba0]
push str.NSU3
push ecx
lea edx, [esp + 0x28]
push str._s_s_s
push edx
call fcn.00402110
mov ecx, dword [esp + 0x30]
add esp, 0x14
push edi
push edi
push edi
push edi
push edi
push edi
push 3
lea eax, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x38], 0
mov word [esp + 0x39], di
call fcn.00415b68
add esp, 0x24
call fcn.00407d39
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x404064
push 0x80004005
call fcn.00401230
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push 0x430f8c
push edx
mov byte [esp + 0x84], 5
call fcn.00402110
mov ebp, dword [esp + 0x34]
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push ebp
mov esi, eax
push esi
push str.execInstall_:__d__GetDriveType__s__
push 4
call fcn.00401920
add esp, 0x10
push 0x42fd24
lea ecx, [esp + 0x24]
call fcn.00401590
cmp esi, 5
mov bl, 6
mov byte [esp + 0x78], bl
jne 0x40421e
push str.NSU3
lea eax, [esp + 0x30]
push 0x43bba0
push eax
call fcn.004059c0
add esp, 0xc
lea ecx, [esp + 0x20]
lea edi, [esp + 0x2c]
mov byte [esp + 0x78], 7
call fcn.00404f50
mov esi, eax
test esi, esi
je 0x4041db
cmp dword [0x43bb9c], 0
jne 0x404114
mov dword [0x43bb9c], 0xffff8ac2
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [esp + 0x78], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x78], 5
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404168
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x78], 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404189
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x78], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x7c], 1
call fcn.004043b0
mov byte [esp + 0x78], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x403f8a
mov ecx, dword [esp + 0x20]
push str.Setup.exe
push ecx
lea edx, [esp + 0x24]
push str._s_s
push edx
call fcn.00402110
mov byte [esp + 0x88], bl
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40421e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x30]
call fcn.00407e0f
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0x7c], 8
call fcn.00407f46
lea edi, [esp + 0x18]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x1c]
call fcn.00405470
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], 0
mov esi, eax
je 0x404260
lea ecx, [esp + 0x20]
call fcn.00405170
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x404281
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], bl
call fcn.00407e26
jmp 0x404143
mov ecx, dword [0x43bb98]
test ecx, ecx
je 0x404297
mov edx, dword [ecx]
mov eax, dword [edx + 0x164]
push 3
call eax
mov ecx, dword [0x43bba0]
push str.Disk1Setup.exe
push 0x4301e8
push ecx
lea edx, [esp + 0x28]
push str._s_s_s
push edx
call fcn.00402110
add esp, 0x14
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x34]
call fcn.00407f46
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x20]
call fcn.00405690
mov esi, eax
add esp, 4
test esi, esi
je 0x40432d
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], bl
call fcn.00407e26
lea ecx, [esp + 0x20]
call fcn.00401570
lea ecx, [esp + 0x28]
call fcn.00401570
lea ecx, [esp + 0x1c]
call fcn.00401570
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x7c], 1
call fcn.004043b0
lea ecx, [esp + 0x24]
call fcn.00401570
lea ecx, [esp + 0x18]
call fcn.00401570
jmp 0x403fbe
mov ecx, dword [0x43bb98]
test ecx, ecx
je 0x404343
mov eax, dword [ecx]
mov edx, dword [eax + 0x164]
push 4
call edx
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], bl
call fcn.00407e26
lea ecx, [esp + 0x20]
call fcn.00401570
lea ecx, [esp + 0x28]
call fcn.00401570
lea ecx, [esp + 0x1c]
call fcn.00401570
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x7c], 1
call fcn.004043b0
lea ecx, [esp + 0x24]
call fcn.00401570
lea ecx, [esp + 0x18]
call fcn.00401570
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret