Function at 0x4014b9
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Parse pe header
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
push ebx
push esi
xor esi, esi
push edi
mov byte [ebp - 0x518], 0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
push 0x104
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401521
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName___failed____u_n
call fcn.0040107c
pop ecx
pop ecx
mov dword [0x404004], 0xff
jmp 0x40170f
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp word [eax], 0x5a4d
jne 0x4016eb
cmp dword [ecx], 0x4550
jne 0x4016eb
movzx ebx, word [ecx + 6]
test ebx, ebx
movzx eax, word [ecx + 0x14]
lea edi, [eax + ecx + 0x18]
jbe 0x401580
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
push 8
mov edx, str..tsustub
call fcn.00401042
test eax, eax
je 0x401575
add dword [ebp - 4], 0x28
inc esi
cmp esi, ebx
jb 0x401557
jmp 0x401580
imul esi, esi, 0x28
mov esi, dword [esi + edi + 0x14]
test esi, esi
jne 0x40159a
push str.Executable_has_no_.tsustub_section_n
call fcn.0040107c
pop ecx
mov dword [0x404004], 0xfe
jmp 0x40170f
lea eax, [ebp - 0x518]
push eax
push 0x408
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4015c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempPath___failed____u_n
jmp 0x40150b
cmp byte [ebp - 0x518], 0
lea eax, [ebp - 0x518]
je 0x4015d6
inc eax
cmp byte [eax], 0
jne 0x4015d0
movzx edx, word [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
shr ecx, 0x10
xor ecx, edx
push ecx
push str.Tsu__04X.dll
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x518]
push eax
push 0xffffffffffffffff
push 0xffff000e
push esi
lea eax, [ebp - 0x110]
push eax
call fcn.004010c1
test eax, eax
je 0x401637
lea ecx, [ebp - 0x518]
push ecx
push eax
push str.Error__u_while_extracting_TSU.DLL_to__s_n
call fcn.0040107c
add esp, 0xc
mov dword [0x404004], 0xf9
jmp 0x40170f
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 4], eax
jne 0x401675
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x518]
push ecx
push eax
push str.Error__u_while_loading_TSU.DLL__s_n
call fcn.0040107c
add esp, 0xc
mov dword [0x404004], 0xf9
jmp 0x401700
push str._TsuRunInstallerA_8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x40169c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x518]
push ecx
push eax
push str.Error__u_while_retrieving_TsuRunInstaller___entry_point_from__s_n
jmp 0x40165e
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x20
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004013e4
mov esi, eax
test esi, esi
mov dword [ebp - 8], eax
je 0x4016cd
cmp byte [esi], 0
je 0x4016cd
inc eax
cmp byte [eax], 0
jne 0x4016c7
lea ecx, [ebp - 0x110]
push ecx
push str.__d:__s_
push eax
call edi
add esp, 0xc
push 0
push esi
call ebx
mov dword [0x404004], eax
jmp 0x401700
push str.Executable_has_no_valid_MZ_signature_n
call fcn.0040107c
pop ecx
mov dword [0x404004], 0xfe
cmp dword [ebp - 4], 0
je 0x40170f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x518], 0
je 0x401768
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401768
and eax, 0xfffffffa
push eax
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0xa
pop esi
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401768
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x401768
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x40173e
mov ecx, dword [ebp - 8]
call fcn.00401010
push dword [0x404004]
call dword [sym.imp.KERNEL32.dll_ExitProcess]