Function at 0x40af40
Capabilities:
Read file on windows
Set environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529d39
mov eax, dword fs:[0]
push eax
mov eax, 0x4264
call fcn.0050b1c0
mov eax, dword [0x58c920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.install_test.exe]
mov ecx, dword [0x53fdcc]
mov edx, dword [0x53fdd0]
mov edi, dword [ebp + 0xc]
mov dword [0x58e238], eax
mov eax, dword [0x53fdd4]
mov dword [0x58e244], eax
mov eax, dword [ebp + 8]
mov dword [0x58e23c], ecx
mov cl, byte [0x53fdd8]
xor ebx, ebx
mov dword [0x58e240], edx
mov byte [0x58e248], cl
cmp eax, 3
jle 0x40afcf
mov ecx, dword [edi + 0xc]
mov edx, 0x58e238
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x40afc0
jmp 0x40b0cd
cmp eax, 2
jle 0x40b0cd
mov esi, dword [edi + 4]
mov eax, esi
mov dword [ebp - 0x4124], 0xf
mov dword [ebp - 0x4128], ebx
mov byte [ebp - 0x4138], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40aff6
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x4138]
call fcn.004034c0
lea edx, [ebp - 0x4138]
push edx
mov dword [ebp - 4], ebx
call fcn.00402a70
add esp, 4
push eax
push 0x53fdb4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, dword [edi + 8]
mov eax, esi
mov dword [ebp - 0x40ec], 0xf
mov dword [ebp - 0x40f0], ebx
mov byte [ebp - 0x4100], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40b048
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x4100]
call fcn.004034c0
lea eax, [ebp - 0x4100]
push eax
mov byte [ebp - 4], 1
call fcn.00402a70
add esp, 4
push eax
push str.XSBPATHI
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, 0x10
cmp dword [ebp - 0x40ec], esi
jb 0x40b099
mov ecx, dword [ebp - 0x4100]
push ecx
call fcn.0041a274
add esp, 4
mov dword [ebp - 0x40ec], 0xf
mov dword [ebp - 0x40f0], ebx
mov byte [ebp - 0x4100], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x4124], esi
jb 0x40b0cd
mov edx, dword [ebp - 0x4138]
push edx
call fcn.0041a274
add esp, 4
push 0x58e238
push str.output:__s_r_n
call fcn.0050aac4
add esp, 8
push ebx
lea eax, [ebp - 0x4264]
push eax
push 0x58e63c
mov dword [ebp - 0x4264], 1
mov dword [ebp - 0x4260], ebx
mov dword [ebp - 0x425c], ebx
mov dword [ebp - 0x4258], ebx
call sub.gdiplus.dll_GdiplusStartup
call fcn.004096d0
push ebx
lea ecx, [ebp - 0x4254]
call fcn.00404520
lea ecx, [ebp - 0x4228]
call fcn.00406bf0
lea ecx, [ebp - 0x4224]
mov dword [ebp - 4], 2
call fcn.00412c70
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [ebp - 0x4240], eax
call esi
push ebx
mov dword [ebp - 0x423c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [edi]
mov dword [ebp - 0x422c], eax
mov eax, esi
mov dword [0x58e638], esi
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40b170
sub eax, ecx
push eax
push esi
mov ecx, 0x58810c
call fcn.004034c0
mov ecx, dword [edi]
push 0x539fac
push ecx
call fcn.0050ac3d
mov edi, eax
add esp, 8
mov dword [ebp - 0x4230], edi
cmp edi, ebx
jne 0x40b1c8
push str.Open_file_failed_n
call fcn.0050aac4
add esp, 4
lea ecx, [ebp - 0x4228]
mov dword [ebp - 4], 0xffffffff
call fcn.00401850
or eax, 0xffffffff
jmp 0x40b8c2
push 2
push ebx
push edi
call fcn.0050b13e
push edi
call fcn.0050b04f
push ebx
push ebx
push edi
mov esi, eax
call fcn.0050b13e
add esp, 0x1c
cmp esi, 0x1c7c00
jne 0x40b86c
mov eax, 0xf
mov dword [ebp - 0x40d0], eax
mov dword [ebp - 0x40d4], ebx
mov byte [ebp - 0x40e4], bl
mov dword [ebp - 0x4098], eax
mov dword [ebp - 0x409c], ebx
mov byte [ebp - 0x40ac], bl
mov dword [ebp - 0x40b4], eax
mov dword [ebp - 0x40b8], ebx
mov byte [ebp - 0x40c8], bl
lea edx, [ebp - 0x4138]
push edx
mov byte [ebp - 4], 5
call fcn.004039d0
add esp, 4
push eax
lea ecx, [ebp - 0x40e4]
mov byte [ebp - 4], 6
call fcn.004036f0
cmp dword [ebp - 0x4124], 0x10
mov byte [ebp - 4], 5
jb 0x40b26a
mov eax, dword [ebp - 0x4138]
push eax
call fcn.0041a274
add esp, 4
push 0x539f8c
push 0x58e238
call fcn.0050ac3d
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40b328
push 0x58e238
push str.Open__s_failed__n
call fcn.0050aac4
push edi
call fcn.0050a699
mov edi, 0x10
add esp, 0xc
cmp dword [ebp - 0x40b4], edi
jb 0x40b2ba
mov ecx, dword [ebp - 0x40c8]
push ecx
call fcn.0041a274
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x40b4], esi
mov dword [ebp - 0x40b8], ebx
mov byte [ebp - 0x40c8], bl
cmp dword [ebp - 0x4098], edi
jb 0x40b2e8
mov edx, dword [ebp - 0x40ac]
push edx
call fcn.0041a274
add esp, 4
mov dword [ebp - 0x4098], esi
mov dword [ebp - 0x409c], ebx
mov byte [ebp - 0x40ac], bl
cmp dword [ebp - 0x40d0], edi
jb 0x40b311
mov eax, dword [ebp - 0x40e4]
push eax
call fcn.0041a274
add esp, 4
mov dword [ebp - 0x40d0], esi
mov dword [ebp - 0x40d4], ebx
mov byte [ebp - 0x40e4], bl
jmp 0x40b1ae
mov ecx, dword [ebp - 0x422c]
mov eax, dword [ebp - 0x423c]
push ebx
push ecx
push ebx
cdq
push ebx
sub eax, edx
push 0x1e
sar eax, 1
push 0xb4
sub eax, 0x5a
push eax
mov eax, dword [ebp - 0x4240]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x5a
push eax
push 0x90400000
push ebx
push str.static
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push str.Waiting_...
push eax
mov dword [0x58e640], eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 0x4000
lea edx, [ebp - 0x4090]
push 1
push edx
call fcn.0050ae9e
add esp, 0x10
cmp eax, ebx
jbe 0x40b3c0
push esi
push eax
lea eax, [ebp - 0x4090]
push 1
push eax
call fcn.0050aa4a
push edi
push 0x4000
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.0050ae9e
add esp, 0x20
cmp eax, ebx
ja 0x40b395
push esi
call fcn.0050a699
mov eax, 0x58e238
add esp, 4
mov dword [ebp - 0x4108], 0xf
mov dword [ebp - 0x410c], ebx
mov byte [ebp - 0x411c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b3e7
sub eax, edx
push eax
push 0x58e238
lea ecx, [ebp - 0x411c]
call fcn.004034c0
lea edx, [ebp - 0x411c]
push edx
lea eax, [ebp - 0x4170]
push eax
mov byte [ebp - 4], 7
call fcn.00403770
add esp, 8
mov esi, 0x10
mov byte [ebp - 4], 9
cmp dword [ebp - 0x4108], esi
jb 0x40b43b
mov ecx, dword [ebp - 0x411c]
push ecx
call fcn.0041a274
add esp, 4
cmp dword [ebp - 0x415c], 8
mov eax, dword [ebp - 0x4170]
mov dword [ebp - 0x4108], 0xf
mov dword [ebp - 0x410c], ebx
mov byte [ebp - 0x411c], bl
jae 0x40b466
lea eax, [ebp - 0x4170]
push eax
push str.setup_LoaderIcon.ico
call fcn.004021a0
add esp, 8
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x40e4]
push edx
lea ecx, [ebp - 0x40c8]
call fcn.004032b0
push 8
push str.test.zip
lea ecx, [ebp - 0x40c8]
call fcn.00403e40
mov eax, dword [ebp - 0x40c8]
cmp dword [ebp - 0x40b4], esi
jae 0x40b4af
lea eax, [ebp - 0x40c8]
push eax
lea ecx, [ebp - 0x4254]
call fcn.004045f0
lea ecx, [ebp - 0x4254]
call fcn.00404540
lea eax, [ebp - 0x4254]
push eax
push 0x53fd04
lea ecx, [ebp - 0x4228]
call fcn.00406c00
lea ecx, [ebp - 0x4254]
call fcn.00404600
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x40e4]
push ecx
lea ecx, [ebp - 0x40ac]
call fcn.004032b0
push 8
push str.qlib.zip
lea ecx, [ebp - 0x40ac]
call fcn.00403e40
mov eax, dword [ebp - 0x40ac]
cmp dword [ebp - 0x4098], esi
jae 0x40b523
lea eax, [ebp - 0x40ac]
push eax
lea ecx, [ebp - 0x4254]
call fcn.004045f0
lea ecx, [ebp - 0x4254]
call fcn.00404540
lea edx, [ebp - 0x4254]
push edx
push str.setup
lea ecx, [ebp - 0x4228]
call fcn.00406c00
lea ecx, [ebp - 0x4254]
call fcn.00404600
push 0x53fcf4
push 0x58e238
call fcn.0050ac3d
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40b5bd
push 0x58e238
push str.Open__s_failed__n
call fcn.0050aac4
push edi
call fcn.0050a699
add esp, 0xc
lea ecx, [ebp - 0x4170]
call fcn.0040cc10
lea ecx, [ebp - 0x40c8]
call fcn.00402e10
lea ecx, [ebp - 0x40ac]
call fcn.00402e10
lea ecx, [ebp - 0x40e4]
call fcn.00402e10
jmp 0x40b1ae
cmp dword [ebp - 0x40b4], 0x10
mov eax, dword [ebp - 0x40c8]
jae 0x40b5d2
lea eax, [ebp - 0x40c8]
push 0x539fac
push eax
call fcn.0050ac3d
add esp, 8
mov dword [ebp - 0x422c], eax
cmp eax, ebx
je 0x40b85d
cmp dword [ebp - 0x4098], 0x10
mov eax, dword [ebp - 0x40ac]
jae 0x40b603
lea eax, [ebp - 0x40ac]
push 0x539fac
push eax
call fcn.0050ac3d
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x40b857
push 2
push ebx
push esi
call fcn.0050b13e
push esi
call fcn.0050b04f
push edi
push 0x4000
mov dword [ebp - 0x4234], eax
lea eax, [ebp - 0x4090]
push 1
push eax
call fcn.0050ae9e
add esp, 0x20
cmp eax, ebx
jbe 0x40b67b
jmp 0x40b650
push esi
push eax
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.0050aa4a
push edi
push 0x4000
lea edx, [ebp - 0x4090]
push 1
push edx
call fcn.0050ae9e
add esp, 0x20
cmp eax, ebx
ja 0x40b650
push esi
call fcn.0050b04f
mov dword [ebp - 0x4238], eax
mov eax, dword [ebp - 0x422c]
push eax
push 0x4000
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.0050ae9e
add esp, 0x14
cmp eax, ebx
jbe 0x40b6d9
push esi
push eax
lea edx, [ebp - 0x4090]
push 1
push edx
call fcn.0050aa4a
mov eax, dword [ebp - 0x422c]
push eax
push 0x4000
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.0050ae9e
add esp, 0x20
cmp eax, ebx
ja 0x40b6a8
lea edx, [ebp - 0x50]
push edx
push edi
lea ecx, [ebp - 0x4224]
call fcn.004136d0
mov ebx, dword [ebp - 0x422c]
lea eax, [ebp - 0x90]
push eax
push ebx
lea ecx, [ebp - 0x4224]
call fcn.004136d0
push esi
push 4
lea ecx, [ebp - 0x4234]
push 1
push ecx
call fcn.0050aa4a
push esi
push 0x20
lea edx, [ebp - 0x50]
push 1
push edx
call fcn.0050aa4a
push esi
push 4
lea eax, [ebp - 0x4238]
push 1
push eax
call fcn.0050aa4a
push esi
push 0x20
lea ecx, [ebp - 0x90]
push 1
push ecx
call fcn.0050aa4a
add esp, 0x40
push esi
push 9
push 1
push str._____end
call fcn.0050aa4a
push ebx
call fcn.0050a699
mov edx, dword [ebp - 0x4230]
push edx
call fcn.0050a699
push edi
call fcn.0050a699
push esi
call fcn.0050a699
mov eax, dword [0x58e640]
add esp, 0x20
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x53fcec
lea ecx, [ebp - 0x4154]
call fcn.004035c0
push str.setup_
lea ecx, [ebp - 0x4154]
mov byte [ebp - 4], 0xa
call fcn.00403640
lea ecx, [ebp - 0x4154]
push ecx
lea ecx, [ebp - 0x418c]
call fcn.00409d70
push str.uninstallicon.ico
lea ecx, [ebp - 0x418c]
mov byte [ebp - 4], 0xb
call fcn.00403640
push str.uninstall.exe
lea ecx, [ebp - 0x4154]
call fcn.00403640
mov ecx, dword [ebp - 0x4154]
mov eax, 8
cmp dword [ebp - 0x4140], eax
jae 0x40b7f5
lea ecx, [ebp - 0x4154]
cmp dword [ebp - 0x4178], eax
mov eax, dword [ebp - 0x418c]
jae 0x40b809
lea eax, [ebp - 0x418c]
push ecx
push eax
call fcn.004021a0
add esp, 8
lea ecx, [ebp - 0x418c]
call fcn.0040cc10
lea ecx, [ebp - 0x4154]
call fcn.0040cc10
lea ecx, [ebp - 0x4170]
call fcn.0040cc10
lea ecx, [ebp - 0x40c8]
call fcn.00402e10
lea ecx, [ebp - 0x40ac]
call fcn.00402e10
lea ecx, [ebp - 0x40e4]
call fcn.00402e10
jmp 0x40b8ae
mov edi, dword [ebp - 0x4230]
push str.test.zip
push str.fopen__s_failed__n
jmp 0x40b57e
push edi
call fcn.0050a699
add esp, 4
call fcn.0040a130
lea ecx, [ebp - 0x4270]
call fcn.004137f0
push 0x86000000
push 5
push 3
push 0x40a650
push str.Cwin
lea ecx, [ebp - 0x4270]
call fcn.00413810
lea ecx, [ebp - 0x4270]
call fcn.00413920
lea ecx, [ebp - 0x4228]
mov dword [ebp - 4], 0xffffffff
call fcn.00401850
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005090f3
mov esp, ebp
pop ebp
ret