Function at 0x401800
Capabilities:
Copy file
Create thread
Get common file path
Get system information on windows
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x40b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00404610
push 0x103
lea ecx, [ebp - 0x20b]
push ebx
push ecx
mov byte [ebp - 0x20c], bl
call fcn.00404610
push 0x103
lea edx, [ebp - 0x35f]
push ebx
push edx
mov byte [ebp - 0x360], bl
call fcn.00404610
add esp, 0x24
mov dword [ebp - 0x214], 1
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0xc8
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push ebx
push 0x80
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [section.HID_Shar]
test eax, eax
jne 0x401a28
mov dword [section.HID_Shar], 1
mov ecx, esi
call fcn.00401100
mov ecx, esi
call fcn.00401270
mov ecx, esi
call fcn.004013d0
push 0x104
lea edx, [ebp - 0x108]
push ebx
push edx
call fcn.00404610
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call esi
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4018f5
mov ecx, dword [str._display_setup.exe]
mov edx, dword [0x40a154]
mov dword [eax], ecx
mov ecx, dword [0x40a158]
mov dword [eax + 4], edx
mov edx, dword [0x40a15c]
mov dword [eax + 8], ecx
mov cx, word [0x40a160]
mov dword [eax + 0xc], edx
mov dl, byte [0x40a162]
mov word [eax + 0x10], cx
lea ecx, [ebp - 0x108]
mov byte [eax + 0x12], dl
call fcn.00401000
push 0x104
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00404610
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call esi
lea eax, [ebp - 0x108]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401970
mov edx, dword [str._cmcc_sign.dll]
mov ecx, dword [0x40a174]
mov dword [eax], edx
mov edx, dword [0x40a178]
mov dword [eax + 4], ecx
mov cx, word [0x40a17c]
mov dword [eax + 8], edx
mov dl, byte [0x40a17e]
mov word [eax + 0xc], cx
push 0x104
mov byte [eax + 0xe], dl
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00404610
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push str.WINDIR
call edi
lea edx, [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x25c]
cmp ax, 9
je 0x401a52
cmp ax, 6
je 0x401a52
lea eax, [ebp - 0x20c]
dec eax
jmp 0x401a00
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401a00
mov ecx, dword [str._system32_]
mov edx, dword [0x40a18c]
mov dword [eax], ecx
mov cx, word [0x40a190]
mov dword [eax + 4], edx
mov dl, byte [0x40a192]
jmp 0x401a86
mov ecx, dword [section.HID_Shar]
cmp ecx, 1
jne 0x4018b0
push 0x50030
push str.DriverCoding
push str.User_cancel_the_installation_process_last_time_please_wait_a_moment__
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401ce0
lea eax, [ebp - 0x20c]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401a60
mov ecx, dword [str.SysWOW64_]
mov edx, dword [0x40a198]
mov dword [eax], ecx
mov cx, word [0x40a19c]
mov dword [eax + 4], edx
mov dl, byte [0x40a19e]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401a94
mov ecx, dword [str.cmcc_sign.dll]
mov edx, dword [0x40a1a4]
mov dword [eax], ecx
mov ecx, dword [0x40a1a8]
mov dword [eax + 4], edx
mov dx, word [0x40a1ac]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
push 5
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebx
push ebx
lea edx, [ebp - 0x214]
push edx
push 0x401530
push ebx
push ebx
mov byte [0x40cc8c], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x64
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00404610
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call esi
lea eax, [ebp - 0x108]
dec eax
jmp 0x401b30
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401b30
mov edx, dword [str._setup.exe]
mov ecx, dword [0x40a168]
mov dword [eax], edx
mov dx, word [0x40a16c]
mov dword [eax + 4], ecx
mov cl, byte [0x40a16e]
mov word [eax + 8], dx
mov byte [eax + 0xa], cl
lea ecx, [ebp - 0x108]
call fcn.00401000
push 0x104
lea edx, [ebp - 0x108]
push ebx
push edx
mov byte [0x40cc8c], 1
call fcn.00404610
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call esi
lea eax, [ebp - 0x108]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401ba0
mov ecx, dword [str._cmcc_sign.dll]
mov edx, dword [0x40a174]
mov dword [eax], ecx
mov ecx, dword [0x40a178]
mov dword [eax + 4], edx
mov dx, word [0x40a17c]
mov dword [eax + 8], ecx
mov cl, byte [0x40a17e]
mov word [eax + 0xc], dx
push 0x104
lea edx, [ebp - 0x20c]
push ebx
push edx
mov byte [eax + 0xe], cl
call fcn.00404610
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.WINDIR
call edi
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x238]
cmp ax, 9
je 0x401c4d
cmp ax, 6
je 0x401c4d
lea eax, [ebp - 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401c25
mov edx, dword [str._system32_]
mov ecx, dword [0x40a18c]
mov dword [eax], edx
mov dx, word [0x40a190]
mov dword [eax + 4], ecx
mov cl, byte [0x40a192]
jmp 0x401c7a
lea eax, [ebp - 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401c54
mov edx, dword [str.SysWOW64_]
mov ecx, dword [0x40a198]
mov dword [eax], edx
mov dx, word [0x40a19c]
mov dword [eax + 4], ecx
mov cl, byte [0x40a19e]
mov word [eax + 8], dx
mov byte [eax + 0xa], cl
lea eax, [ebp - 0x20c]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x401c88
mov edx, dword [str.cmcc_sign.dll]
mov ecx, dword [0x40a1a4]
mov dword [eax], edx
mov edx, dword [0x40a1a8]
mov dword [eax + 4], ecx
mov cx, word [0x40a1ac]
mov dword [eax + 8], edx
push ebx
lea edx, [ebp - 0x20c]
mov word [eax + 0xc], cx
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [ebp - 0x210]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401cf5
mov esp, ebp
pop ebp
ret 0x10