Function at 0x401526
Capabilities:
Check if file exists
Get file attributes
Move file
Resolve function by parsing pe exports
Set file attributes
Shutdown system

Disassembly:
sub esp, 0xe54
push ebx
push ebp
push esi
push edi
mov ebp, 0x104
mov dword [esp + 0x1c], 0x402a19
push ebp
xor ebx, ebx
mov dword [esp + 0x24], 0x402a28
lea eax, [esp + 0x57c]
mov dword [esp + 0x40], ebx
push eax
mov esi, ebx
mov dword [esp + 0x64], 0x402a19
push ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x6c], 0x402a28
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401ddd
cmp eax, ebp
ja 0x401ddd
lea edx, [esp + 0x578]
lea ecx, [esp + 0x84]
call fcn.00405212
mov ebp, eax
test ebp, ebp
jne 0x4015d5
xorps xmm0, xmm0
lea edx, [esp + 0x74]
lea ecx, [esp + 0x84]
movlpd qword [esp + 0x74], xmm0
call fcn.0040119d
test eax, eax
jne 0x4015c2
mov esi, str.Cant_find_7z_archive
mov dword [esp + 0x38], esi
jmp 0x4015d5
push ebx
lea edx, [esp + 0x78]
lea ecx, [esp + 0x88]
call fcn.00405146
mov ebp, eax
mov edi, ebp
neg edi
push 0xb
sbb edi, edi
pop ebx
and edi, ebx
test esi, esi
je 0x4015eb
mov edi, ebx
jmp 0x401a24
test ebp, ebp
jne 0x401d62
cmp dword [0x40c0c8], 0
mov ebp, 0x40c500
jne 0x401615
push 0x104
push ebp
push 0x6f
push dword [0x40c0cc]
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
lea ecx, [esp + 0x7c]
call fcn.00405037
xor edx, edx
lea ecx, [esp + 0x8c]
call fcn.00405a10
and dword [esp + 0xa8], 0
mov ecx, ebp
mov edx, ebp
movzx eax, word [edx]
lea edx, [edx + 2]
cmp eax, 0x22
je 0x401638
mov word [ecx], ax
add ecx, 2
test ax, ax
jne 0x401638
movzx edx, word [0x40c500]
xor esi, esi
xor ecx, ecx
inc esi
jmp 0x401670
cmp dx, 0x20
mov eax, esi
movzx edx, word [esi*2 + 0x40c500]
cmove eax, ecx
inc esi
mov ecx, eax
test dx, dx
jne 0x40165c
xor edx, edx
mov word [ecx*2 + 0x40c500], dx
cmp word [0x40c500], dx
jne 0x401692
mov ecx, str.Incorrect_path
jmp 0x401dd6
mov ecx, ebp
call fcn.00401ebe
call fcn.0040102c
mov ebp, eax
test ebp, ebp
push 0x40c500
cmovne edi, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x50], eax
test edi, edi
jne 0x4016f9
mov esi, 0x40000
lea ecx, [esp + 0x1c]
mov edx, esi
call dword [esp + 0x1c]
mov dword [esp + 0xa8], eax
test eax, eax
jne 0x4016d7
push 2
pop edi
jmp 0x4016f9
and dword [esp + 0xa4], 0
lea eax, [esp + 0x7c]
and dword [esp + 0xa0], 0
mov dword [esp + 0xac], esi
mov dword [esp + 0x9c], eax
lea ecx, [esp + 0xcc]
call fcn.00403a52
test edi, edi
jne 0x4019f5
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0xd4]
call fcn.00403db9
mov edi, eax
test edi, edi
jne 0x4019f5
or dword [esp + 0x58], 0xffffffff
and dword [esp + 0x34], eax
and dword [esp + 0x54], eax
and dword [0x40c0dc], eax
cmp dword [0x40c0c8], eax
jne 0x401782
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x40c0d8]
call esi
push 5
push dword [0x40c0d4]
call esi
push dword [esp + 0x114]
push edi
push 0x406
push dword [0x40c0d8]
call dword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov dword [esp + 0x14], esi
cmp dword [esp + 0x114], esi
jbe 0x40196b
xor edi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x2c], edi
cmp dword [0x40c0c8], edi
jne 0x401813
jmp 0x4017e9
lea eax, [esp + 0xb0]
push eax
push dword [0x40c0cc]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x4017dd
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x40c0cc], edi
je 0x401ddd
push 1
push edi
push edi
push edi
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4017a9
push edi
push esi
push 0x402
push dword [0x40c0d8]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edx, esi
lea ecx, [esp + 0xd0]
call fcn.00403a15
cmp eax, 0x104
jae 0x401969
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0xcc]
mov edx, esi
lea edi, [eax*2 + 0x40c500]
push edi
mov dword [esp + 0x2c], edi
call fcn.00403a15
cmp dword [0x40c0c8], 0
jne 0x401861
push edi
push dword [0x40c0d4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x70]
push eax
push esi
lea edx, [esp + 0xac]
lea ecx, [esp + 0xec]
call fcn.00403800
mov edi, eax
test edi, edi
jne 0x40196b
xor esi, esi
xor edx, edx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x28]
push 4
pop eax
mov dword [esp + 0x24], eax
movzx eax, word [esi]
mov dword [esp + 0x18], edx
mov ecx, eax
test ax, ax
je 0x4018f9
mov ebx, esi
cmp cx, 0x2f
jne 0x4018e4
xor eax, eax
mov ecx, 0x40c500
mov word [esi], ax
call fcn.00401deb
mov edx, dword [esp + 0x18]
push 0x5c
pop eax
mov word [esi], ax
inc edx
mov dword [esp + 0x18], edx
lea esi, [ebx + edx*2]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4018c5
push 0xb
pop ebx
mov esi, dword [esp + 0x14]
mov edx, 0x80
mov eax, dword [esp + 0x11c]
mov ecx, esi
and ecx, 7
sar edx, cl
mov ecx, esi
shr ecx, 3
mov dword [esp + 0x18], edx
mov dword [esp + 0x4c], ecx
test byte [ecx + eax], dl
je 0x401931
mov ecx, 0x40c500
call fcn.00401deb
jmp 0x401d36
push 0x40c500
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x10]
mov ecx, eax
test eax, eax
je 0x401acc
mov eax, dword [esp + 0x24]
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], eax
cmp ecx, 0x64
jbe 0x401b48
mov edi, ebx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
call dword [esp + 0x20]
cmp dword [0x40c0c8], 0
jne 0x401997
push 0
push dword [esp + 0x18]
push 0x402
push dword [0x40c0d8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x50]
xor ecx, ecx
mov word [eax*2 + 0x40c500], cx
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x114]
jne 0x4019f5
mov ecx, 0x80000001
call fcn.00402017
mov ecx, 0x80000002
call fcn.00402017
call fcn.004021f0
call fcn.00402287
mov ecx, dword [0x40c0cc]
call fcn.00402074
cmp dword [0x40c0c8], 0
jne 0x4019f5
push str.7_Zip_24.05_is_installed
push dword [0x40c0d4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0xcc]
call fcn.00403986
mov edx, dword [esp + 0xa8]
lea ecx, [esp + 0x1c]
call dword [esp + 0x20]
lea ecx, [esp + 0x84]
call fcn.0040507f
mov esi, dword [esp + 0x38]
test ebp, ebp
jne 0x401d62
mov ebx, edi
test edi, edi
jne 0x401d62
cmp dword [0x40c0c8], edi
jne 0x401ac5
inc ebp
cmp dword [esp + 0x3c], ebp
jle 0x401ac5
push 0x104
push str.7_Zip_24.05_Setup
push str.You_must_restart_your_system_to_complete_the_installation._nRestart_now_
push dword [0x40c0cc]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x401ac5
lea eax, [esp + 0x40]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401ac5
lea eax, [esp + 0x68]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 2
mov dword [esp + 0x68], ebp
lea eax, [esp + 0x68]
pop ebp
push ebx
push ebx
push ebx
push eax
push ebx
push dword [esp + 0x54]
mov dword [esp + 0x88], ebp
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401ac5
push ebx
push ebp
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor eax, eax
jmp 0x401de0
mov esi, dword [esp + 0x10]
push 0
push 0x40c500
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x40c500
lea ecx, [esp + 0x30]
call fcn.0040521a
mov dword [esp + 0x40], eax
test eax, eax
je 0x401c41
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401ba0
mov ecx, dword [esp + 0x28]
mov edx, str.7_zip.dll
call fcn.00401291
test eax, eax
je 0x401b38
mov ecx, 0x40c500
call fcn.004013b5
xor esi, esi
add eax, 0xffeffffd
xor ecx, ecx
inc esi
cmp eax, 0x80002
seta cl
inc ecx
mov dword [esp + 0x24], ecx
jmp 0x401b44
cmp dword [0x40c0c8], 0
je 0x401baa
xor esi, esi
inc esi
mov dword [esp + 0x10], esi
lea eax, [esp + 0x154]
push eax
push 0x40c500
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, str..tmp
mov ecx, 0x40c500
call fcn.00401000
cmp esi, 1
jbe 0x401b88
push 0x40c500
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, esi
lea edx, [eax*2 + 0x40c500]
call fcn.004014de
push 0x40c500
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401ad0
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
jmp 0x401948
mov edx, str.Cant_open_file_n
lea esi, [esp + 0x784]
mov cl, byte [edx]
inc edx
movzx eax, cl
mov word [esi], ax
lea esi, [esi + 2]
test cl, cl
jne 0x401bb6
push 0x40c500
lea eax, [esp + 0x788]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, 0x40a4d4
lea ecx, [esp + 0x784]
call fcn.00401000
lea eax, [esp + 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x784]
lea edx, [edx + eax*2]
call fcn.0040137b
push 0x212
push str.Error
lea eax, [esp + 0x78c]
push eax
push dword [0x40c0cc]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, eax
cmp ecx, 3
je 0x401d4d
xor eax, eax
cmp ecx, 5
sete al
jmp 0x401ba1
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
push eax
lea edx, [edx + ecx]
lea ecx, [esp + 0x34]
call fcn.004051b7
mov ebp, eax
mov eax, dword [esp + 0x2c]
test ebp, ebp
jne 0x401c72
cmp dword [esp + 0x48], eax
je 0x401c7c
mov dword [esp + 0x38], str.Cant_write_output_file
mov edi, ebx
add dword [0x40c0dc], eax
mov eax, dword [esp + 0x130]
test eax, eax
je 0x401cc7
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x18]
test byte [edx + eax], cl
je 0x401cc7
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x14]
mov eax, dword [ecx + edx*8]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + edx*8 + 4]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x64]
push eax
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea ecx, [esp + 0x30]
call fcn.0040507f
test edi, edi
jne 0x40196b
test eax, eax
jne 0x401d5b
mov eax, dword [esp + 0x128]
test eax, eax
je 0x401d0d
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x18]
test byte [edx + eax], cl
je 0x401d0d
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x14]
push dword [eax + ecx*4]
push 0x40c500
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x401d32
push 5
lea eax, [esp + 0x158]
push eax
push 0x40c500
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x401d55
mov eax, dword [esp + 0x24]
or dword [esp + 0x3c], eax
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, dword [esp + 0x114]
jb 0x401795
jmp 0x40196b
push 0x64
pop edi
jmp 0x40196b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x40196b
cmp dword [0x40c0c8], 0
jne 0x401ddd
test ebp, ebp
je 0x401d92
xor eax, eax
lea edx, [esp + 0x154]
mov ecx, ebp
mov word [esp + 0x154], ax
call fcn.0040137b
lea edx, [esp + 0x154]
xor ecx, ecx
jmp 0x401dd8
cmp ebx, 0x64
jne 0x401d9c
push 2
pop eax
jmp 0x401de0
cmp ebx, 4
jne 0x401da8
mov ecx, str.Decoder_doesnt_support_this_archive
jmp 0x401dd6
cmp ebx, 2
jne 0x401db4
mov ecx, str.Cant_allocate_required_memory
jmp 0x401dd6
cmp ebx, 3
jne 0x401dc0
mov ecx, str.CRC_error
jmp 0x401dd6
cmp ebx, 1
jne 0x401dcc
mov ecx, str.Data_error
jmp 0x401dd6
test esi, esi
mov ecx, str.ERROR
cmovne ecx, esi
xor edx, edx
call fcn.00401f40
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe54
ret