Function at 0x485830
Capabilities:
Check os version
Copy file
Create directory
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540020
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x5bc684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x42c], esi
call fcn.004cb750
add esp, 4
test esi, esi
je 0x485930
mov eax, esi
cmp byte [eax], 0
je 0x485930
push str._tellprod
push esi
call fcn.004ff027
add esp, 8
test eax, eax
jne 0x4858aa
call fcn.0047cc50
xor eax, eax
jmp 0x4862a0
push 0x56eb8c
push esi
call fcn.004bef70
mov esi, eax
add esp, 8
test esi, esi
je 0x485930
add esi, 2
push 0x551f88
push esi
call fcn.004fee10
add esp, 8
test eax, eax
jne 0x4858e3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4858d8
sub eax, edx
add eax, esi
mov bl, byte [eax]
mov edi, 0x5c1ac8
mov byte [eax], 0
mov ecx, esi
sub edi, esi
mov dl, byte [ecx]
mov byte [ecx + edi], dl
inc ecx
test dl, dl
jne 0x4858f1
mov byte [eax], bl
mov eax, 0x5c1ac8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x485905
sub eax, edx
lea eax, [eax + 0x5c1ac7]
cmp eax, 0x5c1ac8
jbe 0x485930
jmp 0x485920
cmp byte [eax], 0x20
jne 0x485930
mov byte [eax], 0
dec eax
cmp eax, 0x5c1ac8
ja 0x485920
cmp byte [0x5c1ac8], 0
jne 0x485950
mov ecx, dword [ebp - 0x424]
push 0x104
push 0x5c1ac8
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, 0x5c1ac8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x485958
push 0x5c1ac8
push 0x104
push 0x5c19c0
push 0x54f15a
push str.cmdLine
sub eax, edx
push str.System
mov dword [eax + 0x5c1ac5], 0x696e69
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [0x5bbfe4]
mov dword [ebp - 0x428], edx
mov dword [ebp - 4], 0
push 0x5c19c0
lea ecx, [ebp - 0x428]
call fcn.004bfc00
mov esi, dword [ebp - 0x42c]
mov byte [0x5c19c0], 0
test esi, esi
je 0x4859ec
cmp byte [esi], 0
je 0x4859ec
mov eax, dword [ebp - 0x428]
cmp byte [eax], 0
je 0x4859e0
push 0x20
lea ecx, [ebp - 0x428]
call fcn.004bfd90
push esi
lea ecx, [ebp - 0x428]
call fcn.004bfd50
mov ecx, dword [ebp - 0x424]
mov esi, dword [ebp - 0x428]
push str.RICHED32.DLL
mov dword [0x5c0834], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.eb2012xInstSetup32
push 0
push 0x1f0003
mov dword [0x5c093c], eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov dword [0x5c051c], eax
test eax, eax
jne 0x48622f
push str.eb2012xInstSetup32
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [0x5c051c], eax
xor eax, eax
jmp 0x485a50
mov cl, byte [eax + str.ocxdrv32.dll]
mov byte [eax + 0x5bfe78], cl
inc eax
test cl, cl
jne 0x485a50
push 0
push 0x5bfca8
call fcn.004c55a0
push 0
call fcn.004ff06e
push eax
call fcn.00502ee1
push esi
call fcn.00406f50
push esi
call fcn.00480ff0
add esp, 0x18
cmp dword [0x5c19bc], 0
jne 0x485fb3
push 0x103
lea edx, [ebp - 0x113]
push 0
push edx
mov byte [ebp - 0x114], 0
call fcn.004ff6f0
add esp, 0xc
cmp dword [0x5c1dfc], 0
je 0x485af4
cmp byte [0x5c1e00], 0
je 0x485af4
push 0x5c1e00
call fcn.0041dcb0
add esp, 4
test eax, eax
je 0x485af4
xor eax, eax
jmp 0x485ae0
mov cl, byte [eax + 0x5c1e00]
mov byte [ebp + eax - 0x114], cl
inc eax
test cl, cl
jne 0x485ae0
jmp 0x485b12
xor eax, eax
jmp 0x485b00
mov cl, byte [eax + str._8834]
mov byte [ebp + eax - 0x114], cl
inc eax
test cl, cl
jne 0x485b00
push 0x103
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.004ff6f0
add esp, 0xc
cmp dword [0x5c1dfc], 0
je 0x485b74
cmp byte [0x5c1e00], 0
je 0x485b74
push 0x5c1e00
call fcn.0041dcb0
add esp, 4
test eax, eax
je 0x485b74
xor eax, eax
jmp 0x485b60
mov cl, byte [eax + 0x5c1e00]
mov byte [ebp + eax - 0x218], cl
inc eax
test cl, cl
jne 0x485b60
jmp 0x485b83
lea ecx, [ebp - 0x218]
push ecx
call fcn.004da960
add esp, 4
push 1
push 0x104
push 0x5c0080
call fcn.0046e2e0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 0xc
test eax, eax
jne 0x485c09
cmp dword [0x5c159c], 0
mov byte [0x5c0080], 0
je 0x485bdd
xor eax, eax
mov cl, byte [eax + str._34_.__.iht_66]
mov byte [eax + str.ocxdrv32.dll], cl
inc eax
test cl, cl
jne 0x485bb3
lea edx, [ebp - 0x114]
push edx
call fcn.0046e710
add esp, 4
call fcn.0046f240
jmp 0x485e03
push 0
push 1
push str.32.dll
push str.ocxdrv32.dll
call fcn.0047d7f0
lea eax, [ebp - 0x218]
push eax
call fcn.0046e710
add esp, 0x14
call fcn.0046f240
jmp 0x485e03
cmp eax, 1
jle 0x485c67
push 0
push 0xdf13
lea ecx, [ebp - 0x424]
call fcn.00406200
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x424]
push 0x30
push 0x54f6e0
push ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
call fcn.004bfa40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.004bfa40
xor eax, eax
jmp 0x4862a0
push 0x5c0080
push 0
push 4
call fcn.0046f040
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0xc
push 1
push str.BuildNumber
mov ecx, esi
call eax
mov ecx, dword [esi + 0x60]
mov eax, dword [ecx + 0x16a0]
cmp eax, 0x2036
jbe 0x485cd0
push 0
push 0xdf14
lea ecx, [ebp - 0x424]
call fcn.00406200
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x424]
push 0x30
push 0x54f6e0
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x485c3f
cmp eax, 0xc0c
jae 0x485d0d
push 0
push 0xdf15
lea ecx, [ebp - 0x424]
call fcn.00406200
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x424]
push 0x30
push 0x54f6e0
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x485c3f
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp dword [0x5c159c], 0
je 0x485d48
push 0x104
push str._34_.__.iht_66
push str.ocxdrv32.dll
call fcn.004bf0a0
lea ecx, [ebp - 0x114]
push ecx
call fcn.0046e710
add esp, 0x10
jmp 0x485e03
push 0x5c
push 0x5c0080
call fcn.004ff460
add esp, 8
test eax, eax
je 0x485d6d
inc eax
mov edx, str.ocxdrv32.dll
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x485d63
push 0x103
lea edx, [ebp - 0x31b]
push 0
push edx
mov byte [ebp - 0x31c], 0
call fcn.004ff6f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x31c]
push eax
call edi
lea ecx, [ebp - 0x31c]
push ecx
call fcn.004bf2e0
lea eax, [ebp - 0x31c]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x485db0
sub eax, edx
push eax
lea edx, [ebp - 0x31c]
push 0x5c0080
push edx
call fcn.00504aba
add esp, 0xc
test eax, eax
jne 0x485e03
lea eax, [ebp - 0x218]
push eax
call fcn.0046e710
push str.ocxdrv32.dll
push str._34_.__.iht_66
call fcn.004ff027
add esp, 0xc
test eax, eax
jne 0x485e03
lea ecx, [ebp - 0x114]
push ecx
call fcn.0046e710
add esp, 4
push 0x104
push 0x5c0290
call fcn.0046e5d0
add esp, 8
push 0x104
lea edx, [ebp - 0x420]
push edx
call edi
lea eax, [ebp - 0x420]
push eax
push 0x5c0290
call fcn.004ff027
add esp, 8
test eax, eax
jne 0x485e4a
lea ecx, [ebp - 0x218]
push ecx
call fcn.0046e710
add esp, 4
push 0x104
push 0x5c0290
call fcn.0046e5d0
push 0x5c0290
call fcn.004c46e0
add esp, 0xc
test eax, eax
jne 0x485e80
push eax
push 0x5c0290
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [0x5c007c], 1
push 0x5c0290
call fcn.004c4aa0
add esp, 4
test eax, eax
je 0x485e9e
push 0x5c0290
call fcn.004c8e00
add esp, 4
xor eax, eax
mov cl, byte [eax + 0x5c0290]
mov byte [eax + 0x5c0188], cl
inc eax
test cl, cl
jne 0x485ea0
push 0x5c0188
call fcn.004bf2e0
add esp, 4
xor eax, eax
mov cl, byte [eax + 0x5c0188]
mov byte [eax + 0x5bff78], cl
inc eax
test cl, cl
jne 0x485ec0
mov eax, str.ocxdrv32.dll
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x485ed8
mov edi, 0x5bff78
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x485ee7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 1
mov ecx, eax
and ecx, 3
push str.32.dll
push str.ocxdrv32.dll
rep movsb byte es:[edi], byte [esi]
call fcn.0047d7f0
mov eax, str.ocxdrv32.dll
add esp, 0x10
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x485f20
mov edi, 0x5c0188
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x485f31
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp byte [0x5c0080], 0
rep movsb byte es:[edi], byte [esi]
je 0x485fa5
push 0x5c0080
call fcn.004c4aa0
add esp, 4
test eax, eax
je 0x485f73
push 0
push 0x5c0188
push 0x5c0080
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp byte [0x5c0080], 0
je 0x485fa5
mov eax, 0x5bff78
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x485f84
sub eax, edx
push eax
push 0x5bff78
push 0x5c0080
call fcn.00504aba
add esp, 0xc
mov dword [0x5c0184], eax
call fcn.0040b0b0
cmp dword [0x5c19bc], 0
je 0x486010
push 0
push 0xe00c
lea ecx, [ebp - 0x430]
call fcn.00406200
mov bl, 0xc
mov byte [ebp - 4], bl
push 0
push 0xe00d
lea ecx, [ebp - 0x42c]
call fcn.00406200
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x430]
push edx
push eax
push str._s__s
push 0x5c0398
call fcn.004ff1e4
add esp, 0x10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004bfa40
jmp 0x48603d
push 0
push 0xe00b
lea ecx, [ebp - 0x430]
call fcn.00406200
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x430]
mov edx, 0x5c0398
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x486033
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x430]
call fcn.004bfa40
cmp dword [0x5c1bcc], 0
jne 0x4860a2
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
cmp eax, 0x80000000
jae 0x486089
call fcn.004c6240
test eax, eax
jne 0x486089
push 1
push 2
push str.This_product_requires_Administrator_rights_to_Install_or_Modify.
call fcn.00407720
mov esi, dword [0x5bdba0]
add esp, 0xc
jmp 0x48628c
call esi
cmp eax, 0x80000000
jae 0x4860a2
call esi
cmp al, 6
jb 0x4860a2
mov dword [0x5c17ac], 1
lea ecx, [ebp - 0x438]
push ecx
mov dword [ebp - 0x438], 8
mov dword [ebp - 0x434], 0x1ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0xf4fffe
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x5c0c54], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x5c0834]
push eax
push edx
push 0x482d70
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esi, dword [ebp - 0x424]
push esi
mov dword [0x5c0d5c], eax
call fcn.004857a0
add esp, 4
test ax, ax
je 0x4861af
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.0047cd00
add esp, 8
test eax, eax
je 0x4861af
mov ecx, dword [0x5c0a44]
push 0
push 0
push 0x590
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea edx, [ebp - 0x454]
push edx
call ebx
test eax, eax
jle 0x4861b9
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x486160
mov eax, dword [0x5c0b4c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x486188
mov edx, dword [0x5c0b4c]
lea ecx, [ebp - 0x454]
push ecx
push edx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x48619a
lea eax, [ebp - 0x454]
push eax
call esi
lea ecx, [ebp - 0x454]
push ecx
call edi
push 0
push 0
push 0
lea edx, [ebp - 0x454]
push edx
call ebx
test eax, eax
jg 0x486160
jmp 0x4861b9
mov dword [ebp - 0x44c], 0
mov eax, dword [0x5c0d5c]
test eax, eax
je 0x4861c9
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x5c0c54]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call esi
mov eax, dword [0x5bfd6c]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
cmp eax, ebx
je 0x4861fc
push eax
call edi
push 0x5bfd70
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x5bfd6c], ebx
mov eax, dword [0x5c093c]
cmp eax, ebx
je 0x48620e
push eax
call edi
mov dword [0x5c093c], ebx
mov ecx, dword [0x5c072c]
push ecx
call esi
mov edx, dword [0x5c051c]
push ebx
push 1
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esi, dword [0x5bdba0]
jmp 0x48628c
mov eax, dword [0x5bbfe4]
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 3
push 0x54f15a
lea ecx, [ebp - 0x42c]
call fcn.004bfc00
push 0
push 0xe00f
lea ecx, [ebp - 0x42c]
call fcn.004c1150
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x42c]
push 1
push 0x10
push ecx
call fcn.00407720
mov esi, dword [0x5bdba0]
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x42c]
call fcn.004bfa40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.004bfa40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe1f5
mov esp, ebp
pop ebp
ret 0x10