Function at 0x401398
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1860
call fcn.00405790
mov al, byte [ebp + 0xb]
push ebx
push esi
xor esi, esi
push edi
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0x80000002
mov byte [ebp - 0x14], al
call fcn.00402e19
mov al, byte [ebp + 0xb]
push esi
lea ecx, [ebp - 0x60]
mov byte [ebp - 0x60], al
call fcn.00402e19
mov al, byte [ebp + 0xb]
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call fcn.00402e19
mov dl, byte [0x410fb4]
mov ebx, 0xff
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x85f]
mov byte [ebp - 0x860], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x45f]
mov byte [ebp - 0x460], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x145f]
mov byte [ebp - 0x1460], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x185f]
mov byte [ebp - 0x1860], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x400
mov dword [ebp - 0x3c], 1
stosb byte es:[edi], al
lea eax, [ebp - 0x460]
push esi
push eax
push 1
pop ebx
mov dword [ebp - 0x38], esi
push ebx
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x38]
mov edi, str.SOFTWAREDuduDddOEMOEMID
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x3c]
push eax
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ebx
call fcn.00401b12
test al, al
jne 0x4014ea
lea eax, [ebp - 0x24]
push eax
call fcn.00402f73
pop ecx
push dword [0x40c2d0]
lea ecx, [ebp - 0x60]
push 0
push eax
call fcn.00402b48
push ebx
lea ecx, [ebp - 0x24]
call fcn.00402e19
mov eax, dword [ebp - 0x5c]
test eax, eax
jne 0x4014b7
mov eax, 0x40c28c
push dword [ebp - 0x58]
lea ecx, [ebp - 4]
push eax
push ebx
push edi
call fcn.00401c79
lea eax, [ebp - 0x460]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x460]
push eax
push ebx
push str.SOFTWAREDuduDddOEMOEMVENDOR
lea ecx, [ebp - 4]
call fcn.00401c79
jmp 0x401507
lea eax, [ebp - 0x860]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x60]
call fcn.00402e55
mov edi, str.http:__dddvc.dudu.com_ddd_oemlite2.html_oemid
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00402e55
lea eax, [ebp - 0x860]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov edi, str.installed
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
cmp dword [ebp + 8], ebx
jne 0x4016eb
mov esi, 0x40e108
push esi
call fcn.004057c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov edi, str.vendor
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
lea eax, [ebp - 0x460]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov edi, str.end_install1
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov al, byte [0x410fb4]
mov ecx, 0x1ff
mov byte [ebp - 0x1060], al
xor eax, eax
lea edi, [ebp - 0x105f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1060]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x1060]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402e55
mov edi, str.tmp875.tmp
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x34]
call fcn.00402a8a
lea eax, [ebp - 0x14]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x34]
push eax
call section..text
mov al, byte [ebp + 0xb]
add esp, 0xc
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x4c], al
push 0
call fcn.00402e19
mov eax, dword [ebp - 0x30]
and dword [ebp - 0x50], 0
test eax, eax
jne 0x40164c
mov eax, 0x40c28c
push 2
push eax
lea ecx, [ebp - 0x50]
call fcn.00401ab7
test al, al
je 0x4016a8
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x50]
push eax
call fcn.00401929
mov edi, 0x40e0dc
push edi
call fcn.004057c0
pop ecx
push eax
push edi
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push 0
call fcn.00402d01
test eax, eax
push ebx
jne 0x40168e
push 0x40e0d8
jmp 0x40168f
push esi
push ebx
push str.SOFTWAREDuduDddOEMOEMRPS
lea ecx, [ebp - 4]
call fcn.00401c79
push ebx
lea ecx, [ebp - 0x24]
call fcn.00402e19
jmp 0x4016b8
push ebx
push esi
push ebx
push str.SOFTWAREDuduDddOEMOEMRPS
lea ecx, [ebp - 4]
call fcn.00401c79
cmp dword [ebp - 0x50], 0
je 0x4016c7
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
and dword [ebp - 0x50], 0
test eax, eax
jne 0x4016d7
mov eax, 0x40c28c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x50]
call fcn.0040190a
jmp 0x4018ea
mov al, byte [ebp + 0xb]
push 0
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x24], al
call fcn.00402e19
mov al, byte [0x410fb4]
mov ecx, 0x1ff
mov byte [ebp - 0x1060], al
xor eax, eax
lea edi, [ebp - 0x105f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1060]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x1060]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402e55
mov edi, str.dddsetup.ini
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.00402a8a
mov edi, 0x40e0d8
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov edi, str.vendor
push edi
call fcn.004057c0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
lea eax, [ebp - 0x460]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4017b2
mov eax, 0x40c28c
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [ebp - 0x1460]
push esi
push eax
push 0x410fb4
mov ebx, str.DDDSETUP
push str.OldVer
push ebx
call edi
push str.old_ver
call fcn.004057c0
pop ecx
push eax
push str.old_ver
lea ecx, [ebp - 0x14]
call fcn.00402a8a
lea eax, [ebp - 0x1460]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x1460]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x401815
mov eax, 0x40c28c
push eax
lea eax, [ebp - 0x1860]
push esi
push eax
push 0x410fb4
push str.OldVendor
push ebx
call edi
mov esi, str.old_vendor
push esi
call fcn.004057c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
lea eax, [ebp - 0x1860]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x1860]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402a8a
mov esi, str.end_repair1
push esi
call fcn.004057c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00402a8a
lea eax, [ebp - 0x1060]
push eax
call fcn.004057c0
pop ecx
push eax
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402e55
mov esi, str.tmp876.tmp
push esi
call fcn.004057c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.00402a8a
lea eax, [ebp - 0x14]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x34]
push eax
call section..text
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
jne 0x4018c5
mov eax, 0x40c28c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4018da
mov eax, 0x40c28c
push eax
call esi
push 1
lea ecx, [ebp - 0x24]
call fcn.00402e19
push 1
pop ebx
push ebx
lea ecx, [ebp - 0x34]
call fcn.00402e19
push ebx
lea ecx, [ebp - 0x60]
call fcn.00402e19
push ebx
lea ecx, [ebp - 0x14]
call fcn.00402e19
pop edi
pop esi
pop ebx
leave
ret