Function at 0x40a4c0
Capabilities:
Create directory
Create thread
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43ab78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44e848]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0040ad12
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40a505
push 0x80004005
call fcn.00401020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.00409540
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40a546
push 0x104
lea ecx, [esp + 0x18]
call fcn.00401180
mov esi, dword [esp + 0x14]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00427fe0
add esp, 8
cmp eax, ebx
jl 0x40a5ce
cmp eax, dword [esi - 8]
jg 0x40a5ce
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp ebp, ebx
je 0x40a5d8
cmp ebp, 0x104
ja 0x40a5d8
mov eax, dword [edi + 0x5b8]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401390
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00427fe0
add esp, 8
cmp eax, ebx
jl 0x40a5ce
cmp eax, dword [esi - 8]
jg 0x40a5ce
push ebx
xor edx, edx
mov dword [esi - 0xc], eax
push esi
mov word [esi + eax*2], dx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x43ec4c
lea ecx, [esp + 0x18]
call fcn.00403820
jmp 0x40a63a
push 0x80070057
call fcn.00401020
lea ecx, [esp + 0x14]
call fcn.00403210
lea edx, [edi + 0x3aa]
cmp edx, ebx
jne 0x40a5ef
xor eax, eax
jmp 0x40a603
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a5f4
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.00403430
push 4
push str.Temp
lea ecx, [esp + 0x1c]
call fcn.00401390
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
push 0x43ec4c
lea ecx, [esp + 0x1c]
call fcn.00401390
push 9
push str.setup.exe
lea ecx, [esp + 0x1c]
call fcn.00401390
lea eax, [edi + 0x14c]
mov dword [0x4500ac], edi
cmp eax, ebx
jne 0x40a662
mov dword [0x4500b8], ebx
jmp 0x40a66b
mov ecx, dword [eax + 0x20]
mov dword [0x4500b8], ecx
push ebx
push 0x43ebcc
mov ecx, 0x4500b0
call fcn.00403430
lea edx, [esp + 0x14]
push edx
mov ecx, 0x4500b4
call fcn.004055d0
lea eax, [edi + 0x5bc]
push eax
mov ecx, 0x4500bc
call fcn.004055d0
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00409490
push eax
push 0x43f714
call fcn.00407e20
mov bl, al
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a6d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, 0x4500c0
test bl, bl
je 0x40a6e9
push 5
push str.runas
jmp 0x40a6f0
push 0
push 0x43ebcc
call fcn.00403430
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x4500ac
push 0x408390
push 0
push 0
call fcn.00428100
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0x18
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a73a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret