Function at 0x402d50
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x40605b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov eax, dword [esp + 0x9c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa4]
mov ebp, ecx
mov ecx, dword [esp + 0xa0]
push eax
push esi
push ecx
mov ecx, ebp
mov dword [esp + 0x18], ebp
call entry0
push str.Runs_the_given_file_and_deletes_it._It_also_removes_the_given_key_from_Add_Remove_Program_list
push str.NVU_File__Uninstall_Reg_key
xor ebx, ebx
push 0x4043d0
push str.Uninstall
mov ecx, ebp
mov dword [esp + 0xa8], ebx
mov dword [ebp + 0x558], esi
mov byte [ebp + 0x5e4], bl
call fcn.004014a0
push str.Uninstalls_the_given_product_from_add_remove_programs._nIf_it_detects_uninstall_as_its_nvu_it_uses_internal_uninstall_command_otherwise_calls_the_appropriate_uninstall_command.
push str.Uninstall_Display_Reg_key
push 0x404490
push str.UnInstallEx
mov ecx, ebp
call fcn.004014a0
push str.Adds_Display_name_as_the_title_to_in_Add_Remove_programs_list_and_copies_uninstall_binary_and_script_file_to_windows_system_directory
push str.Uninstall_File___Display_Name
push 0x404520
push str.AddUninstall
mov ecx, ebp
call fcn.004014a0
push str.Put_the_given_file_for_delete_in_the_next_reboot._nIf_the_file_exists_it_will_ask_user_for_the_reboot_when_program_ends.
push str.Path_to_files_to_be_deleted_on_reboot
push 0x403f00
push str.DelBoot
mov ecx, ebp
call fcn.004014a0
push str.Deletes_the_given_file_if_it_exists__It_also_deletes_a_directory_if_it_is_empty._If_the_file_is_locked_it_will_set_the_system_to_delete_the_file_upon_reboot
push str.Path_to_file_to_be_deleted
push fcn.00403960
push 0x40a410
mov ecx, ebp
call fcn.004014a0
push str.Copies_a_file_from_the_given_source_to_given_dest
push str.Srcfile_DstFile
push 0x4039e0
push str.Copy
mov ecx, ebp
call fcn.004014a0
push str.Deletes_regkey_s__matching_the_given_registry_key
push str.Registry_pattern_matching_string
push 0x403810
push str.DelReg
mov ecx, ebp
call fcn.004014a0
push str.Only_deletes_regkey_s__matching_the_given_registry_key_if_they_have_no_subkeys_or_values
push str.Registry_pattern_matching_string
push 0x403890
push str.DelRegE
mov ecx, ebp
call fcn.004014a0
push str.For_all_the_matching_registry_paths__sets_values_if__value__is_present__creates_subkeys_otherwise
push str.Registry_pattern_matching_stringName_value_
push 0x403680
push str.SetReg
mov ecx, ebp
call fcn.004014a0
push str.If_it_finds_name_under_regkeypath_copies_its_value_to_the_given_variable__othewise_does_nothing.
push str.Variable__regkeypathName
push 0x404840
push str.GetReg
mov ecx, ebp
call fcn.004014a0
push str.uninstalls_the_given_service_name
push str.Service_Name
push 0x404210
push str.UninstallService
mov ecx, ebp
call fcn.004014a0
push str.Remove_any_device_matched_with_the_given_description_from_the_system_using_setupdi_calls._nEnum_can_be__PCI__EISA__etc___HWID_usually_is_VEN_10DE_and_device_type_can_be_DISPLAY_HDC_MEDIA_NET_SYSTEM
push str.Enum_Type___Hardware_ID__Device_type
push 0x4057e0
push str.RemoveDevice
mov ecx, ebp
call fcn.004014a0
push str.Installs_the_given_driver_for_any_device_matched_with_the_given_device_ID_from_the_system_using_setupdi_calls.
push str.Hardware_ID__InfFullPath
push 0x405570
push str.InstallDriverEx
mov ecx, ebp
call fcn.004014a0
push str.Installs_the_given_driver_for_any_device_matched_using_UpdateDriverForPlugAndPlayDevices_for_Win200_and_above_and_InstallDriverEx_for_Win95_and_Win98
push str.Hardware_ID__InfFullPath
push 0x405130
push str.InstallDriver
mov ecx, ebp
call fcn.004014a0
push str.This_function_first_creates_a_device_Installs_the_driver_for_this_device_using_given_inf._This_function_should_work_for_all_versions_of_Windows
push str.Hardware_ID__InfFullPath
push 0x405370
push str.CreateDevice
mov ecx, ebp
call fcn.004014a0
push str.Sets_the_given_variable_to_a_string_representing_the_infs_GUID
push str.Variable_Name__Full_Path_to_Inf
push 0x405000
push str.GetInfGUID
mov ecx, ebp
call fcn.004014a0
push str._it_searches_in_all_inf_files_under_sysdirinf_Wildcard_and_OEM.inf__and_if_it_finds_a_match_with_given_parameters_it_deletes_it_on_reboot
push str.WildCard___Section___Name___Value____..._
push 0x405bd0
push str.DelOemInfs
mov ecx, ebp
call fcn.004014a0
push str.it_searches_in_all_inf_files_under_sysdirinfOEM.inf_and_if_it_finds_a_match_with_given_parameters_it_deletes_it_on_reboot
push str.Inffile___Section___Name___Value_____..._
push 0x405ab0
push str.DelIniIfMatched
mov ecx, ebp
call fcn.004014a0
push str.Replaces_all_uninstall_keys_listed_with_the_first_one_in_the_list_creates_main_NVU_file_to_call_all_othernvu_files_during_uninstall.
push str.Unified_Display_Name___DispName1___NVUFile1_____..._
push 0x4058b0
push str.UnifyUninst
mov ecx, ebp
call fcn.004014a0
push str.Enumerates_all_keys_matching_the_given_regpath_and_when_matched_calls_the_given_command_Current_Reg_Key_is_set_then_the_given_command_is_executed
push str.RegPathToEnumatrate___Command
push 0x405c60
push str.EnumRegCmd
mov ecx, ebp
call fcn.004014a0
push str.Adds_the_given_name_to_environment_variables_and_sets_its_value
push str.NameValue
push 0x405e00
push str.SetEnv
mov ecx, ebp
call fcn.004014a0
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionUninstall
push str.UninstRegKey
mov ecx, ebp
call fcn.00401670
push 0x409a50
push str.Install_ITB_Driver
mov ecx, ebp
call fcn.00401670
push str.sysdir
mov ecx, ebp
call fcn.00401560
lea edx, [ebp + 0x564]
mov esi, edx
mov cl, byte [eax]
inc eax
mov byte [esi], cl
inc esi
test cl, cl
jne 0x403015
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.NVUninst.nvu]
dec edi
push edx
push str.Master_Data_File
mov dword [edi], eax
mov ecx, dword [0x409a30]
mov dword [edi + 4], ecx
mov eax, dword [0x409a34]
mov dword [edi + 8], eax
mov cx, word [0x409a38]
mov word [edi + 0xc], cx
mov ecx, ebp
call fcn.00401670
mov edx, dword [ebp + 0x550]
push 0x80
push 0x40b9f8
push 1
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [ebp + 0x550]
lea eax, [esp + 0x14]
push 0x80
push eax
push ecx
mov dword [ebp + 0x54c], 0x40b9f8
mov dword [ebp + 0x558], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.sysdir
mov ecx, ebp
call fcn.00401560
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
mov esi, ecx
mov ecx, ebp
call fcn.00401b60
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esi + ecx + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ecx, ebp
mov ebx, eax
push str.sysdir
call fcn.00401560
mov esi, ebx
mov cl, byte [eax]
inc eax
mov byte [esi], cl
inc esi
test cl, cl
jne 0x4030e9
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.00401b60
mov edi, eax
or ecx, 0xffffffff
dec edi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
sete al
test al, al
mov byte [ebp + 0x5e5], al
pop edi
jne 0x403173
push 0x31
push 0x10000
push ebx
mov ecx, ebp
call fcn.00403430
test al, al
je 0x403173
push 0
lea ecx, [esp + 0x14]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403173
push ebx
mov ecx, ebp
call fcn.004022b0
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x94]
add esp, 4
mov eax, ebp
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 0xc