Function at 0x403c49
Capabilities:
Copy file
Create process on windows
Create process suspended
Delete file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
xor eax, eax
mov edi, 0x409280
mov ebx, 0x409278
push eax
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xc8], ebx
call fcn.00401b09
mov esi, 0x409274
push 0
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xac], ebx
call fcn.00401b09
push 0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x90], ebx
call fcn.00401b09
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], ebx
call fcn.00401b09
push 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], ebx
call fcn.00401b09
push 0
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x1cc], edi
mov dword [ebp - 0x1c4], ebx
call fcn.00401b09
push 0
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1b0], edi
mov dword [ebp - 0x1a8], ebx
call fcn.00401b09
push 1
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x1bc], esi
call fcn.00401b09
and byte [ebp - 0x5d0], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x5cf]
or dword [ebp - 8], 0xffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x3d8]
mov dword [ebp - 0x3dc], edx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
mov byte [ebp - 9], 1
call fcn.00403026
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00404f70
mov edi, dword [ebp - 0x14]
lea eax, [edi + 4]
push 0x40
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x224], edi
push eax
call fcn.00407ae0
add esp, 0xc
add edi, 0x4c
push str.D:is6CodeXTSetup_setup.cpp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push dword [ebp - 4]
call fcn.00407e18
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x404579
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x22d], 0
je 0x403e36
lea eax, [ebp - 0x264]
push 0x40
push eax
mov eax, dword [ebp - 0x224]
add eax, 4
push eax
call fcn.00407ae0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00404f7b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x409288
call fcn.00403083
lea ecx, [ebp - 8]
call fcn.0040703c
lea ecx, [ebp - 0x58]
call fcn.00406e1a
lea ecx, [ebp - 0x5c]
call fcn.00406e1a
xor esi, esi
jmp 0x40450f
mov edi, 0x409280
push 0
push str.InstallShieldEngine6Intel_32_
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xe4], ebx
call fcn.00406a5b
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x344]
push eax
mov dword [ebp - 0xf8], esi
call fcn.00404fb9
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.00404e2f
add esp, 0xc
lea ecx, [ebp - 0xdc]
push eax
call fcn.00406b8b
lea ecx, [ebp - 0x360]
call fcn.00401b92
lea ecx, [ebp - 0x344]
call fcn.00401b92
lea ecx, [ebp - 0xf8]
call fcn.00401b92
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xdc]
push eax
call fcn.0040675c
push 0
push str.IKernel.exe
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x170], ebx
call fcn.00406a5b
lea eax, [ebp - 0x184]
mov dword [ebp - 0x184], esi
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x37c]
push eax
call fcn.00404e2f
add esp, 0xc
lea ecx, [ebp - 0x3c]
push eax
call fcn.00406b8b
lea ecx, [ebp - 0x37c]
call fcn.00401b92
lea ecx, [ebp - 0x184]
call fcn.00401b92
lea ecx, [ebp - 0x3c]
call fcn.00406fc7
push dword [ebp - 0x38]
lea ecx, [ebp - 0x220]
call fcn.0040797b
test al, al
je 0x40402c
push 0
push str.data1.hdr
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x138], ebx
call fcn.00406a5b
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14c]
push ecx
mov dword [ebp - 0x14c], esi
mov eax, dword [eax + 0x24c]
push eax
lea eax, [ebp - 0x398]
push eax
call fcn.00404f10
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
call fcn.00406fc7
mov eax, dword [ebp - 4]
push 0
push 0x80
push 3
mov eax, dword [eax + 4]
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp dword [ebp - 8], eax
mov dword [ebp - 4], eax
je 0x403fc2
lea ecx, [ebp - 8]
call fcn.0040703c
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x398]
call fcn.00401b92
lea ecx, [ebp - 0x14c]
call fcn.00401b92
cmp dword [ebp - 8], 0xffffffff
je 0x40402c
lea eax, [ebp - 0x20]
push 0
push eax
lea eax, [ebp - 0x9d8]
push 0x1ed
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40402c
mov eax, dword [ebp - 0x214]
and dword [ebp - 0x7c], 0
and dword [ebp - 0x84], 0
cmp dword [ebp - 0x883], eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x87f]
jg 0x40402c
jl 0x404028
cmp edx, ecx
ja 0x40402c
and byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x404408
lea eax, [ebp - 0x2f0]
push 0
push eax
call fcn.004045df
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xc0]
call fcn.00406b8b
lea ecx, [ebp - 0x2f0]
call fcn.00401b92
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xc0]
push eax
call fcn.0040675c
lea eax, [ebp - 0x29c]
lea ecx, [ebp - 0xc0]
push eax
call fcn.004049e5
push eax
lea ecx, [ebp - 0xa4]
call fcn.00406b8b
lea ecx, [ebp - 0x29c]
call fcn.00401b92
xor eax, eax
cmp dword [ebp - 0x94], eax
je 0x4040ab
push dword [ebp - 0x94]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x4040c1
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xa4]
push eax
call fcn.00406b8b
push 0
push 0x40b3ac
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x100], ebx
call fcn.00406a5b
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], esi
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.00404e2f
add esp, 0xc
lea ecx, [ebp - 0x78]
push eax
call fcn.00404a9d
lea ecx, [ebp - 0x328]
call fcn.00401b92
lea ecx, [ebp - 0x114]
call fcn.00401b92
push 0
push str.IKernel.ex_
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x11c], ebx
call fcn.00406a5b
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x130], esi
call fcn.00406fc7
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push ecx
mov eax, dword [eax + 0x24c]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.00404f10
mov ecx, eax
add esp, 0xc
mov dword [ebp - 4], ecx
call fcn.00406fc7
mov eax, dword [ebp - 4]
push 0
push dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb al, al
lea ecx, [ebp - 0x2b8]
inc al
mov byte [ebp - 0x15], al
call fcn.00401b92
lea ecx, [ebp - 0x130]
call fcn.00401b92
cmp byte [ebp - 0x15], 0
je 0x4041c8
push 0x231
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.0040657a
lea ecx, [ebp - 0x3c]
call fcn.00406fc7
push 0x80
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x454]
lea ecx, [ebp - 0x3c]
push eax
mov dword [ebp - 0x4c], 0x104
call fcn.004047aa
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.00406fc7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004047aa
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.00406fc7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x47c]
push eax
call fcn.004047aa
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.00406fc7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00404833
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.00406fc7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x404]
push eax
call fcn.00404833
mov ecx, eax
mov dword [ebp - 0x10], ecx
call fcn.00406fc7
lea ecx, [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x5d0]
push ecx
mov eax, dword [eax + 4]
push dword [ebp - 4]
push dword [ebp - 0x84]
push dword [ebp - 0x7c]
push dword [ebp - 0x20]
push eax
push 0
call sub.VERSION.dll_VerInstallFileA
lea ecx, [ebp - 0x404]
mov dword [ebp - 4], eax
call fcn.00401b92
lea ecx, [ebp - 0x4a4]
call fcn.00401b92
lea ecx, [ebp - 0x47c]
call fcn.00401b92
lea ecx, [ebp - 0x42c]
call fcn.00401b92
lea ecx, [ebp - 0x454]
call fcn.00401b92
mov eax, dword [ebp - 4]
test al, 1
je 0x404378
lea eax, [ebp - 0x5d0]
push 0
push eax
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x154], ebx
call fcn.00406a5b
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4cc]
push eax
mov dword [ebp - 0x168], esi
call fcn.004047aa
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.00404e2f
mov esi, eax
add esp, 0xc
mov ecx, esi
call fcn.00406fc7
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x2d4]
call fcn.00401b92
lea ecx, [ebp - 0x4cc]
call fcn.00401b92
lea ecx, [ebp - 0x168]
call fcn.00401b92
mov eax, dword [ebp - 4]
test eax, eax
je 0x404408
test al, 4
jne 0x404408
test al, 0x80
mov ebx, eax
jne 0x404393
test ah, 4
je 0x404396
push 0x20
pop ebx
test ah, 2
je 0x40439e
push 5
pop ebx
test ah, 1
je 0x4043a6
push 0x70
pop ebx
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push eax
push 0x9012
mov ecx, edi
call fcn.004065a1
lea ecx, [ebp - 0xdc]
call fcn.004046cf
mov esi, eax
mov ecx, esi
call fcn.00406fc7
push dword [esi + 4]
lea ecx, [ebp - 0x48]
call fcn.0040740b
push eax
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x7e8]
lea ecx, [edi + 0x5e0]
push eax
call fcn.00402495
push 0x256
push ebx
mov ecx, edi
call fcn.0040657a
lea eax, [ebp - 0x30c]
lea ecx, [ebp - 0x3c]
push eax
call fcn.00404715
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00406b8b
lea ecx, [ebp - 0x30c]
call fcn.00401b92
push 1
push str.__RegServer
lea ecx, [ebp - 0x280]
call fcn.004068d0
mov esi, dword [ebp - 0x270]
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push esi
lea ecx, [ebp - 0x190]
call fcn.0040202e
lea ecx, [ebp - 0x280]
call fcn.00401b92
lea ecx, [ebp - 0x1a0]
call fcn.00406fc7
push dword [ebp - 0x19c]
lea eax, [ebp - 0x6e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x5c]
xor esi, esi
push eax
lea eax, [ebp - 0x3dc]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6e4]
push esi
push eax
push esi
mov dword [ebp - 0x3dc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x2710
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x264]
push 0x40
push eax
mov eax, dword [ebp - 0x224]
add eax, 4
push eax
call fcn.00407ae0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00404f7b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x409288
call fcn.00403083
cmp dword [ebp - 8], 0xffffffff
je 0x404507
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00403c22
lea ecx, [ebp - 0x1a0]
call fcn.00401b92
lea ecx, [ebp - 0x1bc]
call fcn.00401b92
lea ecx, [ebp - 0x1d8]
call fcn.00401b92
lea ecx, [ebp - 0x3c]
call fcn.00401b92
lea ecx, [ebp - 0x78]
call fcn.00401b92
lea ecx, [ebp - 0xa4]
call fcn.00401b92
lea ecx, [ebp - 0xc0]
call fcn.00401b92
lea ecx, [ebp - 0xdc]
call fcn.00401b92
lea ecx, [ebp - 0x44]
call fcn.00401d65
push dword [ebp - 0x48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + 0x5d4]
push eax
push 0x9009
call fcn.004065a1
lea eax, [ebp - 0x264]
push 0x40
push eax
mov eax, dword [ebp - 0x224]
add eax, 4
push eax
call fcn.00407ae0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00404f7b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x409288
call fcn.00403083
cmp dword [ebp - 8], 0xffffffff
je 0x4045d8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 8], 0xffffffff
mov esi, edi
jmp 0x404507