Function at 0x40aeb0
Capabilities:
Read file on windows
Set environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529609
mov eax, dword fs:[0]
push eax
mov eax, 0x4264
call fcn.00509ca0
mov eax, dword [0x58c8c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [str.install_test.exe]
mov ecx, dword [0x53fd54]
mov edx, dword [0x53fd58]
mov edi, dword [ebp + 0xc]
mov dword [0x58e1d8], eax
mov eax, dword [0x53fd5c]
mov dword [0x58e1e4], eax
mov eax, dword [ebp + 8]
mov dword [0x58e1dc], ecx
mov cl, byte [0x53fd60]
xor ebx, ebx
mov dword [0x58e1e0], edx
mov byte [0x58e1e8], cl
cmp eax, 3
jle 0x40af3f
mov ecx, dword [edi + 0xc]
mov edx, 0x58e1d8
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x40af30
jmp 0x40b03d
cmp eax, 2
jle 0x40b03d
mov esi, dword [edi + 4]
mov eax, esi
mov dword [ebp - 0x4124], 0xf
mov dword [ebp - 0x4128], ebx
mov byte [ebp - 0x4138], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40af66
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x4138]
call fcn.004034e0
lea edx, [ebp - 0x4138]
push edx
mov dword [ebp - 4], ebx
call fcn.00402a60
add esp, 4
push eax
push 0x53fd3c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, dword [edi + 8]
mov eax, esi
mov dword [ebp - 0x40ec], 0xf
mov dword [ebp - 0x40f0], ebx
mov byte [ebp - 0x4100], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40afb8
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x4100]
call fcn.004034e0
lea eax, [ebp - 0x4100]
push eax
mov byte [ebp - 4], 1
call fcn.00402a60
add esp, 4
push eax
push str.XSBPATHI
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, 0x10
cmp dword [ebp - 0x40ec], esi
jb 0x40b009
mov ecx, dword [ebp - 0x4100]
push ecx
call fcn.0041a1a9
add esp, 4
mov dword [ebp - 0x40ec], 0xf
mov dword [ebp - 0x40f0], ebx
mov byte [ebp - 0x4100], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x4124], esi
jb 0x40b03d
mov edx, dword [ebp - 0x4138]
push edx
call fcn.0041a1a9
add esp, 4
push 0x58e1d8
push str.output:__s_r_n
call fcn.00509679
add esp, 8
push ebx
lea eax, [ebp - 0x4264]
push eax
push 0x58e5dc
mov dword [ebp - 0x4264], 1
mov dword [ebp - 0x4260], ebx
mov dword [ebp - 0x425c], ebx
mov dword [ebp - 0x4258], ebx
call sub.gdiplus.dll_GdiplusStartup
call fcn.00409650
push ebx
lea ecx, [ebp - 0x4254]
call fcn.00404490
lea ecx, [ebp - 0x4228]
call fcn.00406b60
lea ecx, [ebp - 0x4224]
mov dword [ebp - 4], 2
call fcn.00412bb0
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call esi
push 1
mov dword [ebp - 0x4240], eax
call esi
push ebx
mov dword [ebp - 0x423c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [edi]
mov dword [ebp - 0x422c], eax
mov eax, esi
mov dword [0x58e5d8], esi
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40b0e0
sub eax, ecx
push eax
push esi
mov ecx, 0x58810c
call fcn.004034e0
mov ecx, dword [edi]
push 0x539f20
push ecx
call fcn.00509662
mov edi, eax
add esp, 8
mov dword [ebp - 0x4230], edi
cmp edi, ebx
jne 0x40b138
push str.Open_file_failed_n
call fcn.00509679
add esp, 4
lea ecx, [ebp - 0x4228]
mov dword [ebp - 4], 0xffffffff
call fcn.00406b70
or eax, 0xffffffff
jmp 0x40b832
push 2
push ebx
push edi
call fcn.00509c20
push edi
call fcn.00509b31
push ebx
push ebx
push edi
mov esi, eax
call fcn.00509c20
add esp, 0x1c
cmp esi, 0x1c6a00
jne 0x40b7dc
mov eax, 0xf
mov dword [ebp - 0x40d0], eax
mov dword [ebp - 0x40d4], ebx
mov byte [ebp - 0x40e4], bl
mov dword [ebp - 0x4098], eax
mov dword [ebp - 0x409c], ebx
mov byte [ebp - 0x40ac], bl
mov dword [ebp - 0x40b4], eax
mov dword [ebp - 0x40b8], ebx
mov byte [ebp - 0x40c8], bl
lea edx, [ebp - 0x4138]
push edx
mov byte [ebp - 4], 5
call fcn.004039f0
add esp, 4
push eax
lea ecx, [ebp - 0x40e4]
mov byte [ebp - 4], 6
call fcn.00403710
cmp dword [ebp - 0x4124], 0x10
mov byte [ebp - 4], 5
jb 0x40b1da
mov eax, dword [ebp - 0x4138]
push eax
call fcn.0041a1a9
add esp, 4
push 0x539f00
push 0x58e1d8
call fcn.00509662
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40b298
push 0x58e1d8
push str.Open__s_failed__n
call fcn.00509679
push edi
call fcn.0050917b
mov edi, 0x10
add esp, 0xc
cmp dword [ebp - 0x40b4], edi
jb 0x40b22a
mov ecx, dword [ebp - 0x40c8]
push ecx
call fcn.0041a1a9
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x40b4], esi
mov dword [ebp - 0x40b8], ebx
mov byte [ebp - 0x40c8], bl
cmp dword [ebp - 0x4098], edi
jb 0x40b258
mov edx, dword [ebp - 0x40ac]
push edx
call fcn.0041a1a9
add esp, 4
mov dword [ebp - 0x4098], esi
mov dword [ebp - 0x409c], ebx
mov byte [ebp - 0x40ac], bl
cmp dword [ebp - 0x40d0], edi
jb 0x40b281
mov eax, dword [ebp - 0x40e4]
push eax
call fcn.0041a1a9
add esp, 4
mov dword [ebp - 0x40d0], esi
mov dword [ebp - 0x40d4], ebx
mov byte [ebp - 0x40e4], bl
jmp 0x40b11e
mov ecx, dword [ebp - 0x422c]
mov eax, dword [ebp - 0x423c]
push ebx
push ecx
push ebx
cdq
push ebx
sub eax, edx
push 0x1e
sar eax, 1
push 0xb4
sub eax, 0x5a
push eax
mov eax, dword [ebp - 0x4240]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x5a
push eax
push 0x90400000
push ebx
push str.static
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push str.Waiting_...
push eax
mov dword [0x58e5e0], eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 0x4000
lea edx, [ebp - 0x4090]
push 1
push edx
call fcn.00509980
add esp, 0x10
cmp eax, ebx
jbe 0x40b330
push esi
push eax
lea eax, [ebp - 0x4090]
push 1
push eax
call fcn.0050952c
push edi
push 0x4000
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.00509980
add esp, 0x20
cmp eax, ebx
ja 0x40b305
push esi
call fcn.0050917b
mov eax, 0x58e1d8
add esp, 4
mov dword [ebp - 0x4108], 0xf
mov dword [ebp - 0x410c], ebx
mov byte [ebp - 0x411c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40b357
sub eax, edx
push eax
push 0x58e1d8
lea ecx, [ebp - 0x411c]
call fcn.004034e0
lea edx, [ebp - 0x411c]
push edx
lea eax, [ebp - 0x4170]
push eax
mov byte [ebp - 4], 7
call fcn.00403790
add esp, 8
mov esi, 0x10
mov byte [ebp - 4], 9
cmp dword [ebp - 0x4108], esi
jb 0x40b3ab
mov ecx, dword [ebp - 0x411c]
push ecx
call fcn.0041a1a9
add esp, 4
cmp dword [ebp - 0x415c], 8
mov eax, dword [ebp - 0x4170]
mov dword [ebp - 0x4108], 0xf
mov dword [ebp - 0x410c], ebx
mov byte [ebp - 0x411c], bl
jae 0x40b3d6
lea eax, [ebp - 0x4170]
push eax
push str.setup_LoaderIcon.ico
call fcn.00402190
add esp, 8
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x40e4]
push edx
lea ecx, [ebp - 0x40c8]
call fcn.004032d0
push 8
push str.test.zip
lea ecx, [ebp - 0x40c8]
call fcn.00403db0
mov eax, dword [ebp - 0x40c8]
cmp dword [ebp - 0x40b4], esi
jae 0x40b41f
lea eax, [ebp - 0x40c8]
push eax
lea ecx, [ebp - 0x4254]
call fcn.00404560
lea ecx, [ebp - 0x4254]
call fcn.004044b0
lea eax, [ebp - 0x4254]
push eax
push 0x53fc8c
lea ecx, [ebp - 0x4228]
call fcn.00406b80
lea ecx, [ebp - 0x4254]
call fcn.00404570
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x40e4]
push ecx
lea ecx, [ebp - 0x40ac]
call fcn.004032d0
push 8
push str.qlib.zip
lea ecx, [ebp - 0x40ac]
call fcn.00403db0
mov eax, dword [ebp - 0x40ac]
cmp dword [ebp - 0x4098], esi
jae 0x40b493
lea eax, [ebp - 0x40ac]
push eax
lea ecx, [ebp - 0x4254]
call fcn.00404560
lea ecx, [ebp - 0x4254]
call fcn.004044b0
lea edx, [ebp - 0x4254]
push edx
push str.setup
lea ecx, [ebp - 0x4228]
call fcn.00406b80
lea ecx, [ebp - 0x4254]
call fcn.00404570
push 0x53fc7c
push 0x58e1d8
call fcn.00509662
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40b52d
push 0x58e1d8
push str.Open__s_failed__n
call fcn.00509679
push edi
call fcn.0050917b
add esp, 0xc
lea ecx, [ebp - 0x4170]
call fcn.00402e30
lea ecx, [ebp - 0x40c8]
call fcn.00402e00
lea ecx, [ebp - 0x40ac]
call fcn.00402e00
lea ecx, [ebp - 0x40e4]
call fcn.00402e00
jmp 0x40b11e
cmp dword [ebp - 0x40b4], 0x10
mov eax, dword [ebp - 0x40c8]
jae 0x40b542
lea eax, [ebp - 0x40c8]
push 0x539f20
push eax
call fcn.00509662
add esp, 8
mov dword [ebp - 0x422c], eax
cmp eax, ebx
je 0x40b7cd
cmp dword [ebp - 0x4098], 0x10
mov eax, dword [ebp - 0x40ac]
jae 0x40b573
lea eax, [ebp - 0x40ac]
push 0x539f20
push eax
call fcn.00509662
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x40b7c7
push 2
push ebx
push esi
call fcn.00509c20
push esi
call fcn.00509b31
push edi
push 0x4000
mov dword [ebp - 0x4234], eax
lea eax, [ebp - 0x4090]
push 1
push eax
call fcn.00509980
add esp, 0x20
cmp eax, ebx
jbe 0x40b5eb
jmp 0x40b5c0
push esi
push eax
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.0050952c
push edi
push 0x4000
lea edx, [ebp - 0x4090]
push 1
push edx
call fcn.00509980
add esp, 0x20
cmp eax, ebx
ja 0x40b5c0
push esi
call fcn.00509b31
mov dword [ebp - 0x4238], eax
mov eax, dword [ebp - 0x422c]
push eax
push 0x4000
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.00509980
add esp, 0x14
cmp eax, ebx
jbe 0x40b649
push esi
push eax
lea edx, [ebp - 0x4090]
push 1
push edx
call fcn.0050952c
mov eax, dword [ebp - 0x422c]
push eax
push 0x4000
lea ecx, [ebp - 0x4090]
push 1
push ecx
call fcn.00509980
add esp, 0x20
cmp eax, ebx
ja 0x40b618
lea edx, [ebp - 0x50]
push edx
push edi
lea ecx, [ebp - 0x4224]
call fcn.00413610
mov ebx, dword [ebp - 0x422c]
lea eax, [ebp - 0x90]
push eax
push ebx
lea ecx, [ebp - 0x4224]
call fcn.00413610
push esi
push 4
lea ecx, [ebp - 0x4234]
push 1
push ecx
call fcn.0050952c
push esi
push 0x20
lea edx, [ebp - 0x50]
push 1
push edx
call fcn.0050952c
push esi
push 4
lea eax, [ebp - 0x4238]
push 1
push eax
call fcn.0050952c
push esi
push 0x20
lea ecx, [ebp - 0x90]
push 1
push ecx
call fcn.0050952c
add esp, 0x40
push esi
push 9
push 1
push str._____end
call fcn.0050952c
push ebx
call fcn.0050917b
mov edx, dword [ebp - 0x4230]
push edx
call fcn.0050917b
push edi
call fcn.0050917b
push esi
call fcn.0050917b
mov eax, dword [0x58e5e0]
add esp, 0x20
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x53fc74
lea ecx, [ebp - 0x4154]
call fcn.004035e0
push str.setup_
lea ecx, [ebp - 0x4154]
mov byte [ebp - 4], 0xa
call fcn.00403660
lea ecx, [ebp - 0x4154]
push ecx
lea ecx, [ebp - 0x418c]
call fcn.00409cf0
push str.uninstallicon.ico
lea ecx, [ebp - 0x418c]
mov byte [ebp - 4], 0xb
call fcn.00403660
push str.uninstall.exe
lea ecx, [ebp - 0x4154]
call fcn.00403660
mov ecx, dword [ebp - 0x4154]
mov eax, 8
cmp dword [ebp - 0x4140], eax
jae 0x40b765
lea ecx, [ebp - 0x4154]
cmp dword [ebp - 0x4178], eax
mov eax, dword [ebp - 0x418c]
jae 0x40b779
lea eax, [ebp - 0x418c]
push ecx
push eax
call fcn.00402190
add esp, 8
lea ecx, [ebp - 0x418c]
call fcn.00402e30
lea ecx, [ebp - 0x4154]
call fcn.00402e30
lea ecx, [ebp - 0x4170]
call fcn.00402e30
lea ecx, [ebp - 0x40c8]
call fcn.00402e00
lea ecx, [ebp - 0x40ac]
call fcn.00402e00
lea ecx, [ebp - 0x40e4]
call fcn.00402e00
jmp 0x40b81e
mov edi, dword [ebp - 0x4230]
push str.test.zip
push str.fopen__s_failed__n
jmp 0x40b4ee
push edi
call fcn.0050917b
add esp, 4
call fcn.0040a0a0
lea ecx, [ebp - 0x4270]
call fcn.00413730
push 0x86000000
push 5
push 3
push 0x40a5c0
push str.Cwin
lea ecx, [ebp - 0x4270]
call fcn.00413750
lea ecx, [ebp - 0x4270]
call fcn.00413860
lea ecx, [ebp - 0x4228]
mov dword [ebp - 4], 0xffffffff
call fcn.00406b70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005089e3
mov esp, ebp
pop ebp
ret