Function at 0x4025d8
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create directory
Delete file
Delete registry key
Get file attributes
Get graphical window text
Get installed programs
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa7c
mov eax, dword [0x415010]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
mov esi, dword [ebp + 0x7c]
xor ebx, ebx
push edi
mov dword [ebp - 0x9d0], esi
mov dword [ebp - 0x9d4], ebx
cmp esi, ebx
je 0x402617
push 0x3ee
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x9d4], eax
push str.Start_Install_Process...
call fcn.00401186
pop ecx
mov eax, str.__x64_
cmp dword [0x415f2c], ebx
jne 0x402634
mov eax, str.__x86_
push 0x415f34
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
push eax
push str.WinVer:__08X_s__LiuVer:__s
call fcn.00401186
add esp, 0x10
cmp dword [ebp - 0x9d4], ebx
je 0x40268e
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000
push ebx
push 0x401
push dword [ebp - 0x9d4]
call edi
push ebx
push 1
push 0x404
push dword [ebp - 0x9d4]
call edi
push ebx
push ebx
push 0x405
push dword [ebp - 0x9d4]
call edi
cmp dword [0x416ab8], ebx
je 0x4026cf
push 0x14
lea eax, [ebp + 0x48]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x30
lea eax, [ebp + 0x48]
push eax
push 0x411db0
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00401079
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
jmp 0x402e05
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
cmp esi, ebx
je 0x4026f7
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa0
push ebx
call edi
lea eax, [ebp - 0x80]
push eax
push 0x3f3
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push str.LiuPack
mov esi, 0x416cd0
push esi
mov dword [ebp - 0x9d8], eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
call fcn.00402022
test eax, eax
jne 0x402767
cmp dword [ebp - 0x9d0], ebx
je 0x402737
push 0x14
lea eax, [ebp + 0x48]
push eax
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xaa
push ebx
call edi
push 0x30
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4026c8
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x416368
lea eax, [ebp - 0x9cc]
push 0x4113e0
push eax
call esi
mov eax, dword [ebp - 0x9d8]
add eax, 0xc8
push eax
call fcn.004024c2
add esp, 0x14
cmp dword [ebp - 0x9d4], ebx
je 0x4027b0
push ebx
push ebx
push 0x405
push dword [ebp - 0x9d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x415f58
lea eax, [ebp - 0x3b4]
push str._sBoshiamyTIPuninst.exe
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4027f9
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4027f9
push 4
push ebx
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
lea eax, [ebp - 0x9d8]
push eax
push 0x20206
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.BoshiamyTIP
push dword [ebp - 0x9d8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x9d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x9d0], ebx
je 0x40285e
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa1
push ebx
call edi
lea eax, [ebp - 0x80]
push eax
push 0x3f3
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x9d8], eax
mov dword [ebp - 0xa08], str.BoshiamyTIP.dll
mov dword [ebp - 0xa04], str.BoshiamyTIP_x64.dll
mov dword [ebp - 0xa00], str.liu_uni.tab
mov dword [ebp - 0x9fc], str.liu_uni2.tab
mov dword [ebp - 0x9f8], str.liu_uni3.tab
mov dword [ebp - 0x9f4], str.liu_uni4.tab
mov dword [ebp - 0x9f0], str.liuphon.tab
mov dword [ebp - 0x9ec], str.BoshiamyConfig.exe
mov dword [ebp - 0x9e8], str.LiuBoxEditor.exe
mov dword [ebp - 0x9e4], str.LiuQuery.exe
mov dword [ebp - 0x9e0], str.unliu64.exe
cmp dword [0x415f2c], ebx
jne 0x4028ea
mov dword [ebp - 0x9e0], str.unliu.exe
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa2
push ebx
call edi
push 0x415f58
lea eax, [ebp - 0x5bc]
push str._sBoshiamyTIP
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4029c9
push ebx
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x4029c9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x5bc]
push eax
push str.Error:_CreateDirectory____s___ErrCode__X_
call fcn.00401186
add esp, 0xc
cmp dword [ebp - 0x9d0], ebx
je 0x40296f
push 0x14
lea eax, [ebp + 0x48]
push eax
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xab
push ebx
call edi
lea eax, [ebp - 0xa08]
sub eax, 4
push dword [eax]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x148]
push eax
call esi
add esp, 0xc
push 0x30
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x9d0]
call fcn.00402511
pop ecx
jmp 0x4026c8
mov eax, dword [ebp - 0x9d8]
add eax, 0xc8
push eax
call fcn.004024c2
pop ecx
mov dword [ebp - 0x9dc], ebx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d0], ebx
je 0x402a2a
mov eax, dword [ebp - 0x9dc]
push dword [ebp + eax*4 - 0xa08]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x148]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push 0x3f3
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [ebp - 0x9dc]
push dword [ebp + eax*4 - 0xa08]
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x3b4]
push 0x4113e0
push eax
call esi
mov eax, dword [ebp - 0x9dc]
push dword [ebp + eax*4 - 0xa08]
lea eax, [ebp - 0x5bc]
push 0x415f58
push str._sBoshiamyTIP_s
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402aea
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
mov eax, dword [ebp - 0x9dc]
push dword [ebp + eax*4 - 0xa08]
lea eax, [ebp - 0x7c4]
push 0x415f58
push str._sBoshiamyTIP_s._lu
push eax
call esi
add esp, 0x14
push ebx
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x402c67
push 5
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x7c4]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov dword [0x416d10], 1
jmp 0x402b07
push ebx
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x402c67
mov eax, dword [ebp - 0x9d8]
add eax, 0x42
push eax
call fcn.004024c2
inc dword [ebp - 0x9dc]
cmp dword [ebp - 0x9dc], 0xb
pop ecx
jb 0x4029e1
cmp dword [ebp - 0x9d4], ebx
je 0x402b45
push ebx
push ebx
push 0x405
push dword [ebp - 0x9d4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x9d0], ebx
je 0x402b70
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa3
push ebx
call edi
lea eax, [ebp - 0x80]
push eax
push 0x3f3
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x32
mov dword [ebp - 0x9d8], eax
lea eax, [ebp - 0xe4]
push eax
push 0x85
push ebx
call edi
push 0x416778
lea eax, [ebp - 0x3b4]
push str._s_regsvr32
push eax
call esi
push 0x415f58
lea eax, [ebp - 0x7c4]
push str._sBoshiamyTIP
push eax
call esi
lea eax, [ebp - 0x1ac]
push str._s_BoshiamyTIP.dll
push eax
call esi
push ebx
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x3b4]
push eax
call fcn.004010ec
lea eax, [ebp - 0x1ac]
push str._s_BoshiamyTIP_x64.dll
push eax
call esi
push ebx
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x3b4]
push eax
call fcn.004010ec
mov eax, dword [ebp - 0x9d8]
add eax, 0xc8
add esp, 0x48
push eax
call fcn.004024c2
pop ecx
cmp dword [ebp - 0x9d4], ebx
je 0x402c35
push ebx
push ebx
push 0x405
push dword [ebp - 0x9d4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x9d0], ebx
je 0x402cc9
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa4
push ebx
call edi
lea eax, [ebp - 0x80]
push eax
mov esi, 0x3f3
push esi
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x402cce
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x3b4]
push eax
push dword [ebp - 0x9dc]
push str.Error:_CopyFile____02d____s____s___ErrCode__X_
call fcn.00401186
add esp, 0x14
cmp dword [ebp - 0x9d0], ebx
je 0x402ca9
push 0x14
lea eax, [ebp + 0x48]
push eax
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xab
push ebx
call edi
mov eax, dword [ebp - 0x9dc]
push dword [ebp + eax*4 - 0xa08]
jmp 0x402988
mov esi, 0x3f3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x9d8], eax
call fcn.00402224
test eax, eax
jne 0x402d0d
cmp dword [ebp - 0x9d0], ebx
je 0x402cfd
push 0x14
lea eax, [ebp + 0x48]
push eax
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xaf
jmp 0x402742
mov eax, dword [ebp - 0x9d8]
add eax, 0xc8
push eax
call fcn.004024c2
pop ecx
cmp dword [ebp - 0x9d4], ebx
je 0x402d3a
push ebx
push ebx
push 0x405
push dword [ebp - 0x9d4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x9d0], ebx
je 0x402d61
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa6
push ebx
call edi
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x9d8], eax
lea eax, [ebp - 0x9cc]
push eax
call fcn.0040127e
mov eax, dword [ebp - 0x9d8]
add eax, 0xc8
push eax
call fcn.004024c2
push 0x80
push dword [0x4169bc]
call fcn.00402e17
add esp, 0x10
test al, al
jne 0x402dbc
cmp dword [ebp - 0x9d4], ebx
je 0x402dbc
push ebx
push ebx
push 0x405
push dword [ebp - 0x9d4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x9d0], ebx
je 0x402dfd
push 0x64
lea eax, [ebp - 0x80]
push eax
push 0xa7
push ebx
call edi
lea eax, [ebp - 0x80]
push eax
push esi
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 5
push 0x3f4
push dword [ebp - 0x9d0]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401272
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040762a
add ebp, 0x74
leave
ret