Function at 0x4015ad
Capabilities:
Check if file exists
Check os version
Delete file
Get common file path
Get file attributes
Parse pe header
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x740
push ebx
push esi
xor ebx, ebx
push edi
mov word [ebp - 0x538], bx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 2
jne 0x401610
cmp dword [ebp - 0x124], 6
ja 0x401604
jne 0x401610
cmp dword [ebp - 0x120], 2
jb 0x401610
mov dword [0x40440c], 0x1100
jmp 0x40161a
mov dword [0x40440c], 8
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
not edi
xor edi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
push 0x104
xor edi, eax
lea eax, [ebp - 0x740]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401698
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x40167c
push str.This_installer_is_for_Windows_2000_and_later_n
call fcn.00401077
pop ecx
mov dword [0x404408], 0xfd
jmp 0x4018a0
push eax
push str.GetModuleFileName___failed____u_n
call fcn.00401077
pop ecx
pop ecx
mov dword [0x404408], 0xff
jmp 0x4018a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp word [eax], 0x5a4d
jne 0x401872
cmp dword [ecx], 0x4550
jne 0x401872
movzx eax, word [ecx + 0x14]
lea ebx, [eax + ecx + 0x18]
movzx eax, word [ecx + 6]
xor esi, esi
test eax, eax
mov dword [ebp - 8], eax
jbe 0x4016fd
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 4]
push 8
mov edx, str..tsustub
call section..text
test eax, eax
je 0x4016f2
add dword [ebp - 4], 0x28
inc esi
cmp esi, dword [ebp - 8]
jb 0x4016d3
jmp 0x4016fd
imul esi, esi, 0x28
mov esi, dword [esi + ebx + 0x14]
test esi, esi
jne 0x40171d
push str..tsustub
push str.Executable_has_no__s_section_n
call fcn.00401077
pop ecx
pop ecx
mov dword [0x404408], 0xfe
jmp 0x4018a0
lea eax, [ebp - 0x538]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x401744
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempPath___failed____u_n
jmp 0x401682
xor ebx, ebx
cmp word [ebp - 0x538], bx
lea eax, [ebp - 0x538]
je 0x40175c
inc eax
inc eax
cmp word [eax], bx
jne 0x401755
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push str.Tsu_08lX.dll
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x538]
push eax
push 0xffffffffffffffff
push 0xffff000f
push esi
lea eax, [ebp - 0x740]
push eax
call fcn.004010a9
cmp eax, ebx
je 0x4017b1
lea ecx, [ebp - 0x538]
push ecx
push eax
push str.Error__u_while_extracting_TSU.DLL_to__ls_n
call fcn.00401077
add esp, 0xc
mov dword [0x404408], 0xf9
jmp 0x4018a0
push dword [0x40440c]
lea eax, [ebp - 0x538]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4017f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x538]
push ecx
push eax
push str.Error__u_while_loading_TSU.DLL__ls_n
call fcn.00401077
add esp, 0xc
mov dword [0x404408], 0xf9
jmp 0x401887
push str._TsuMainW_8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40181e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x538]
push ecx
push eax
push str.Error__u_while_retrieving_entry_point_from__ls_n
jmp 0x4017df
lea eax, [ebp - 0x740]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x20
push eax
lea eax, [ebp - 0x740]
push eax
call fcn.00401461
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0xc], esi
jne 0x401848
xor eax, eax
jmp 0x401854
cmp word [esi], bx
je 0x401854
inc eax
inc eax
cmp word [eax], bx
jne 0x40184d
lea ecx, [ebp - 0x740]
push ecx
push str.__d:__s_
push eax
call edi
add esp, 0xc
push ebx
push esi
call dword [ebp - 8]
mov dword [0x404408], eax
jmp 0x401887
push str.Executable_has_no_valid_MZ_signature_n
call fcn.00401077
pop ecx
mov dword [0x404408], 0xfe
cmp dword [ebp - 4], 0
je 0x4018a0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x40188d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp word [ebp - 0x538], 0
je 0x4018fa
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4018fa
and eax, 0xfffffffa
push eax
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0xa
pop esi
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4018fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4018fa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x4018d0
mov ecx, dword [ebp - 0xc]
call fcn.00401920
push dword [0x404408]
call dword [sym.imp.KERNEL32.dll_ExitProcess]