Function at 0x401e60
Capabilities:
Create directory
Create shortcut via ishelllink
Delete registry key
Extract resource via kernel32 functions
Get common file path
Get file attributes
Persist via lnk shortcut
Persist via run registry key
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x748
mov eax, dword [0x45602c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.Installing
push 1
push dword [0x457ccc]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x470b20
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push 0x470b20
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x318]
push 0x457de0
push eax
call edi
push 0x44465c
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea eax, [ebp - 0x318]
push eax
call esi
push 0x470b20
push 0x470120
call edi
push 0x470b20
push 0x46ff20
call edi
push 0x470b20
push 0x46fd20
call edi
push 0x470b20
push 0x46fb20
call edi
push 0x443318
push str.EQ3D.EXE
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x72c], eax
test eax, eax
je 0x402753
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44509c
push 0x470b20
call esi
push dword [ebp - 0x72c]
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x72c]
mov dword [ebp - 0x730], eax
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x470b20
mov dword [ebp - 0x72c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x734], eax
cmp eax, 0xffffffff
je 0x402753
push 0
lea ecx, [ebp - 0x738]
push ecx
push dword [ebp - 0x730]
push dword [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x734]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xff
push 0x470720
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x44331c
push 0x470720
call esi
push str.Earthquake3D.sCr
push 0x470720
call esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x470720
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x734], eax
cmp eax, 0xffffffff
je 0x40204f
push 0
lea ecx, [ebp - 0x738]
push ecx
push dword [ebp - 0x730]
push dword [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x734]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x443318
push str.BIGLIST
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x730], eax
test eax, eax
je 0x402753
push 0x4450cc
push 0x470120
call esi
push dword [ebp - 0x730]
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x730]
mov dword [ebp - 0x734], eax
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x470120
mov dword [ebp - 0x730], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x72c], eax
cmp eax, 0xffffffff
je 0x402753
push 0
lea ecx, [ebp - 0x738]
push ecx
push dword [ebp - 0x734]
push dword [ebp - 0x730]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x72c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x443318
push 0x4450dc
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x730], eax
test eax, eax
je 0x402753
push 0x46ff20
push 0x470120
call edi
push 0x4450e0
push 0x470120
call esi
push dword [ebp - 0x730]
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x730]
mov dword [ebp - 0x734], eax
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x470120
mov dword [ebp - 0x730], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x72c], eax
cmp eax, 0xffffffff
je 0x402753
push 0
lea ecx, [ebp - 0x738]
push ecx
push dword [ebp - 0x734]
push dword [ebp - 0x730]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x72c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x443318
push str.SCRAPER
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x734], eax
test eax, eax
je 0x402753
push 0x457de0
lea eax, [ebp - 0x318]
push eax
call edi
push str.Earthquake3Dprofiles.txt
lea eax, [ebp - 0x318]
push eax
call esi
mov esi, dword [ebp - 0x734]
push esi
push dword [0x457dc4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [0x457dc4]
mov dword [ebp - 0x734], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
push 0
mov dword [ebp - 0x730], eax
lea eax, [ebp - 0x318]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402753
push 0
lea eax, [ebp - 0x738]
push eax
push dword [ebp - 0x734]
push dword [ebp - 0x730]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.quake0.wav
push str.WAV0
call fcn.00402770
push str.quake1.wav
push str.WAV1
call fcn.00402770
push str.quake2.wav
push str.WAV2
call fcn.00402770
push str.quake3.wav
push str.WAV3
call fcn.00402770
push str.quake4.wav
push str.WAV4
call fcn.00402770
push str.quake5.wav
push str.WAV5
call fcn.00402770
push str.quake6.wav
push str.WAV6
call fcn.00402770
push str.quake7.wav
push str.WAV7
call fcn.00402770
add esp, 0x40
push str.quake8.wav
push str.WAV8
call fcn.00402770
push str.quake9.wav
push str.WAV9
call fcn.00402770
push str.eq3d0.mp3
push str.MP30
call fcn.00402770
push str.eq3d1.mp3
push str.MP31
call fcn.00402770
push str.eq3d2.mp3
push str.MP32
call fcn.00402770
push str.eq3d3.mp3
push str.MP33
call fcn.00402770
push str.eq3d4.mp3
push str.MP34
call fcn.00402770
push str.eq3d5.mp3
push str.MP35
call fcn.00402770
add esp, 0x40
push str.eq3d6.mp3
push str.MP36
call fcn.00402770
push str.eq3d7.mp3
push str.MP37
call fcn.00402770
push str.eq3d8.mp3
push str.MP38
call fcn.00402770
push str.eq3d9.mp3
push str.MP39
call fcn.00402770
push str.Night_Earth.tga
push str.PIC1
call fcn.00402770
push str.Cloudy_Earth.tga
push str.PIC2
call fcn.00402770
push 0x4452dc
push str.UNINSTAL
call fcn.00402770
add esp, 0x38
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x470920
push 0x456014
push str.version
push str.Items
call esi
push 0x470920
push 0x4445f0
push str.firstrun
push str.Items
call esi
push 0x470920
push 0x470b20
push str.installpath
push str.Items
call esi
push 0x64
push 0x470e20
push 0x6e
push dword [0x457dc4]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x728]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x720]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, word [ebp - 0x71e]
lea eax, [eax + ecx*4]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, word [ebp - 0x71c]
lea eax, [eax + ecx*4]
push eax
call fcn.0040e4f5
call fcn.0040e4d4
movzx esi, ax
shl esi, 0xe
call fcn.0040e4d4
movzx eax, ax
add eax, 0x3b9aca00
add eax, esi
push eax
lea eax, [ebp - 0x68]
push 0x445304
push eax
call fcn.004030e0
add esp, 0x10
mov dword [ebp - 0x73c], 0x200
lea eax, [ebp - 0x730]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402753
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x740]
push eax
push 0
push str.Programs
push dword [ebp - 0x730]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x730]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x518]
push str.Earthquake3D.lnk
push eax
call esi
push 0x470b20
lea eax, [ebp - 0x2f0]
push eax
call edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x72c]
push eax
push 0x445ec0
push 1
push 0
push 0x449d20
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4025fd
mov eax, dword [ebp - 0x72c]
lea edx, [ebp - 0x2f0]
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [ebp - 0x72c]
push str.Earthquake3D_slink
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [ebp - 0x72c]
lea edx, [ebp - 0x734]
push edx
push 0x447150
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
test eax, eax
js 0x4025ef
push 0xff
lea eax, [ebp - 0x718]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x518]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x734]
lea edx, [ebp - 0x718]
push 1
push edx
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [ebp - 0x734]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov eax, dword [ebp - 0x72c]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x46fb20
push 0x470520
call edi
push str.uninstal.exe
push 0x470520
call esi
movups xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionUninstall]
mov eax, dword [0x4453c0]
mov dword [ebp - 0x20], eax
mov eax, dword [0x444664]
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x720], eax
movups xmm0, xmmword [0x4453a0]
mov ax, word [0x444668]
mov word [ebp - 0x71c], ax
mov al, byte [0x44466a]
movups xmmword [ebp - 0x40], xmm0
push 0x470520
movups xmm0, xmmword [0x4453b0]
mov byte [ebp - 0x71a], al
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x44465c]
movq qword [ebp - 0x728], xmm0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [ebp - 0x73c], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xe8]
push eax
call edi
lea eax, [ebp - 0x728]
push eax
lea eax, [ebp - 0xe8]
push eax
call esi
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0xe8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40273b
push dword [ebp - 0x73c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x470520
push 1
push eax
push str.UninstallString
push dword [ebp - 0x72c]
call esi
test eax, eax
je 0x402713
lea eax, [ebp - 0x728]
push eax
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x25
push str.Earthquake_3D__Remove_only_
push 1
push 0
push str.DisplayName
push dword [ebp - 0x72c]
call esi
test eax, eax
jne 0x4026e8
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00403615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret