Function at 0x40162b
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
or dword [ebp - 0x10], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], eax
cmp word [esi], ax
jne 0x401860
push 0x104
push esi
push dword [0x41cb38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push eax
push 0x40
push 0x8000
push esi
call fcn.00403b7b
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
je 0x401877
push edi
call fcn.00403c97
mov esi, eax
push edi
mov dword [ebp - 8], esi
call fcn.00403454
mov dword [ebp - 4], eax
add eax, 0x3e4
pop ecx
pop ecx
cmp esi, eax
jbe 0x40188a
push 0x3e4
call fcn.0040893b
mov esi, eax
xor eax, eax
push eax
push eax
push dword [ebp - 4]
push edi
call fcn.00403c3d
push 0x3e4
push esi
push edi
call fcn.00403cca
add esp, 0x20
cmp eax, 0x3e4
jne 0x401856
cmp byte [esi], 0x44
jne 0x401856
cmp byte [esi + 1], 0x45
jne 0x401856
cmp byte [esi + 2], 0x43
jne 0x401856
cmp byte [esi + 3], 0x43
jne 0x401856
cmp byte [esi + 4], 0x41
jne 0x401856
cmp byte [esi + 5], 0x42
jne 0x401856
cmp byte [esi + 7], 0x55
jne 0x401856
xor ecx, ecx
cmp word [esi + 0x210], cx
jne 0x40173e
mov dword [esi + 0x318], ecx
mov byte [esi + 6], 0x33
jmp 0x40179d
cmp byte [esi + 6], 0x36
jne 0x40179d
push 0xffffffffffffffff
call fcn.0040217d
pop ecx
test eax, eax
jne 0x401796
push esi
call fcn.00408920
push edi
call fcn.00403d1e
pop ecx
pop ecx
push 0x80
lea eax, [ebp - 0x134]
push eax
push 0x16
push dword [0x41cb38]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push str.CAB_SFX
lea eax, [ebp - 0x134]
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x401d0f
mov byte [0x41cb46], 0x36
push dword [ebp + 8]
push esi
push 0x41cb48
call fcn.00403e0e
add esp, 0xc
mov dword [ebp - 0xc], eax
lea ecx, [esi + 0x210]
push ecx
push 0x41cd50
call ebx
mov eax, dword [esi + 0x310]
mov dword [0x41ce50], eax
mov eax, dword [esi + 0x314]
mov dword [0x41ce54], eax
mov eax, dword [esi + 0x318]
mov dword [0x41ce58], eax
mov eax, dword [esi + 0x31c]
mov dword [0x41ce5c], eax
mov eax, dword [esi + 0x320]
mov dword [0x41ce60], eax
lea eax, [esi + 0x324]
push eax
push 0x41ce64
call ebx
lea eax, [esi + 0x364]
push eax
push 0x41cea4
call ebx
mov ecx, dword [0x41ce60]
test ecx, ecx
je 0x401848
push dword [ebp + 8]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
add eax, 0x3e4
push eax
push ecx
push dword [0x41cb38]
push edi
call fcn.00403786
add esp, 0x18
test eax, eax
jne 0x401848
cmp word [0x41cd50], ax
jne 0x40188a
xor eax, eax
push eax
push eax
push eax
push edi
call fcn.00403c3d
add esp, 0x10
push esi
call fcn.00408920
mov esi, dword [ebp + 8]
pop ecx
push edi
push esi
mov dword [0x41c90c], esi
call fcn.00401d19
mov dword [ebp - 8], eax
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x401896
push 0x80
lea eax, [ebp - 0x134]
push eax
push 0xc
jmp 0x40176c
push edi
call fcn.00403d1e
pop ecx
jmp 0x40178f
cmp dword [0x41c908], 0xffffffff
jne 0x4018b2
push 0x80
lea eax, [ebp - 0x134]
push eax
push 0xd
jmp 0x40176c
cmp word [0x41cea4], 0
je 0x4018da
push 0x24
push 0x41ce64
push 0x41cea4
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40178f
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x234]
push eax
push esi
call fcn.00403343
add esp, 0xc
mov esi, 0x41cb48
cmp word [0x41cb48], 0
jne 0x40190a
lea eax, [ebp - 0x234]
push eax
push esi
call ebx
push 0x2e
pop eax
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.00405eea
pop ecx
pop ecx
test eax, eax
je 0x401925
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x434]
push eax
call fcn.004032f3
pop ecx
cmp dword [0x41ce5c], 0
jne 0x401951
lea eax, [ebp - 0x434]
push eax
call fcn.00402cfe
pop ecx
cmp eax, 1
jne 0x40178f
push esi
call fcn.00403318
push esi
call fcn.00403183
cmp word [0x41cb48], 0
pop ecx
pop ecx
jne 0x401978
lea eax, [ebp - 0x234]
push eax
push esi
call ebx
jmp 0x401aa0
push 0x5c
pop eax
push eax
push esi
call fcn.00405eea
pop ecx
pop ecx
test eax, eax
jne 0x4019aa
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [eax*2 + 0x41cb46], 0x3a
je 0x4019aa
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x401969
movzx eax, word [0x41cb48]
push 0x5c
pop ecx
cmp ax, cx
jne 0x4019c9
cmp word [0x41cb4a], cx
je 0x4019e1
push 0x41cb4a
jmp 0x40199b
push 0x2e
pop edx
cmp ax, dx
jne 0x4019e1
cmp word [0x41cb4a], cx
jne 0x4019e1
push 0x41cb4c
jmp 0x40199b
push 0x414498
push esi
call fcn.00405f8e
pop ecx
pop ecx
cmp eax, esi
jne 0x401aa0
xor eax, eax
mov ebx, eax
jmp 0x401a0c
add esi, 4
inc ebx
push esi
push 0x41cb48
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x414498
push esi
call fcn.00405f8e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4019fc
lea eax, [ebp - 0x234]
push eax
call fcn.00403183
lea eax, [ebp - 0x234]
push eax
call fcn.00408590
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
pop ecx
pop ecx
test ebx, ebx
jle 0x401a64
push 0x5c
pop eax
push eax
push esi
call fcn.00405eea
pop ecx
pop ecx
test eax, eax
je 0x401ad2
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x401a44
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x234]
push esi
push eax
call ebx
push 0x41cb48
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x234]
push eax
push 0x41cb48
call ebx
push esi
call fcn.00408920
pop ecx
mov esi, 0x41cb48
push str.____
push esi
call fcn.004085ef
push 0x41cb48
mov esi, eax
call fcn.00408648
add esp, 0xc
cmp esi, eax
je 0x401af6
lea eax, [ebp - 0x234]
mov esi, 0x41cb48
push eax
push esi
call ebx
jmp 0x401932
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x234]
push eax
push 0x41cb48
call ebx
push esi
call fcn.00408920
mov esi, 0x41cb48
jmp 0x401931
mov ebx, 0x41cb48
push ebx
call fcn.004032f3
push ebx
call fcn.00403157
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401bb3
cmp dword [0x41ce50], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
jne 0x401b78
push 0x80
lea eax, [ebp - 0x134]
push eax
push 0xe
push dword [0x41cb38]
call esi
push ebx
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x634]
xor ebx, ebx
push 0x21
push str.CAB_SFX
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x401cfe
jmp 0x401b7a
xor ebx, ebx
push 0x41cb48
call fcn.0040303f
pop ecx
test eax, eax
jne 0x401bb3
push 0x80
lea eax, [ebp - 0x634]
push eax
push 0x11
push dword [0x41cb38]
call esi
push 0x10
push str.CAB_SFX
lea eax, [ebp - 0x634]
push eax
push ebx
jmp 0x401789
xor ebx, ebx
push ebx
push dword [ebp - 8]
call fcn.00402d42
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
push 0x401584
push ebx
push ebx
call fcn.00408aa2
add esp, 0x20
mov esi, eax
lea eax, [ebp - 0x34]
mov dword [ebp + 8], esi
push ebx
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
push eax
call ebx
test eax, eax
je 0x401c27
xor esi, esi
lea eax, [ebp - 0x34]
push eax
push dword [0x41cf24]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x401c17
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x34]
push eax
call ebx
test eax, eax
jne 0x401bef
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00403c81
and eax, edx
pop ecx
cmp eax, 0xffffffff
je 0x401c57
push edi
call fcn.00403d1e
pop ecx
cmp dword [0x41cf28], 0
je 0x401c6a
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x401cfe
cmp word [0x41cd50], 0
je 0x401cd0
push dword [0x41ce58]
mov ebx, 0x41cb48
push ebx
push 0x41cd50
call fcn.00401e6f
add esp, 0xc
cmp dword [0x41cf48], 0
je 0x401d0c
call fcn.00403de1
jmp 0x401cb5
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00403df3
mov esi, eax
test esi, esi
jne 0x401c9d
cmp dword [ebp - 0xc], eax
je 0x401cfe
push ebx
call section..text
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x401cfe
cmp dword [0x41ce54], 0
je 0x401cfe
cmp dword [ebp - 0x10], 0
jne 0x401cfe
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
push 0xa
xor eax, eax
push eax
push eax
push 0x41cb48
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x41cf48], 0
je 0x401d0c
call fcn.00403d43
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret