Function at 0x402f90
Capabilities:
Copy file
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x65c
mov eax, dword [0x40e090]
mov dword [esp + 0x658], eax
xor eax, eax
push ebx
push esi
push edi
mov byte [esp + 0x348], 0
mov ecx, 0x40
lea edi, [esp + 0x349]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x30], 0
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x240], 0
mov ecx, 0x40
lea edi, [esp + 0x241]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x450], 0
mov ecx, 0x40
lea edi, [esp + 0x451]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x558], 0
mov ecx, 0x40
lea edi, [esp + 0x559]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x138], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x139]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x28]
or ebx, 0xffffffff
xor esi, esi
stosb byte es:[edi], al
call fcn.00401000
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x403060
xor eax, eax
jmp 0x40306e
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403065
sub eax, edi
push eax
push edx
mov ecx, 0x40e770
call fcn.00401cf0
call fcn.004016c0
call fcn.00402ee0
mov eax, dword [0x40e760]
test eax, eax
je 0x4030cb
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 0x81
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
test esi, esi
je 0x4030cb
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00401170
test eax, eax
jne 0x40310a
push 0x10
push str.Error
push str.File_CRC_Error_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x28]
call fcn.00401110
mov eax, 0xfffffff6
mov ecx, dword [esp + 0x664]
call fcn.00403bb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x348]
push 0x104
push ecx
call fcn.00401510
add esp, 8
test eax, eax
je 0x403248
push 0x104
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x350]
push eax
call fcn.00402750
add esp, 0xc
test eax, eax
jne 0x40315b
mov cx, word [0x40b404]
mov dl, byte [0x40b406]
mov word [esp + 0x30], cx
mov byte [esp + 0x32], dl
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
lea eax, [esp + 0x55c]
push eax
push 0x67
push 0
call edi
push 0x104
lea ecx, [esp + 0x244]
push ecx
push 0x68
push 0
mov ebx, 0xfffffffe
call edi
test eax, eax
je 0x403248
push 0x104
lea edx, [esp + 0x454]
push edx
push 0x69
push 0
call edi
test eax, eax
je 0x403248
lea eax, [esp + 0x240]
push eax
push 0x80000002
lea ecx, [esp + 0x30]
mov ebx, 0xfffffffd
call fcn.00401010
test eax, eax
jne 0x4031e8
lea ecx, [esp + 0x240]
push ecx
push 0x80000001
lea ecx, [esp + 0x30]
call fcn.00401010
test eax, eax
je 0x403248
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x454]
push eax
lea ecx, [esp + 0x30]
mov ebx, 0xfffffffc
call fcn.004010b0
test eax, eax
je 0x403248
push 0x40b288
push 0x40b400
lea ecx, [esp + 0x30]
call fcn.004010b0
test eax, eax
je 0x403248
lea ecx, [esp + 0x138]
push 0x104
push ecx
call fcn.004036a0
add esp, 8
test eax, eax
jge 0x403282
cmp eax, 0x80004005
je 0x40327b
dec eax
neg eax
sbb eax, eax
add eax, 0xfffffffa
mov ebx, eax
push 0x40
push 0x40b3ec
push 0x40b398
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x28]
call fcn.00401110
mov ecx, dword [esp + 0x664]
mov eax, ebx
call fcn.00403bb5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, 0xfffffffb
jmp 0x403248
test esi, esi
je 0x40328f
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor esi, esi
lea edx, [esp + 0x138]
push 1
push edx
call fcn.004015b0
add esp, 8
test eax, eax
jne 0x403248
cmp dword [0x40e764], 3
jne 0x403506
lea ecx, [esp + 0x10]
call fcn.00401b90
lea ecx, [esp + 0x24]
call fcn.00401b90
lea ecx, [esp + 0x18]
call fcn.00401b90
lea eax, [esp + 0x10]
push eax
call fcn.00402600
add esp, 4
test eax, eax
jne 0x4032f6
push 0x10
push str.Error
push str.Cant_Find_Program_Files_Path
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4034eb
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
dec eax
push eax
lea ecx, [esp + 0x14]
call fcn.00401bf0
cmp al, 0x5c
je 0x40331a
push 0x40b2ec
lea ecx, [esp + 0x14]
call fcn.004025c0
push str.KingsoftAntiVirusKAV2007IS_
lea ecx, [esp + 0x14]
call fcn.004025c0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
call fcn.00402510
push str.Setup.log
lea ecx, [esp + 0x1c]
call fcn.004025c0
push str.KAVSetup.EXE
lea ecx, [esp + 0x14]
call fcn.004025c0
push 0x40b338
push 0x40b268
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push 0x40b268
push ecx
call fcn.00402350
add esp, 0xc
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00402290
add esp, 0xc
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00402290
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
call fcn.00402510
lea ecx, [esp + 0x14]
call fcn.00401a50
lea ecx, [esp + 0x20]
call fcn.00401a50
lea ecx, [esp + 0x1c]
call fcn.00401a50
mov ecx, dword [esp + 0x24]
push 1
push ecx
call fcn.004015b0
add esp, 8
test eax, eax
je 0x4033db
push 0x10
push str.Error
push str.Cant_Execute_SetupFile_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x40e76c]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x4034eb
push 0x5c
push 1
lea eax, [esp + 0x24]
push eax
mov ecx, 0x40e76c
call fcn.004021d0
push eax
call fcn.00401bd0
add esp, 8
lea ecx, [esp + 0x1c]
mov bl, al
call fcn.00401a50
test bl, bl
je 0x4034ba
lea ecx, [esp + 0x14]
call fcn.00401b90
push 0x5c
mov ecx, 0x40e76c
call fcn.00401a20
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x40e76c
call fcn.00402230
push eax
lea ecx, [esp + 0x18]
call fcn.00402510
lea ecx, [esp + 0x1c]
call fcn.00401a50
push 0x40b288
push 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x20]
call fcn.004021d0
push eax
call fcn.00401bb0
add esp, 8
lea ecx, [esp + 0x20]
mov bl, al
call fcn.00401a50
test bl, bl
je 0x40348e
push 0x40b2ec
lea ecx, [esp + 0x18]
call fcn.004025c0
mov eax, dword [esp + 0x14]
push eax
call fcn.004017e0
mov ecx, dword [0x40e76c]
mov edx, dword [esp + 0x1c]
add esp, 4
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x14]
call fcn.00401a50
jmp 0x4034eb
mov eax, dword [0x40e76c]
push eax
call fcn.004017e0
add esp, 4
push str.Setup.log
mov ecx, 0x40e76c
call fcn.004025c0
mov ecx, dword [0x40e76c]
mov edx, dword [esp + 0x18]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x18]
call fcn.00401a50
lea ecx, [esp + 0x24]
call fcn.00401a50
lea ecx, [esp + 0x10]
call fcn.00401a50
lea eax, [esp + 0x138]
push eax
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40325b
xor ebx, ebx
jmp 0x40325b