Function at 0x10028d30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
call fcn.1001ee30
cmp eax, 3
jl 0x10028d50
push str.NSIS_IsSetupStartible
call fcn.10003d40
add esp, 4
push ebx
push edi
call fcn.10025f50
test eax, eax
jne 0x10029071
call fcn.10025ec0
test eax, eax
jne 0x10029071
push 1
call fcn.1002ab00
add esp, 4
test eax, eax
je 0x10028d9c
call fcn.1001ee30
cmp eax, 3
jl 0x10028d91
push str.NSIS_IsSetupStartible___return__1___IsFindExceptionProcess_is_TRUE.
call fcn.10003d40
add esp, 4
pop edi
mov eax, 0x10097da8
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x57]
mov byte [ebp - 0x58], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push eax
call fcn.1002a6e0
add esp, 4
test eax, eax
je 0x10028de6
call fcn.1001ee30
cmp eax, 3
jl 0x10028ddb
lea ecx, [ebp - 0x58]
push ecx
push str.NSIS_IsSetupStartible___return__1___Installed_Service___s_
call fcn.10003d40
add esp, 8
pop edi
mov eax, 0x10097de8
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push ebx
push 0x7530
push ebx
push ebx
push ebx
push 1
push str.version
push str.http:__CONFIG_DOMAIN_config.php
push 0x10097e18
call fcn.100034a0
add esp, 0x1c
lea edx, [ebp - 8]
push eax
push edx
call fcn.1001cae0
add esp, 0x18
lea ecx, [ebp - 8]
call fcn.10002f20
test eax, eax
jne 0x10028fcf
push 0x40
lea ecx, [ebp - 8]
call fcn.10002f50
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1001f050
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.10002f20
test eax, eax
jne 0x10028fc7
mov ecx, 0x40
lea edi, [ebp - 0x15b]
mov byte [ebp - 0x15c], bl
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x15c]
stosw word es:[edi], ax
push ecx
push 0x10097e24
push str.patch_version
lea ecx, [ebp - 0xc]
stosb byte es:[edi], al
call fcn.10002f50
push eax
call fcn.10024f70
lea edx, [ebp - 0x15c]
push str.1.1.14.1
push edx
call fcn.1001d940
add esp, 0x18
test eax, eax
jle 0x10028fc7
call fcn.1001ee30
cmp eax, 3
jl 0x10028ebd
lea eax, [ebp - 0x15c]
push eax
push str.NSIS_IsSetupStartible___New_Version___s_
call fcn.10003d40
add esp, 8
lea ecx, [ebp - 4]
call fcn.10002f10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x15c]
push eax
push ecx
lea edx, [ebp - 0x10]
push 0x10097e70
push edx
call fcn.1001e8e0
mov eax, dword [eax]
add esp, 4
lea ecx, [ebp - 4]
push eax
push str._s_setup_ag__s__s__d_.exe
push ecx
call fcn.10053d2b
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.1005bb45
lea ecx, [ebp - 4]
call fcn.10002f50
push eax
call fcn.1001c140
add esp, 4
test al, al
je 0x10028f24
lea ecx, [ebp - 4]
call fcn.10002f50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
lea ecx, [ebp - 4]
call fcn.10002f50
push eax
call fcn.1001bf50
add esp, 8
lea ecx, [ebp - 4]
push ebx
push ebx
push 0x7530
call fcn.10002f50
push eax
push ebx
push 1
push ebx
push ebx
push str.sdown
push 0x10097e9c
push 0x10097ec0
call fcn.100034a0
add esp, 0x1c
push eax
call fcn.1001cf30
add esp, 0x14
test al, al
je 0x10028fbf
push ebx
push ebx
push ebx
push 5
lea ecx, [ebp - 4]
call fcn.10002f50
push eax
call fcn.100227e0
add esp, 0x14
call fcn.1001ee30
cmp eax, 3
jl 0x10028f9c
push str.NSIS_IsSetupStartible___return_0___New_Version_Download
call fcn.10003d40
add esp, 4
lea ecx, [ebp - 4]
call fcn.1005bb45
lea ecx, [ebp - 0xc]
call fcn.1005bb45
lea ecx, [ebp - 8]
call fcn.1005bb45
pop edi
mov eax, 0x10097f04
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
call fcn.1005bb45
lea ecx, [ebp - 0xc]
call fcn.1005bb45
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
push edx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.10024b30
add esp, 8
test eax, eax
jne 0x10029013
call fcn.1001ee30
cmp eax, 3
jl 0x10029000
push str.NSIS_IsSetupStartible___return_0___User_is_not_admin
call fcn.10003d40
add esp, 4
lea ecx, [ebp - 8]
call fcn.1005bb45
pop edi
mov eax, 0x10097f40
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10022de0
cmp eax, 8
jle 0x10029047
call fcn.1001ee30
cmp eax, 3
jl 0x10029034
push str.NSIS_IsSetupStartible___return_0___IE_9.0
call fcn.10003d40
add esp, 4
lea ecx, [ebp - 8]
call fcn.1005bb45
pop edi
mov eax, 0x10097f70
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1001ee30
cmp eax, 3
jl 0x1002905e
push str.NSIS_IsSetupStartible___return_1
call fcn.10003d40
add esp, 4
lea ecx, [ebp - 8]
call fcn.1005bb45
pop edi
mov eax, 0x10097f98
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1001ee30
cmp eax, 3
jl 0x10029088
push str.NSIS_IsSetupStartible___return__1___WinsHelp_Installed_or_WinControl_Installed
call fcn.10003d40
add esp, 4
pop edi
mov eax, 0x10097d60
pop ebx
mov esp, ebp
pop ebp
ret