Function at 0x403276
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d4
push ebx
push esi
xor eax, eax
push edi
mov ebx, 0x80
push eax
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
push ebx
push 2
push eax
mov edi, 0x40000000
push 1
push edi
mov dword [ebp - 8], eax
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4033fe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
je 0x4032db
cmp eax, 0x20
je 0x4032db
cmp dword [0x423118], 0
je 0x4034f6
push dword [ebp + 8]
call fcn.00403221
pop ecx
jmp 0x4034f6
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x41e064
push dword [ebp + 8]
call fcn.0040c076
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push 0
push ebx
push 2
push 0
push 1
lea eax, [ebp - 0x12c]
pop ebx
push ebx
push edi
push eax
call esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x12c]
xor edi, edi
push eax
push edi
push str.SourceFile
call fcn.00402ad0
add esp, 0xc
call fcn.0040249a
test eax, eax
je 0x4033ad
call fcn.004024de
test eax, eax
je 0x40335f
push 5
lea eax, [ebp - 0x12c]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
test eax, eax
je 0x403415
mov dword [0x422f04], ebx
jmp 0x403415
cmp dword [0x42162c], edi
jne 0x403415
cmp dword [0x421b94], edi
mov eax, str.As_current_user_does_not_have_admin_privileges__cant_install_file__s._n_nIf_you_have_trouble_using_this_application__log_on_as_admin_and_restart_installation.
jne 0x40337d
mov eax, 0x41a3a0
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2d0]
push 0x30
push 0x420e88
push eax
push dword [0x421310]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403415
mov esi, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov edi, 0x104
lea eax, [ebp - 0x230]
push edi
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x3d4]
push edi
push eax
lea eax, [ebp - 0x12c]
push eax
call esi
lea eax, [ebp - 0x3d4]
push str.WININIT.INI
push eax
lea eax, [ebp - 0x230]
push eax
push str.Rename
call fcn.0040c714
add esp, 0x10
mov dword [0x422f04], ebx
jmp 0x403413
push 0x104
lea eax, [ebp - 0x12c]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
xor edi, edi
push dword [0x421524]
call fcn.00401f1d
test eax, eax
pop ecx
jne 0x4034d3
mov ebx, 0x4000
push ebx
push dword [0x42151c]
push dword [0x421524]
call fcn.00401fe0
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x403488
cmp esi, edi
jbe 0x4034c3
push esi
push dword [0x42151c]
push dword [ebp - 4]
call fcn.0040cb25
add esp, 0xc
test eax, eax
je 0x403496
add dword [ebp - 8], esi
cmp dword [0x42162c], edi
jne 0x40342e
push esi
push 0x4c8
push 0x400
push dword [0x421310]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40342e
push dword [0x421524]
call fcn.00402107
pop ecx
jmp 0x4034d3
push dword [0x421524]
call fcn.00402107
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x423118], edi
jmp 0x4032c7
push dword [0x421524]
call fcn.00402107
test eax, eax
pop ecx
je 0x4034fb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x423118], edi
je 0x4034f6
call fcn.004031f0
or eax, 0xffffffff
jmp 0x40352e
lea eax, [ebp - 0x28]
push eax
call fcn.004030df
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFileTimeToFileTime]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret