Function at 0x4056d0
Capabilities:
Check if file exists
Create thread
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bb90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3b4
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x13], 0
mov dword [ebp - 0x54], esi
mov byte [ebp - 0x50], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
mov ecx, 0x424728
mov dword [0x424728], eax
mov byte [ebp - 4], 1
call fcn.00402560
cmp eax, esi
jne 0x405762
mov ecx, dword [0x424730]
push ecx
push esi
push 0x10
push esi
push 0x6a
lea ecx, [ebp - 0x44]
call fcn.004015e0
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 2
call fcn.00403830
push 0x4201c8
lea eax, [ebp - 0x15c]
push eax
call fcn.0040970a
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00404e60
add esp, 4
test al, al
jne 0x4059df
mov edx, dword [0x424738]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40584d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
lea ecx, [ebp - 0x44]
jne 0x4057e0
mov eax, dword [0x424738]
push eax
push 2
push 0x10
push esi
push 0x70
call fcn.004015e0
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 3
call fcn.00403830
push 0x4201c8
lea edx, [ebp - 0xdc]
push edx
call fcn.0040970a
cmp eax, 0x666
jne 0x40581d
mov eax, dword [0x424738]
push eax
push 2
push 0x10
push esi
push 0x78
call fcn.004015e0
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 4
call fcn.00403830
push 0x4201c8
lea edx, [ebp - 0x9c]
push edx
call fcn.0040970a
push esi
push eax
push 0x10
push esi
push 0x68
call fcn.004015e0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 5
call fcn.00403830
push 0x4201c8
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0040970a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004030d0
test al, al
je 0x40586a
push str.change_user__INSTALL
call fcn.004038d0
add esp, 4
call fcn.00415332
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.00403bc0
mov bl, al
add esp, 4
test bl, bl
je 0x4059a5
push str._c:_msiinit.exe__delayrebootq_
mov word [ebp - 0x3c0], 0
xor eax, eax
mov ecx, 0x98
lea edi, [ebp - 0x3be]
rep stosd dword es:[edi], eax
mov ecx, dword [0x42474c]
push str.instmsiw.exe
push ecx
push str._s_s__s
lea edx, [ebp - 0x3c0]
push 0x131
push edx
stosw word es:[edi], ax
call fcn.00403300
add esp, 0x18
push 0x424720
push 0
push 0
push 0x4031b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x424724], eax
lea eax, [ebp - 0x3c0]
push eax
call fcn.004038d0
mov ecx, dword [0x424724]
mov edx, dword [0x424720]
add esp, 4
push ecx
push edx
mov esi, eax
call fcn.00402e40
add esp, 8
cmp esi, 0xbc2
je 0x4059a1
test esi, esi
je 0x40599b
cmp esi, 0x1001
lea ecx, [ebp - 0x44]
push 0
je 0x405967
push esi
push 0x10
push 0
push 0x68
call fcn.004015e0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 8
call fcn.00403830
push 0x4201c8
lea ecx, [ebp - 0xbc]
push ecx
call fcn.0040970a
push 0x1001
push 0x10
push 0
push 0x6c
call fcn.004015e0
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
call fcn.00403830
push 0x4201c8
lea eax, [ebp - 0xfc]
push eax
call fcn.0040970a
cmp esi, 0xbc2
sete byte [ebp - 0x11]
lea ecx, [ebp - 0x13]
push ecx
call fcn.004040f0
mov al, byte [ebp - 0x13]
add esp, 4
test al, al
jne 0x4059f4
mov ecx, 0x424728
call fcn.00401d10
test al, al
jne 0x4059f4
call fcn.00406350
test al, al
jne 0x4059f4
lea ecx, [ebp - 0x18]
call fcn.004012b0
lea ecx, [ebp - 0x54]
call fcn.00402f20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00403b20
mov ecx, 0x424728
call fcn.00402a60
test eax, eax
jne 0x405a6e
call fcn.00415332
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
movzx eax, word [0x424780]
push eax
lea ecx, [ebp + 8]
push 0x41ccec
push ecx
mov byte [ebp - 4], 9
call fcn.004020a0
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
push 0
push 0x10
push 0
push 0x7a
lea ecx, [ebp - 0x44]
call fcn.004015e0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xa
call fcn.00403830
push 0x4201c8
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0040970a
call fcn.00415332
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
mov eax, dword [0x424760]
push eax
push 0x41c490
mov byte [ebp - 4], 0xb
call fcn.0040993e
add esp, 8
test eax, eax
jne 0x405aaa
mov ecx, dword [0x42475c]
push ecx
call fcn.00403e30
add esp, 4
mov edx, dword [0x424760]
push edx
lea ecx, [ebp - 0x48]
call fcn.004015a0
test bl, bl
je 0x405ac9
mov eax, dword [ebp - 0x18]
push eax
call fcn.00409caf
add esp, 4
mov ecx, dword [0x424760]
push 0
push ecx
push 0x1fdf
call sub.msi.dll_MsiGetComponentPathW
mov edx, dword [0x424764]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x4230b4]
cmp eax, 2
je 0x405af8
cmp eax, 3
jne 0x405b02
call fcn.004056b0
mov eax, dword [0x4230b4]
push 0
push eax
call sub.msi.dll_MsiSetPropertyW
mov eax, dword [0x424784]
mov ecx, dword [0x424738]
push eax
push ecx
call sub.msi.dll_MsiOpenDatabaseW
mov esi, eax
cmp esi, 0x644
ja 0x405b34
je 0x405b69
test esi, esi
je 0x405b69
cmp esi, 0x642
jmp 0x405b42
cmp esi, 0x669
je 0x405b69
cmp esi, 0xbc2
je 0x405b69
lea ecx, [ebp - 0x44]
call fcn.004013c0
push 0x10
push esi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xc
call fcn.00401b00
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xb
call fcn.004036a0
jmp 0x405b73
cmp esi, 0xbc2
sete byte [ebp - 0x12]
mov al, byte [0x424782]
test al, al
je 0x405ccd
lea ecx, [ebp - 0x3c]
call fcn.00403700
push 0x424794
push 0x80000002
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xd
call fcn.004068b0
test al, al
je 0x405cc1
push 0x41c490
lea ecx, [ebp - 0x1c]
call fcn.004024c0
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0x424798
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xe
call fcn.004065c0
test al, al
je 0x405cb9
lea ecx, [ebp + 0x10]
call fcn.00401290
mov edx, dword [0x424760]
push edx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xf
call fcn.004024c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x405c02
or esi, 0xffffffff
jmp 0x405c20
push 0x41c880
push eax
call fcn.0040949a
add esp, 8
test eax, eax
jne 0x405c19
or esi, 0xffffffff
jmp 0x405c20
sub eax, dword [ebp + 8]
sar eax, 1
mov esi, eax
lea ecx, [ebp - 0x24]
call fcn.00401290
mov bl, 0x11
mov byte [ebp - 4], bl
lea ecx, [ecx]
test esi, esi
jle 0x405c75
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
sub eax, esi
dec eax
push eax
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp + 8]
call fcn.00403a20
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x12
call fcn.00402030
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.004012b0
inc esi
push esi
push 0x41c880
lea ecx, [ebp + 8]
call fcn.00403370
mov esi, eax
jmp 0x405c30
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp + 0x10]
call fcn.00402030
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp + 0x10]
call fcn.00401ee0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push 0xb
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x24]
call fcn.004012b0
lea ecx, [ebp + 8]
call fcn.004012b0
lea ecx, [ebp + 0x10]
call fcn.004012b0
lea ecx, [ebp - 0x1c]
call fcn.004012b0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xb
call fcn.00403730
mov al, byte [ebp - 0x11]
test al, al
jne 0x405cff
mov al, byte [ebp - 0x12]
test al, al
jne 0x405cff
xor al, al
je 0x405d3c
push 0
push 0
push 0
push 0x66
push 0x72
lea ecx, [ebp - 0x44]
call fcn.004015e0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x14
call fcn.00401760
jmp 0x405d30
cmp dword [0x4230b4], 2
je 0x405d3c
push 0
push 0
push 4
push 0x66
push 0x71
lea ecx, [ebp - 0x44]
call fcn.004015e0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x13
call fcn.00401760
cmp eax, 6
jne 0x405d30
call fcn.00402ce0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xb
call fcn.004036a0
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405d5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405d7e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x405d8c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10