Function at 0x40afd0
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
sub esp, 0xc5c
lea eax, [esp + 0x25c]
push ebx
push ebp
push esi
push edi
push 0x40bba0
push 0x100
push 8
push eax
call fcn.00401030
lea ecx, [esp + 0xc70]
call fcn.00401380
mov ecx, dword [esp + 0xc70]
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
mov eax, dword [esp + 0xc70]
mov ebp, dword [eax - 8]
cmp ebp, 0x100
jge 0x40ba19
mov edx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
xor ecx, ecx
cmp edx, 1
jg 0x40b037
mov edx, dword [eax - 4]
test edx, edx
jge 0x40b085
test ebp, ebp
jle 0x40b03d
mov ecx, ebp
push ecx
lea ecx, [esp + 0xc74]
call fcn.004012f0
test eax, eax
jne 0x40b052
xor ebx, ebx
jmp 0x40b087
mov edi, dword [esp + 0xc70]
lea ecx, [ebp + ebp + 2]
mov edx, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc74]
mov dword [eax - 8], ebp
call fcn.00401350
mov eax, dword [esp + 0xc70]
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov dword [esp + 0x26c], 0
call ebp
lea eax, [eax + eax + 0xc]
push eax
call fcn.004c6296
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 4
mov esi, eax
push 0x4da038
push esi
mov dword [esi], 0
mov word [esi], 0
call edi
push ebx
push esi
call edi
push 0x4da038
push esi
call edi
push 0x4da038
push esi
call edi
push 0x4da038
push esi
call edi
push 0x4da038
push esi
call edi
push esi
call ebp
push esi
call ebp
mov edi, eax
lea ecx, [edi + edi*2]
push ecx
call fcn.004c6296
lea edi, [esi + edi*2]
add esp, 4
xor ebp, ebp
cmp esi, edi
mov dword [eax], 0
mov ebx, eax
mov ecx, esi
jae 0x40b14d
cmp word [ecx], 0x22
jne 0x40b11d
xor edx, edx
test ebp, ebp
sete dl
mov ebp, edx
test ebp, ebp
je 0x40b12c
cmp word [ecx], 0x20
jne 0x40b12c
mov word [ecx], 9
add ecx, 2
cmp ecx, edi
jb 0x40b10e
cmp esi, edi
jae 0x40b14d
mov cx, word [esi]
cmp cx, 0x22
je 0x40b146
mov word [eax], cx
add eax, 2
add esi, 2
cmp esi, edi
jb 0x40b137
push ebx
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebp, [ebx + eax*2 - 2]
mov edi, ebx
cmp ebx, ebp
mov esi, ebx
jae 0x40b1e3
cmp word [edi], 0x20
jne 0x40b1dc
push esi
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x40b1d9
mov eax, dword [esp + 0x268]
push 0x4da034
push esi
mov dword [esp + eax*8 + 0x274], esi
mov ecx, dword [esp + 0x270]
mov dword [esp + ecx*8 + 0x278], 0
call fcn.004c546f
add esp, 8
test eax, eax
je 0x40b1c3
mov ecx, dword [esp + 0x268]
lea edx, [eax + 2]
mov dword [esp + ecx*8 + 0x270], edx
mov word [eax], 0
mov eax, dword [esp + 0x268]
inc eax
cmp eax, 0x100
mov dword [esp + 0x268], eax
jge 0x40b1e3
lea esi, [edi + 2]
add edi, 2
cmp edi, ebp
jb 0x40b165
cmp ebx, ebp
mov eax, ebx
jae 0x40b206
cmp word [eax], 0xa
jne 0x40b1f4
mov word [eax], 0x20
cmp word [eax], 9
jne 0x40b1ff
mov word [eax], 0x20
add eax, 2
cmp eax, ebp
jb 0x40b1e9
mov eax, dword [esp + 0x268]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor esi, esi
test eax, eax
jle 0x40b23d
lea edi, [esp + 0x26c]
mov edx, dword [edi]
push edx
push str._install
call ebx
test eax, eax
je 0x40b274
mov eax, dword [esp + 0x268]
inc esi
add edi, 8
cmp esi, eax
jl 0x40b220
xor edi, edi
test eax, eax
jle 0x40b915
lea esi, [esp + 0x26c]
mov eax, dword [esi]
push eax
push str._uninstall
call ebx
test eax, eax
je 0x40b3e3
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40b24e
jmp 0x40b915
mov eax, dword [esp + 0x268]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
test eax, eax
jle 0x40b35b
lea esi, [esp + 0x26c]
mov eax, dword [esi]
push eax
push str.forall
call ebx
test eax, eax
je 0x40b2b4
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40b292
jmp 0x40b35b
call fcn.0040ada0
test eax, eax
jne 0x40b351
mov eax, dword [esp + 0xc70]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x40b2e3
mov dword [ecx], eax
mov ecx, dword [esp + 0xc74]
add ecx, 0xfffffff4
push ecx
call ebp
jmp 0x40b2f8
mov edx, dword [0x4d9540]
mov dword [ecx], edx
mov eax, dword [esp + 0xc74]
push eax
call fcn.004016e0
call fcn.0040ab50
add esp, 4
test eax, eax
je 0x40b351
mov eax, dword [esp + 0xc70]
mov edx, dword [0x4d9544]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40b4a7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40b4a7
mov edx, dword [esp + 0xc70]
add edx, 0xfffffff4
push edx
call fcn.004c5432
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
mov dword [0x4e3cb8], 1
call fcn.004a3340
mov eax, dword [esp + 0xc70]
push ecx
mov ecx, esp
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x40b382
mov dword [ecx], eax
mov eax, dword [esp + 0xc74]
add eax, 0xfffffff4
push eax
call ebp
jmp 0x40b397
mov edx, dword [0x4d9540]
mov dword [ecx], edx
mov eax, dword [esp + 0xc74]
push eax
call fcn.004016e0
call fcn.0040ae50
mov edx, dword [0x4d9544]
mov esi, eax
mov eax, dword [esp + 0xc74]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40b3d6
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40b3d6
mov edx, dword [esp + 0xc70]
add edx, 0xfffffff4
push edx
call fcn.004c5432
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
mov eax, dword [esp + 0x268]
xor edi, edi
test eax, eax
jle 0x40b41a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea esi, [esp + 0x26c]
mov ecx, dword [esi]
push ecx
push str._uninstall
call ebx
test eax, eax
je 0x40b420
mov eax, dword [esp + 0x268]
inc edi
add esi, 8
cmp edi, eax
jl 0x40b3fd
xor edi, edi
xor eax, eax
jmp 0x40b436
mov edi, dword [esp + edi*8 + 0x270]
test edi, edi
jne 0x40b42f
xor eax, eax
jmp 0x40b436
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, 0x4e3ca0
call fcn.00401630
mov edx, dword [0x4e3ca0]
mov eax, dword [edx - 8]
test eax, eax
je 0x40b4b7
call fcn.004a3340
lea ecx, [esp + 0x38]
call fcn.0040bbf0
mov dword [esp + 0x38], 0x4d3944
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
lea eax, [esp + 0x38]
lea ecx, [esp + 0x40]
push eax
push ecx
push 0x4edfe0
call fcn.0040bbb0
mov edx, dword [0x4edfe8]
push 0
push 0x410630
push esi
push 0xd6
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [esp + 0xc70]
call fcn.004014c0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
lea ecx, [esp + 0x38]
call fcn.0040bbf0
mov eax, dword [0x4d9540]
mov dword [esp + 0x38], 0x4d3944
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
mov edx, dword [eax - 0xc]
lea ebx, [eax - 0xc]
cmp edx, 1
mov ecx, 0x105
jg 0x40b4ea
cmp dword [eax - 4], ecx
jge 0x40b52b
mov ebp, dword [eax - 8]
cmp ebp, ecx
jle 0x40b4f3
mov ecx, ebp
push ecx
lea ecx, [esp + 0x14]
call fcn.004012f0
test eax, eax
je 0x40b52b
mov edi, dword [esp + 0x10]
lea ecx, [ebp + ebp + 2]
mov eax, ecx
lea esi, [ebx + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov dword [ecx - 8], ebp
call fcn.00401350
mov eax, dword [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x10]
call fcn.00401380
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov word [edx + eax*2], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x40b5b0
mov edx, dword [eax - 0xc]
test edx, edx
jge 0x40b57e
mov edx, dword [0x4d9544]
add eax, 0xfffffff4
cmp eax, edx
jne 0x40b585
mov eax, dword [ecx - 0xc]
test eax, eax
jge 0x40b595
mov eax, dword [ecx - 8]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401630
jmp 0x40b5b0
lea ecx, [esp + 0x24]
call fcn.0040e950
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [0x4d9540]
lea edx, [esp + 0xa6c]
push 0x100
push edx
push 0x80
mov dword [esp + 0x24], ecx
call fcn.0040e810
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x40b5f0
lea edx, [esp + 0xa6c]
lea ecx, [esp + 0x18]
push edx
call fcn.004016e0
jmp 0x40b63e
push 0x1ff
lea ecx, [esp + 0x1c]
mov esi, 0x200
call fcn.0040f900
test eax, eax
je 0x40b633
push esi
push eax
push 0x80
call fcn.0040e810
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x40b633
add esi, 0x100
lea ecx, [esp + 0x18]
lea edx, [esi - 1]
push edx
call fcn.0040f900
test eax, eax
jne 0x40b607
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.00401970
mov eax, dword [0x4d9540]
mov ecx, 0x4d9c5c
test ecx, ecx
mov dword [esp + 0x2c], eax
jne 0x40b654
xor eax, eax
jmp 0x40b65b
push 0x4d9c5c
call edi
mov ecx, dword [esp + 0x18]
push ecx
mov edx, dword [ecx - 8]
lea ecx, [esp + 0x30]
push edx
push 0x4d9c5c
push eax
call fcn.004017b0
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
call fcn.00401200
lea ecx, [esp + 0x2c]
call fcn.004014c0
mov ecx, dword [0x4d9540]
mov edx, str._uninstall.exe
test edx, edx
mov dword [esp + 0x20], ecx
jne 0x40b6a1
xor eax, eax
jmp 0x40b6a8
push str._uninstall.exe
call edi
push str._uninstall.exe
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [eax - 8]
push eax
call fcn.004017b0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401200
lea ecx, [esp + 0x20]
call fcn.004014c0
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.0040f810
lea ecx, [esp + 0x1c]
call fcn.004014c0
lea ecx, [esp + 0x14]
call fcn.004014c0
lea eax, [esp + 0x10]
push eax
call fcn.0048ba60
lea ecx, [esp + 0x2c]
push ecx
call fcn.00489c40
add esp, 8
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push 0x4d9fb8
push edx
push 0x4d9c5c
push eax
call fcn.0040f340
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0040f1f0
push eax
lea ecx, [esp + 0x2c]
call fcn.0040f810
lea ecx, [esp + 0x14]
call fcn.004014c0
lea ecx, [esp + 0x1c]
call fcn.004014c0
lea edx, [esp + 0x28]
push edx
call fcn.0048ba60
mov eax, dword [0x4e3a2c]
mov ecx, 0x81
mov dword [esp + 0x60], eax
xor eax, eax
lea edi, [esp + 0x64]
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x5c]
push 0x104
push ecx
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
mov edx, dword [0x4d9540]
push 0
lea ecx, [esp + 0x60]
push eax
push ecx
mov dword [esp + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40b857
push str._n__n_
lea ecx, [esp + 0x18]
call fcn.004014f0
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x34]
push 3
push ecx
call fcn.0048eb30
add esp, 8
lea edx, [esp + 0x28]
push eax
push edx
call fcn.0040f0a0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0040f0a0
push eax
lea ecx, [esp + 0x34]
call fcn.0040ec90
lea ecx, [esp + 0x1c]
call fcn.004014c0
lea ecx, [esp + 0x20]
call fcn.004014c0
lea ecx, [esp + 0x2c]
call fcn.004014c0
lea ecx, [esp + 0x14]
call fcn.004014c0
mov ecx, dword [esp + 0x30]
push 0x10
push 0
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x30]
call fcn.004014c0
lea ecx, [esp + 0x28]
call fcn.004014c0
lea ecx, [esp + 0x18]
call fcn.004014c0
lea ecx, [esp + 0x24]
call fcn.004014c0
lea ecx, [esp + 0x10]
call fcn.004014c0
jmp 0x40b49b
push 0x4ecbe8
lea ecx, [esp + 0x38]
call fcn.00401200
lea edx, [esp + 0x28]
mov ecx, 0x4ecbe8
push edx
call fcn.0040ec90
push 0
push 0x4d9a14
call fcn.004b51b0
add esp, 8
mov esi, eax
lea eax, [esp + 0x34]
mov ecx, 0x4ecbe8
push eax
call fcn.0040ec90
push 0x4d9fb4
lea ecx, [esp + 0x18]
call fcn.004014f0
test esi, esi
mov esi, 0x4d9e98
jne 0x40b8b0
mov esi, str.open
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push edx
lea eax, [esp + 0x28]
push str._runas__uninstall_
push eax
call fcn.0040f340
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0040f0a0
mov edx, dword [esp + 0x24]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
push 5
push edx
push eax
push ecx
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x1c]
call fcn.004014c0
lea ecx, [esp + 0x20]
call fcn.004014c0
lea ecx, [esp + 0x14]
call fcn.004014c0
lea ecx, [esp + 0x34]
call fcn.004014c0
jmp 0x40b825
mov edx, dword [0x4e3a2c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x5c], edx
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x60]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040ea20
push 0x5c
lea ecx, [esp + 0x14]
call fcn.0040fb70
cmp eax, 0xffffffff
jne 0x40b972
push 0x2f
lea ecx, [esp + 0x14]
call fcn.0040fb70
cmp eax, 0xffffffff
je 0x40ba10
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call fcn.0040fba0
lea ecx, [esp + 0x10]
call fcn.00401380
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
push 0
push str.install
lea ecx, [esp + 0x18]
call fcn.00401a30
test eax, eax
jge 0x40b9cf
push 0
push str.inst_all
lea ecx, [esp + 0x18]
call fcn.00401a30
test eax, eax
jge 0x40b9cf
push 0
push str.setup
lea ecx, [esp + 0x18]
call fcn.00401a30
test eax, eax
jl 0x40ba10
call fcn.004a3340
push ecx
lea eax, [esp + 0xc74]
mov ecx, esp
push eax
call fcn.00401200
call fcn.0040ae50
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.004014c0
lea ecx, [esp + 0xc70]
call fcn.004014c0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc5c
ret
lea ecx, [esp + 0x10]
call fcn.004014c0
lea ecx, [esp + 0xc70]
call fcn.004014c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc5c
ret