Function at 0x401350
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Print debug messages

Disassembly:
sub esp, 0x464
mov eax, dword [0x4115a4]
push ebx
push ebp
push esi
cmp eax, 1
push edi
mov byte [esp + 0x113], 0
mov byte [esp + 0x10], 0
jg 0x4015e6
lea eax, [esp + 0x26c]
push 0x104
push eax
push 0
mov byte [esp + 0x37b], 0
mov byte [esp + 0x278], 0
mov byte [esp + 0x277], 0
mov byte [esp + 0x174], 0
mov byte [esp + 0x47f], 0
mov byte [esp + 0x37c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4013cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName__
jmp 0x401593
lea eax, [esp + 0x168]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4013f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempPath__
jmp 0x401593
lea eax, [esp + 0x168]
lea ecx, [esp + 0x168]
push eax
push 0
push 0x40da98
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x401429
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempFileName__
jmp 0x4014dd
lea ecx, [esp + 0x168]
push 0
lea edx, [esp + 0x270]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401453
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetTempFileName__
jmp 0x401483
push 0
push 0x4000000
push 3
push 0
push 1
lea edx, [esp + 0x17c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4014b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFile__
lea eax, [esp + 0x18]
push 0x103
push eax
call fcn.004031e4
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x464
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40150a
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess__
lea edx, [esp + 0x18]
push 0x103
push edx
call fcn.004031e4
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x464
ret 0x10
lea ecx, [esp + 0x26c]
lea edx, [esp + 0x168]
push ecx
push esi
push edx
push str._s__d___s_
lea eax, [esp + 0x380]
push 0x103
push eax
call fcn.004031e4
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x12c]
add esp, 0x18
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x158]
lea edx, [esp + 0x114]
push ecx
push edx
push eax
push eax
push eax
push 1
push eax
push eax
lea eax, [esp + 0x390]
mov dword [esp + 0x134], 0x44
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4015c0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call edi
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess__
lea ecx, [esp + 0x18]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x464
ret 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x464
ret 0x10
cmp eax, 3
jl 0x401782
mov eax, dword [0x4115a8]
mov ecx, dword [eax + 4]
push ecx
call fcn.004030b9
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 4
mov esi, eax
push 0x1388
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401641
push esi
call edi
push str.WaitForSingleObject__
lea edx, [esp + 0x14]
push 0x103
push edx
call fcn.004031e4
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call ebp
push esi
call edi
mov ecx, dword [0x4115a8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00409230
test eax, 0x10000
je 0x401686
mov eax, dword [str.UninstallPermit]
mov ecx, dword [str.Global]
push eax
push ecx
push 0x40d9d0
lea edx, [esp + 0x1c]
push 0x103
push edx
call fcn.004031e4
add esp, 0x14
jmp 0x40169e
mov eax, dword [str.UninstallPermit]
push 0x103
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00402f30
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
jne 0x4016cc
push 0x40d9bc
call ebp
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x464
ret 0x10
push 0x1388
push esi
call ebx
test eax, eax
jne 0x401729
push eax
mov eax, dword [str.yfbyfbyyfyyf]
push 1
push eax
lea ecx, [esp + 0x120]
call fcn.00401af0
lea ecx, [esp + 0x114]
call fcn.00401b30
test eax, eax
jne 0x401704
push 0x40d99c
jmp 0x401709
push 0x40d97c
call ebp
lea ecx, [esp + 0x114]
call fcn.00401b20
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x464
ret 0x10
cmp eax, 0x102
jne 0x40174a
push 0x40d968
call ebp
push esi
call edi
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x464
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40d944
lea ecx, [esp + 0x18]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x10
lea edx, [esp + 0x10]
push edx
call ebp
push esi
call edi
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x464
ret 0x10
push 0x40d930
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x464
ret 0x10