Function at 0x405da0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x67c
mov eax, dword [0x424008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x110]
push esi
push edi
push 0x425750
push 0x425548
push 0x425414
push str._s_s_s
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x110]
push str..ini
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
lea eax, [ebp - 0x110]
push eax
push 0x104
push 0x425854
push 0x420874
push str.InstallFold
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [0x425854], 0x2a
lea eax, [ebp - 0x110]
push eax
jne 0x405e66
push 0x4212d8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x110]
push 0x30
push 0x42564c
push eax
push dword [0x425188]
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [0x425188]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a88f
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push str.Mode
push str.INSTALL
call esi
mov dword [0x425524], eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.shortcut
push str.INSTALL
call esi
mov dword [0x42551c], eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.IsOpenReadme
push str.INSTALL
call esi
movups xmm0, xmmword [0x42b710]
mov dword [0x425520], eax
mov eax, dword [0x425198]
movups xmmword [0x42b7d0], xmm0
push str.String
movups xmm0, xmmword [0x42b720]
movups xmmword [0x42b7e0], xmm0
mov esi, dword [0x42b7e0]
sub esi, dword [0x42b7d8]
mov dword [0x42b7ec], eax
mov eax, dword [0x4251a8]
lea ecx, [eax*4]
lea edi, [ecx + eax]
mov dword [0x42b7dc], ecx
push ecx
mov dword [0x42b7e4], edi
sub edi, ecx
push edi
push esi
mov ecx, 0x42cea0
call fcn.004011f0
push str.Mask
push ecx
push edi
push esi
mov ecx, 0x42d1e0
call fcn.004011f0
mov ecx, dword [0x42b7e8]
mov eax, dword [0x42b7ec]
mov dword [0x42b7c8], ecx
mov dword [0x42b7a8], ecx
mov ecx, dword [0x42d0b0]
mov dword [0x42b7c0], esi
mov dword [0x42b7c4], edi
mov dword [0x42b7a0], esi
mov esi, dword [0x42d0b4]
mov dword [0x42b7a4], edi
mov edi, dword [0x42d0b8]
mov dword [0x42b7cc], eax
mov dword [0x42b7ac], eax
test ecx, ecx
je 0x405fda
mov eax, dword [0x42d1d8]
mov edx, dword [0x42d0bc]
mov eax, dword [eax]
add eax, ecx
mov ecx, edx
imul ecx, esi
mov dword [ebp - 0x620], eax
mov eax, dword [0x42d0c8]
sub eax, ecx
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x620]
test edi, edi
jle 0x405fda
mov ecx, dword [ebp - 0x61c]
nop dword [eax]
test esi, esi
jle 0x405fd3
mov ecx, esi
nop word [eax + eax]
mov dword [eax], 0xffffffff
add eax, edx
sub ecx, 1
jne 0x405fc0
mov ecx, dword [ebp - 0x61c]
add eax, ecx
sub edi, 1
jne 0x405fb0
push 0x2710
push 0
push 0x426894
call fcn.0040bb50
add esp, 0xc
call fcn.004058a0
test eax, eax
jne 0x40613d
call fcn.004046d0
push 0x425750
push 0x425548
push 0x425414
lea eax, [ebp - 0x218]
push str._s_s_s
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x218]
push str..ini
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
call eax
lea eax, [ebp - 0x218]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104
push 0x425854
push 0x420874
push str.InstallFold
push str.INSTALL
call eax
push str.Setup.exe
push 0x425854
lea eax, [ebp - 0x320]
push 0x42086c
push eax
call ebx
push str.Setup.exe
push 0x425548
push 0x425414
lea eax, [ebp - 0x218]
push str._s_s_s
push eax
call ebx
add esp, 0x24
lea eax, [ebp - 0x218]
push 0
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x628], 0
xorps xmm0, xmm0
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x660]
movlpd qword [ebp - 0x658], xmm0
push eax
movlpd qword [ebp - 0x640], xmm0
movlpd qword [ebp - 0x638], xmm0
movlpd qword [ebp - 0x630], xmm0
mov dword [ebp - 0x660], 0x3c
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x64c], str.Uninstall
mov dword [ebp - 0x648], 0x425414
mov dword [ebp - 0x65c], 0x8000
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push dword [0x425188]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a88f
mov esp, ebp
pop ebp
ret
push 0x425750
push 0x425548
push 0x425414
lea eax, [ebp - 0x218]
push str._s_s_s
push eax
call ebx
add esp, 0x14
lea eax, [ebp - 0x218]
push str..ini
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
call eax
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x320]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x420874
push str.SaveFold
push str.INSTALL
call eax
cmp byte [ebp - 0x320], 0x2a
je 0x4063d2
lea ecx, [ebp - 0x320]
call fcn.00407fd0
call fcn.004046d0
call fcn.00403e40
call fcn.00404050
lea eax, [ebp - 0x110]
push eax
push 0x421358
push str.IsInstall
push str.INSTALL
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, 0x42d1e0
call fcn.004010b0
mov ecx, 0x42cea0
call fcn.004010b0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x42564c
push 0x421368
push dword [0x425188]
call esi
mov eax, dword [0x425180]
test eax, eax
je 0x406224
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x425180], 0
push str.Setup.exe
push 0x425854
lea eax, [ebp - 0x110]
push 0x42086c
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x110]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x406263
push 0x30
push 0x42564c
push 0x42138c
push 0
call esi
cmp dword [0x425520], 0
je 0x4063ea
push 0x425a5c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
cmp byte [eax + 0x425a5c], 0x2e
je 0x40628f
dec eax
cmp byte [eax + 0x425a5c], 0x2e
jne 0x406285
lea eax, [eax + 0x425a5c]
mov edx, str..txt
mov ecx, eax
nop dword [eax]
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x4062c0
test bl, bl
je 0x4062bc
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x4062c0
add ecx, 2
add edx, 2
test bl, bl
jne 0x4062a0
xor ecx, ecx
jmp 0x4062c5
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x40634a
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x63c], 0x100
lea eax, [ebp - 0x618]
push 0x425a5c
push 0x425854
push str.notepad__s_s
push eax
mov dword [ebp - 0x644], 0x30
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x668]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x618]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a88f
mov esp, ebp
pop ebp
ret
mov edx, str..html
mov ecx, eax
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x406371
test bl, bl
je 0x40636d
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x406371
add ecx, 2
add edx, 2
test bl, bl
jne 0x406351
xor ecx, ecx
jmp 0x406376
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x4063a9
mov ecx, str..htm
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4063a0
test dl, dl
je 0x40639c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4063a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x406380
xor eax, eax
jmp 0x4063a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4063ea
push 1
push 0
push 0
push 0x425a5c
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a88f
mov esp, ebp
pop ebp
ret
push 0x20
push 0x42564c
push 0x421338
push dword [0x425188]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a88f
mov esp, ebp
pop ebp
ret