Function at 0x4026df
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Get file size
Hide graphical window
Read .ini file
Read file on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push section..Shared
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
jne 0x402b70
mov esi, 0xff
mov edi, 0x408770
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
mov edi, 0x408570
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call section..text
add esp, 4
mov edi, 0x408870
push esi
push 0x408670
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x402ada
mov ebx, 0x4070e0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push ebx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x402781
push 0x406240
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
mov ebx, 0x408770
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, eax
jne 0x4027ca
push ebx
push str.Dont_open__s
mov ebx, 0x4070e0
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push 0xfa
push edi
call fcn.00401241
add esp, 0xc
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
sub eax, 0x100
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x100
push 0x4070e0
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
cmp byte [ecx + 0x4070df], bl
je 0x402832
lea eax, [ecx - 1]
mov byte [ecx + 0x4070e0], bl
test eax, eax
jle 0x40281f
cmp byte [eax + 0x4070e0], 0
je 0x40281f
dec eax
test eax, eax
jg 0x402811
add eax, 0x4070e1
push eax
push 0x408970
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402849
push str.uninstal.ini
push 0x408570
push 0x408970
call fcn.004012eb
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x408970
push esi
call fcn.004010dd
add esp, 4
test eax, eax
jne 0x402887
push esi
push str.File__s_doesnt_exist_
mov esi, 0x4070e0
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
push 0xfa
push 0
call fcn.00401241
add esp, 0xc
push 0x4076bc
mov edi, 0x4074c8
push 0
call fcn.00401153
add esp, 8
mov ebx, 0x4070e0
push eax
push edi
push 0xed
call fcn.00401153
add esp, 8
push eax
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x24
push edi
push 0xa2
call fcn.00401153
add esp, 8
push eax
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x402b92
mov ebx, 0x408970
mov esi, 0x4070e0
push ebx
push 0x100
push esi
push 0x40606c
push 0x406204
push str.Before
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4029d1
push ebx
mov edi, 0x4078b0
push 0x100
push edi
push 0x40606c
push str.Func
push str.Before
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push 0x100
push 0x4074c8
push 0x40606c
push str.Param
push str.Before
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402aa5
push esi
call fcn.00401116
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x4029b7
push esi
push edi
push 0x407aa4
mov esi, 0x4076bc
push 0xa8
call fcn.00401153
add esp, 8
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push esi
push 0xfa
push 0
call fcn.00401241
add esp, 0xc
push 0
push 0x4074c8
call ebx
test eax, eax
je 0x402b92
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x408570
mov ebx, 0x407c98
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x408770
push eax
push 0x408870
push ebx
mov esi, 0x408770
call fcn.004012eb
add esp, 0xc
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402a39
push ebx
push esi
push 0x4074c8
mov esi, 0xfa
push esi
mov ebx, 0x4070e0
call fcn.00401153
add esp, 8
push eax
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebx
push esi
push 0
call fcn.00401241
add esp, 0xc
push 0x408970
mov esi, 0x4074c8
push 0x407c98
xor edi, edi
push str._s___s_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x5c]
push 0x44
push edi
push eax
call fcn.00402d30
add esp, 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x5c], 0x44
push eax
lea ecx, [ebp - 0x5c]
push ecx
push edi
push edi
push 0x4000020
push 1
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402ac1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402b92
push 1
push 0x4070e0
call fcn.00401192
add esp, 8
test eax, eax
jne 0x4029d1
jmp 0x402b92
push 0x4070e0
push 0xa5
push 0
call fcn.00401241
add esp, 0xc
jmp 0x402b92
push dword [ebp + 0x10]
mov esi, 0x408470
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov edi, 0x408970
call fcn.00401116
add esp, 4
push str.uninstal.ini
push 0x408870
push edi
call fcn.004012eb
add esp, 0xc
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax - 1]
cmp byte [esi + 0x408470], 0x5c
je 0x402b31
dec esi
cmp byte [esi + 0x408470], 0x5c
jne 0x402b27
push 0x408470
mov edi, 0x4070e0
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov byte [esi + 0x4070e0], bl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebx
push 0x402692
push ebx
push 0x65
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x408970
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402b92
mov eax, dword [section..rdata]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push 6
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10