Function at 0x401000
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43201a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbd8
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
push 3
call fcn.0042ba68
pop ecx
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x43cfc0], eax
push 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x43cfc4], eax
push 6
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x43cfc8], eax
push 0x20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x43cfcc], eax
push 0x21
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [0x43cfd0], eax
call fcn.0040a038
add esp, 8
push 0xffffffffffffffac
push eax
mov ecx, 0x43cf88
call fcn.00408be8
mov dword [0x438060], 1
xor eax, eax
mov ecx, 0x43cf88
mov dword [0x43cf98], eax
push 0x43cf98
mov dword [0x43cf9c], eax
push str.debug
call fcn.0040926c
push 0x43cf9c
push str.quiet
mov ecx, 0x43cf88
call fcn.0040926c
push 0x438060
push 0x434d60
mov ecx, 0x43cf88
call fcn.0040926c
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov ecx, 0x43cf88
push eax
push str.configFile
call fcn.004092f0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x40183f
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov ecx, 0x43cf88
push eax
push 0x434d70
call fcn.004092f0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
mov ecx, 0x43cf88
push eax
push str.uninstall
call fcn.004092f0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov ecx, 0x43cf88
push eax
push str.uninstallApp
call fcn.004092f0
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
mov ecx, 0x43cf88
push eax
push str.uninstallFile
call fcn.004092f0
mov eax, dword [0x43cf98]
test eax, eax
je 0x401187
push 0
push str.c:_wininstaller.log.txt
mov ecx, 0x43cfa0
call fcn.00409458
push str.Installation_started
push 0x43cfa0
call fcn.0040979c
push str.Getting_module_handle
push 0x43cfa0
call fcn.0040979c
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Loading_riched20.dll
push 0x43cfa0
mov dword [0x43cfbc], eax
call fcn.0040979c
add esp, 8
push str.riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x290]
call fcn.004018b0
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], 0x43cfa0
test eax, eax
jne 0x401404
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x401334
push str.Real_uninstall
push 0x43cfa0
call fcn.0040979c
add esp, 8
call fcn.004018d0
push 1
push 0
lea ecx, [ebp - 0x290]
push dword [ebp - 0x30]
call fcn.0041c9d8
mov ebx, eax
test ebx, ebx
jne 0x40127c
mov eax, dword [0x438060]
test eax, eax
je 0x40125f
push 0x43cfa0
push 0x43cfe8
lea ecx, [ebp - 0x290]
mov dword [0x43d01c], ecx
call fcn.0040ae98
mov ebx, eax
jmp 0x40127c
push 0x43cfa0
push 0x43d020
lea ecx, [ebp - 0x290]
mov dword [0x43d038], ecx
call fcn.0040ae98
mov ebx, eax
lea ecx, [ebp - 0x290]
call fcn.0040ae60
lea ecx, [ebp - 0x290]
call fcn.0041b3e0
test eax, eax
jne 0x4012bf
lea ecx, [ebp - 0x290]
call fcn.0041b3e8
test eax, eax
je 0x4012bf
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x290]
call fcn.004018f8
movzx eax, al
test eax, eax
jne 0x4012bf
mov ebx, 1
mov edx, dword [0x43cf98]
test edx, edx
jne 0x4012d2
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00401948
test ebx, ebx
je 0x401309
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4013a3
mov ebx, dword [str._BINARYIMAGEOFFSET_]
lea eax, [ebp - 0x4a0]
push pe_nt_image_headers32
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40138a
lea eax, [ebp - 0x4a0]
push ebx
push eax
push str.Initializing_with_file__s___offset_i
push 0x43cfa0
call fcn.0040979c
add esp, 0x10
lea eax, [ebp - 0x4a0]
push 0
push ebx
push eax
lea ecx, [ebp - 0x290]
call fcn.0041c9d8
jmp 0x4013b5
push str.Failed_to_obtain_module_file_name
push 0x43cfa0
call fcn.0040979c
add esp, 8
mov eax, 0xffffffff
jmp 0x4013e1
lea ecx, [ebp - 0x290]
xor eax, eax
push eax
push eax
push dword [ebp - 0x28]
call fcn.0041c9d8
test eax, eax
jne 0x4013e1
mov eax, dword [0x438060]
test eax, eax
jne 0x401808
push 0x43cfa0
push 0x43d020
lea ecx, [ebp - 0x290]
mov dword [0x43d038], ecx
call fcn.0040ae98
push eax
push str.Installation_finished__res_i_
push 0x43cfa0
call fcn.0040979c
add esp, 0xc
lea ecx, [ebp - 0x290]
call fcn.0040ae60
jmp 0x4017a3
push str.Uninstalling
push 0x43cfa0
call fcn.0040979c
add esp, 8
lea eax, [ebp - 0x390]
push pe_nt_image_headers32
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401461
call fcn.00401948
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x5a0]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4014aa
call fcn.00401948
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0x7e4]
lea edi, [ebp - 0x5a0]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4014b6
lea edi, [ebp - 0x7e4]
mov edx, str._vrayuninst.log
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x4014db
lea eax, [ebp - 0x7e4]
push 0
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401538
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00401948
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea esi, [ebp - 0x9e4]
lea edi, [ebp - 0x5a0]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x401544
lea edi, [ebp - 0x9e4]
mov edx, str._vrayuninst.dll
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x401569
lea edx, [ebp - 0x390]
lea eax, [ebp - 0x9e4]
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4015c4
call fcn.00401948
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xbe4]
push 0x200
push 0x434260
push eax
call fcn.0042bac0
add esp, 0xc
lea edi, [ebp - 0xbe4]
lea edx, [ebp - 0x9e4]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x4015f5
lea edi, [ebp - 0xbe4]
mov edx, str.___uninstallFile_
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x40161a
lea edi, [ebp - 0xbe4]
lea edx, [ebp - 0x7e4]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x401640
lea edi, [ebp - 0xbe4]
mov edx, str.___uninstallApp_
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x401665
mov edx, dword [ebp - 0x2c]
lea edi, [ebp - 0xbe4]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x401688
lea edi, [ebp - 0xbe4]
mov edx, 0x434a64
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x4016ad
mov eax, dword [0x438060]
test eax, eax
jne 0x4016e9
lea edi, [ebp - 0xbe4]
mov edx, str.__gui0
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov al, byte [edx]
add edx, 1
mov byte [edi], al
add edi, 1
test al, al
jne 0x4016db
xor eax, eax
mov dword [ebp - 0x5e4], eax
mov dword [ebp - 0x5e0], eax
mov dword [ebp - 0x5dc], eax
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x5d4], eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5ac], eax
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5e4], 0x44
xor eax, eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], eax
lea ebx, [ebp - 0xbe4]
lea ecx, [ebp - 0x5a0]
lea edx, [ebp - 0x5e4]
lea eax, [ebp - 0x3a0]
xor esi, esi
push eax
push edx
push ecx
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4017d5
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00401948
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x290]
call fcn.0040185c
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.Running_installation
push 0x43cfa0
lea eax, [ebp - 0x290]
mov dword [0x43d01c], eax
call fcn.0040979c
add esp, 8
push 0x43cfa0
push 0x43cfe8
lea ecx, [ebp - 0x290]
call fcn.0040ae98
jmp 0x4013e1
mov edi, dword [ebp - 0x20]
mov esi, 0x43cd40
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x401847
jmp 0x401105