Function at 0x401000
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Get common file path

Disassembly:
sub esp, 0x70
push ebx
push ebp
push esi
push edi
push 1
xor ebp, ebp
pop edi
push ebp
mov dword [esp + 0x14], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push str.RegDeleteKeyExW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x405e34], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
call fcn.004016a0
mov esi, eax
mov ebx, 0x404694
mov dword [esp + 0x18], esi
mov ax, word [esi]
cmp ax, bp
je 0x4010f3
cmp ax, 0x20
jne 0x401064
inc esi
inc esi
jmp 0x4010eb
mov ecx, esi
call fcn.004016a0
cmp word [0x404020], 0x2f
mov esi, eax
mov eax, edi
jne 0x4010d0
mov cx, word [0x404022]
cmp cx, 0x53
jne 0x401097
cmp word [0x404024], bp
jne 0x4010d0
mov dword [0x405c14], edi
jmp 0x4010ce
cmp cx, 0x4e
jne 0x4010a8
cmp word [0x404024], bp
jne 0x4010d0
jmp 0x4010ca
cmp cx, 0x44
jne 0x4010d0
cmp word [0x404024], 0x3d
jne 0x4010d0
push 0x404026
push 0x4059f8
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov dword [esp + 0x10], ebp
xor eax, eax
cmp eax, ebp
je 0x4010eb
cmp word [0x404694], bp
jne 0x4010eb
push 0x404020
push ebx
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov ax, word [esi]
jmp 0x40104e
cmp word [0x404694], bp
je 0x40111c
cmp dword [0x405c14], ebp
jne 0x401110
mov edx, ebx
mov ecx, str.Unsupported_command:
call fcn.0040155a
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 0x10
mov ebx, 0x104
mov esi, 0x4048ac
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebp
je 0x401110
cmp eax, ebx
ja 0x401110
push esi
mov esi, 0x405c18
push esi
xor edi, edi
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov eax, dword [0x405c18]
pop ecx
pop ecx
cmp ax, bp
mov ecx, 0x405c1a
je 0x40116d
cmp ax, 0x5c
jne 0x40115f
mov edi, ecx
mov ax, word [ecx]
inc ecx
inc ecx
cmp ax, bp
jne 0x401157
cmp edi, ebp
jne 0x401172
push 1
pop eax
jmp 0x401112
mov edx, dword [0x403128]
mov ecx, edi
call fcn.004015e6
test eax, eax
jne 0x401187
mov dword [esp + 0x10], ebp
cmp dword [esp + 0x10], ebp
mov word [edi], bp
mov edi, 0x404f28
je 0x401396
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x401396
cmp eax, 0x105
ja 0x401396
mov edx, edi
mov ecx, esi
call fcn.00401633
test eax, eax
jne 0x401396
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
shl esi, 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
shl esi, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
lea eax, [ebx*2 + 0x404f28]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov edx, 0x4036d0
call fcn.0040152d
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [eax*2 + 0x404f28]
pop ecx
mov ebx, esi
mov dword [esp + 0x14], 8
lea ecx, [eax + 0xe]
mov edx, ebx
and edx, 0xf
shr ebx, 4
cmp edx, 0xa
jae 0x401238
add edx, 0x30
jmp 0x40123b
add edx, 0x37
mov word [ecx], dx
dec ecx
dec ecx
dec dword [esp + 0x14]
jne 0x401226
mov word [eax + 0x10], bp
call fcn.004016fc
test eax, eax
mov ebx, 0x404234
jne 0x401271
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40128a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4012a0
inc dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
cmp dword [esp + 0x10], 0x64
jb 0x4011fc
jmp 0x4012a0
mov edx, 0x4036cc
mov ecx, edi
call fcn.00401540
push edi
push ebx
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
cmp word [0x404234], bp
je 0x401391
mov esi, 0x404ac8
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
mov edx, str.Uninst.exe
pop ecx
mov ecx, esi
call fcn.00401540
push 1
push esi
push 0x4048ac
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x401391
mov ecx, esi
call fcn.00401712
mov ecx, ebx
call fcn.00401712
mov edx, esi
mov esi, 0x405390
mov ecx, esi
mov word [0x405390], bp
call fcn.0040171e
mov edx, str.__N__D
mov ecx, esi
call fcn.00401540
mov edx, 0x405c18
mov ecx, esi
call fcn.0040171e
mov eax, dword [esp + 0x18]
cmp word [eax], bp
je 0x40133e
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 0x212
pop ecx
jae 0x40133e
push dword [esp + 0x18]
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
push 0x44
lea eax, [esp + 0x40]
push ebp
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 0x44
push eax
lea eax, [esp + 0x40]
push eax
push ebx
push ebp
push ebp
push ebp
push ebp
push ebp
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401391
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [esp + 0x20], ebp
je 0x401391
push dword [esp + 0x20]
call esi
xor eax, eax
jmp 0x401112
mov esi, 0x405c18
push esi
mov esi, dword [sym.imp.MSVCRT.dll_wcscpy]
push edi
call esi
cmp word [0x4059f8], bp
pop ecx
pop ecx
je 0x4013bc
push 0x4059f8
push edi
call esi
pop ecx
pop ecx
mov ecx, edi
call fcn.0040167b
cmp dword [0x405c14], ebp
je 0x4013ce
call fcn.00401776
jmp 0x401112
push 1
pop esi
push ebp
push 0x401fe5
push ebp
push 0x64
push dword [esp + 0x94]
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_CreateDialogParamW]
cmp eax, ebp
mov dword [0x405e38], eax
jne 0x4013fb
mov eax, esi
jmp 0x401112
push esi
push dword [esp + 0x88]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
push 0x80
push dword [0x405e38]
call ebx
push ebp
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebp
je 0x40150e
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, 0xffffffff
je 0x401524
mov eax, dword [0x405e38]
cmp eax, ebp
je 0x401524
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40147c
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x405e38], ebp
je 0x401524
cmp dword [0x4048a4], ebp
je 0x4014f8
cmp dword [0x40538c], ebp
jne 0x4014f8
call fcn.00401776
push 1
cmp eax, ebp
pop ecx
mov dword [esp + 0x10], eax
mov dword [0x40538c], ecx
jne 0x40150e
mov eax, dword [0x405e38]
cmp eax, ebp
je 0x401524
push str.Close
push ecx
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 1
push 1
push dword [0x405e38]
call esi
push eax
call edi
push ebp
push 2
push dword [0x405e38]
call esi
push eax
call edi
push 1
push 1
push dword [0x405e38]
call esi
push eax
push 0x28
push dword [0x405e38]
call ebx
push ebp
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebp
jne 0x401440
mov eax, dword [0x405e38]
cmp eax, ebp
je 0x401524
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x405e38], ebp
mov eax, dword [esp + 0x10]
jmp 0x401112