Function at 0x401000
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Get common file path

Disassembly:
sub esp, 0x70
push ebx
push ebp
push esi
push edi
push 1
xor ebp, ebp
pop edi
push ebp
mov dword [esp + 0x14], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push str.RegDeleteKeyExW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x405e34], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
call fcn.0040169a
mov esi, eax
mov ebx, 0x404694
mov dword [esp + 0x18], esi
mov ax, word [esi]
cmp ax, bp
je 0x4010ef
cmp ax, 0x20
jne 0x401064
inc esi
inc esi
jmp 0x4010e7
mov ecx, esi
call fcn.0040169a
cmp word [0x404020], 0x2f
mov esi, eax
mov eax, edi
jne 0x4010ce
mov cx, word [0x404022]
cmp cx, 0x53
jne 0x401097
cmp word [0x404024], bp
jne 0x4010ce
mov dword [0x405c14], edi
jmp 0x4010cc
cmp cx, 0x4e
jne 0x4010a8
cmp word [0x404024], bp
jne 0x4010ce
jmp 0x4010c8
cmp cx, 0x44
jne 0x4010ce
cmp word [0x404024], 0x3d
jne 0x4010ce
push 0x404026
push 0x4059f8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [esp + 0x10], ebp
xor eax, eax
cmp eax, ebp
je 0x4010e7
cmp word [0x404694], bp
jne 0x4010e7
push 0x404020
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ax, word [esi]
jmp 0x40104e
cmp word [0x404694], bp
je 0x401118
cmp dword [0x405c14], ebp
jne 0x40110c
mov edx, ebx
mov ecx, str.Unsupported_command:
call fcn.00401546
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 0x10
mov ebx, 0x104
mov esi, 0x4048ac
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebp
je 0x40110c
cmp eax, ebx
ja 0x40110c
push esi
mov esi, 0x405c18
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [0x405c18]
mov ecx, 0x405c1a
cmp ax, bp
je 0x401167
cmp ax, 0x5c
jne 0x401159
mov edi, ecx
mov ax, word [ecx]
inc ecx
inc ecx
cmp ax, bp
jne 0x401151
cmp edi, ebp
jne 0x40116c
push 1
pop eax
jmp 0x40110e
mov edx, dword [0x403128]
mov ecx, edi
call fcn.004015d0
test eax, eax
jne 0x401181
mov dword [esp + 0x10], ebp
cmp dword [esp + 0x10], ebp
mov word [edi], bp
mov edi, 0x404f28
je 0x401387
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebp
je 0x401387
cmp eax, 0x105
ja 0x401387
mov edx, edi
mov ecx, esi
call fcn.00401624
test eax, eax
jne 0x401387
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
shl esi, 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
shl esi, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
lea eax, [ebx*2 + 0x404f28]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov edx, 0x4036d0
call fcn.0040151a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 0x404f28]
mov ebx, esi
mov dword [esp + 0x14], 8
lea ecx, [eax + 0xe]
mov edx, ebx
and edx, 0xf
shr ebx, 4
cmp edx, 0xa
jae 0x401230
add edx, 0x30
jmp 0x401233
add edx, 0x37
mov word [ecx], dx
dec ecx
dec ecx
dec dword [esp + 0x14]
jne 0x40121e
mov word [eax + 0x10], bp
call fcn.004016f6
test eax, eax
mov ebx, 0x404234
jne 0x401269
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401282
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401296
inc dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
cmp dword [esp + 0x10], 0x64
jb 0x4011f5
jmp 0x401296
mov edx, 0x4036cc
mov ecx, edi
call fcn.0040152d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [0x404234], bp
je 0x401382
mov esi, 0x404ac8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, str.Uninst.exe
mov ecx, esi
call fcn.0040152d
push 1
push esi
push 0x4048ac
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x401382
mov ecx, esi
call fcn.0040170c
mov ecx, ebx
call fcn.0040170c
mov edx, esi
mov esi, 0x405390
mov ecx, esi
mov word [0x405390], bp
call fcn.00401718
mov edx, str.__N__D
mov ecx, esi
call fcn.0040152d
mov edx, 0x405c18
mov ecx, esi
call fcn.00401718
mov eax, dword [esp + 0x18]
cmp word [eax], bp
je 0x40132f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x212
jae 0x40132f
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x44
lea eax, [esp + 0x40]
push ebp
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
mov dword [esp + 0x3c], 0x44
push eax
lea eax, [esp + 0x40]
push eax
push ebx
push ebp
push ebp
push ebp
push ebp
push ebp
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401382
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [esp + 0x20], ebp
je 0x401382
push dword [esp + 0x20]
call esi
xor eax, eax
jmp 0x40110e
mov esi, 0x405c18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call esi
cmp word [0x4059f8], bp
je 0x4013a9
push 0x4059f8
push edi
call esi
mov ecx, edi
call fcn.00401676
cmp dword [0x405c14], ebp
je 0x4013bb
call fcn.0040176e
jmp 0x40110e
push 1
pop esi
push ebp
push 0x40201f
push ebp
push 0x64
push dword [esp + 0x94]
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_CreateDialogParamW]
cmp eax, ebp
mov dword [0x405e38], eax
jne 0x4013e8
mov eax, esi
jmp 0x40110e
push esi
push dword [esp + 0x88]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
push 0x80
push dword [0x405e38]
call ebx
push ebp
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebp
je 0x4014fb
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, 0xffffffff
je 0x401511
mov eax, dword [0x405e38]
cmp eax, ebp
je 0x401511
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x401469
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [0x405e38], ebp
je 0x401511
cmp dword [0x4048a4], ebp
je 0x4014e5
cmp dword [0x40538c], ebp
jne 0x4014e5
call fcn.0040176e
push 1
cmp eax, ebp
pop ecx
mov dword [esp + 0x10], eax
mov dword [0x40538c], ecx
jne 0x4014fb
mov eax, dword [0x405e38]
cmp eax, ebp
je 0x401511
push str.Close
push ecx
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 1
push 1
push dword [0x405e38]
call esi
push eax
call edi
push ebp
push 2
push dword [0x405e38]
call esi
push eax
call edi
push 1
push 1
push dword [0x405e38]
call esi
push eax
push 0x28
push dword [0x405e38]
call ebx
push ebp
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebp
jne 0x40142d
mov eax, dword [0x405e38]
cmp eax, ebp
je 0x401511
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x405e38], ebp
mov eax, dword [esp + 0x10]
jmp 0x40110e