Function at 0x401b95
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x224
mov eax, dword [0x423214]
xor eax, ebp
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x70]
mov dword [0x423f40], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401bd4
cmp dword [ebp - 0x20], 2
mov byte [0x423f44], 1
je 0x401bdb
mov byte [0x423f44], 0
push ebx
push esi
lea ecx, [ebp - 0x12c]
call fcn.00401284
lea ecx, [ebp - 0x5c]
call fcn.00401284
lea ecx, [ebp - 0xe4]
call fcn.00401284
lea ecx, [ebp - 0xfc]
call fcn.00401284
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040129c
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x12c]
lea ecx, [ebp - 0x40]
call fcn.00403529
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
lea ecx, [ebp - 0xd8]
call fcn.00401284
mov ecx, dword [0x423f40]
lea edx, [ebp - 0xd8]
call fcn.00404069
lea ecx, [ebp - 0x5c]
call fcn.00401b57
lea ecx, [ebp - 0x5c]
call fcn.00401b31
push 0x41d59c
lea ecx, [ebp - 0xf0]
mov byte [ebp - 0x31], 0
call fcn.0040129c
mov esi, eax
push 2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004018ee
mov edx, dword [esi]
mov ecx, dword [eax]
call fcn.0040370a
push dword [ebp - 0x40]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call fcn.00403648
push dword [ebp - 0xf0]
call fcn.00403648
test bl, bl
pop ecx
pop ecx
je 0x401cde
push 2
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x31], 1
call fcn.004018cd
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040135f
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.00401b57
lea ecx, [ebp - 0x5c]
call fcn.00401b31
lea ecx, [ebp - 0xcc]
call fcn.004013fe
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xcc]
push eax
push str.___InstallEnd__
mov edx, str.___Install__UTF_8_
call fcn.004016c6
test al, al
jne 0x401d72
cmp byte [ebp - 0x31], al
jne 0x401d1a
mov edx, str.Cant_load_config_info
xor ecx, ecx
call fcn.0040f841
push dword [ebp - 0xcc]
call fcn.00403648
push dword [ebp - 0xd8]
call fcn.00403648
push dword [ebp - 0xfc]
call fcn.00403648
push dword [ebp - 0xe4]
call fcn.00403648
push dword [ebp - 0x5c]
call fcn.00403648
push dword [ebp - 0x12c]
call fcn.00403648
xor eax, eax
add esp, 0x18
inc eax
mov ecx, dword [ebp + 0x64]
pop esi
xor ecx, ebp
pop ebx
call fcn.00411d0c
add ebp, 0x68
leave
ret 0x10
push edi
push 0x41d564
lea ecx, [ebp - 0xf0]
call fcn.0040129c
lea ecx, [ebp - 0x68]
call fcn.00401284
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
xor edi, edi
cmp dword [ebp - 0xc8], edi
mov byte [ebp - 0xb4], 1
je 0x402088
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], 4
mov dword [ebp - 0xb0], 0x41d39c
call fcn.00403a84
test al, al
jne 0x401e5d
cmp byte [ebp - 0x31], al
jne 0x401df2
mov edx, str.Config_failed
xor ecx, ecx
call fcn.0040f841
xor esi, esi
inc esi
lea ecx, [ebp - 0xb0]
call fcn.0040149f
push dword [ebp - 0x68]
call fcn.00403648
push dword [ebp - 0xf0]
call fcn.00403648
push dword [ebp - 0xcc]
call fcn.00403648
push dword [ebp - 0xd8]
call fcn.00403648
push dword [ebp - 0xfc]
call fcn.00403648
push dword [ebp - 0xe4]
call fcn.00403648
push dword [ebp - 0x5c]
call fcn.00403648
push dword [ebp - 0x12c]
call fcn.00403648
add esp, 0x20
mov eax, esi
pop edi
jmp 0x401d5f
push str.Title
lea ecx, [ebp - 0x40]
call fcn.0040129c
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0x120]
call fcn.00403a06
push dword [ebp - 0x40]
call fcn.00403648
lea ecx, [ebp - 0x40]
mov dword [esp], str.BeginPrompt
call fcn.0040129c
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0x108]
call fcn.00403a06
push dword [ebp - 0x40]
call fcn.00403648
lea ecx, [ebp - 0x40]
mov dword [esp], 0x41d510
call fcn.0040129c
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0x114]
call fcn.00403a06
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
mov ecx, dword [ebp - 0x114]
mov edx, 0x41d508
call fcn.0040370a
test eax, eax
jne 0x401efa
mov byte [ebp - 0xb4], al
push str.Directory
lea ecx, [ebp - 0x40]
call fcn.0040129c
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0xb0]
call fcn.004039d4
push dword [ebp - 0x40]
mov esi, eax
call fcn.00403648
cmp esi, edi
pop ecx
jl 0x401f3c
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0xf0]
call fcn.0040135f
cmp dword [ebp - 0x104], edi
je 0x401f8b
cmp byte [ebp - 0x31], 0
jne 0x401f8b
push 0x24
push dword [ebp - 0x120]
push dword [ebp - 0x108]
push edi
call ebx
cmp eax, 6
je 0x401f8b
push dword [ebp - 0x114]
call fcn.00403648
push dword [ebp - 0x108]
call fcn.00403648
push dword [ebp - 0x120]
call fcn.00403648
add esp, 0xc
xor esi, esi
jmp 0x401df5
push str.RunProgram
lea ecx, [ebp - 0x40]
call fcn.0040129c
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0x50]
call fcn.00403a06
push eax
lea ecx, [ebp - 0x68]
call fcn.0040135f
push dword [ebp - 0x50]
call fcn.00403648
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
pop ecx
push str.ExecuteFile
lea ecx, [ebp - 0x40]
call fcn.0040129c
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0x50]
call fcn.00403a06
push eax
lea ecx, [ebp - 0xe4]
call fcn.0040135f
push dword [ebp - 0x50]
call fcn.00403648
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
pop ecx
push str.ExecuteParameters
lea ecx, [ebp - 0x40]
call fcn.0040129c
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0x8c]
call fcn.00403a06
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.00401679
push eax
lea ecx, [ebp - 0xfc]
call fcn.0040135f
push dword [ebp - 0x50]
call fcn.00403648
push dword [ebp - 0x8c]
call fcn.00403648
push dword [ebp - 0x40]
call fcn.00403648
push dword [ebp - 0x114]
call fcn.00403648
push dword [ebp - 0x108]
call fcn.00403648
push dword [ebp - 0x120]
call fcn.00403648
add esp, 0x18
lea ecx, [ebp - 0xb0]
call fcn.0040149f
lea ecx, [ebp - 0x98]
mov byte [ebp - 0x9c], 0
call fcn.004013fe
push dword [section..data]
lea ecx, [ebp - 0x9c]
call fcn.00404de0
test al, al
jne 0x4020d3
cmp byte [ebp - 0x31], al
jne 0x4020c0
mov edx, str.Can_not_create_temp_folder_archive
xor ecx, ecx
call fcn.0040f841
lea ecx, [ebp - 0x9c]
call fcn.0040125b
xor esi, esi
inc esi
jmp 0x401e00
push 0x1c
call fcn.0040361d
cmp eax, edi
pop ecx
je 0x4020ea
mov ecx, eax
call fcn.004018a8
mov esi, eax
jmp 0x4020ec
xor esi, esi
push esi
lea ecx, [ebp - 0x44]
call fcn.00407a4c
mov ecx, esi
call fcn.004079a9
test eax, eax
je 0x40211b
mov edx, str.Can_not_load_codecs
xor ecx, ecx
call fcn.0040f841
mov eax, dword [ebp - 0x44]
cmp eax, edi
je 0x4020c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4020c0
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x80]
call fcn.00401233
lea ecx, [ebp - 0xc0]
mov byte [ebp - 0x32], 0
call fcn.00401284
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x32]
push eax
push dword [ebp - 0xb4]
lea eax, [ebp - 0x80]
push eax
lea edx, [ebp - 0xd8]
mov ecx, esi
call fcn.00403363
cmp eax, edi
je 0x4021e2
cmp byte [ebp - 0x31], 0
jne 0x4021c8
cmp eax, 1
je 0x402173
cmp byte [ebp - 0x32], 0
je 0x402198
push 8
pop edx
lea ecx, [ebp - 0x40]
call fcn.0040587e
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040135f
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
mov eax, 0x80004005
cmp eax, 0x80004004
je 0x4021c8
cmp dword [ebp - 0xbc], edi
je 0x4021c8
push 7
pop edx
lea ecx, [ebp - 0x40]
call fcn.0040587e
push 0x10
push dword [eax]
push dword [ebp - 0xc0]
push edi
call ebx
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
push dword [ebp - 0xc0]
call fcn.00403648
push dword [ebp - 0x80]
call fcn.00403648
pop ecx
pop ecx
jmp 0x40210c
push dword [ebp - 0xc0]
call fcn.00403648
pop ecx
lea ecx, [ebp - 0x74]
call fcn.0040187f
push dword [ebp - 0x98]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call esi
test eax, eax
jne 0x402212
push dword [ebp - 0x74]
call esi
push dword [ebp - 0x74]
jmp 0x4021ce
cmp dword [ebp - 0xe0], edi
je 0x402337
lea edx, [ebp - 0xe4]
lea ecx, [ebp - 0x50]
call fcn.00401247
cmp dword [ebp - 0x58], edi
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x168], 0x3c
mov dword [ebp - 0x164], 0x140
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], eax
je 0x402269
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xfc]
call fcn.004013c8
lea edx, [ebp - 0xfc]
lea ecx, [ebp - 0x8c]
call fcn.00401247
mov eax, dword [ebp - 0x88]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x8c]
xor ebx, ebx
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x168]
inc ebx
push eax
mov dword [ebp - 0x150], edi
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x130], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x148], 0x20
ja 0x402318
cmp byte [ebp - 0x31], 0
jne 0x4022cd
mov edx, str.Can_not_open_file
xor ecx, ecx
call fcn.0040f841
push dword [ebp - 0x8c]
call fcn.00403648
push dword [ebp - 0x50]
call fcn.00403648
pop ecx
pop ecx
push dword [ebp - 0x74]
call esi
push dword [ebp - 0x74]
call fcn.00403648
push dword [ebp - 0x80]
call fcn.00403648
mov eax, dword [ebp - 0x44]
cmp eax, edi
pop ecx
pop ecx
je 0x402306
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x9c]
call fcn.0040125b
mov esi, ebx
jmp 0x401e00
push dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x130]
call fcn.00403648
push dword [ebp - 0x50]
call fcn.00403648
pop ecx
jmp 0x4024c2
cmp dword [ebp - 0x64], edi
jne 0x40238b
push 0x41d3f4
lea ecx, [ebp - 0x68]
call fcn.0040131a
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x50]
call fcn.00401247
mov ecx, dword [eax]
call fcn.0040523a
push dword [ebp - 0x50]
mov bl, al
neg bl
sbb bl, bl
inc bl
call fcn.00403648
test bl, bl
pop ecx
je 0x40238b
cmp byte [ebp - 0x31], 0
jne 0x402208
mov edx, str.Can_not_find_setup.exe
xor ecx, ecx
call fcn.0040f841
jmp 0x402208
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x50]
call fcn.004012df
lea ecx, [ebp - 0x50]
call fcn.004055f8
push str.__T_
lea ecx, [ebp - 0x8c]
call fcn.0040129c
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00401a5f
push dword [ebp - 0x8c]
call fcn.00403648
push dword [ebp - 0x50]
call fcn.00403648
pop ecx
pop ecx
push 0x41d3b0
lea ecx, [ebp - 0x50]
call fcn.0040129c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x68]
call fcn.00401a5f
push dword [ebp - 0x50]
call fcn.00403648
cmp dword [ebp - 0x58], edi
pop ecx
je 0x402418
push 0x20
lea ecx, [ebp - 0x68]
call fcn.0040139d
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x68]
call fcn.004013c8
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0xf0]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x1bc], 0x44
mov dword [ebp - 0x1b8], edi
mov dword [ebp - 0x1b4], edi
mov dword [ebp - 0x1b0], edi
mov dword [ebp - 0x190], edi
mov word [ebp - 0x18a], di
mov dword [ebp - 0x188], edi
call fcn.00401679
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00401247
push dword [ebp - 0x50]
call fcn.00403648
pop ecx
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x1bc]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4024a8
cmp byte [ebp - 0x31], al
jne 0x40249a
xor ecx, ecx
call fcn.0040f8b3
push dword [ebp - 0x40]
call fcn.00403648
pop ecx
jmp 0x402208
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x178]
call fcn.00403648
cmp ebx, edi
pop ecx
je 0x4024d7
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x74]
call esi
push dword [ebp - 0x74]
call fcn.00403648
push dword [ebp - 0x80]
call fcn.00403648
mov eax, dword [ebp - 0x44]
cmp eax, edi
pop ecx
pop ecx
je 0x4024fb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x9c]
call fcn.0040125b
xor esi, esi
jmp 0x401e00