Function at 0x411ce0
Capabilities:
Accept command line arguments
Get file system object information
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push esi
mov esi, 1
push edi
mov dword [esp + 0x10], esi
call fcn.004510a0
push 0x92427c
xor ebx, ebx
push ebx
call fcn.00659c7f
add esp, 8
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call fcn.00659df3
add esp, 4
push eax
call fcn.006590c7
add esp, 4
call fcn.0043cf00
call fcn.00411a80
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0x7ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x48], 1
mov dword [esp + 0x30], esi
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
cmp byte [esp + 0x3c], bl
je 0x411da1
lea ecx, [esp + 0x38]
push ecx
call dword [esp + 0x30]
call fcn.004716e0
call fcn.0046fb00
call fcn.00456ee0
call fcn.00445900
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea esi, [esp + 0x9c]
call fcn.00401920
mov esi, dword [esp + 0x1a4]
mov edi, dword [0x9f48bc]
cmp esi, ebx
jne 0x411de3
mov esi, dword [edi + 0xa4]
cmp esi, ebx
je 0x411e10
cmp esi, dword [edi + 0xa4]
je 0x411e09
mov edx, dword [edi + 0xa4]
push edx
call fcn.00658a01
add esp, 4
push esi
call fcn.00660bd4
add esp, 4
mov dword [edi + 0xa4], eax
mov eax, esi
call fcn.0044a210
cmp byte [esp + 0x17c], bl
je 0x411e1e
call fcn.00451170
cmp byte [esp + 0x148], bl
je 0x411e2c
call fcn.00406430
cmp dword [esp + 0xf0], ebx
jbe 0x411e58
lea ebx, [esp + 0xf0]
call fcn.004372d0
cmp byte [esp + 0x17c], 0
je 0x411e58
push str.pause
call fcn.00658e50
add esp, 4
cmp byte [esp + 0x188], 0
jne 0x4122dd
mov ecx, dword [esp + 0x168]
mov al, byte [esp + 0x1a1]
push ecx
mov byte [0x9f43eb], al
call fcn.00403040
mov ecx, dword [0x9f48bc]
add esp, 4
cmp byte [ecx + 6], 0
mov dword [0x9e8474], eax
je 0x411eae
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 8
call esi
push 5
mov dword [0x9f5a78], eax
call esi
mov ecx, dword [0x9f48bc]
jmp 0x411eba
mov edx, dword [ecx + 8]
mov dword [0x9f5a78], edx
mov eax, dword [ecx + 0xc]
mov dword [0x9f5a7c], eax
cmp byte [ecx + 0x30], 0
je 0x411ed6
mov ecx, dword [0x9f5a78]
mov dword [0x9f5a78], eax
mov dword [0x9f5a7c], ecx
mov al, byte [0x9f43ea]
mov byte [0x9f5149], al
call fcn.00410e00
test al, al
je 0x4122dd
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x84
xor ebx, ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7da
push ebx
mov dword [0x9eef1c], eax
call esi
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov dword [0x9eef18], eax
cmp dword [esp + 0x180], ebx
je 0x411f3e
lea ecx, [esp + 0x98]
push ecx
call fcn.00411790
add esp, 4
test al, al
je 0x4122dd
cmp dword [esp + 0x14c], ebx
je 0x411fa1
xor esi, esi
cmp dword [esp + 0x98], ebx
jbe 0x411f98
lea edi, [esi + 1]
cmp byte [esp + 0x189], bl
mov edx, dword [esp + 0x150]
sete al
movzx ecx, al
mov eax, dword [esp + 0xa4]
mov eax, dword [eax + esi*4]
push edx
mov edx, dword [esp + 0x150]
push ecx
push edx
call fcn.0041da90
add esp, 0xc
test al, al
jne 0x411f8d
add dword [esp + 0x10], edi
add esi, edi
cmp esi, dword [esp + 0x98]
jb 0x411f55
dec dword [esp + 0x10]
jmp 0x4122dd
mov edi, dword [0x9f48bc]
cmp dword [esp + 0x98], ebx
jne 0x4120b8
cmp byte [edi + 0xb8], bl
je 0x4120b8
cmp byte [edi + 0xec], bl
je 0x4120b8
push 0x4011
push 0x2b4
lea ecx, [esp + 0x1b0]
push ecx
push ebx
push 0x92357c
mov byte [esp + 0x23], 1
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [0x9f48bc]
cmp dword [edi + 0xf4], ebx
je 0x4120ce
lea esi, [esp + 0x40]
call fcn.00449340
mov eax, dword [edi + 0xf4]
push 0xffffffffffffffff
mov edx, esi
push edx
push eax
call fcn.004575b0
add esp, 0xc
call fcn.004124f0
mov ecx, esi
call fcn.00412530
cmp eax, ebx
je 0x412063
mov edi, edi
push eax
lea eax, [esp + 0x9c]
call fcn.0044f5d0
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x40]
lea eax, [ecx + edx*4]
mov ecx, dword [esp + 0x94]
cmp eax, ecx
je 0x412063
mov eax, ecx
add ecx, 4
mov dword [esp + 0x94], ecx
cmp eax, ebx
jne 0x412030
mov edi, dword [esp + 0x40]
xor edx, edx
lea esi, [esp + 0x40]
call fcn.00412460
mov esi, dword [0x9f48bc]
mov ecx, dword [esi + 0xf4]
push ecx
call fcn.00658a01
mov dword [esi + 0xf4], ebx
add esp, 4
lea esi, [esp + 0x40]
call fcn.00449370
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x50]
cmp eax, edx
je 0x4120c8
mov ecx, dword [esp + 0x90]
push eax
cmp ecx, ebx
jne 0x4120c1
call fcn.00658a01
add esp, 4
jmp 0x4120c8
mov byte [esp + 0xf], bl
jmp 0x411ff5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov edi, dword [0x9f48bc]
mov dword [esp + 0x14], ebx
cmp byte [esp + 0x14a], bl
jne 0x412177
cmp dword [esp + 0x18c], ebx
jne 0x412177
cmp dword [0x9f43ec], ebx
jne 0x412177
cmp byte [esp + 0x15c], bl
je 0x412110
push 0
push str.SUMATRA_PDF_FRAME
call dword [sym.imp.USER32.dll_FindWindowW]
jmp 0x41212a
cmp byte [edi + 5], bl
jne 0x41211d
cmp byte [edi + 0xed], bl
je 0x412177
lea ecx, [esp + 0x14]
push ecx
call fcn.00411af0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x412173
xor edi, edi
cmp dword [esp + 0x98], edi
jbe 0x4122dd
nop
mov ecx, dword [esp + 0xa4]
test edi, edi
sete dl
movzx eax, dl
mov edx, dword [ecx + edi*4]
push eax
push edx
push ebx
lea esi, [esp + 0xa4]
call fcn.00410f50
inc edi
add esp, 0xc
cmp edi, dword [esp + 0x98]
jb 0x412140
jmp 0x4122dd
mov ebx, dword [esp + 0x14]
xor esi, esi
xor edi, edi
cmp dword [esp + 0x98], esi
jbe 0x4121e1
mov edx, dword [esp + 0xa4]
test esi, esi
sete al
movzx ecx, al
mov eax, dword [edx + edi*4]
push ecx
push eax
lea ecx, [esp + 0xa0]
call fcn.004111c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4121b3
inc dword [esp + 0x10]
jmp 0x4121c9
mov eax, dword [esp + 0x149]
test ah, ah
je 0x4121c9
push eax
mov ecx, esi
call fcn.0041ca60
add esp, 4
mov eax, dword [esp + 0x98]
inc edi
cmp edi, eax
jb 0x412184
test eax, eax
je 0x4121e1
test esi, esi
je 0x4122dd
mov eax, dword [esp + 0x149]
test ah, ah
je 0x4121f4
test al, al
jne 0x4122dd
test esi, esi
jne 0x412207
call fcn.00405200
mov esi, eax
test esi, esi
je 0x4122dd
call fcn.0040b830
cmp dword [esi], 0
jne 0x412216
call fcn.00404e90
mov ecx, dword [0x9f48bc]
cmp dword [ecx + 0xac], 0
je 0x412231
mov edx, dword [esi + 8]
push edx
call fcn.004064a0
add esp, 4
cmp dword [esp + 0x18c], 0
je 0x412268
mov eax, dword [0x9e8474]
and eax, 0xfffffffb
or eax, 0x1000000
mov dword [0x9e8474], eax
call fcn.004033e0
push 0x9f56e8
lea ecx, [esp + 0x9c]
push esi
push ecx
call fcn.00439420
add esp, 0xc
mov edx, dword [0x9f48bc]
cmp byte [edx + 0xb1], 0
je 0x412282
push 1
push esi
call fcn.00406a30
add esp, 8
cmp byte [esp + 0xf], 0
je 0x4122bf
mov eax, dword [0x9f56e0]
cmp dword [eax], 0
jbe 0x4122bf
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x4122bf
push 0x74
call fcn.00659e93
add esp, 4
test eax, eax
je 0x4122b1
push eax
call fcn.004108d0
jmp 0x4122b3
xor eax, eax
mov esi, eax
mov dword [0x9f43fc], eax
call fcn.00455fe0
call fcn.00446310
call fcn.0040d070
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x4122d8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00428b70
mov eax, dword [0x9f48c0]
mov esi, eax
test eax, eax
je 0x412303
push 0x9ef130
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00456900
push 0x9ef130
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x9e8478], 0
jbe 0x412326
lea esp, [esp]
mov ecx, dword [0x9e8484]
mov edi, dword [ecx]
call fcn.00405260
cmp dword [0x9e8478], 0
ja 0x412310
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]