Function at 0x401150
Capabilities:
Accept command line arguments
Check os version
Copy file
Create process on windows
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x433053
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x442718]
xor eax, esp
mov dword [esp + 0x4d0], eax
push ebx
push esi
push edi
mov eax, dword [0x442718]
xor eax, esp
push eax
lea eax, [esp + 0x4e8]
mov dword fs:[0], eax
lea eax, [esp + 0x24]
mov ebx, 8
push eax
mov esi, ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.00402ad7
xor edi, edi
push edi
call fcn.00403bf5
mov esi, 7
add esp, 4
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe0], edi
mov word [esp + 0xd0], di
lea ecx, [esp + 0xcc]
mov dword [esp + 0x4f0], edi
call fcn.00401070
test eax, eax
je 0x4017e3
push 0x114
lea edx, [esp + 0x178]
push edi
push edx
call fcn.0041e160
add esp, 0xc
lea eax, [esp + 0x174]
push eax
mov dword [esp + 0x178], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x178], 5
jne 0x4017fb
mov ebx, 1
cmp dword [esp + 0x17c], ebx
jne 0x4017f6
push 0xffffffffffffffff
push edi
lea eax, [esp + 0xd4]
lea ecx, [esp + 0xb8]
mov dword [esp + 0xd0], esi
mov dword [esp + 0xcc], edi
mov word [esp + 0xbc], di
call fcn.004019b0
lea ecx, [esp + 0xb0]
mov byte [esp + 0x4f0], bl
push ecx
mov ebx, 0x439984
lea esi, [esp + 0x98]
call fcn.00401fa0
lea edx, [esp + 0xb4]
push edx
mov ebx, str.Generickb945436update_
lea esi, [esp + 0x128]
mov byte [esp + 0x4f8], 2
call fcn.00401fa0
add esp, 8
mov byte [esp + 0x4f0], 3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
movzx ecx, al
add ecx, 0xffffffff
cmp ecx, 0x1e
ja case.0x4012d5.1
jmp dword [ecx*4 + 0x40183c]
lea eax, [esp + 0x94]
push eax
mov edx, str.Arabic_
jmp 0x40148f
cmp ax, 0x416
jne 0x401306
lea ecx, [esp + 0x94]
push ecx
mov edx, str.Brazilian_
jmp 0x40148f
cmp ax, 0x816
jne case.0x4012d5.1
lea edx, [esp + 0x94]
push edx
mov edx, str.Portuguese_
jmp 0x40148f
cmp ax, 0x804
jne 0x40133a
lea eax, [esp + 0x94]
push eax
mov edx, str.CHS_
jmp 0x40148f
cmp ax, 0x404
jne case.0x4012d5.1
lea ecx, [esp + 0x94]
push ecx
mov edx, str.CHT_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.Czech_
jmp 0x40148f
lea eax, [esp + 0x94]
push eax
mov edx, str.Danish_
jmp 0x40148f
lea ecx, [esp + 0x94]
push ecx
mov edx, str.Dutch_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.English_
jmp 0x40148f
lea eax, [esp + 0x94]
push eax
mov edx, str.Finnish_
jmp 0x40148f
lea ecx, [esp + 0x94]
push ecx
mov edx, str.French_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.German_
jmp 0x40148f
lea eax, [esp + 0x94]
push eax
mov edx, str.Greek_
jmp 0x40148f
lea ecx, [esp + 0x94]
push ecx
mov edx, str.Hebrew_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.Hungarian_
jmp 0x40148f
lea eax, [esp + 0x94]
push eax
mov edx, str.Italian_
jmp 0x40148f
lea ecx, [esp + 0x94]
push ecx
mov edx, str.Japanese_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.Korean_
jmp 0x40148f
lea eax, [esp + 0x94]
push eax
mov edx, str.Norwegian_
jmp 0x40148f
lea ecx, [esp + 0x94]
push ecx
mov edx, str.Polish_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.Russian_
jmp 0x40148f
lea eax, [esp + 0x94]
push eax
mov edx, str.Spanish_
jmp 0x40148f
lea ecx, [esp + 0x94]
push ecx
mov edx, str.Swedish_
jmp 0x40148f
lea edx, [esp + 0x94]
push edx
mov edx, str.Turkish_
call fcn.004018f0
mov eax, 7
mov dword [esp + 0x11c], eax
mov dword [esp + 0x118], edi
mov word [esp + 0x108], di
mov dword [esp + 0x100], eax
mov dword [esp + 0xfc], edi
mov word [esp + 0xec], di
lea eax, [esp + 0x94]
push eax
mov ebx, 0x439ba8
lea esi, [esp + 0x140]
mov byte [esp + 0x4f4], 5
call fcn.00401fa0
add esp, 4
mov byte [esp + 0x4f0], 6
cmp dword [esp + 0x154], 8
mov eax, dword [esp + 0x140]
jae 0x401509
lea eax, [esp + 0x140]
lea ecx, [esp + 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x20], esi
je 0x40165c
jmp 0x401530
lea edx, [esp + 0x2b8]
push 0x439bb0
push edx
call fcn.0041d612
add esp, 8
test eax, eax
je 0x401644
lea eax, [esp + 0x2b8]
push 0x439bb4
push eax
call fcn.0041d612
add esp, 8
test eax, eax
je 0x401644
lea ecx, [esp + 0x94]
push ecx
lea ebx, [esp + 0x2bc]
lea esi, [esp + 0x34]
call fcn.00401fa0
add esp, 4
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x10c]
mov byte [esp + 0x4f8], 7
call fcn.004019b0
mov byte [esp + 0x4f0], 6
cmp dword [esp + 0x48], 8
jb 0x4015b8
mov edx, dword [esp + 0x34]
push edx
call fcn.0040211f
add esp, 4
lea eax, [esp + 0x120]
push eax
lea ebx, [esp + 0x2bc]
lea esi, [esp + 0x34]
call fcn.00401fa0
add esp, 4
push 0xffffffffffffffff
mov ebx, 8
push edi
lea ecx, [esp + 0xf0]
mov byte [esp + 0x4f8], bl
call fcn.004019b0
mov byte [esp + 0x4f0], 6
cmp dword [esp + 0x48], ebx
jb 0x401609
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0040211f
add esp, 4
cmp dword [esp + 0x100], ebx
mov ecx, dword [esp + 0xec]
jae 0x401620
lea ecx, [esp + 0xec]
cmp dword [esp + 0x11c], ebx
mov eax, dword [esp + 0x108]
jae 0x401637
lea eax, [esp + 0x108]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x28c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x401530
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x120]
push eax
mov ebx, str.update.exe
lea esi, [esp + 0x15c]
call fcn.00401fa0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x44
lea ecx, [esp + 0x50]
push edi
push ecx
mov esi, eax
call fcn.0041e160
xor eax, eax
mov ebx, 8
add esp, 0xc
cmp dword [esp + 0x170], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x4c], 0x44
jae 0x4016cd
lea eax, [esp + 0x15c]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x50]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40171a
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
lea esi, [esp + 0x158]
call fcn.004018c0
lea esi, [esp + 0x13c]
call fcn.004018c0
lea esi, [esp + 0xe8]
call fcn.004018c0
lea esi, [esp + 0x104]
call fcn.004018c0
jmp 0x401751
mov ebx, 8
cmp dword [esp + 0x138], ebx
jb 0x40176a
mov ecx, dword [esp + 0x124]
push ecx
call fcn.0040211f
add esp, 4
cmp dword [esp + 0xac], ebx
mov esi, 7
mov dword [esp + 0x138], esi
mov dword [esp + 0x134], edi
mov word [esp + 0x124], di
jb 0x40179e
mov edx, dword [esp + 0x98]
push edx
call fcn.0040211f
add esp, 4
cmp dword [esp + 0xc8], ebx
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], edi
mov word [esp + 0x98], di
jb 0x4017cd
mov eax, dword [esp + 0xb4]
push eax
call fcn.0040211f
add esp, 4
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], edi
mov word [esp + 0xb4], di
cmp dword [esp + 0xe4], ebx
jb 0x401814
mov ecx, dword [esp + 0xd0]
push ecx
jmp 0x40180c
mov ebx, 8
cmp dword [esp + 0xe4], ebx
jb 0x401814
mov edx, dword [esp + 0xd0]
push edx
call fcn.0040211f
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4d0]
xor ecx, esp
call fcn.0041d137
mov esp, ebp
pop ebp
ret