Function at 0x405049
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Get common file path
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b4
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, 0x104
mov dword [ebp - 0x30], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
push eax
call fcn.004080d0
mov esi, 0x410c20
push esi
push dword [ebp - 0x1c]
call fcn.004081c0
push eax
mov dword [ebp - 4], eax
call fcn.0040851a
inc eax
push eax
call fcn.004084a6
push dword [ebp - 4]
mov dword [0x412e40], eax
push eax
call fcn.004080d0
inc dword [0x411dbc]
push esi
push ebx
call fcn.004081c0
add esp, 0x28
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x405159
push str._silent
push eax
call fcn.004082e6
pop ecx
test eax, eax
pop ecx
je 0x405119
push 0x410c10
push dword [ebp - 4]
call fcn.004082e6
pop ecx
test eax, eax
pop ecx
je 0x405119
push 0x410c0c
push dword [ebp - 4]
call fcn.004082e6
pop ecx
test eax, eax
pop ecx
je 0x405119
push 0x410c08
push dword [ebp - 4]
call fcn.004082e6
pop ecx
test eax, eax
pop ecx
jne 0x40511f
mov dword [0x410ba4], ebx
push dword [ebp - 4]
call fcn.0040851a
inc eax
push eax
call fcn.004084a6
push dword [ebp - 4]
mov ecx, dword [0x411dbc]
push eax
mov dword [ecx*4 + 0x412e40], eax
call fcn.004080d0
inc dword [0x411dbc]
push esi
push ebx
call fcn.004081c0
add esp, 0x18
jmp 0x4050c4
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x8b4]
push 0x400
push ecx
push eax
mov dword [0x4120b4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push edi
push 0x411cb8
push 2
push dword [0x4120b4]
call esi
test eax, eax
jne 0x40519a
push 2
call fcn.0040755d
pop ecx
lea eax, [ebp - 0x4b4]
push edi
push eax
push 5
push dword [0x4120b4]
call esi
test eax, eax
jne 0x4051b8
push 5
call fcn.0040755d
pop ecx
push edi
push 0x412a40
push 6
push dword [0x4120b4]
call esi
test eax, eax
jne 0x4051d4
push 6
call fcn.0040755d
pop ecx
push ebx
push ebx
push 3
push ebx
push 1
lea eax, [ebp - 0x8b4]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405331
mov eax, dword [str.DONOCHK]
push 2
push ebx
mov al, byte [eax + 8]
neg al
sbb eax, eax
and eax, 4
add eax, 0xfffffffc
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
call section..text
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [str.DONOCHK]
add esp, 0xc
mov dword [ebp - 0x14], ebx
cmp byte [eax + 8], bl
jne 0x405278
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x1c]
push 4
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405278
lea eax, [ebp - 0x4b4]
push edi
push eax
push 7
push dword [0x4120b4]
call esi
test eax, eax
jne 0x405328
push 7
jmp 0x405322
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x24], ebx
jle 0x4052f8
mov eax, 0x200
cmp dword [ebp - 8], eax
ja 0x405296
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x20]
push ebx
push ecx
push eax
push 0x411ab8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40534f
push dword [ebp - 0x20]
push 0x411ab8
push dword [ebp - 0x10]
call section..text
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 8], eax
add esp, 0xc
cmp dword [0x412be4], ebx
jne 0x4052ed
push 0x411ab8
call fcn.004048b9
test eax, eax
pop ecx
je 0x4052ed
mov eax, dword [ebp - 0x14]
mov dword [0x412be4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
cmp dword [ebp - 8], ebx
jg 0x405289
mov eax, dword [str.DONOCHK]
cmp byte [eax + 8], bl
jne 0x405369
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
je 0x405369
lea eax, [ebp - 0x4b4]
push edi
push eax
push 9
push dword [0x4120b4]
call esi
test eax, eax
jne 0x405328
push 9
call fcn.0040755d
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x410ba4], ebx
je 0x4057f0
push 0x10
push 0x412a40
lea eax, [ebp - 0x4b4]
jmp 0x405436
lea eax, [ebp - 0x4b4]
push edi
push eax
push 8
push dword [0x4120b4]
call esi
test eax, eax
jne 0x405328
push 8
jmp 0x405322
mov eax, dword [0x412be4]
cmp eax, ebx
je 0x4053f7
push ebx
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.0040490e
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x4053f7
mov ecx, dword [ebp - 0x10]
add ecx, eax
cmp ecx, dword [ebp - 0x24]
jle 0x405443
lea eax, [ebp - 0x164]
push edi
push eax
push 0xa
push dword [0x4120b4]
call esi
test eax, eax
jne 0x4053d4
push 0xa
call fcn.0040755d
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x410ba4], ebx
je 0x4057f0
push ebx
push 0x412a40
lea eax, [ebp - 0x164]
jmp 0x405436
lea eax, [ebp - 0x164]
push edi
push eax
push 0xb
push dword [0x4120b4]
call esi
test eax, eax
jne 0x405415
push 0xb
call fcn.0040755d
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x410ba4], ebx
je 0x4057f0
push ebx
push 0x412a40
lea eax, [ebp - 0x164]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4057f0
cmp dword [ebp - 0xc], ebx
je 0x4056a1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp - 0x30]
mov dword [ebp - 8], eax
push esi
call fcn.004080d0
pop ecx
mov byte [0x412ae0], bl
pop ecx
mov eax, esi
mov cl, byte [esi]
cmp cl, 0x22
jne 0x4054c5
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
cmp cl, bl
je 0x405490
cmp cl, 0x22
je 0x405490
push eax
jmp 0x40547c
cmp byte [eax], bl
je 0x40549b
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x20
push eax
je 0x405495
mov esi, dword [ebp - 8]
push esi
call fcn.004080d0
mov eax, esi
pop ecx
pop ecx
mov al, byte [eax]
cmp al, bl
je 0x4054d9
cmp al, 0x3d
je 0x4054d9
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [esi]
jmp 0x4054b0
cmp cl, bl
je 0x40549b
cmp cl, 0x20
je 0x40549b
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
jmp 0x4054c5
cmp byte [esi], bl
je 0x405500
push str.uninstallfrom
mov byte [esi], bl
push dword [ebp - 8]
call fcn.004082e6
pop ecx
test eax, eax
pop ecx
jne 0x405500
inc esi
push esi
push 0x412ae0
call fcn.004080d0
pop ecx
pop ecx
push 0x412ae0
push 0x412d20
call fcn.004080d0
cmp byte [0x412d20], bl
pop ecx
pop ecx
jne 0x4056a1
push dword [ebp - 8]
mov edi, 0x82
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x2ac]
push eax
push ebx
push 0x410bf4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push str..exe
push str..nsu
call fcn.00408050
lea esi, [ebp - 0x2ac]
sub esi, eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.00408050
pop ecx
add esi, eax
pop ecx
push esi
call fcn.004080d0
pop ecx
lea eax, [ebp - 0x164]
pop ecx
push edi
push eax
push dword [0x4120b4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2ac]
push ebx
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4057f0
xor eax, eax
lea edi, [ebp - 0x44]
mov dword [ebp - 0x48], ebx
mov esi, dword [sym.imp.USER32.dll_CharPrevA]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
xor eax, eax
cmp byte [ebp - 0x164], bl
pop ecx
lea edi, [ebp - 0x1a4]
mov dword [ebp - 0x1a8], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x164]
je 0x4055fe
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
jne 0x4055d8
lea ecx, [ebp - 0x164]
cmp eax, ecx
jbe 0x4055fe
cmp byte [eax], 0x5c
je 0x4055fe
push eax
lea eax, [ebp - 0x164]
push eax
call esi
jmp 0x4055e3
mov byte [eax], bl
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x2ac]
push eax
push str.__s__uninstallfrom_s
push dword [ebp - 8]
call fcn.00408454
add esp, 0x10
cmp byte [ebp - 0x2ac], bl
lea eax, [ebp - 0x2ac]
je 0x405652
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
jne 0x40562c
lea ecx, [ebp - 0x2ac]
cmp eax, ecx
jbe 0x405652
cmp byte [eax], 0x5c
je 0x405652
push eax
lea eax, [ebp - 0x2ac]
push eax
call esi
jmp 0x405637
mov byte [eax], bl
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x2ac]
push eax
push ebx
push 8
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4057f0
cmp dword [ebp - 0x44], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40568e
push dword [ebp - 0x44]
call esi
cmp dword [ebp - 0x48], ebx
je 0x4057f0
push dword [ebp - 0x48]
call esi
jmp 0x4057f0
lea eax, [ebp - 0x38]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4056ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x4057aa
lea eax, [ebp - 0x3b0]
push edi
push eax
push 0x34
push dword [0x4120b4]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x405789
push 0x34
jmp 0x405783
lea eax, [ebp - 0x50]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x40572d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x4057aa
lea eax, [ebp - 0x3b0]
push edi
push eax
push 0x33
push dword [0x4120b4]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x405789
push 0x33
jmp 0x405783
mov eax, dword [ebp - 0x50]
push ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
push ebx
lea eax, [ebp - 0x60]
push ebx
push eax
push ebx
push dword [ebp - 0x38]
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4057aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
je 0x4057aa
lea eax, [ebp - 0x3b0]
push edi
push eax
push 0x35
push dword [0x4120b4]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x405789
push 0x35
call fcn.0040755d
pop ecx
cmp dword [0x410ba4], ebx
je 0x4057aa
push ebx
lea eax, [ebp - 0x3b0]
push 0x412a40
push eax
push dword [0x412e24]
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0xc]
push dword [ebp - 0x34]
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.004058fa
add esp, 0x18
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], eax
je 0x4057d1
push dword [ebp - 0x18]
jmp 0x4057d9
cmp dword [ebp - 0xc], ebx
je 0x4057df
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call fcn.00407fad
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]