Function at 0x5665f0
Capabilities:
Accept command line arguments
Check os version
Create directory
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cea7
mov eax, dword fs:[0]
push eax
mov eax, 0x3f28
call fcn.0053c940
mov eax, dword [0x5ebfc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x3f2c]
mov dword [ebp - 0x3f2c], 8
push eax
mov dword [ebp - 0x3f28], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.00415872
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call edi
lea eax, [ebp - 0x218]
push 0x2e
push eax
call fcn.0053dbee
add esp, 8
test eax, eax
je 0x5666ec
xor ecx, ecx
push str..ini
mov word [eax], cx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0054392a
push 0
push 0
push 0x104
lea eax, [ebp - 0x830]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00545436
lea edx, [ebp - 0x218]
add esp, 0x30
lea ecx, [ebx + 0xe4]
lea esi, [edx + 2]
jmp 0x5666d0
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x5666d0
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
push edx
push eax
call fcn.00402430
push 0x118
lea eax, [ebp - 0x948]
push 0
push eax
call fcn.0053eae0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x94c]
add esp, 0xc
mov dword [ebp - 0x94c], 0x11c
push eax
call esi
test eax, eax
jne 0x566732
lea eax, [ebp - 0x94c]
mov dword [ebp - 0x94c], 0x114
push eax
call esi
cmp dword [ebp - 0x948], 6
jb 0x56684f
push dword [ebx + 0xe4]
lea edi, [ebx + 0xe4]
push 0x5c38e0
push 0x5c38e4
push 0x5c38fc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x566849
call fcn.00407271
mov ecx, eax
test ecx, ecx
je 0x566c2f
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x5940e4
jne 0x566c28
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x3f18], eax
push 1
push 0x1c
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x5c390c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x3f18]
push 0x5c392c
push eax
call fcn.00404950
mov esi, dword [ebp - 0x3f18]
add esp, 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c3938
lea eax, [ebp - 0x830]
push eax
push esi
push 0x5c3940
push edi
call fcn.00404950
add esp, 0x14
push dword [edi]
push 0x5c3954
push 0x5c3958
push 0x5c3970
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x566837
push 0x5c3980
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push eax
push str._s_s._s
push edi
call fcn.00404950
add esp, 0x14
lea ecx, [ebp - 0x3f18]
mov dword [ebp - 4], 0xffffffff
call fcn.00402930
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00407271
mov ecx, eax
test ecx, ecx
je 0x566c2f
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x5940e4
jne 0x566c39
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x3f20], eax
mov dword [ebp - 4], 1
call fcn.00407271
mov ecx, eax
test ecx, ecx
je 0x566c40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x5940e4
jne 0x566c4a
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x3f1c], eax
push 0x104
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 2
push eax
push 0
call edi
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.0053dbee
add esp, 8
test eax, eax
je 0x5668e2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebx + 0xe0]
push 0x5c399c
push eax
call fcn.00404950
push str.CdmResource_themes_
lea eax, [ebp - 0x420]
push eax
lea eax, [ebx + 0xd0]
push 0x5c39cc
push eax
call fcn.00404950
push str.CdmResourcelanguage_
lea eax, [ebp - 0x420]
push eax
lea eax, [ebx + 0xd4]
push 0x5c3a04
push eax
call fcn.00404950
push str.CdmResource_themesDefault
lea eax, [ebp - 0x420]
mov dword [ebx + 0xd8], 3
push eax
lea eax, [ebp - 0x3f20]
mov dword [ebx + 0xdc], 5
push 0x5c3a48
push eax
call fcn.00404950
push str.CdmResourcelanguageEnglish.lang
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x3f1c]
push 0x5c3a54
push eax
call fcn.00404950
add esp, 0x4c
call fcn.00407271
mov ecx, eax
test ecx, ecx
je 0x566c51
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x5940e4
jne 0x566c5b
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x3f18], eax
mov byte [ebp - 4], 3
push dword [ebx + 0xe4]
push 0
push 0x5c3aa4
push 0x5c3ab8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, 2
cmp ecx, eax
push eax
sbb ecx, ecx
not ecx
and ecx, eax
lea eax, [ebp - 0x3f18]
push 0x5c3ac8
push eax
mov dword [0x5f4d34], ecx
call fcn.00404950
mov esi, dword [ebp - 0x3f18]
add esp, 0xc
push dword [ebx + 0xe4]
push esi
push str.DebugMode
push 0x5c3ae4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x566aad
lea eax, [ebp - 0x3f24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x3f24], 2
jl 0x566a77
mov eax, dword [eax + 4]
mov ecx, 0x5c3b14
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x566a6e
test dx, dx
je 0x566a6a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x566a6e
add eax, 4
add ecx, 4
test dx, dx
jne 0x566a48
xor eax, eax
jmp 0x566a73
sbb eax, eax
or eax, 1
test eax, eax
je 0x566aad
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0
call edi
push 1
push 0
push 0x5c3b20
lea eax, [ebp - 0x628]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x566b3c
push 8
lea eax, [ebp - 0x3f34]
push eax
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
push dword [ebp - 0x3f34]
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push ecx
lea ecx, [ebp - 0x3f14]
xor edi, edi
call fcn.00573290
lea eax, [ebp - 0x3f14]
mov byte [ebp - 4], 4
mov ecx, eax
mov dword [ebx + 0x20], eax
call fcn.00407ae5
cmp eax, 0x174b
jne 0x566af6
mov edi, 1
push dword [ebp - 0x3f34]
call dword [sym.imp.WINMM.dll_timeEndPeriod]
test edi, edi
je 0x566b31
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push 0
push 0
lea eax, [ebp - 0x628]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x3f14]
call fcn.00573a70
or edi, 0xffffffff
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x566b85
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x5940e4
jne 0x566c62
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x566c62
push 0
push dword [ecx + 4]
call ebx
mov byte [ebp - 4], 1
mov eax, edi
mov ecx, dword [ebp - 0x3f1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x566bcb
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x5940e4
jne 0x566c69
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x566c69
push 0
push dword [edx + 4]
call ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x3f20]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x566c0a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x5940e4
jne 0x566c72
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x566c72
push 0
push dword [edx + 4]
call ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c0f2
mov esp, ebp
pop ebp
ret
call edx
jmp 0x56678e
push 0x80004005
call fcn.00402ab0
call edx
jmp 0x566875
push 0x80004005
call fcn.00402ab0
call edx
jmp 0x5668ab
push 0x80004005
call fcn.00402ab0
call edx
jmp 0x5669ab
call edx
jmp 0x566b85
mov ecx, edx
call esi
jmp 0x566bcb
mov ecx, edx
call esi
jmp 0x566c0a