Function at 0x401c70
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x704
mov eax, dword [0x413090]
xor eax, esp
mov dword [esp + 0x700], eax
push ebx
push esi
push edi
push str.ole32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CoInitializeEx
push esi
call ebx
xor edi, edi
cmp eax, edi
je 0x401cc6
push 2
push edi
call eax
cmp eax, edi
jge 0x401cc6
push str.CoInitialize
push esi
call ebx
cmp eax, edi
je 0x401cc6
push edi
call eax
mov byte [esp + 0xf], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x410be8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CommandLineToArgvW
push eax
call ebx
cmp eax, edi
je 0x401cfa
lea ecx, [esp + 0x34]
push ecx
push esi
call eax
mov dword [esp + 0x10], eax
cmp eax, edi
jne 0x401d13
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x700]
xor ecx, esp
call fcn.004045e7
mov esp, ebp
pop ebp
ret 0x10
mov esi, 7
xor edx, edx
xor ecx, ecx
cmp dword [esp + 0x34], edi
mov dword [esp + 0xec], esi
mov dword [esp + 0xe8], edi
mov word [esp + 0xd8], dx
mov dword [esp + 0xd0], esi
mov dword [esp + 0xcc], edi
mov word [esp + 0xbc], cx
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], edi
mov word [esp + 0xa0], dx
mov byte [esp + 0xe], cl
mov dword [esp + 0x30], edi
jg 0x401dfb
lea ebx, [esi + 1]
xor eax, eax
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], edi
mov word [esp + 0xa0], ax
cmp dword [esp + 0xd0], ebx
jb 0x401da4
mov ecx, dword [esp + 0xbc]
push ecx
call fcn.004045f6
add esp, 4
xor edx, edx
mov dword [esp + 0xd0], esi
mov dword [esp + 0xcc], edi
mov word [esp + 0xbc], dx
cmp dword [esp + 0xec], ebx
jb 0x401dd5
mov eax, dword [esp + 0xd8]
push eax
call fcn.004045f6
add esp, 4
cmp byte [esp + 0xf], 0
je 0x4022b8
call fcn.00401250
jmp 0x40244c
mov eax, dword [esp + 0x10]
xor edi, edi
mov esi, 7
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + ecx*4]
xor edx, edx
mov ecx, eax
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], edi
mov word [esp + 0x84], dx
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x401e20
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x84]
call fcn.00403de0
mov eax, esi
push eax
mov ecx, 2
xor edx, edx
lea esi, [esp + 0x18]
call fcn.004029a0
mov ecx, eax
mov eax, dword [ecx + 0x14]
push 0x410cb8
mov edi, 2
call fcn.004026e0
test eax, eax
mov edi, 8
sete bl
cmp dword [esp + 0x2c], edi
jb 0x401e80
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004045f6
add esp, 4
test bl, bl
je 0x401ec0
lea edx, [esp + 0x80]
push edx
or ecx, 0xffffffff
mov edx, 2
lea esi, [esp + 0x18]
call fcn.004029a0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xdc]
call fcn.00403a70
cmp dword [esp + 0x2c], edi
jb 0x401ec0
mov eax, dword [esp + 0x18]
push eax
call fcn.004045f6
add esp, 4
lea ecx, [esp + 0x80]
push ecx
mov ecx, 2
xor edx, edx
lea esi, [esp + 0x18]
call fcn.004029a0
mov ecx, eax
mov eax, dword [ecx + 0x14]
push 0x410cc0
mov edi, 2
call fcn.004026e0
test eax, eax
mov ebx, 8
sete byte [esp + 0xd]
cmp dword [esp + 0x2c], ebx
jb 0x401f0b
mov edx, dword [esp + 0x18]
push edx
call fcn.004045f6
add esp, 4
cmp byte [esp + 0xd], 0
je 0x401f4b
lea eax, [esp + 0x80]
push eax
or ecx, 0xffffffff
mov edx, edi
lea esi, [esp + 0x18]
call fcn.004029a0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xc0]
call fcn.00403a70
cmp dword [esp + 0x2c], ebx
jb 0x401f4b
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004045f6
add esp, 4
lea edx, [esp + 0x80]
push edx
mov ecx, edi
xor edx, edx
lea esi, [esp + 0x18]
call fcn.004029a0
mov ecx, eax
mov eax, dword [ecx + 0x14]
push 0x410cc8
call fcn.004026e0
test eax, eax
sete byte [esp + 0xd]
cmp dword [esp + 0x2c], ebx
jb 0x401f89
mov eax, dword [esp + 0x18]
push eax
call fcn.004045f6
add esp, 4
cmp byte [esp + 0xd], 0
je 0x401fc9
lea ecx, [esp + 0x80]
push ecx
or ecx, 0xffffffff
mov edx, edi
lea esi, [esp + 0x18]
call fcn.004029a0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xa4]
call fcn.00403a70
cmp dword [esp + 0x2c], ebx
jb 0x401fc9
mov edx, dword [esp + 0x18]
push edx
call fcn.004045f6
add esp, 4
lea eax, [esp + 0x80]
push eax
mov ecx, 7
xor edx, edx
lea esi, [esp + 0x18]
call fcn.004029a0
mov ecx, eax
mov eax, dword [ecx + 0x14]
push str._create
mov edi, 7
call fcn.004026e0
test eax, eax
sete byte [esp + 0xd]
cmp dword [esp + 0x2c], ebx
jb 0x40200f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004045f6
add esp, 4
cmp byte [esp + 0xd], 0
je 0x40201b
mov byte [esp + 0xe], 1
mov eax, dword [esp + 0x94]
push str._install
mov edi, ebx
lea ecx, [esp + 0x84]
call fcn.004026e0
test eax, eax
jne 0x40203e
mov byte [esp + 0xf], 1
cmp dword [esp + 0x98], ebx
jb 0x402057
mov edx, dword [esp + 0x84]
push edx
call fcn.004045f6
add esp, 4
mov eax, dword [esp + 0x30]
inc eax
cmp eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
jl 0x401df0
cmp byte [esp + 0xe], 0
je 0x402295
xor ebx, ebx
cmp dword [esp + 0xcc], ebx
jne 0x4020b6
lea eax, [esp + 0xd4]
push eax
lea esi, [esp + 0x18]
call fcn.00402620
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xc0]
call fcn.00403a70
cmp dword [esp + 0x2c], edi
jb 0x4020b6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004045f6
add esp, 4
cmp dword [esp + 0xb0], ebx
jne 0x402193
push 0xa
mov eax, str._APPDATA__
lea esi, [esp + 0xa0]
call fcn.00403de0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
mov edi, 7
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0xdc]
mov word [ecx + 4], dx
call fcn.00403a70
lea ecx, [esp + 0x30]
call fcn.004027d0
add esp, 0x1c
push ebx
push eax
or eax, 0xffffffff
call fcn.00402480
cmp dword [esp + 0x2c], 8
jb 0x402129
mov eax, dword [esp + 0x18]
push eax
call fcn.004045f6
add esp, 4
push 1
mov eax, 0x410d2c
lea ecx, [esp + 0xa0]
call fcn.00402540
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0xdc]
mov word [ecx + 4], dx
call fcn.00403a70
lea ecx, [esp + 0x30]
call fcn.00402750
add esp, 0x1c
push ebx
push eax
or eax, 0xffffffff
lea esi, [esp + 0xa4]
call fcn.00402480
cmp dword [esp + 0x2c], 8
jb 0x402198
mov eax, dword [esp + 0x18]
push eax
call fcn.004045f6
add esp, 4
jmp 0x402198
mov edi, 7
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0xc0]
mov word [ecx + 4], dx
call fcn.00403a70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x48], esp
xor eax, eax
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0xffffffffffffffff
mov word [ecx + 4], ax
push ebx
lea eax, [esp + 0xf8]
call fcn.00403a70
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x64], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0x130]
mov word [ecx + 4], dx
call fcn.00403a70
call fcn.004019e0
mov esi, 8
add esp, 0x54
cmp dword [esp + 0xb4], esi
jb 0x40222a
mov eax, dword [esp + 0xa0]
push eax
call fcn.004045f6
add esp, 4
xor ecx, ecx
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb0], ebx
mov word [esp + 0xa0], cx
cmp dword [esp + 0xd0], esi
jb 0x40225b
mov edx, dword [esp + 0xbc]
push edx
call fcn.004045f6
add esp, 4
xor eax, eax
mov dword [esp + 0xd0], edi
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], ax
cmp dword [esp + 0xec], esi
jb 0x402457
mov ecx, dword [esp + 0xd8]
push ecx
call fcn.004045f6
add esp, 4
jmp 0x402457
cmp dword [esp + 0xb4], ebx
jb 0x4022ae
mov edx, dword [esp + 0xa0]
push edx
call fcn.004045f6
add esp, 4
xor edi, edi
lea esi, [edi + 7]
jmp 0x401d73
push 0x206
lea edx, [esp + 0xf6]
xor ecx, ecx
push edi
push edx
mov word [esp + 0xfc], cx
call fcn.00405360
add esp, 0xc
push 0x104
lea eax, [esp + 0xf4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x500]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x2f8]
push edx
push edi
push 0x410d30
lea eax, [esp + 0x50c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor ecx, ecx
lea eax, [esp + 0x2f8]
mov dword [esp + 0x98], esi
mov dword [esp + 0x94], edi
mov word [esp + 0x84], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x402340
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x2fc]
lea esi, [esp + 0x84]
call fcn.00403de0
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x98], ebx
jae 0x40237a
lea eax, [esp + 0x84]
push edi
push eax
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0xa
mov eax, 0x410d38
lea ecx, [esp + 0x84]
call fcn.00402540
push 0x44
lea eax, [esp + 0x3c]
push edi
push eax
call fcn.00405360
mov eax, dword [esp + 0x90]
add esp, 0xc
mov dword [esp + 0x38], 0x44
cmp dword [esp + 0x98], ebx
jae 0x4023cc
lea eax, [esp + 0x84]
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x3c]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402433
mov eax, dword [esp + 0x9c]
push 0xdbba0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x9c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xa0]
push edx
call esi
cmp dword [esp + 0x98], ebx
jb 0x402457
mov eax, dword [esp + 0x84]
push eax
call fcn.004045f6
add esp, 4
jmp 0x402457
cmp dword [esp + 0x98], ebx
jb 0x40244c
mov ecx, dword [esp + 0x84]
push ecx
call fcn.004045f6
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x70c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004045e7
mov esp, ebp
pop ebp
ret 0x10