Function at 0x41dd21
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x449040]
xor eax, esp
mov dword [esp + 0x188], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x44b964], eax
call fcn.0041d713
test al, al
jne 0x41dd63
xor dl, dl
mov ecx, str.Unsupported_Windows_version
call fcn.0041d75c
xor eax, eax
inc eax
jmp 0x41e5ca
call fcn.00401c47
lea ecx, [esp + 0xb0]
call fcn.004070d4
lea ecx, [esp + 0x38]
call fcn.004070d4
lea ecx, [esp + 0xa4]
call fcn.004070d4
lea ecx, [esp + 0x8c]
call fcn.004070d4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x30]
call fcn.004070f8
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0x30]
call fcn.004067dc
lea ecx, [esp + 0x2c]
call fcn.0040674d
lea ecx, [esp + 0x80]
call fcn.004070d4
lea ecx, [esp + 0x80]
call fcn.004080c2
lea ecx, [esp + 0x38]
call fcn.004067cc
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x16], 0
call fcn.00406c4a
xor ebx, ebx
inc ebx
test al, al
je 0x41de17
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x16], bl
call fcn.0041d5ab
push eax
call fcn.00407195
lea ecx, [esp + 0x38]
call fcn.004067cc
lea ecx, [esp + 0x98]
call fcn.00406dc7
lea eax, [esp + 0x98]
push eax
push ecx
lea ecx, [esp + 0x88]
call fcn.00406778
mov ecx, eax
call fcn.0041d991
test al, al
je 0x41e570
lea ecx, [esp + 0x98]
call fcn.00406764
test al, al
jne 0x41e570
lea ecx, [esp + 0x64]
call fcn.004070d4
lea ecx, [esp + 0x58]
call fcn.004070d4
lea ecx, [esp + 0x18]
call fcn.004068e7
mov edx, ecx
lea ecx, [esp + 0x98]
call fcn.004077de
test al, al
jne 0x41dea3
cmp byte [esp + 0x12], al
jne 0x41e019
xor dl, dl
mov ecx, str.Config_failed
call fcn.0041d75c
jmp 0x41e019
push str.Title
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x30]
call fcn.00407a02
push str.BeginPrompt
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x48]
call fcn.00407a02
push 0x442108
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x74]
call fcn.00407a02
push 0x442114
lea ecx, [esp + 0x74]
call fcn.00407d47
lea ecx, [esp + 0x44]
mov byte [esp + 0x14], al
call fcn.00406764
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
test al, al
jne 0x41df2d
cmp byte [esp + 0x12], 0
jne 0x41df2d
lea ecx, [esp + 0x2c]
call fcn.00406778
lea ecx, [esp + 0x44]
mov edx, eax
call fcn.00406778
push 0x24
push edx
push eax
push 0
call edi
cmp eax, 6
je 0x41df2d
xor ebx, ebx
jmp 0x41dffe
push str.RunProgram
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x164]
call fcn.00407a02
push eax
lea ecx, [esp + 0x68]
call fcn.004071f4
lea ecx, [esp + 0x160]
call fcn.0040674d
push str.ExecuteFile
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x164]
call fcn.00407a02
push eax
lea ecx, [esp + 0xa8]
call fcn.004071f4
lea ecx, [esp + 0x160]
call fcn.0040674d
push str.ExecuteParameters
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x164]
call fcn.00407a02
push eax
lea ecx, [esp + 0x90]
call fcn.004071f4
lea ecx, [esp + 0x160]
call fcn.0040674d
push str.InstallPath
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x164]
call fcn.00407a02
push eax
lea ecx, [esp + 0x5c]
call fcn.004071f4
lea ecx, [esp + 0x160]
call fcn.0040674d
lea ecx, [esp + 0x58]
call fcn.0041dc43
test al, al
jne 0x41e027
cmp byte [esp + 0x12], al
jne 0x41dffe
xor dl, dl
mov ecx, str.Install_path_is_incorrect
call fcn.0041d75c
lea ecx, [esp + 0x70]
call fcn.0040674d
lea ecx, [esp + 0x44]
call fcn.0040674d
lea ecx, [esp + 0x2c]
call fcn.0040674d
lea ecx, [esp + 0x18]
call fcn.004169cf
jmp 0x41e55c
lea ecx, [esp + 0x70]
call fcn.0040674d
lea ecx, [esp + 0x44]
call fcn.0040674d
lea ecx, [esp + 0x2c]
call fcn.0040674d
lea ecx, [esp + 0x18]
call fcn.004169cf
lea ecx, [esp + 0xbc]
call fcn.0041d602
lea ecx, [esp + 0x58]
call fcn.00406764
test al, al
je 0x41e09e
push ecx
lea ecx, [esp + 0xc0]
call fcn.00408a67
test al, al
jne 0x41e088
mov dl, byte [esp + 0x12]
mov ecx, str.Cannot_create_temp_folder_archive
call fcn.0041d75c
jmp 0x41e550
lea ecx, [esp + 0xbc]
call fcn.0041d662
push eax
lea ecx, [esp + 0x5c]
call fcn.004071f4
push 0x18
call fcn.0041f061
pop ecx
mov ecx, eax
call fcn.0041d785
mov esi, eax
lea ecx, [esp + 0x7c]
push esi
call fcn.0040bbba
mov ecx, esi
call fcn.00416888
test eax, eax
je 0x41e0d5
xor dl, dl
mov ecx, str.Cannot_load_codecs
call fcn.0041d75c
jmp 0x41e547
lea ecx, [esp + 0x18]
mov byte [esp + 0x13], 0
call fcn.004070d4
lea eax, [esp + 0x18]
mov ecx, esi
push eax
lea eax, [esp + 0x17]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x64]
push eax
lea edx, [esp + 0x90]
call fcn.00419f48
mov edx, eax
test edx, edx
je 0x41e1af
cmp byte [esp + 0x12], 0
jne 0x41e1a1
cmp edx, ebx
je 0x41e12e
cmp byte [esp + 0x13], 0
jne 0x41e12e
cmp edx, 0x80004004
je 0x41e1a1
jmp 0x41e13f
push 8
lea edx, [esp + 0x1c]
pop ecx
call fcn.0040a3ce
mov edx, 0x80004005
lea ecx, [esp + 0x18]
call fcn.00406764
test al, al
je 0x41e16e
lea ecx, [esp + 0x160]
call fcn.0041d5ed
push eax
lea ecx, [esp + 0x1c]
call fcn.004071f4
lea ecx, [esp + 0x160]
call fcn.0040674d
push 7
pop edx
lea ecx, [esp + 0x160]
call fcn.0040a2af
mov ecx, eax
call fcn.00406778
push 0x10
push eax
lea ecx, [esp + 0x20]
call fcn.00406778
push eax
push 0
call edi
lea ecx, [esp + 0x160]
call fcn.0040674d
lea ecx, [esp + 0x18]
call fcn.0040674d
jmp 0x41e547
lea ecx, [esp + 0x18]
call fcn.0040674d
lea ecx, [esp + 0x108]
call fcn.0041d666
lea ecx, [esp + 0x58]
call fcn.00406778
mov ecx, eax
call fcn.004087a9
test al, al
je 0x41e53b
and dword [esp + 0x54], 0
lea ecx, [esp + 0xa4]
call fcn.00406764
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test al, al
jne 0x41e314
call fcn.0040b91a
push eax
lea ecx, [esp + 0x30]
call fcn.0040716a
and dword [esp + 0xd4], 0
lea ecx, [esp + 0x2c]
and dword [esp + 0xd8], 0
mov dword [esp + 0xcc], 0x3c
mov dword [esp + 0xd0], 0x140
call fcn.00406778
lea ecx, [esp + 0x38]
mov dword [esp + 0xdc], eax
call fcn.00406764
test al, al
jne 0x41e26a
lea ecx, [esp + 0x8c]
call fcn.0040738a
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x90]
call fcn.004073d4
lea ecx, [esp + 0x8c]
call fcn.0040b91a
push eax
lea ecx, [esp + 0x48]
call fcn.0040716a
lea ecx, [esp + 0x44]
call fcn.00406764
test al, al
je 0x41e297
and dword [esp + 0xe0], 0
jmp 0x41e2a7
lea ecx, [esp + 0x44]
call fcn.00406778
mov dword [esp + 0xe0], eax
and dword [esp + 0xe4], 0
lea eax, [esp + 0xcc]
and dword [esp + 0x104], 0
push eax
mov dword [esp + 0xec], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [esp + 0xec], 0x20
ja 0x41e2fb
cmp byte [esp + 0x12], 0
jne 0x41e2e9
xor dl, dl
mov ecx, str.Cannot_open_file
call fcn.0041d75c
lea ecx, [esp + 0x44]
call fcn.0040674d
lea ecx, [esp + 0x2c]
jmp 0x41e4df
mov esi, dword [esp + 0x104]
lea ecx, [esp + 0x44]
call fcn.0040674d
lea ecx, [esp + 0x2c]
jmp 0x41e4fd
lea ecx, [esp + 0x64]
call fcn.00406764
test al, al
je 0x41e328
xor ebx, ebx
jmp 0x41e53b
push 0x442218
lea ecx, [esp + 0x30]
call fcn.004070f8
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x6c]
call fcn.0040757c
lea ecx, [esp + 0x2c]
call fcn.0040674d
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x74]
call fcn.0040716a
sub esp, 0xc
lea eax, [esp + 0x44]
mov ecx, esp
push eax
call fcn.0040716a
call fcn.0041a1f5
test al, al
jne 0x41e428
lea ecx, [esp + 0x80]
call fcn.00406778
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push ecx
push eax
lea ecx, [esp + 0x168]
call fcn.0041e794
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x17c]
call fcn.0041ae20
lea ecx, [esp + 0x160]
call fcn.0041d98c
lea ecx, [esp + 0x178]
call fcn.0041b011
test eax, eax
je 0x41e41c
lea ecx, [esp + 0x38]
call fcn.0040738a
call fcn.0041a1ef
push eax
lea ecx, [esp + 0x3c]
call fcn.004073d4
lea ecx, [esp + 0x178]
call fcn.0040b91a
mov ecx, eax
call fcn.0041bb31
push eax
lea ecx, [esp + 0x164]
call fcn.0040712a
push eax
lea ecx, [esp + 0x3c]
call fcn.004073d4
lea ecx, [esp + 0x160]
call fcn.0040674d
lea ecx, [esp + 0x178]
call fcn.0041e5e1
lea ecx, [esp + 0x38]
call fcn.00406764
test al, al
jne 0x41e44c
lea ecx, [esp + 0x64]
call fcn.00407382
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x68]
call fcn.004073d4
xor ecx, ecx
mov dword [esp + 0x118], 0x44
xor eax, eax
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x14c], ecx
lea ecx, [esp + 0x64]
mov word [esp + 0x14a], ax
call fcn.0040b91a
push eax
lea ecx, [esp + 0x30]
call fcn.0040716a
lea eax, [esp + 0x44]
xor edx, edx
push eax
lea eax, [esp + 0x11c]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
lea ecx, [esp + 0x4c]
call fcn.00406778
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41e4e6
cmp byte [esp + 0x12], al
jne 0x41e4d2
lea ecx, [esp + 0x70]
call fcn.0041dbb7
lea ecx, [esp + 0x2c]
call fcn.0040674d
lea ecx, [esp + 0x70]
call fcn.0040674d
jmp 0x41e53b
push dword [esp + 0x48]
call edi
mov esi, dword [esp + 0x44]
lea ecx, [esp + 0x2c]
call fcn.0040674d
lea ecx, [esp + 0x70]
call fcn.0040674d
test esi, esi
je 0x41e537
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x54]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.0041d922
mov ecx, eax
call fcn.0041e7b4
mov ebx, dword [esp + 0x54]
lea ecx, [esp + 0x108]
call fcn.0041d693
lea ecx, [esp + 0x7c]
call fcn.0040b91d
lea ecx, [esp + 0xbc]
call fcn.0041d61c
lea ecx, [esp + 0x58]
call fcn.0040674d
lea ecx, [esp + 0x64]
call fcn.0040674d
jmp 0x41e583
cmp byte [esp + 0x12], 0
jne 0x41e583
xor dl, dl
mov ecx, str.Cant_load_config_info
call fcn.0041d75c
lea ecx, [esp + 0x98]
call fcn.0040674d
lea ecx, [esp + 0x80]
call fcn.0040674d
lea ecx, [esp + 0x8c]
call fcn.0040674d
lea ecx, [esp + 0xa4]
call fcn.0040674d
lea ecx, [esp + 0x38]
call fcn.0040674d
lea ecx, [esp + 0xb0]
call fcn.0040674d
mov eax, ebx
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041eea0
mov esp, ebp
pop ebp
ret 0x10