Function at 0x401b3c
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov ecx, dword [ebp + 8]
and byte [ebp - 1], 0
push ebx
push esi
push edi
mov dword [0x403684], ecx
call fcn.00401097
test eax, eax
je 0x401b77
push 0x10
push str.Mousepads_Diablo_II_Maphack
push str.Program_has_been_modified
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d67
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
call fcn.00401ab3
mov edi, eax
test edi, edi
je 0x401be2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._install
push edi
call esi
test eax, eax
je 0x401bd1
push str._remove
push edi
call esi
test eax, eax
je 0x401bd6
push str._noedit
push edi
call esi
test eax, eax
jne 0x401bbf
mov byte [0x40368c], 1
push str._nowarnings
push edi
call esi
test eax, eax
jne 0x401b80
mov byte [ebp - 1], 1
jmp 0x401b80
push 1
pop ecx
jmp 0x401bd8
xor ecx, ecx
call fcn.0040122b
jmp 0x401d69
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Warning_s__:__n_n
lea eax, [ebp - 0x81c]
push eax
call ebx
and byte [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.00401fd9
mov ecx, eax
mov dword [ebp - 0xc], ecx
call fcn.0040206b
test eax, eax
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
jne 0x401c67
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x41c]
call fcn.00401fef
test eax, eax
je 0x401c42
lea eax, [ebp - 0x41c]
push eax
call fcn.00401d70
pop ecx
jmp 0x401c47
mov eax, str.UNKNOWN
push eax
push str.Parent_process___s__is_hidden__MAY_be_a_virus_trojan__n
lea eax, [ebp - 0x81c]
push eax
call edi
lea eax, [ebp + eax - 0x81c]
push eax
call esi
add esp, 0xc
mov byte [ebp + 8], 1
push 0x4033dc
mov dl, 0x2e
lea ecx, [ebp - 0x110]
call fcn.004010ed
push eax
call ebx
lea ecx, [ebp - 0x110]
call fcn.004010c0
test eax, eax
jne 0x401cc3
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.00401b17
pop ecx
pop ecx
inc eax
push eax
call fcn.00401d70
pop ecx
push eax
push str._s_is_missing__extract_ALL_the_files_from_zip_n
lea eax, [ebp - 0x81c]
push eax
call edi
lea eax, [ebp + eax - 0x81c]
push eax
call esi
add esp, 0xc
mov byte [ebp + 8], 1
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dl, 0x5c
lea ecx, [ebp - 0x318]
call fcn.004010ed
and byte [eax], 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401d13
push str.Running_from_temp_directory__DO_NOT_run_directly_from_zip_n
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [ebp + 8], 1
cmp byte [ebp - 1], 0
jne 0x401d35
cmp byte [ebp + 8], 0
je 0x401d35
push 0x30
push str.Mousepads_Diablo_II_Maphack
lea eax, [ebp - 0x81c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x6e
push dword [0x403684]
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [0x403684]
mov edx, eax
call fcn.00401801
push 0
push 0x4018ee
push 0
push 0x65
push dword [0x403684]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10