Function at 0x41a220
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Get program files directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ae14
mov eax, dword fs:[0]
push eax
sub esp, 0x874
mov eax, dword [0x608ec4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x830], edi
call fcn.00433eae
push dword [edi + 0xa8]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x80
push dword [edi + 0x20]
call esi
push dword [edi + 0xa8]
push 0
push 0x80
push dword [edi + 0x20]
call esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.005720f0
add esp, 0xc
lea eax, [ebp - 0x410]
push 0
push 0x26
push eax
mov eax, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
mov dword [ebp - 0x840], eax
call eax
lea eax, [ebp - 0x410]
push 0x5e21bf
push eax
call fcn.0057a1f3
add esp, 8
test eax, eax
jne 0x41a2e5
push str.C:Program_Files
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.0057b0ba
add esp, 0xc
push 0x5e4790
lea ecx, [ebp - 0x410]
push ecx
lea eax, [edi + 0xb8]
push str._s_s_
push eax
mov dword [ebp - 0x850], eax
call fcn.00403070
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac00
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x854], eax
push esi
lea ecx, [ebp - 0x854]
mov dword [ebp - 4], 0
call fcn.004033a0
test al, al
jne 0x41a36c
test esi, esi
jne 0x41a351
xor ecx, ecx
jmp 0x41a35f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a356
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x854]
call fcn.004036d0
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x854]
mov dword [ebp - 0x864], edi
mov esi, dword [edi - 0xc]
add esi, 0xa
push esi
call fcn.0042545e
push esi
push 0
push eax
mov dword [ebp - 0x84c], eax
call fcn.005720f0
push edi
mov edi, dword [ebp - 0x84c]
push esi
push edi
call fcn.0057b0ba
add esp, 0x1c
push edi
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
push esi
push edi
call fcn.0057b0ba
push 0x3070
call fcn.00425426
mov esi, eax
mov dword [ebp - 0x82c], eax
add esp, 0x10
mov dword [ebp - 0x834], esi
test esi, esi
je 0x41a413
push 0x5e2700
lea ecx, [esi + 4]
mov dword [esi], vtable.CToken.0
push 0x32
push ecx
call fcn.0057b0ba
add esp, 0xc
mov dword [esi + 0x306c], 0
lea edi, [esi + 0x106c]
mov ecx, 0x400
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x84c]
jmp 0x41a41b
xor esi, esi
mov dword [ebp - 0x82c], esi
mov eax, dword [esi]
mov ecx, esi
push 1
push edi
call dword [eax + 4]
cmp dword [esi + 0x306c], 0
ja 0x41a46e
mov ecx, esi
mov dword [esi], vtable.CToken.0
call fcn.00413cd0
mov ecx, esi
call fcn.00413d30
push 0x3070
push esi
call fcn.0056eea1
push edi
call fcn.00425467
mov ecx, dword [ebp - 0x830]
add esp, 0xc
mov eax, dword [ecx]
call dword [eax + 0x180]
mov esi, 1
jmp 0x41aabb
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac0a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x838], edi
mov byte [ebp - 4], 2
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac14
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x844], esi
mov byte [ebp - 4], 3
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac1e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x84c], eax
xorps xmm0, xmm0
mov dword [ebp - 0x818], 0
xor eax, eax
mov dword [ebp - 0x814], 7
movups xmmword [ebp - 0x828], xmm0
mov word [ebp - 0x828], ax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x82c]
cmp dword [eax + 0x306c], 0
ja 0x41a514
mov eax, 0x5e21bf
jmp 0x41a517
mov eax, dword [eax + 0x38]
push str.download
push eax
call fcn.0057a1f3
add esp, 8
test eax, eax
jne 0x41a562
mov edi, str.FileStar_Download_List_From_Updater
mov dword [ebp - 0x83c], 0x23
mov dword [ebp - 0x860], str.FileStar_class_down
mov eax, str.FileStarDown.exe
mov dword [ebp - 0x85c], 0x13
mov edx, 0x10
mov dword [ebp - 0x848], 1
jmp 0x41a5c8
mov eax, dword [ebp - 0x82c]
cmp dword [eax + 0x306c], 0
ja 0x41a578
mov eax, 0x5e21bf
jmp 0x41a57b
mov eax, dword [eax + 0x38]
push str.upload
push eax
call fcn.0057a1f3
add esp, 8
test eax, eax
jne 0x41aafd
mov edi, str.FileStar_Upload_List_From_Updater
mov dword [ebp - 0x83c], 0x21
mov dword [ebp - 0x860], str.FileStar_class_upload
mov eax, str.FileStarUp.exe
mov dword [ebp - 0x85c], 0x15
mov edx, 0xe
mov dword [ebp - 0x848], 2
mov esi, dword [ebp - 0x830]
mov ecx, 0xcc
mov dword [ebp - 0x858], esi
mov esi, dword [ebp - 0x848]
mov dword [ebp - 0x834], edi
mov edi, dword [ebp - 0x858]
push edx
push eax
mov dword [edi + ecx], esi
lea ecx, [ebp - 0x838]
call fcn.004036d0
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x844]
push dword [ebp - 0x860]
call fcn.004036d0
push dword [ebp - 0x83c]
mov edi, dword [ebp - 0x834]
lea ecx, [ebp - 0x84c]
push edi
call fcn.004036d0
mov eax, dword [ebp - 0x82c]
cmp dword [eax + 0x306c], 1
ja 0x41a640
mov eax, 0x5e21bf
jmp 0x41a643
mov eax, dword [eax + 0x3c]
mov esi, dword [ebp - 0x830]
push eax
push 0x5e2b34
lea edi, [esi + 0xc4]
push edi
call fcn.00403070
add esp, 0xc
mov ecx, esi
call fcn.0041b370
mov esi, dword [ebp - 0x844]
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, eax
test ecx, ecx
je 0x41a6c4
lea eax, [ebp - 0x834]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x834]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x83c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x83c]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41a84c
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac00
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x850]
mov byte [ebp - 4], 6
push dword [ebp - 0x838]
push dword [eax]
lea eax, [ebp - 0x834]
push 0x5e4910
push eax
call fcn.00403070
add esp, 0x10
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac28
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x82c], eax
mov byte [ebp - 4], 7
lea eax, [ebp - 0x82c]
push dword [edi]
push 0x5e2b34
push eax
call fcn.00403070
add esp, 0xc
lea ecx, [ebp - 0x880]
call fcn.00439e2b
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x880]
mov edi, dword [ebp - 0x834]
push 0
push edi
call fcn.0043a0ab
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x850], eax
mov byte [ebp - 4], 7
call fcn.00439fd3
cmp dword [ebp - 0x850], 0
jne 0x41a7ec
push 0
push 0
push 0x5e4d60
call fcn.0043215c
mov ecx, dword [ebp - 0x830]
mov eax, dword [ecx]
call dword [eax + 0x180]
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov edx, dword [ebp - 0x82c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a7c1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41a7dd
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x82c], 0
jmp 0x41aa54
mov esi, dword [ebp - 0x82c]
push 1
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 6
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a82b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41a846
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x844]
xor edi, edi
nop
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x41a88b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x41a850
mov ecx, dword [ebp - 0x830]
mov eax, dword [ecx]
call dword [eax + 0x180]
mov dword [ebp - 0x82c], 1
jmp 0x41aa54
push 0x400
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.005720f0
add esp, 0xc
lea eax, [ebp - 0x810]
push 0
push 0x23
push eax
push 0
call dword [ebp - 0x840]
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac00
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x848], eax
push 0x5e4790
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x848]
push str._s_s_
push eax
call fcn.00403070
add esp, 0x10
lea ecx, [ebp - 0x848]
call fcn.00412ee0
call fcn.00431e1a
mov ecx, eax
test ecx, ecx
je 0x41ac32
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x834]
push dword [ebp - 0x84c]
mov edi, dword [ebp - 0x848]
push edi
push 0x5e4910
push eax
call fcn.00403070
mov esi, dword [ebp - 0x834]
add esp, 0x10
mov dword [ebp - 0x83c], 0
nop word [eax + eax]
lea ecx, [ebp - 0x880]
call fcn.00439e2b
push 0
push esi
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xb
call fcn.0043a0ab
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x840], eax
mov byte [ebp - 4], 0xa
call fcn.00439fd3
cmp dword [ebp - 0x840], 0
jne 0x41a9ba
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x83c]
inc eax
mov dword [ebp - 0x83c], eax
cmp eax, 3
jl 0x41a960
jmp 0x41a9fd
lea ecx, [ebp - 0x880]
call fcn.00439e2b
push 0
push esi
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xc
call fcn.0043a0ab
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x840], eax
mov byte [ebp - 4], 0xa
call fcn.00439fd3
cmp dword [ebp - 0x840], 0
je 0x41a9fd
push 0
push esi
call fcn.00425c73
mov ecx, dword [ebp - 0x830]
mov eax, dword [ecx]
call dword [eax + 0x180]
lea edx, [esi - 0x10]
mov dword [ebp - 0x82c], 1
or esi, 0xffffffff
mov byte [ebp - 4], 9
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41aa4e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x844]
mov edi, dword [ebp - 0x838]
mov byte [ebp - 4], 3
or eax, 0xffffffff
mov edx, dword [ebp - 0x84c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa9a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41aab5
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x82c]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edi, dword [ebp - 0x864]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41aae0
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056ee93
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x82c]
cmp dword [eax + 0x306c], 0
ja 0x41ab13
mov eax, 0x5e21bf
jmp 0x41ab16
mov eax, dword [eax + 0x38]
push str.upload_list
push eax
call fcn.0057a1f3
add esp, 8
test eax, eax
jne 0x41abb2
mov eax, dword [ebp - 0x830]
mov dword [eax + 0xcc], 3
add eax, 0xc8
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x82c]
cmp dword [eax + 0x306c], 1
ja 0x41aba7
mov edx, 0x5e21bf
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x840], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ab66
sub ecx, dword [ebp - 0x840]
push ecx
mov ecx, dword [ebp - 0x850]
push edx
call fcn.004036d0
mov ecx, dword [ebp - 0x830]
push 0
push 0xa
push 0x400
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 0x82c], 1
jmp 0x41aa5a
mov edx, dword [eax + 0x3c]
test edx, edx
jne 0x41ab5b
xor ecx, ecx
jmp 0x41ab73
mov eax, dword [ebp - 0x82c]
mov ecx, eax
mov dword [eax], vtable.CToken.0
call fcn.00413cd0
mov ecx, dword [ebp - 0x82c]
call fcn.00413d30
push 0x3070
push dword [ebp - 0x82c]
call fcn.0056eea1
mov ecx, dword [ebp - 0x830]
add esp, 8
mov eax, dword [ecx]
call dword [eax + 0x180]
mov dword [ebp - 0x82c], 1
jmp 0x41aa5a
push 0x80004005
call fcn.00403680
push 0x80004005
call fcn.00403680
push 0x80004005
call fcn.00403680
push 0x80004005
call fcn.00403680
push 0x80004005
call fcn.00403680
push 0x80004005
call fcn.00403680
int3