Function at 0x422480
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f55d
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x57146c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x238], 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 8
push eax
mov dword [ebp - 0x22c], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x575f4c], eax
call fcn.00433f30
push 0x532e70
push 0
call fcn.004c6966
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x532e74
call fcn.004264e0
add esp, 8
mov ecx, 0x579f50
push 0
push dword [0x575e50]
push 0
call fcn.00421f30
lea ecx, [ebp - 0x23c]
call fcn.00407350
mov dword [ebp - 4], 0
call fcn.00421d60
mov ecx, eax
call fcn.00467350
mov eax, dword [0x579fe0]
test al, 1
jne 0x42258d
or eax, 1
mov dword [0x579fe0], eax
mov ecx, 0x579fdc
mov byte [ebp - 4], 1
call fcn.0042d1d0
push 0x52b850
call fcn.00478174
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x579fdc
call fcn.0042d220
push ebx
call fcn.00421ca0
mov ecx, eax
call fcn.00417c30
push ebx
push str.lpstrCmdLine_s
call fcn.004264e0
add esp, 8
call fcn.00421ca0
mov ecx, eax
call fcn.00418f60
mov ebx, eax
call fcn.00433f30
mov esi, eax
push esi
mov eax, dword [esi]
call dword [eax]
test eax, eax
jne 0x422632
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ecx
push str.DLL_NETUL
push 0xcc
push dword [0x575e50]
push esi
call dword [eax + 8]
test eax, eax
jne 0x422600
push str.InitCloudConfig_failed.
call fcn.004264e0
add esp, 4
jmp 0x422632
push str.InitCloudConfig_success.
call fcn.004264e0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x22c], esp
mov ecx, esp
push eax
call fcn.00404880
mov byte [ebp - 4], 2
call fcn.00421ca0
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.00417b60
cmp dword [0x575e50], 0
jne 0x422643
test ebx, ebx
jne 0x422643
xor eax, eax
jmp 0x422648
mov eax, 1
push eax
call fcn.0042c710
cmp dword [0x5701ac], 0
je 0x4226f3
push str.ntdll.dll
mov dword [ebp - 0x228], 0
xor edi, edi
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x21c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4226e9
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4226c5
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
call eax
movzx eax, word [ebp - 0x21c]
mov edi, 1
mov dword [ebp - 0x21c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x4226e9
mov eax, dword [0x579fe4]
mov ecx, 1
cmp dword [ebp - 0x228], 6
cmovae eax, ecx
mov dword [0x579fe4], eax
mov dword [0x5701ac], 0
cmp dword [0x579fe4], 0
jne 0x4228d6
push str.xp_sp2
call fcn.004264e0
add esp, 4
push 0
push 0
push 0x532ecc
push 0
call fcn.0042c910
xor ebx, ebx
mov eax, dword [0x579fe0]
test al, 1
jne 0x42274f
or eax, 1
mov dword [0x579fe0], eax
mov ecx, 0x579fdc
mov byte [ebp - 4], 0x13
call fcn.0042d1d0
push 0x52b850
call fcn.00478174
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x579fdc
call fcn.0042d6c0
call fcn.00421d60
mov ecx, eax
call fcn.004674c0
call fcn.00434870
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x579f8c
call fcn.004080a0
mov edi, dword [0x575e70]
add edi, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x579f88]
test esi, esi
je 0x4227e1
cmp dword [esi + 4], 0
jle 0x4227af
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x579f88]
test esi, esi
je 0x4227e1
mov eax, dword [esi]
test eax, eax
je 0x4227c8
push eax
call fcn.004c3ca3
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00477d79
add esp, 8
push edi
mov dword [0x579f88], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x579f84]
test esi, esi
je 0x42283a
mov eax, dword [esi]
test eax, eax
je 0x422811
push eax
call fcn.004c3ca3
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x422828
push eax
call fcn.004c3ca3
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.00477d79
add esp, 8
mov esi, dword [0x579f7c]
test esi, esi
je 0x422873
cmp dword [esi], 0
je 0x422873
nop dword [eax]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x42285d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x422850
mov esi, dword [0x575edc]
mov ecx, dword [0x575ee0]
cmp esi, ecx
jae 0x42289d
mov eax, dword [esi]
test eax, eax
je 0x422896
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x575ee0]
add esi, 4
cmp esi, ecx
jb 0x422883
mov ecx, 0x579f50
call fcn.004248e0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x23c]
call fcn.00407390
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00477d68
mov esp, ebp
pop ebp
ret
mov ecx, 0x579f8c
call fcn.00407a80
test eax, eax
jne 0x4228ff
push str.CheckSingleInstance_failed__exit
call fcn.004264e0
add esp, 4
push 0
push 0
push 0x532f44
jmp 0x422716
call fcn.004057e0
mov ecx, eax
test ecx, ecx
je 0x422f52
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 3
push eax
call fcn.004213e0
mov esi, eax
add esp, 4
test esi, esi
jg 0x422972
jns 0x422972
push 0
push 0
push 0x532f60
push 0
call fcn.0042c910
mov edx, dword [ebp - 0x228]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42271d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42271d
call fcn.00421ca0
mov ecx, eax
call fcn.00417840
push eax
call fcn.00421e20
mov ecx, eax
call fcn.0040e930
push 0x532de0
call fcn.00421e20
mov ecx, eax
call fcn.0040e9a0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a7120
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x575e50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.00421e20
mov ecx, eax
call fcn.0040e8a0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x22c], esp
mov dword [eax + 0x24], 0
mov byte [ebp - 0x221], 0
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 5
push eax
call fcn.00453c55
lea eax, [ebp - 0x220]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x221]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x244]
push eax
push 0x420540
push 0x579fc8
call fcn.00454660
add esp, 0x10
test eax, eax
je 0x422f32
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 7
push eax
call fcn.00453c8f
mov ecx, dword [0x579fc4]
add esp, 4
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
push 0
push 0
push str.install1_2
call fcn.0040e590
cmp esi, 2
jne 0x422c3e
test ebx, ebx
je 0x422c3e
push 0x579fe8
push dword [0x575e50]
call fcn.0042f2c0
mov edi, esp
mov dword [ebp - 0x22c], esp
mov esi, eax
mov dword [ebp - 0x21c], edi
call fcn.004057e0
mov ecx, eax
test ecx, ecx
je 0x422f5c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.00404bb0
test al, al
jne 0x422aed
test esi, esi
jne 0x422ad0
xor ecx, ecx
jmp 0x422ae4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422ad5
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00405fa0
push dword [0x575e50]
mov byte [ebp - 4], 0xb
call fcn.0042f2c0
mov edi, esp
mov esi, eax
mov dword [ebp - 0x21c], edi
call fcn.004057e0
mov ecx, eax
test ecx, ecx
je 0x422f66
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push esi
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.00404bb0
test al, al
jne 0x422b58
test esi, esi
jne 0x422b37
xor ecx, ecx
jmp 0x422b4f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x422b40
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00405fa0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 3
call fcn.00430ab0
add esp, 0xc
cmp dword [0x579fe8], 0
je 0x422c3e
push str.inst_limit_halopets
lea ecx, [ebp - 0x22c]
call fcn.00404880
push str.loader_dll2
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xd
call fcn.00404880
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x234], esp
mov dword [eax + 0x24], 0
push 1
push 0
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00421e20
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.0040e660
mov edx, dword [ebp - 0x21c]
or edi, 0xffffffff
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x422bf5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x22c]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x422c16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x228]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x42271d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42271d
call fcn.00433f30
mov esi, eax
push esi
mov eax, dword [esi]
call dword [eax]
mov ebx, eax
or edi, 0xffffffff
test ebx, ebx
je 0x422cfb
mov byte [ebp - 4], 0x10
call fcn.004057e0
mov ecx, eax
test ecx, ecx
je 0x422f70
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x21c], eax
lea eax, [ebx - 1]
cmp eax, 3
ja case.default.0x422c8a
jmp dword [eax*4 + 0x422f90]
push 0x10
push 0x532b1c
jmp 0x422cb3
push 0x10
push 0x532b40
jmp 0x422cb3
push 0x11
push 0x532b64
jmp 0x422cb3
push 0x10
push 0x532b88
lea ecx, [ebp - 0x21c]
call fcn.00405fa0
mov esi, dword [ebp - 0x21c]
push 0
push 0
push esi
push 0
call fcn.0042c910
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x422ceb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
push str.PreInitCheck_failed__ret___d__exit
call fcn.004264e0
add esp, 8
jmp 0x422d2f
mov eax, dword [esi]
push str.DLL_7Z
push 0xcb
push dword [0x575e50]
push esi
call dword [eax + 4]
test eax, eax
jne 0x422d61
push eax
push eax
push 0x532bac
push eax
call fcn.0042c910
push str.Init_7z_failed__exit
call fcn.004264e0
add esp, 4
mov ecx, 0x579f8c
call fcn.004080a0
mov edx, dword [ebp - 0x228]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x42271d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42271d
call fcn.00433f30
mov esi, eax
push str.SETUPDATA
push 0xd7
push dword [0x575e50]
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
or edi, 0xffffffff
test eax, eax
jne 0x422dc8
push str.InitPackInfo_failed__exit
call fcn.004264e0
add esp, 4
push 0
push 4
push 0x532bac
push 0
call fcn.0042c910
cmp eax, 6
jne 0x422e6f
push 1
push 0
push 0
push str.http:__www.halopet.cn_
push 0x52f464
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x422e6f
push str.InitPackInfo_success
call fcn.004264e0
add esp, 4
lea ecx, [ebp - 0x221]
call fcn.00420920
push eax
lea ecx, [ebp - 0x21c]
call fcn.00404880
push dword [ebp - 0x21c]
mov eax, dword [esi]
push str.SETUPCONFIG
push 0xd5
push dword [0x575e50]
mov byte [ebp - 4], 0x11
push esi
call dword [eax + 0xc]
test eax, eax
jne 0x422ec6
push str.InitConfig_failed__exit
call fcn.004264e0
add esp, 4
push 0
push 4
push 0x532bac
push 0
call fcn.0042c910
cmp eax, 6
jne 0x422e4e
push 1
push 0
push 0
push str.http:__www.halopet.cn_
push 0x52f464
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x21c]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x422e6f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x234], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.install_file_fail
mov byte [ebp - 4], 0x12
call fcn.00421e20
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040e590
mov edx, dword [ebp - 0x228]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x42271d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42271d
push str.InitConfig_success
call fcn.004264e0
mov edx, dword [ebp - 0x21c]
or edi, 0xffffffff
add esp, 4
mov byte [ebp - 4], 3
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x422ef7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 0x14]
push dword [ebp - 0x234]
call fcn.004243b0
mov edx, dword [ebp - 0x228]
add esp, 8
mov ebx, eax
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x42271f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42271f
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 8
push eax
call fcn.00453cd1
add esp, 4
mov byte [ebp - 4], 6
test al, al
jne 0x422f7a
call fcn.00454731
push 0x80004005
call fcn.00404b90
push 0x80004005
call fcn.00404b90
push 0x80004005
call fcn.00404b90
push 0x80004005
call fcn.00404b90
sub esp, 8
lea eax, [ebp - 0x220]
mov ecx, esp
push eax
call fcn.00416810
call fcn.0041a640
xchg ecx, eax
sub al, 66
add byte [edx - 0x5cffbdd4], bl
sub al, 0x42
add byte [esp + ebp - 0x74aaffbe], ch
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
call fcn.004247d0
mov ebx, dword [edi]
xor edx, edx
movzx eax, word [ebx]
cmp dx, ax
je 0x42312f
mov esi, dword [ebp + 8]
mov edx, 0x27
mov dword [ebp + 8], esi
cmp dx, ax
jne 0x4230b0
mov edi, dword [sym.imp.USER32.dll_CharNextW]
push ebx
call edi
mov ebx, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 8], 0
mov dword [ebx], edx
movzx ecx, word [edx]
mov eax, ecx
cmp word [ebp - 8], cx
je 0x42308a
nop dword [eax]
mov ecx, 0x27
cmp cx, ax
jne 0x423017
push edx
call edi
mov ecx, 0x27
cmp cx, word [eax]
jne 0x42308a
mov edi, dword [ebx]
mov eax, 0x27
cmp ax, word [edi]
jne 0x42302e
push edi
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
mov dword [ebx], edi
push edi
call dword [sym.imp.USER32.dll_CharNextW]
mov edx, eax
mov dword [ebp - 8], eax
sub edx, edi
mov dword [ebx], eax
mov eax, dword [ebp + 8]
sar edx, 1
add eax, 0x2000
lea ecx, [edx + 1]
lea ecx, [esi + ecx*2]
cmp ecx, eax
jae 0x42312f
test edx, edx
jle 0x423073
sub edi, esi
nop dword [eax]
mov ax, word [edi + esi]
mov word [esi], ax
add esi, 2
sub edx, 1
jne 0x423060
mov edx, dword [ebx]
jmp 0x423076
mov edx, dword [ebp - 8]
movzx eax, word [edx]
xor edi, edi
cmp di, ax
mov edi, dword [sym.imp.USER32.dll_CharNextW]
jne 0x423000
mov eax, dword [ebx]
xor ecx, ecx
cmp cx, word [eax]
je 0x42312f
xor eax, eax
mov word [esi], ax
push dword [ebx]
call edi
pop edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx eax, ax
add eax, 0xfffffff7
cmp eax, 0x17
ja case.0x4230c2.11
movzx eax, byte [eax + 0x423148]
jmp dword [eax*4 + 0x423140]
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, dword [ebp + 8]
mov dword [edi], eax
add ecx, 0x2000
mov edi, eax
mov dword [ebp - 8], eax
sub edi, ebx
sar edi, 1
lea edx, [edi + 1]
lea edx, [esi + edx*2]
cmp edx, ecx
jae 0x42312f
test edi, edi
jle 0x42310d
sub ebx, esi
mov ax, word [ebx + esi]
mov word [esi], ax
add esi, 2
sub edi, 1
jne 0x4230f4
mov edi, dword [ebp - 4]
mov eax, dword [edi]
mov dword [ebp - 8], eax
jmp 0x423110
mov edi, dword [ebp - 4]
movzx eax, word [eax]
xor edx, edx
mov ebx, dword [ebp - 8]
mov ecx, eax
cmp dx, ax
je case.0x4230c2.9
jmp 0x4230b0
xor eax, eax
pop edi
mov word [esi], ax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x80020009
pop ebx
mov esp, ebp
pop ebp
ret 4