Function at 0x401020
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x41d00c]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [0x41e468]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jne 0x401076
push 0x41d8e4
push 0x23c
call fcn.004031b7
add esp, 8
test eax, eax
je 0x40106b
sub esp, 0xc
mov ecx, eax
call fcn.00402440
jmp 0x40106d
xor eax, eax
mov dword [0x41e468], eax
test eax, eax
je 0x401082
add eax, 0x22c
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 1
call fcn.00406039
add esp, 4
push eax
call fcn.00405f47
add esp, 8
mov dword [esp + 0x18], 0
xor eax, eax
xor esi, esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x4010f0
mov esi, dword [0x41e468]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CommandLineToArgvW_failed:__d_n
push 2
push esi
call fcn.00402650
add esp, 0x10
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00402b73
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x18]
cmp eax, 2
je 0x40111a
cmp eax, 3
je 0x40111a
push str._n_Usage__InstallPackageGuard__InstallPath___BackupPath____KillProcesses___n_KillProcesses_:_multiple_processes_can_be_split_by_symbol____.
push 2
push dword [0x41e468]
call fcn.00402650
mov esi, 2
jmp 0x4013ab
push str.NtQueryInformationProcess
xorps xmm0, xmm0
mov dword [esp + 0x24], esi
push str.ntdll.dll
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x401394
push 0
push 0x18
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
js 0x401394
mov ebx, dword [esp + 0x34]
test ebx, ebx
je 0x401394
push 0x208
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00404f90
add esp, 0xc
lea eax, [esp + 0x38]
push ebx
push str.Mutex_Pospal_Install__d
push eax
call fcn.00401d60
add esp, 0xc
lea eax, [esp + 0x38]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
cmp eax, 0xb7
jne 0x4011da
push str.There_is_already_a_guard_process_of_pid__d.
push 4
push dword [0x41e468]
call fcn.00402650
add esp, 0x10
mov esi, 0xd
jmp 0x401376
push 0
push 0x101000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401215
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x41e468]
call eax
push eax
push ebx
push str.Failed_to_open_parent_process__d__error___d.
push 4
push esi
call fcn.00402650
mov esi, 4
jmp 0x401373
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401248
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x41e468]
call eax
push eax
push ebx
push str.Failed_to_WaitForSingleObject__d__error___d.
push 4
push esi
call fcn.00402650
mov esi, 5
jmp 0x401373
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x401286
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x41e468]
call eax
push eax
push ebx
push str.Failed_to_GetExitCodeProcess__d__error___d.
push 4
push esi
call fcn.00402650
mov esi, 6
jmp 0x401373
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401376
cmp dword [esp + 0x18], 3
jne 0x4012c2
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x4012c2
call fcn.00401410
push eax
push dword [edi + 8]
push str.KillProcess_list__s__ret___d.
push 2
push dword [0x41e468]
call fcn.00402650
mov eax, dword [esp + 0x30]
add esp, 0x14
push eax
push ebx
push str.parent_process__d_exit__ExitCode___d__Ready_to_rollback_files.
push 2
push dword [0x41e468]
call fcn.00402650
mov ebx, dword [edi]
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401323
test al, 0x10
je 0x4012f4
mov ecx, ebx
call fcn.00401800
jmp 0x4012fb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401323
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x41e468]
call eax
push eax
push dword [edi]
push str.Failed_to_DeleteFiles__s__error___d.
push 4
push esi
call fcn.00402650
mov esi, 7
jmp 0x401373
push dword [edi]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40135c
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x41e468]
call eax
push eax
push dword [edi]
push dword [edi + 4]
push str.Failed_to_MoveFile__s_____s__error___d.
push 4
push esi
call fcn.00402650
add esp, 0x18
mov esi, 8
jmp 0x401376
push dword [edi]
push dword [edi + 4]
push str.success_to_rollback_files:__s_____s
push 2
push dword [0x41e468]
call fcn.00402650
add esp, 0x14
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401387
push eax
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4013ae
push eax
call ebx
jmp 0x4013ae
push str.Failed_to_query_parent_process_pid.
push 2
push dword [0x41e468]
call fcn.00402650
mov esi, 3
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x41e468]
test eax, eax
je 0x4013f7
add eax, 0x22c
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4013f7
mov edi, dword [0x41e468]
test edi, edi
je 0x4013ed
mov ecx, edi
call fcn.004025a0
push 0x23c
push edi
call fcn.004031a9
add esp, 8
mov dword [0x41e468], 0
mov ecx, dword [esp + 0x244]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402b73
mov esp, ebp
pop ebp
ret 0x10