Function at 0x415899
Capabilities:
Accept command line arguments
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x429a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [0x42a984], eax
push esi
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
test eax, eax
je 0x4158e3
cmp dword [ebp - 0x88], 2
mov byte [0x42a988], 1
je 0x4158e9
mov byte [0x42a988], bl
lea ecx, [ebp - 0x1ac]
call fcn.004092c7
lea ecx, [ebp - 0x184]
call fcn.004092c7
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
call fcn.004092c7
lea ecx, [ebp - 0x13c]
call fcn.004092c7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00408a3a
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.00408bc2
lea ecx, [ebp - 0x160]
call fcn.004092c7
lea eax, [ebp - 0x160]
push eax
call fcn.0040a169
lea ecx, [ebp - 0xc8]
call fcn.004092c7
xor esi, esi
mov byte [ebp - 0x99], bl
cmp dword [ebp - 0x10c], ebx
jbe 0x415a98
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + esi*4]
push 0x422354
push dword [eax]
call fcn.00418ca8
pop ecx
pop ecx
test eax, eax
jne 0x4159cf
mov byte [ebp - 0x99], 1
jmp 0x415a8b
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax + esi*4]
push str._sp_
call fcn.00408e6f
test al, al
je 0x415a8b
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
add eax, 8
push eax
lea ecx, [ebp - 0xc8]
call fcn.00409346
lea ecx, [ebp - 0xc8]
call fcn.0040968f
lea ecx, [ebp - 0xc8]
call fcn.00409656
cmp dword [ebp - 0xc4], ebx
je 0x415a3a
dec dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xc4]
xor eax, eax
mov word [ecx + edx*2], ax
push 0x422348
lea ecx, [ebp - 0xec]
call fcn.004092eb
push 0x422340
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040987b
push dword [ebp - 0xa8]
call fcn.0040990f
push dword [ebp - 0xec]
call fcn.0040990f
pop ecx
pop ecx
inc esi
cmp esi, dword [ebp - 0x10c]
jb 0x4159a8
lea ecx, [ebp - 0x148]
call fcn.00408feb
mov ecx, dword [ebp - 0x160]
lea eax, [ebp - 0x148]
push eax
push str.___InstallEnd__
mov edx, str.___Install__UTF_8_
call fcn.00415612
test al, al
jne 0x415b33
push dword [ebp - 0x148]
call fcn.0040990f
push dword [ebp - 0xc8]
call fcn.0040990f
push dword [ebp - 0x160]
call fcn.0040990f
push dword [ebp - 0x13c]
call fcn.0040990f
push dword [ebp - 0x154]
call fcn.0040990f
add esp, 0x14
lea ecx, [ebp - 0x110]
call fcn.00408b35
push dword [ebp - 0x184]
call fcn.0040990f
push dword [ebp - 0x1ac]
call fcn.0040990f
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00416d6b
leave
ret 0x10
push edi
push 0x422338
lea ecx, [ebp - 0x1a0]
call fcn.004092eb
lea ecx, [ebp - 0xe0]
call fcn.004092c7
lea ecx, [ebp - 0x16c]
call fcn.004092c7
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x114], 1
cmp dword [ebp - 0x144], ebx
je 0x415f56
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x148]
push eax
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
call fcn.00409cd9
test al, al
jne 0x415c34
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0xd4]
call fcn.00415802
push dword [ebp - 0x16c]
call fcn.0040990f
push dword [ebp - 0xe0]
call fcn.0040990f
push dword [ebp - 0x1a0]
call fcn.0040990f
push dword [ebp - 0x148]
call fcn.0040990f
push dword [ebp - 0xc8]
call fcn.0040990f
push dword [ebp - 0x160]
call fcn.0040990f
push dword [ebp - 0x13c]
call fcn.0040990f
push dword [ebp - 0x154]
call fcn.0040990f
add esp, 0x20
lea ecx, [ebp - 0x110]
call fcn.00408b35
push dword [ebp - 0x184]
call fcn.0040990f
push dword [ebp - 0x1ac]
call fcn.0040990f
pop ecx
pop ecx
mov eax, ebx
pop edi
jmp 0x415b23
push str.Title
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.00409c5d
push dword [ebp - 0xa8]
call fcn.0040990f
lea ecx, [ebp - 0xa8]
mov dword [esp], str.BeginPrompt
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.00409c5d
push dword [ebp - 0xa8]
call fcn.0040990f
lea ecx, [ebp - 0xa8]
mov dword [esp], str.Silent
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00409c5d
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
cmp dword [ebp - 0x1cc], ebx
je 0x415ce7
mov byte [ebp - 0x99], 1
push 0x4222f0
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00409c5d
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
cmp byte [ebp - 0x99], bl
jne 0x415d39
push 0x4222ec
push dword [ebp - 0x1b8]
call fcn.00408eb8
test al, al
je 0x415d3f
mov byte [ebp - 0x114], bl
push str.Directory
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00409c29
push dword [ebp - 0xa8]
mov esi, eax
call fcn.0040990f
cmp esi, ebx
pop ecx
jl 0x415d8c
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040939f
cmp dword [ebp - 0x174], ebx
je 0x415de6
cmp byte [ebp - 0x99], bl
jne 0x415de6
push 0x24
push dword [ebp - 0x1c4]
push dword [ebp - 0x178]
push ebx
call edi
cmp eax, 6
je 0x415de6
push dword [ebp - 0x1b8]
call fcn.0040990f
push dword [ebp - 0x1d0]
call fcn.0040990f
push dword [ebp - 0x178]
call fcn.0040990f
push dword [ebp - 0x1c4]
call fcn.0040990f
add esp, 0x10
jmp 0x415ba3
push str.RunProgram
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00409c5d
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040939f
push dword [ebp - 0xec]
call fcn.0040990f
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
pop ecx
push str.RunProgramParameters
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00409c5d
push eax
lea ecx, [ebp - 0x16c]
call fcn.0040939f
push dword [ebp - 0xec]
call fcn.0040990f
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
pop ecx
push str.ExecuteFile
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00409c5d
push eax
lea ecx, [ebp - 0x154]
call fcn.0040939f
push dword [ebp - 0xec]
call fcn.0040990f
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
pop ecx
push str.ExecuteParameters
lea ecx, [ebp - 0xa8]
call fcn.004092eb
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00409c5d
push eax
lea ecx, [ebp - 0x13c]
call fcn.0040939f
push dword [ebp - 0xec]
call fcn.0040990f
push dword [ebp - 0xa8]
call fcn.0040990f
push dword [ebp - 0x1b8]
call fcn.0040990f
push dword [ebp - 0x1d0]
call fcn.0040990f
push dword [ebp - 0x178]
call fcn.0040990f
push dword [ebp - 0x1c4]
call fcn.0040990f
add esp, 0x18
lea ecx, [ebp - 0xd4]
call fcn.00415802
lea ecx, [ebp - 0x120]
mov byte [ebp - 0x124], bl
call fcn.004092c7
push dword [0x429a24]
lea ecx, [ebp - 0x124]
call fcn.0040ace6
test al, al
jne 0x415fa2
cmp byte [ebp - 0x99], bl
jne 0x415f8f
push str.Can_not_create_temp_folder_archive
push ebx
call fcn.0040e06b
lea ecx, [ebp - 0x124]
call fcn.004154f6
xor ebx, ebx
inc ebx
jmp 0x415bae
push 0x18
call fcn.004098e4
pop ecx
cmp eax, ebx
je 0x415fb9
mov ecx, eax
call fcn.00415854
mov esi, eax
jmp 0x415fbb
xor esi, esi
push esi
lea ecx, [ebp - 0xb0]
call fcn.00401086
mov ecx, esi
call fcn.0040e8e3
test eax, eax
je 0x415fef
push str.Can_not_load_codecs
push ebx
call fcn.0040e06b
mov eax, dword [ebp - 0xb0]
cmp eax, ebx
je 0x415f8f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x415f8f
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x104]
call fcn.0040931b
lea ecx, [ebp - 0x130]
mov byte [ebp - 0xa9], bl
call fcn.004092c7
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xa9]
push eax
push dword [ebp - 0x114]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x160]
push eax
push esi
call fcn.00415366
cmp eax, ebx
je 0x4160e2
cmp byte [ebp - 0x99], bl
jne 0x4160c5
cmp eax, 1
je 0x416057
cmp byte [ebp - 0xa9], bl
je 0x41606a
lea eax, [ebp - 0x130]
push eax
push 8
call fcn.0040c5c5
mov eax, 0x80004005
cmp eax, 0x80004004
je 0x4160c5
cmp dword [ebp - 0x12c], ebx
jne 0x41609e
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0040a31a
push eax
lea ecx, [ebp - 0x130]
call fcn.0040939f
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
push 7
lea eax, [ebp - 0xa8]
push eax
call fcn.0040c459
push 0x10
push dword [eax]
push dword [ebp - 0x130]
push ebx
call edi
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
push dword [ebp - 0x130]
call fcn.0040990f
push dword [ebp - 0x104]
call fcn.0040990f
pop ecx
pop ecx
jmp 0x415fdd
push dword [ebp - 0x130]
call fcn.0040990f
pop ecx
lea ecx, [ebp - 0x194]
call fcn.0041551f
push dword [ebp - 0x104]
call fcn.0040a5a7
test al, al
jne 0x416120
lea ecx, [ebp - 0x194]
call fcn.0041554b
push dword [ebp - 0x104]
call fcn.0040990f
jmp 0x4160dc
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x150], ebx
je 0x41626a
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0040c5dd
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x20c], 0x3c
mov dword [ebp - 0x208], 0x140
mov dword [ebp - 0x204], ebx
mov dword [ebp - 0x200], ebx
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0xc4], ebx
je 0x416196
lea ecx, [ebp - 0x13c]
call fcn.00409836
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0040948f
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0040c5dd
mov eax, dword [ebp - 0xf4]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xf8]
xor esi, esi
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x20c]
inc esi
push eax
mov dword [ebp - 0x1f4], ebx
mov dword [ebp - 0x1f0], esi
mov dword [ebp - 0x1d4], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x1ec], 0x20
ja 0x41624e
cmp byte [ebp - 0x99], bl
jne 0x4161fd
push str.Can_not_open_file
push ebx
call fcn.0040e06b
push dword [ebp - 0xf8]
call fcn.0040990f
push dword [ebp - 0xbc]
call fcn.0040990f
pop ecx
pop ecx
lea ecx, [ebp - 0x194]
call fcn.0041554b
push dword [ebp - 0x104]
call fcn.0040990f
mov eax, dword [ebp - 0xb0]
pop ecx
cmp eax, ebx
je 0x41623c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x124]
call fcn.004154f6
mov ebx, esi
jmp 0x415bae
push dword [ebp - 0xf8]
mov esi, dword [ebp - 0x1d4]
call fcn.0040990f
push dword [ebp - 0xbc]
jmp 0x41653b
cmp dword [ebp - 0xdc], ebx
jne 0x4162ad
push str.setup.exe
lea ecx, [ebp - 0xe0]
call fcn.00409346
push dword [ebp - 0xe0]
call fcn.0040b615
test al, al
jne 0x4162ad
cmp byte [ebp - 0x99], bl
jne 0x416108
push str.Can_not_find_setup.exe
push ebx
call fcn.0040e06b
jmp 0x416108
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0xf8]
call fcn.0040931b
lea eax, [ebp - 0xf8]
push eax
call fcn.0040ba47
mov esi, str.__T_
push esi
lea ecx, [ebp - 0xbc]
call fcn.004092eb
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040987b
push dword [ebp - 0xbc]
call fcn.0040990f
pop ecx
push esi
lea ecx, [ebp - 0xbc]
call fcn.004092eb
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x16c]
call fcn.0040987b
push dword [ebp - 0xbc]
call fcn.0040990f
push dword [ebp - 0xf8]
call fcn.0040990f
pop ecx
pop ecx
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0040931b
mov esi, 0x422168
push esi
lea ecx, [ebp - 0xbc]
call fcn.004092eb
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040987b
push dword [ebp - 0xbc]
call fcn.0040990f
pop ecx
push esi
lea ecx, [ebp - 0xbc]
call fcn.004092eb
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x16c]
call fcn.0040987b
push dword [ebp - 0xbc]
call fcn.0040990f
pop ecx
mov esi, 0x422348
push esi
lea ecx, [ebp - 0x234]
call fcn.004092eb
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push esi
lea ecx, [ebp - 0x240]
call fcn.004092eb
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00409275
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.00409275
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00409275
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040939f
push dword [ebp - 0xbc]
call fcn.0040990f
push dword [ebp - 0xf8]
call fcn.0040990f
push dword [ebp - 0x228]
call fcn.0040990f
push dword [ebp - 0x240]
call fcn.0040990f
push dword [ebp - 0x234]
call fcn.0040990f
add esp, 0x14
lea ecx, [ebp - 0xe0]
cmp dword [ebp - 0xc4], ebx
je 0x41646b
call fcn.0040982e
lea eax, [ebp - 0xc8]
jmp 0x416476
call fcn.0040982e
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040948f
xor eax, eax
mov word [ebp - 0x252], ax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x284], 0x44
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x250], ebx
call fcn.0040c5dd
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x284]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xec]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41651c
cmp byte [ebp - 0x99], bl
jne 0x4164ff
lea eax, [ebp - 0xa8]
push eax
call fcn.004155ab
push dword [ebp - 0xec]
call fcn.0040990f
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
pop ecx
jmp 0x416108
push dword [ebp - 0x218]
call edi
push dword [ebp - 0xec]
mov esi, dword [ebp - 0x21c]
call fcn.0040990f
push dword [ebp - 0xa8]
call fcn.0040990f
pop ecx
pop ecx
cmp esi, ebx
je 0x416552
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
lea ecx, [ebp - 0x194]
call fcn.0041554b
push dword [ebp - 0x104]
call fcn.0040990f
mov eax, dword [ebp - 0xb0]
pop ecx
cmp eax, ebx
je 0x416579
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x124]
call fcn.004154f6
jmp 0x415bae