Function at 0x4169c0
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Create process on windows
Create process suspended
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b44
call fcn.004da5e0
mov eax, dword [0x65b500]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.halo_desktop_search_mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x416afb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416afb
push 0
push str.halo_search_main_wnd_class
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x416aef
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x417120
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1ad4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
test edx, edx
jne 0x416a56
xor ecx, ecx
jmp 0x416a6f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416a60
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1ad4]
call fcn.00408d30
mov esi, dword [ebp - 0x1ad4]
xorps xmm0, xmm0
movlpd qword [ebp - 0x141c], xmm0
mov dword [ebp - 0x1420], 0
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x1418], esi
mov dword [ebp - 0x1ad8], 0
lea eax, [eax*2 + 2]
mov dword [ebp - 0x141c], eax
lea eax, [ebp - 0x1ad8]
push eax
push 0x3e8
push 1
lea eax, [ebp - 0x1420]
push eax
push 0
push 0x4a
push ebx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416aef
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41710b
lea ecx, [ebp - 0x1add]
call fcn.004158b0
push 0
push 0
push str.halosearch
call fcn.00414530
add esp, 0xc
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x1adc]
mov dword [ebp - 0x1adc], 8
push eax
mov dword [ebp - 0x1ad8], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push ebx
push 0
mov ecx, 0x6656fc
call fcn.00414410
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.005c5370
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push str.HaloDesktopLogHaloSearch.log
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
call fcn.0045c930
push str.HaloTray.exe
call fcn.0043d990
add esp, 4
test al, al
jne 0x416d17
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005c5370
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.HaloTray.exe
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416d17
xorps xmm0, xmm0
mov dword [ebp - 0x1b38], 0x44
lea eax, [ebp - 0x1b38]
movlpd qword [ebp - 0x1b34], xmm0
push eax
movlpd qword [ebp - 0x1b2c], xmm0
movlpd qword [ebp - 0x1b24], xmm0
movlpd qword [ebp - 0x1b1c], xmm0
movlpd qword [ebp - 0x1b14], xmm0
movlpd qword [ebp - 0x1b0c], xmm0
movlpd qword [ebp - 0x1b04], xmm0
movlpd qword [ebp - 0x1afc], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 4
mov dword [ebp - 0x1b0c], 1
push 0x1000
mov word [ebp - 0x1b08], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x1414]
push 0
push eax
movups xmmword [ebp - 0x1424], xmm0
call fcn.005c5370
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1414]
push str.__s____fromsearch____show1
push eax
call fcn.00413340
add esp, 0x18
lea eax, [ebp - 0x1424]
push eax
lea eax, [ebp - 0x1b38]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x416d17
push dword [ebp - 0x1420]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1424]
call esi
push ebx
call fcn.00467aa0
lea eax, [ebp - 0x14f8]
push eax
call fcn.00463120
add esp, 8
lea ecx, [ebp - 0x14f8]
push str.skin
call fcn.0045f960
lea ecx, [ebp - 0x14f8]
call fcn.0045f8c0
push eax
call fcn.00467d20
push 1
push str.halosearch.uiz
call fcn.00467de0
add esp, 0xc
lea ecx, [ebp - 0x1b44]
call fcn.00460f40
push 2
lea ecx, [ebp - 0x1b44]
call fcn.00461560
push 0
lea eax, [ebp - 0x1af0]
mov dword [ebp - 0x1af0], 1
push eax
lea eax, [ebp - 0x1af4]
mov dword [ebp - 0x1aec], 0
push eax
mov dword [ebp - 0x1ae8], 0
mov dword [ebp - 0x1ae4], 0
call sub.gdiplus.dll_GdiplusStartup
lea ecx, [ebp - 0x1474]
call fcn.00447550
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x141c], 0
mov ecx, edx
mov dword [ebp - 0x1418], 7
xor eax, eax
mov word [ebp - 0x142c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416de6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x142c]
call fcn.004167f0
lea eax, [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1474]
call fcn.00447eb0
mov edx, dword [ebp - 0x1418]
cmp edx, 8
jb 0x416e54
mov ecx, dword [ebp - 0x142c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416e4a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41712a
push edx
push ecx
call fcn.004da0c6
add esp, 8
lea ecx, [ebp - 0x1ad0]
call fcn.0041af50
movaps xmm0, xmmword [0x605180]
lea ecx, [ebp - 0x1ad0]
push 0
sub esp, 0x10
mov eax, esp
push 0
push 0x86020000
push 0
push 0
movups xmmword [eax], xmm0
call fcn.00468a20
push 3
xor eax, eax
mov dword [ebp - 0x141c], 0
push 0x605120
lea ecx, [ebp - 0x142c]
mov dword [ebp - 0x1418], 7
mov word [ebp - 0x142c], ax
call fcn.004167f0
lea eax, [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1474]
call fcn.00447e10
mov edx, dword [ebp - 0x1418]
test eax, eax
sete bl
cmp edx, 8
jb 0x416f0c
mov ecx, dword [ebp - 0x142c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416f02
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41712f
push edx
push ecx
call fcn.004da0c6
add esp, 8
test bl, bl
je 0x4170d3
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x417134
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x1ad4]
push 0x603f94
mov dword [ebp - 0x1ad4], eax
call fcn.00413f80
test al, al
jne 0x416f57
push 0
push 0x603f94
lea ecx, [ebp - 0x1ad4]
call fcn.00408d30
push 5
xor eax, eax
mov dword [ebp - 0x141c], 0
push str.entry
lea ecx, [ebp - 0x142c]
mov dword [ebp - 0x1418], 7
mov word [ebp - 0x142c], ax
call fcn.004167f0
lea eax, [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1474]
call fcn.00447e10
lea ecx, [ebp - 0x142c]
mov esi, eax
call fcn.00409b00
or ebx, 0xffffffff
test esi, esi
je 0x417091
xor eax, eax
mov dword [ebp - 0x141c], 0
push 5
push str.entry
lea ecx, [ebp - 0x1444]
mov dword [ebp - 0x1418], 7
mov word [ebp - 0x142c], ax
mov dword [ebp - 0x1434], eax
mov dword [ebp - 0x1430], 7
mov word [ebp - 0x1444], ax
call fcn.004167f0
lea eax, [ebp - 0x142c]
push eax
lea eax, [ebp - 0x1444]
push eax
lea ecx, [ebp - 0x1474]
call fcn.00447cd0
lea ecx, [ebp - 0x1444]
call fcn.00409b00
cmp dword [ebp - 0x1418], 8
lea eax, [ebp - 0x142c]
lea ecx, [ebp - 0x1ad8]
cmovae eax, dword [ebp - 0x142c]
push eax
call fcn.00406060
push eax
lea ecx, [ebp - 0x1ad4]
call fcn.0040fc30
mov edx, dword [ebp - 0x1ad8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417063
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1ad4]
lea ecx, [ebp - 0x142c]
mov edi, dword [esi - 0xc]
call fcn.00409b00
test edi, edi
je 0x417097
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
call fcn.00407c20
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x4170a4
mov esi, dword [ebp - 0x1ad4]
push ecx
mov ecx, esp
push str.run_other
call fcn.00406060
lea ecx, [ebp - 0x1ad0]
call fcn.0042cad0
push 1
push 1
lea ecx, [ebp - 0x1ad0]
call fcn.004690c0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4170d3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1ad0]
call fcn.00468a60
mov ecx, eax
call fcn.00465850
call fcn.0045cb40
lea ecx, [ebp - 0x1ad0]
call fcn.0041bf90
lea ecx, [ebp - 0x1474]
call fcn.00447660
lea ecx, [ebp - 0x14f8]
call fcn.004328a0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004da36e
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004064e0
call fcn.005c8d19
call fcn.005c8d19
push 0x80004005
call fcn.004064e0
int3