Function at 0x408200
Capabilities:
Accept command line arguments
Check for sandbox and av modules
Check if file exists
Check mutex on windows
Copy file
Create directory
Create process on windows
Get common file path
Get file attributes
Read .ini file
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x15ec
call fcn.00460440
mov eax, dword [0x48c0d0]
xor eax, esp
mov dword [esp + 0x15e8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.ttkvod_update_mutex
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408262
push str.TTKvod_UpdateDlg
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.00415340
add esp, 4
jmp 0x408e6b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x206
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c6]
xor edx, edx
push ebx
push eax
mov word [esp + 0x1cc], dx
call fcn.00459f00
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1c4]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x206
lea eax, [esp + 0x7de]
xor edx, edx
push ebx
push eax
mov word [esp + 0x7e4], dx
call fcn.00459f00
add esp, 0xc
lea ecx, [esp + 0x7d8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x7d8]
push edx
lea eax, [esp + 0x1c4]
push eax
call fcn.00458c61
add esp, 8
test eax, eax
jne 0x4089c7
mov edi, 7
xor ecx, ecx
lea eax, [esp + 0x7d8]
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebx
mov word [esp + 0x9c], cx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408330
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x7dc]
lea esi, [esp + 0x9c]
call fcn.00409400
xor edx, edx
lea eax, [esp + 0x1c0]
mov word [esp + 0x80], dx
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408375
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c4]
lea esi, [esp + 0x80]
call fcn.00409400
mov eax, esi
push eax
mov edi, 1
call fcn.00409180
cmp eax, 0xffffffff
je 0x408960
mov ecx, esi
push ecx
lea edx, [eax + 1]
or ecx, 0xffffffff
lea esi, [esp + 0xf0]
call fcn.00409010
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x84]
call fcn.004090c0
cmp dword [esp + 0x104], 8
jb 0x4083ec
mov edx, dword [esp + 0xf0]
push edx
call fcn.00457a6e
add esp, 4
lea ebx, [esp + 0x14]
lea edi, [esp + 0x98]
call fcn.00408fc0
mov esi, eax
call fcn.00409080
mov esi, eax
call fcn.00409040
cmp word [eax], 0x5c
je 0x40841d
mov eax, edi
push eax
mov edx, 0x4802e4
call fcn.00408f90
mov dword [esp + 0x14], 0
mov ecx, 0x1f
mov esi, 0x4802e8
lea edi, [esp + 0x138]
rep movsd dword es:[edi], dword [esi]
push 0
movsw word es:[edi], word [esi]
call fcn.004580a8
add esp, 4
push eax
call fcn.00458cc2
xor eax, eax
xor ecx, ecx
add esp, 4
mov word [esp + 0x124], cx
mov dword [esp + 0x126], eax
mov dword [esp + 0x12a], eax
mov dword [esp + 0x12e], eax
mov dword [esp + 0x132], eax
xor esi, esi
call fcn.00458cd4
cdq
mov ecx, 0x3e
idiv ecx
inc esi
cmp esi, 8
mov dx, word [esp + edx*2 + 0x138]
mov word [esp + esi*2 + 0x122], dx
jl 0x408477
lea eax, [esp + 0x98]
push eax
lea ebx, [esp + 0x128]
lea esi, [esp + 0xf0]
call fcn.00409790
mov eax, dword [esp + 0xf4]
mov edi, 8
add esp, 4
cmp dword [esp + 0x104], edi
jae 0x4084d4
lea eax, [esp + 0xf0]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
cmp esi, ebx
jne 0x408513
cmp dword [esp + 0x104], edi
jb 0x4084fd
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00457a6e
add esp, 4
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0xa
mov dword [esp + 0x14], eax
jl 0x408425
xor ebx, ebx
jmp 0x408572
lea eax, [esp + 0x124]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408520
sub eax, edx
lea edx, [esp + 0x124]
push edx
sar eax, 1
lea edx, [esp + 0x9c]
call fcn.00409320
push 0x4802e4
mov eax, 1
lea edx, [esp + 0x9c]
call fcn.00409320
cmp dword [esp + 0x104], edi
jb 0x408572
mov eax, dword [esp + 0xf0]
push eax
call fcn.00457a6e
add esp, 4
cmp esi, ebx
jne 0x4085d8
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x94], edi
jb 0x40859a
mov edx, dword [esp + 0x80]
push edx
call fcn.00457a6e
add esp, 4
mov dword [esp + 0x94], 7
xor eax, eax
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], ax
cmp dword [esp + 0xb0], edi
jb 0x408e6b
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.00457a6e
add esp, 4
jmp 0x408e6b
xor edx, edx
lea eax, [esp + 0x1c0]
mov word [esp + 0xb8], dx
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408600
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x1c4]
lea esi, [esp + 0xb8]
call fcn.00409400
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0xd8], ax
push ebx
lea eax, [esp + 0xa0]
lea ecx, [esp + 0xd8]
mov dword [esp + 0xf0], 7
mov dword [esp + 0xec], ebx
call fcn.004090c0
mov ecx, esi
push ecx
mov edi, 1
call fcn.00409180
cmp eax, 0xffffffff
je 0x4086aa
mov edx, esi
push edx
lea ecx, [eax + 1]
xor edx, edx
lea esi, [esp + 0xf0]
call fcn.00409010
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xbc]
call fcn.004090c0
mov edi, 8
cmp dword [esp + 0x104], edi
jb 0x4086af
mov eax, dword [esp + 0xf0]
push eax
call fcn.00457a6e
add esp, 4
jmp 0x4086af
mov edi, 8
push str.config
mov eax, 6
lea edx, [esp + 0xd4]
call fcn.00409320
mov ecx, dword [esp + 0xd4]
cmp dword [esp + 0xe8], edi
jae 0x4086dc
lea ecx, [esp + 0xd4]
mov eax, dword [esp + 0xb8]
cmp dword [esp + 0xcc], edi
jae 0x4086f3
lea eax, [esp + 0xb8]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ecx
push eax
push str.path
push str.Config
call esi
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
lea ecx, [esp + 0x80]
push ecx
or eax, 0xffffffff
lea esi, [esp + 0xa0]
call fcn.00409250
mov eax, dword [esp + 0x9c]
cmp dword [esp + 0xb0], edi
jae 0x40873c
lea eax, [esp + 0x9c]
push ebx
push eax
lea edx, [esp + 0x1c8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4088be
push 0x7fe
lea ecx, [esp + 0xdf6]
xor eax, eax
push ebx
push ecx
mov word [esp + 0xdfc], ax
call fcn.00459f00
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
jle 0x4087c3
mov esi, 1
cmp eax, esi
jle 0x4087c3
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + esi*4]
push eax
lea ecx, [esp + 0xdf4]
push 0x400
push ecx
call fcn.00458cf6
add esp, 0xc
push 0x480394
lea edx, [esp + 0xdf4]
push 0x400
push edx
call fcn.00458cf6
inc esi
add esp, 0xc
cmp esi, dword [esp + 0x10]
jl 0x408785
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x9c]
cmp dword [esp + 0xb0], edi
jae 0x4087ec
lea eax, [esp + 0x9c]
push 1
push ebx
lea ecx, [esp + 0xdf8]
push ecx
push eax
push 0x480398
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0xe8], edi
jb 0x40881d
mov edx, dword [esp + 0xd4]
push edx
call fcn.00457a6e
add esp, 4
xor eax, eax
mov esi, 7
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], ax
cmp dword [esp + 0xcc], edi
jb 0x408853
mov ecx, dword [esp + 0xb8]
push ecx
call fcn.00457a6e
add esp, 4
xor edx, edx
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov word [esp + 0xb8], dx
cmp dword [esp + 0x94], edi
jb 0x408884
mov eax, dword [esp + 0x80]
push eax
call fcn.00457a6e
add esp, 4
xor ecx, ecx
mov dword [esp + 0x94], esi
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], cx
cmp dword [esp + 0xb0], edi
jb 0x408e6b
mov edx, dword [esp + 0x9c]
push edx
call fcn.00457a6e
add esp, 4
jmp 0x408e6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00415230
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xe8], edi
jb 0x4088ed
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.00457a6e
add esp, 4
xor edx, edx
mov esi, 7
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov word [esp + 0xd4], dx
cmp dword [esp + 0xcc], edi
jb 0x408923
mov eax, dword [esp + 0xb8]
push eax
call fcn.00457a6e
add esp, 4
xor ecx, ecx
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov word [esp + 0xb8], cx
cmp dword [esp + 0x94], edi
jb 0x408954
mov edx, dword [esp + 0x80]
push edx
call fcn.00457a6e
add esp, 4
mov dword [esp + 0x94], esi
jmp 0x4085a5
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 8
cmp dword [esp + 0x94], esi
jb 0x408989
mov eax, dword [esp + 0x80]
push eax
call fcn.00457a6e
add esp, 4
xor ecx, ecx
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], cx
cmp dword [esp + 0xb0], esi
jb 0x408e6b
mov edx, dword [esp + 0x9c]
push edx
call fcn.00457a6e
add esp, 4
jmp 0x408e6b
push 0x4080d0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push str.DBGHELP.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MiniDumpWriteDump
push eax
mov dword [0x48ec30], eax
call esi
push str.KERNEL32
mov dword [0x48ec2c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x4803f0
push edi
call esi
push str.Module32First
push edi
mov dword [0x48ec28], eax
call esi
push str.Module32Next
push edi
mov dword [0x48ec24], eax
call esi
push fcn.00415090
mov dword [0x48ec20], eax
call fcn.00458040
add esp, 4
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x408a58
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408e6b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0042e687
lea edx, [esp + 0x13c]
add esp, 4
push edx
call fcn.0042e553
add esp, 4
mov ecx, eax
call fcn.0042d7c3
push eax
call fcn.0042e691
add esp, 4
lea ecx, [esp + 0x138]
call fcn.0042d673
push 0xdc
push str.._ttUpdate.cpp
push 4
push 0x494
call fcn.00458a85
add esp, 0x10
cmp eax, ebx
je 0x408a48
mov edi, eax
call fcn.00407d00
mov edi, eax
cmp edi, ebx
je 0x408a48
mov ecx, dword [esp + 0x14]
push 0x6b
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 1
push 0x80
mov ecx, edi
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x206
lea eax, [esp + 0x5d6]
xor edx, edx
push ebx
push eax
mov word [esp + 0x5dc], dx
call fcn.00459f00
xor ecx, ecx
mov word [esp + 0x118], cx
add esp, 0xc
lea ecx, [esp + 0x108]
mov dword [esp + 0x120], 7
mov dword [esp + 0x11c], ebx
call fcn.0040bb70
lea edx, [esp + 0x108]
push edx
mov ebx, str.config
lea esi, [esp + 0xf0]
call fcn.00409790
mov ebx, 8
add esp, 4
cmp dword [eax + 0x18], ebx
jb 0x408b51
mov eax, dword [eax + 4]
jmp 0x408b54
add eax, 4
push eax
push 0x104
lea eax, [esp + 0x5d8]
push eax
push 0
push str.path
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea esi, [esp + 0xec]
call fcn.00408f30
cmp word [esp + 0x5d0], 0
je 0x408ba8
lea ecx, [edi + 0x270]
push ecx
lea eax, [esp + 0x5d4]
call fcn.00408f60
lea edx, [esp + 0x5d0]
push edx
jmp 0x408bc3
lea esi, [edi + 0x270]
mov ecx, esi
call fcn.0040bb70
cmp dword [esi + 0x18], ebx
jb 0x408bbf
mov esi, dword [esi + 4]
jmp 0x408bc2
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [esp + 0x10]
mov eax, 0x40000
cmp ecx, 2
jne 0x408c25
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 4]
movzx ecx, word [edx]
add ecx, 0xffffffba
cmp ecx, 0x2d
ja case.0x408bf0.71
movzx ecx, byte [ecx + 0x408e90]
jmp dword [ecx*4 + 0x408e84]
mov edx, 1
lea eax, [edx + 0x7f]
jmp 0x408c9a
mov eax, 2
mov word [edi + 0x26c], ax
mov eax, 0x80
jmp 0x408ca1
xor ecx, ecx
mov word [edi + 0x26c], cx
jmp 0x408ca1
cmp ecx, 3
jne 0x408c8f
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx + 4]
movzx ecx, word [ecx]
cmp cx, 0x73
je 0x408c40
cmp cx, 0x53
jne 0x408ca1
mov edx, dword [edx + 8]
movzx ecx, word [edx]
cmp cx, 0x61
je 0x408c78
cmp cx, 0x41
je 0x408c78
cmp cx, 0x66
je 0x408c5e
cmp cx, 0x46
jne 0x408ca1
mov eax, 2
mov word [edi + 0x26c], ax
mov eax, 0x80
mov byte [edi + 0x3a9], 1
jmp 0x408ca1
mov ecx, 1
mov word [edi + 0x26c], cx
lea eax, [ecx + 0x7f]
mov byte [edi + 0x3a8], cl
jmp 0x408ca1
cmp ecx, 1
jne 0x408e54
xor edx, edx
mov word [edi + 0x26c], dx
push 0
push 0x168
push 0x1c2
push 0
push 0
push eax
push 0x96c80000
push str._Y_Y_vwGS
push 0
mov ecx, edi
call fcn.0042e438
mov ecx, edi
call fcn.0042dad7
cmp word [edi + 0x26c], 0
mov ecx, edi
jne 0x408cdc
push 1
jmp 0x408cde
push 0
call fcn.0042d98f
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004318ea
call fcn.0042ea00
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
call dword [sym.imp.ole32.dll_CoUninitialize]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esp + 0x14]
call fcn.004080f0
test eax, eax
jne 0x408d29
push esi
call edi
jmp 0x408e5f
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x3d2]
push ecx
mov word [esp + 0x3d4], ax
call fcn.00459f00
add esp, 0xc
push 0x104
lea edx, [esp + 0x3cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._rundll32.exe
lea eax, [esp + 0x3cc]
push 0x104
push eax
call fcn.00458cf6
add esp, 0xc
lea ecx, [esp + 0x3c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408db6
push 0x104
lea edx, [esp + 0x3cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._rundll32.exe
lea eax, [esp + 0x3cc]
push 0x104
push eax
call fcn.00458cf6
add esp, 0xc
xor ecx, ecx
push 0x40e
push ecx
lea edx, [esp + 0x9ea]
push edx
mov word [esp + 0x9ec], cx
call fcn.00459f00
mov eax, dword [esp + 0x118]
add esp, 0xc
cmp dword [esp + 0x120], ebx
jae 0x408ded
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0x3cc]
push eax
push str._s_SelfDelete.dll__FinishUpdate_16_2__s_ttkupd.exe_config
lea ecx, [esp + 0x9ec]
push 0x208
push ecx
call fcn.00458e0b
add esp, 0x14
push 0x44
lea edx, [esp + 0x34]
push 0
push edx
call fcn.00459f00
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0xa00]
push edx
push 0
mov dword [esp + 0x84], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x408e5f
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x108]
call fcn.00408f30
mov ecx, dword [esp + 0x15f4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00457a79
mov esp, ebp
pop ebp
ret 0x10