Function at 0x408010
Capabilities:
Accept command line arguments
Get session user name
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x73c
and byte [0x4241e0], 0
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [0x420b1c], edi
mov dword [0x420b20], edi
mov dword [ebp - 0xc], edi
mov word [0x424300], di
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str.system.ini
mov esi, 0x423fa0
push 0x103
push esi
push str.progman.exe
push str.shell
push str.boot
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call dword [sym.imp.USER32.dll_CharLowerA]
and byte [0x423860], 0
mov dword [0x423e68], edi
mov word [0x423c60], di
cmp byte [ebx], 0x22
push 0x20
pop edi
jne 0x4080a9
lea eax, [ebx + 1]
push 0x22
push eax
call fcn.00413320
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4080c0
inc esi
cmp byte [esi], 0x20
jne 0x4080c9
jmp 0x4080a1
push edi
push ebx
call fcn.00413320
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4080c0
cmp byte [esi], 0x20
jne 0x4080c9
inc esi
jmp 0x4080b8
push ebx
call fcn.0040918f
pop ecx
mov esi, eax
mov al, byte [esi]
cmp al, 0x2f
jne 0x408233
cmp dword [0x423800], 0
je 0x40814d
cmp byte [esi + 1], 0x50
jne 0x40814d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], 0x22
jne 0x40810a
lea eax, [esi + 2]
push 0x22
push eax
call fcn.00413ce4
pop ecx
test eax, eax
pop ecx
je 0x408120
inc eax
inc eax
cmp word [eax], di
jne 0x40812a
jmp 0x408101
push edi
push esi
call fcn.00413ce4
pop ecx
test eax, eax
pop ecx
je 0x408120
cmp word [eax], di
jne 0x40812a
inc eax
inc eax
jmp 0x408117
push esi
call fcn.00413733
pop ecx
lea eax, [esi + eax*2]
test eax, eax
je 0x408145
cmp word [eax], 0x2f
jne 0x408145
cmp word [eax + 2], 0x50
jne 0x408145
add eax, 4
push eax
call fcn.0040be15
pop ecx
push 1
pop eax
jmp 0x408bbf
cmp al, 0x20
je 0x408233
movsx eax, byte [esi + 1]
inc esi
cmp eax, 0x4c
mov bl, byte [esi + 1]
lea ecx, [esi + 1]
mov dword [ebp - 4], ecx
jg 0x4082cb
je 0x40829a
sub eax, 0x41
je 0x40827b
sub eax, 3
je 0x408263
dec eax
dec eax
je 0x408257
dec eax
je 0x40823f
dec eax
je 0x40820f
dec eax
je 0x4081ad
dec eax
dec eax
jne 0x408229
mov dword [0x420b24], 1
jmp 0x408229
cmp bl, 0x31
jne 0x4081be
mov dword [0x420b0c], 1
jmp 0x4081ca
cmp bl, 0x30
jne 0x4081cc
and dword [0x41c04c], 0
mov esi, ecx
cmp byte [esi + 1], 0x22
jne 0x408229
cmp byte [esi + 2], 0x22
lea eax, [esi + 2]
je 0x408229
mov esi, eax
push 0x22
push esi
call fcn.00413320
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x408229
and byte [ebx], 0
cmp byte [esi], 0
je 0x408208
push 0x102
push esi
push 0x4241e0
call fcn.0040c63d
add esp, 0xc
mov byte [ebx], 0x22
mov esi, ebx
jmp 0x408229
cmp bl, 0x30
je 0x408291
push 1
pop eax
mov dword [0x420b20], eax
mov dword [0x420b1c], eax
cmp bl, 0x31
jne 0x408229
mov esi, dword [ebp - 4]
mov al, byte [esi]
test al, al
jne 0x40814d
cmp byte [esi], 0x20
jne 0x4084d5
inc esi
jmp 0x408233
cmp bl, 0x30
mov dword [0x41c058], 1
jne 0x408221
and dword [0x41c058], 0
jmp 0x408226
mov dword [0x420b14], 1
jmp 0x408229
cmp bl, 0x30
mov dword [0x41c05c], 1
jne 0x408221
and dword [0x41c05c], 0
jmp 0x408226
cmp bl, 0x30
mov dword [0x420b1c], 1
jne 0x408221
and dword [0x420b1c], 0
and dword [0x420b20], 0
jmp 0x408226
xor eax, eax
mov dword [0x41c050], eax
cmp bl, 0x30
jl 0x408229
cmp bl, 0x39
jg 0x408229
mov esi, dword [ebp - 4]
lea eax, [eax + eax*4]
movsx ecx, bl
lea eax, [ecx + eax*2 - 0x30]
lea ecx, [esi + 1]
mov dword [0x41c050], eax
mov dword [ebp - 4], ecx
mov bl, byte [ecx]
jmp 0x4082a1
sub eax, 0x4d
je 0x4084b6
dec eax
je 0x4083b4
sub eax, 4
je 0x4083a8
dec eax
je 0x40839c
push 2
pop ecx
sub eax, ecx
je 0x40837d
sub eax, ecx
je 0x40834e
sub eax, 3
jne 0x408229
cmp bl, 0x22
jne 0x408229
cmp byte [esi + 2], 0
lea eax, [esi + 2]
je 0x408229
mov esi, eax
push 0x22
push esi
call fcn.00413320
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x408229
and byte [edi], 0
push 0x103
push esi
push 0x423860
call fcn.0040c63d
add esp, 0xc
mov byte [edi], bl
mov esi, edi
jmp 0x408229
cmp bl, 0x30
mov dword [0x41c068], 1
jne 0x408369
and dword [0x41c068], 0
jmp 0x408226
cmp bl, 0x32
jne 0x408221
mov dword [0x41c068], ecx
jmp 0x408221
cmp bl, 0x30
mov dword [0x41c060], 1
jne 0x408221
and dword [0x41c060], 0
jmp 0x408226
and dword [0x41c048], 0
jmp 0x408229
and dword [0x41c044], 0
jmp 0x408229
cmp bl, 0x22
jne 0x40840b
mov cl, byte [esi + 2]
lea eax, [esi + 2]
cmp cl, 0x2a
je 0x40840b
cmp cl, bl
je 0x40840b
mov esi, eax
push 0x22
push esi
call fcn.00413320
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x408229
and byte [edi], 0
push 0x103
push esi
mov esi, 0x424300
push esi
call fcn.0040c7b3
mov dword [0x4240ac], esi
add esp, 0xc
mov byte [edi], bl
mov esi, edi
mov dword [ebp - 0xc], 1
jmp 0x408229
cmp dword [0x423800], 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x207
push eax
je 0x408434
mov edi, 0x424300
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x40845b
lea eax, [ebp - 0x73c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x73c]
push 0x103
mov edi, 0x424300
push eax
push edi
call fcn.0040c7b3
add esp, 0xc
cmp dword [0x4240a4], 0
mov dword [0x4240ac], edi
je 0x40846f
call fcn.00408bc4
cmp bl, 0x2a
je 0x408487
cmp bl, 0x22
jne 0x40847f
cmp byte [esi + 2], 0x2a
je 0x408487
mov dword [0x4240ac], edi
jmp 0x40848e
and dword [0x4240ac], 0
cmp bl, 0x22
jne 0x4084ae
inc esi
push 0x22
inc esi
push esi
call fcn.00413320
pop ecx
test eax, eax
pop ecx
je 0x408229
mov esi, eax
jmp 0x408229
cmp bl, 0x2a
jmp 0x408224
cmp bl, 0x30
mov dword [0x41c054], 1
jne 0x408221
and dword [0x41c054], 0
jmp 0x408226
cmp byte [esi], 0x2d
jne 0x4084e5
mov dword [0x420b18], 1
inc esi
xor ebx, ebx
cmp esi, ebx
je 0x408570
cmp byte [esi], bl
je 0x408570
mov edi, 0x103
lea eax, [ebp - 0x238]
push edi
push esi
push eax
call fcn.00413ac0
lea eax, [ebp - 0x238]
push eax
call fcn.0040918f
add esp, 0x10
dec eax
cmp byte [eax], 0x22
jne 0x408536
and byte [eax], bl
lea eax, [ebp - 0x238]
push 0x22
push eax
call fcn.00413670
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x408536
inc esi
jmp 0x40853c
lea esi, [ebp - 0x238]
push esi
call fcn.00409228
pop ecx
cmp eax, 1
push edi
push esi
jne 0x408559
push 0x423860
call fcn.0040c63d
add esp, 0xc
jmp 0x408575
mov esi, 0x423580
push esi
call fcn.0040c63d
push edi
push esi
call fcn.00405302
add esp, 0x14
jmp 0x408575
mov edi, 0x103
cmp byte [0x423860], 0
mov esi, 0x423c60
jne 0x4085ac
cmp dword [0x423800], ebx
push edi
je 0x40859b
push esi
push dword [0x423968]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x4085ac
push 0x423860
push dword [0x423968]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x134]
push eax
push esi
push 0x423860
call fcn.0040a468
add esp, 0xc
test eax, eax
jne 0x40892c
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x130]
jne 0x408915
lea eax, [ebp - 0x120]
push str.install.cab
push eax
call fcn.004139a0
pop ecx
test eax, eax
pop ecx
jne 0x40861e
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
pop ecx
mov ecx, dword [ebp - 0x128]
lea eax, [eax + ecx + 0x1e]
mov dword [0x41c06c], eax
mov eax, dword [ebp - 0x130]
mov dword [0x41c070], eax
jmp 0x408915
lea eax, [ebp - 0x120]
push str.install.inf
push eax
call fcn.004139a0
pop ecx
test eax, eax
pop ecx
jne 0x40869f
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
mov ecx, dword [ebp - 0x128]
lea ebx, [eax + ecx + 0x1e]
mov eax, dword [ebp - 0x130]
inc eax
push eax
call fcn.00413c32
push dword [ebp - 0x130]
mov dword [0x420b30], eax
push eax
push ebx
push esi
push 0x423860
call fcn.0040a673
mov ecx, dword [ebp - 0x130]
add esp, 0x1c
cmp eax, ecx
jne 0x408687
mov eax, dword [0x420b30]
jmp 0x40887a
push dword [0x420b30]
call fcn.00413bc9
and dword [0x420b30], 0
pop ecx
jmp 0x408915
lea eax, [ebp - 0x120]
push str.install64.inf
push eax
call fcn.004139a0
pop ecx
test eax, eax
pop ecx
jne 0x408717
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
mov ecx, dword [ebp - 0x128]
lea ebx, [eax + ecx + 0x1e]
mov eax, dword [ebp - 0x130]
inc eax
push eax
call fcn.00413c32
push dword [ebp - 0x130]
mov edi, eax
mov dword [ebp - 0x10], edi
push edi
push ebx
push esi
push 0x423860
call fcn.0040a673
mov ecx, dword [ebp - 0x130]
add esp, 0x1c
cmp eax, ecx
jne 0x408707
and byte [ecx + edi], 0
jmp 0x408915
push edi
call fcn.00413bc9
and dword [ebp - 0x10], 0
pop ecx
jmp 0x408915
lea eax, [ebp - 0x120]
push str.install.lng
push eax
call fcn.004139a0
pop ecx
test eax, eax
pop ecx
jne 0x408798
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
mov ecx, dword [ebp - 0x128]
lea ebx, [eax + ecx + 0x1e]
mov eax, dword [ebp - 0x130]
inc eax
push eax
call fcn.00413c32
push dword [ebp - 0x130]
mov dword [0x420b2c], eax
push eax
push ebx
push esi
push 0x423860
call fcn.0040a673
mov ecx, dword [ebp - 0x130]
add esp, 0x1c
cmp eax, ecx
jne 0x408780
mov eax, dword [0x420b2c]
jmp 0x40887a
push dword [0x420b2c]
call fcn.00413bc9
and dword [0x420b2c], 0
pop ecx
jmp 0x408915
lea eax, [ebp - 0x120]
push str.liesmich.txt
push eax
call fcn.004139a0
pop ecx
test eax, eax
pop ecx
jne 0x408816
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
mov ecx, dword [ebp - 0x128]
lea ebx, [eax + ecx + 0x1e]
mov eax, dword [ebp - 0x130]
inc eax
push eax
call fcn.00413c32
push dword [ebp - 0x130]
mov dword [0x420b34], eax
push eax
push ebx
push esi
push 0x423860
call fcn.0040a673
mov ecx, dword [ebp - 0x130]
add esp, 0x1c
cmp eax, ecx
jne 0x4087fe
mov eax, dword [0x420b34]
jmp 0x40887a
push dword [0x420b34]
call fcn.00413bc9
and dword [0x420b34], 0
pop ecx
jmp 0x408915
lea eax, [ebp - 0x120]
push str.readme.txt
push eax
call fcn.004139a0
pop ecx
test eax, eax
pop ecx
jne 0x408898
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
mov ecx, dword [ebp - 0x128]
lea ebx, [eax + ecx + 0x1e]
mov eax, dword [ebp - 0x130]
inc eax
push eax
call fcn.00413c32
push dword [ebp - 0x130]
mov dword [0x420b38], eax
push eax
push ebx
push esi
push 0x423860
call fcn.0040a673
mov ecx, dword [ebp - 0x130]
add esp, 0x1c
cmp eax, ecx
jne 0x408883
mov eax, dword [0x420b38]
and byte [eax + ecx], 0
jmp 0x408915
push dword [0x420b38]
call fcn.00413bc9
and dword [0x420b38], 0
pop ecx
jmp 0x408915
cmp dword [0x420b44], 0x10
jge 0x408915
lea eax, [ebp - 0x120]
push eax
call fcn.00413210
inc eax
push eax
call fcn.00413c32
mov ecx, dword [0x420b44]
mov dword [ecx*4 + 0x423ac0], eax
lea ecx, [ebp - 0x120]
push ecx
push eax
call fcn.00413500
mov eax, dword [0x420b44]
mov edi, eax
lea eax, [ebp - 0x120]
push eax
shl edi, 2
call fcn.00413210
mov ecx, dword [ebp - 0x128]
add esp, 0x14
inc dword [0x420b44]
lea eax, [eax + ecx + 0x1e]
mov dword [edi + 0x422c20], eax
mov eax, dword [ebp - 0x130]
mov dword [edi + 0x423820], eax
mov eax, dword [ebp - 0x134]
mov dword [edi + 0x422da0], eax
lea eax, [ebp - 0x134]
push eax
call fcn.0040a648
test eax, eax
pop ecx
je 0x4085c9
xor ebx, ebx
lea eax, [ebp - 0x134]
push eax
call fcn.0040a450
mov esi, dword [ebp - 0x10]
pop ecx
cmp esi, ebx
je 0x40896a
call fcn.0040c803
test eax, eax
je 0x40896a
mov eax, dword [0x420b30]
cmp eax, ebx
je 0x408959
push eax
call fcn.00413bc9
pop ecx
push 1
mov dword [0x420b30], esi
pop edi
mov dword [0x420b3c], edi
jmp 0x40896d
push 1
pop edi
push 2
mov esi, str.auto
push ebx
push esi
push esi
call fcn.004011d0
add esp, 0x10
test eax, eax
je 0x408989
mov dword [0x420b1c], edi
cmp dword [0x420b1c], ebx
je 0x4089cb
push 2
push ebx
push str.hidden
push esi
call fcn.004011d0
add esp, 0x10
test eax, eax
je 0x4089ac
mov dword [0x420b20], edi
cmp dword [0x41c060], 0xffffffff
jne 0x4089cb
push 2
push ebx
push str.update
push esi
call fcn.004011d0
add esp, 0x10
mov dword [0x41c060], eax
push 2
lea eax, [ebp - 0x33c]
push 0x102
mov edi, 0x420b98
push eax
push edi
mov esi, 0x41c25c
push str.Program
push esi
call fcn.0040105a
lea eax, [ebp - 0x33c]
push 0x41caf4
push eax
call fcn.00413510
push 2
mov ebx, 0x423540
push 0x1f
push ebx
push edi
push str.Progver
push esi
call fcn.0040105a
push 0x103
lea eax, [ebp - 0x33c]
push ebx
push eax
call fcn.0040c6bc
add esp, 0x44
push 2
push 0x103
push 0x4240c0
push edi
push 0x41cca0
push esi
call fcn.0040105a
mov ebx, 0x423420
push str.Installation
push ebx
call fcn.00413500
lea eax, [ebp - 0x33c]
push 0x103
push eax
push ebx
call fcn.0040c6bc
push 2
push 0x103
push 0x423980
push edi
push str.ProgName
push esi
call fcn.0040105a
add esp, 0x44
cmp dword [0x420b1c], 0
je 0x408ad2
cmp dword [0x41c060], 1
jne 0x408ad2
call fcn.0040681a
call fcn.00406831
xor ebx, ebx
push ebx
call fcn.0040255a
cmp eax, 6
pop ecx
jne 0x408aca
cmp dword [0x41c058], 0xffffffff
jne 0x408ab9
mov dword [0x41c058], ebx
cmp dword [0x41c05c], 0xffffffff
jne 0x408ad4
mov dword [0x41c05c], ebx
jmp 0x408ad4
mov dword [0x41c060], ebx
jmp 0x408ad4
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
jne 0x408bb5
mov word [0x424300], bx
mov ebx, 0x103
push 2
lea eax, [ebp - 0x238]
push ebx
push eax
push edi
push str.UserName
push esi
call fcn.0040105a
add esp, 0x18
cmp byte [ebp - 0x238], 0
je 0x408b40
lea eax, [ebp - 0x238]
push 0x41caf8
push eax
call fcn.00413a30
pop ecx
test eax, eax
pop ecx
je 0x408b40
lea eax, [ebp - 0x238]
push ebx
mov esi, 0x424300
push eax
push esi
call fcn.0040c7b3
add esp, 0xc
mov dword [0x4240ac], esi
jmp 0x408bb5
cmp dword [0x423800], 0
mov dword [ebp - 8], ebx
je 0x408b5e
lea eax, [ebp - 8]
mov esi, 0x424300
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x408b8e
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x3ff
push eax
lea eax, [ebp - 0x73c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push dword [ebp - 8]
lea eax, [ebp - 0x73c]
mov esi, 0x424300
push eax
push esi
call fcn.0040c7b3
add esp, 0xc
cmp dword [0x4240a4], 0
mov dword [0x4240ac], esi
je 0x408ba2
call fcn.00408bc4
mov al, byte [ebp - 0x238]
sub al, 0x2a
neg al
sbb eax, eax
and eax, esi
mov dword [0x4240ac], eax
call fcn.0040a6e3
call fcn.004056a8
pop edi
pop esi
pop ebx
leave
ret