Function at 0x415d17
Capabilities:
Accept command line arguments
Check if file exists
Create thread
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1868
call fcn.00420e10
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov esi, ecx
call section..text
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
test edx, edx
je 0x4161bb
and word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push 0x103
push eax
push str._unpath:
push edx
call fcn.00402ad1
add esp, 0x10
test eax, eax
je 0x4161bb
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4161bb
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x210]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [esi + 0x3c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
lea edi, [esi + 0x2c]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
and word [ebp - 0x1250], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x124e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push str.User_DataDefault
push eax
lea eax, [ebp - 0x1250]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1250]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x1250]
push eax
lea ecx, [esi + 0x4c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x415e39
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
mov ecx, esi
call fcn.004167fd
and word [ebp - 0x418], 0
mov edx, eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
mov dword [esi + 0x18], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
lea eax, [ebp - 0x418]
neg edx
sbb edx, edx
push edi
and edx, 0xffffffeb
add edx, 0x17
push edx
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4161bb
lea eax, [ebp - 0x418]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [esi + 0x5c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
mov word [ebp - 0x828], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x826]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push 0x42b81c
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x828]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x828]
push eax
lea ecx, [esi + 0x6c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xe3e]
mov word [ebp - 0xe40], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x18]
neg eax
sbb eax, eax
and al, 0xf5
add eax, 0x16
push eax
lea eax, [ebp - 0xe40]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4161bb
lea eax, [ebp - 0xe40]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0xe40]
push eax
lea ecx, [esi + 0x7c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x165e]
mov word [ebp - 0x1660], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x18]
neg eax
sbb eax, eax
and al, 0xf7
add eax, 0x19
push eax
lea eax, [ebp - 0x1660]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4161bb
lea eax, [ebp - 0x1660]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x1660]
push eax
lea ecx, [esi + 0x8c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61e]
mov word [ebp - 0x620], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x620]
push 0x1a
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4161bb
and word [ebp - 0xa30], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x620]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xa30]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0xa30]
push eax
lea ecx, [esi + 0x9c]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
and word [ebp - 0xc38], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc36]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x620]
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
push eax
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc38]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0xc38]
push eax
lea ecx, [esi + 0xac]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
and word [ebp - 0x1048], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1046]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x620]
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedStartMenu
push eax
lea eax, [ebp - 0x1048]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1048]
push eax
call ebx
pop ecx
push eax
lea eax, [ebp - 0x1048]
push eax
lea ecx, [esi + 0xbc]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
and word [ebp - 0x1458], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1456]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1458]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4161bb
lea eax, [ebp - 0x1458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
and word [ebp - 0x1868], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1866]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_time]
pop ecx
push eax
lea eax, [ebp - 0x1458]
push eax
push str._sjuzi__d
lea eax, [ebp - 0x1868]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x1868]
push eax
call ebx
add esp, 0x18
lea ecx, [esi + 0x1c]
push eax
lea eax, [ebp - 0x1868]
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
lea eax, [esi + 4]
xor ebx, ebx
push eax
push 4
push esi
push 0x4161c3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4161bb
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebp - 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x3e8
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 4]
mov dword [esi + 0xc], ebx
call edi
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret