Function at 0x40808a
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Get common file path
Set registry value
Shutdown system

Disassembly:
mov eax, 0x42ca3e
call fcn.00421904
sub esp, 0x748
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x441fe4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x441fe0], eax
mov esi, 0x437ea8
lea eax, [ebp - 0x240]
xor ebx, ebx
push esi
push eax
mov byte [ebp - 0x18], bl
call fcn.00420680
mov edi, str._setup
push edi
push dword [ebp + 0x10]
call fcn.00420a80
add esp, 0x10
cmp eax, ebx
je 0x408132
lea ecx, [ebp - 0x240]
add eax, 7
push ecx
push str.____t___260___
push eax
call fcn.004209be
add esp, 0xc
cmp eax, 1
jge 0x408108
lea eax, [ebp - 0x240]
push esi
push eax
call fcn.00420680
jmp 0x408130
lea eax, [ebp - 0x240]
push eax
call fcn.00420cc0
cmp byte [ebp + eax - 0x241], 0x5c
pop ecx
je 0x408132
lea eax, [ebp - 0x240]
push 0x432a4c
push eax
call fcn.00420690
pop ecx
pop ecx
push str.chinaddrmainmutexstr
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x44222c], eax
je 0x4083d7
mov esi, str._forcerun
push esi
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
jne 0x408181
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408181
push edi
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x4081da
mov byte [ebp - 0x18], 1
push str._addscut
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x4081a5
mov ecx, 0x439d88
call fcn.0041f7ad
push eax
call fcn.004172f0
pop ecx
call fcn.0040ad40
mov ecx, 0x439d88
call fcn.0041e77b
test eax, eax
setne al
mov byte [0x4421d1], al
call fcn.0040ba22
call fcn.0040a221
test eax, eax
jne 0x408281
call fcn.0040a23c
jmp 0x4083d7
push str._uninstall
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
jne 0x408181
push dword [0x44222c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CnsMainWndTitleStr
push str.CnsMainWndClassStr
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
cmp edi, ebx
je 0x4083d7
push str._setting
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x408236
push ebx
push ebx
push 0x2409
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x408279
push str._nosplash
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
pop ecx
test eax, eax
push ebx
je 0x40825e
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push 0x2402
push edi
call esi
push ebx
push 1
jmp 0x408271
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 1
push 0x2402
push edi
call esi
push ebx
push 3
push 0x2413
push edi
call esi
push 1
pop eax
jmp 0x408809
push dword [ebp + 8]
call fcn.00408818
test ax, ax
pop ecx
je 0x4081d0
call fcn.0040aa43
test eax, eax
jne 0x4082b8
push 0x17
push dword [0x441fe4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0040d999
add esp, 0xc
jmp 0x4081d0
push str._uninstall
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x4083de
call fcn.00418096
call fcn.0040a23c
mov al, byte [0x437ea8]
push 0x40
mov byte [ebp - 0x138], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x137]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
lea eax, [ebp - 0x138]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [ebp - 0x138], bl
je 0x40833a
lea eax, [ebp - 0x138]
push eax
call fcn.00420cc0
cmp byte [ebp + eax - 0x139], 0x5c
pop ecx
jne 0x40833a
lea eax, [ebp - 0x138]
push eax
call fcn.00420cc0
pop ecx
mov byte [ebp + eax - 0x139], bl
mov dl, byte [0x437ea8]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x54b]
mov byte [ebp - 0x54c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x447]
mov byte [ebp - 0x448], dl
push str.xuninst.exe
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x138]
mov edi, str._s_s
push eax
push edi
lea eax, [ebp - 0x54c]
push esi
push eax
call fcn.004209f2
lea eax, [ebp - 0x138]
push str.uncns.ini
push eax
push edi
lea eax, [ebp - 0x448]
push esi
push eax
mov byte [ebp - 0x449], bl
call fcn.004209f2
add esp, 0x28
lea eax, [ebp - 0x138]
mov byte [ebp - 0x345], bl
push 5
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x54c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x408809
push 0x439d88
lea ecx, [ebp - 0x14]
call fcn.0041d3fc
push edi
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x40846e
push str.ChinAddrSetupAtomStr
mov byte [ebp + 0x13], bl
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov esi, eax
lea eax, [ebp + 0x13]
push eax
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x18]
call fcn.004168a4
add esp, 0xc
mov edi, eax
call fcn.0040a23c
cmp si, bx
je 0x408436
push esi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
cmp byte [ebp + 0x13], bl
je 0x408452
call fcn.00401ccb
test eax, eax
push ebx
je 0x40844e
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40845b
push 2
jmp 0x408446
cmp edi, ebx
jne 0x40845b
call fcn.004183da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041d42a
mov eax, edi
jmp 0x408809
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00408889
pop ecx
test eax, eax
pop ecx
jne 0x40849b
push 0x18
push dword [0x441fe4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0040d999
add esp, 0xc
jmp 0x408797
call fcn.0041863c
cmp eax, 4
jne 0x4084fd
push str.ChinAddrSetupAtomStr
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov esi, eax
lea eax, [ebp + 0x13]
push eax
lea eax, [ebp - 0x240]
push eax
push ebx
call fcn.004168a4
add esp, 0xc
test eax, eax
jne 0x4084e4
call fcn.0040a23c
cmp si, bx
je 0x4087fb
push esi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
jmp 0x4087fb
call fcn.0040a23c
cmp si, bx
je 0x4084f5
push esi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 1
pop ebx
jmp 0x4087fb
lea ecx, [ebp - 0x14]
call fcn.0041d57d
test eax, eax
jne 0x408510
push 0xb
jmp 0x408481
push esi
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
jne 0x408527
lea ecx, [ebp - 0x14]
call fcn.0041d653
push ebx
call fcn.00403c5e
push esi
push dword [ebp + 0x10]
call fcn.00420a80
add esp, 0xc
test eax, eax
je 0x40862c
push 1
call fcn.00417e28
pop ecx
call fcn.0040bb34
test al, al
je 0x40855a
lea ecx, [ebp - 0x14]
call fcn.0041d688
mov edi, str.xuninst.exe
mov ecx, 0x439d88
push edi
call fcn.0041f7ad
push eax
mov esi, 0x104
push 0x4320f0
lea eax, [ebp - 0x754]
push esi
push eax
call fcn.004209f2
add esp, 0x14
lea eax, [ebp - 0x344]
mov byte [ebp - 0x651], bl
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [ebp - 0x344], bl
je 0x4085cc
lea eax, [ebp - 0x344]
push eax
call fcn.00420cc0
cmp byte [ebp + eax - 0x345], 0x5c
pop ecx
jne 0x4085cc
lea eax, [ebp - 0x344]
push eax
call fcn.00420cc0
pop ecx
mov byte [ebp + eax - 0x345], bl
lea eax, [ebp - 0x344]
push edi
push eax
push str._s_s
lea eax, [ebp - 0x650]
push esi
push eax
call fcn.004209f2
add esp, 0x14
lea eax, [ebp - 0x650]
mov byte [ebp - 0x54d], bl
push ebx
push eax
lea eax, [ebp - 0x754]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.0040bc36
push 1
lea ecx, [ebp - 0x14]
call fcn.0041d4dc
mov ecx, 0x439d88
call fcn.0041f2b9
call fcn.0040bf4d
call fcn.00401040
mov esi, str._forcerun
call fcn.0040b6b3
call fcn.0040b74f
call fcn.0040bb56
call fcn.0040a0c1
test eax, eax
je 0x408797
call fcn.00409feb
test eax, eax
je 0x408797
call fcn.00409a5d
test eax, eax
jne 0x408665
push 0xc
jmp 0x4086ea
call fcn.0040af8e
call fcn.00411b8f
push 0x115c
call fcn.004223d2
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x40868e
mov ecx, eax
call fcn.0040dbdc
jmp 0x408690
xor eax, eax
cmp eax, ebx
mov byte [ebp - 4], bl
mov dword [0x439d80], eax
jne 0x4086a0
push 0x32
jmp 0x4086ea
call fcn.004099bf
test eax, eax
je 0x408797
push esi
push dword [ebp + 0x10]
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x4086c1
call fcn.0040b88d
push 1
call fcn.0040a588
pop ecx
mov ecx, 0x439d88
call fcn.0041f0c6
test al, al
je 0x4086df
push 1
call fcn.00417c1d
pop ecx
call fcn.0040b338
test eax, eax
jne 0x4086f5
push 0x2b
push dword [0x441ffc]
jmp 0x408487
call fcn.00404909
mov edi, dword [ebp + 0x10]
push str._setting
push edi
call fcn.00420a80
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
pop ecx
test eax, eax
pop ecx
je 0x408723
push ebx
push ebx
push 0x2409
push dword [0x441fe8]
call esi
push ebx
push ebx
push 0x2402
push dword [0x441fe8]
call esi
push str._forcerun
push edi
call fcn.00420a80
pop ecx
test eax, eax
pop ecx
je 0x40875c
push ebx
push 5
push 0x2413
push dword [0x441fe8]
call esi
push ebx
push ebx
push 0x241b
jmp 0x408779
push str._nosplash
push edi
call fcn.00420a80
pop ecx
pop ecx
test eax, eax
push ebx
je 0x408772
push 1
jmp 0x408774
push 2
push 0x2413
push dword [0x441fe8]
call esi
push str._register
push edi
call fcn.00420a80
pop ecx
pop ecx
call fcn.004090b8
test eax, eax
jne 0x40879e
call fcn.0040a23c
jmp 0x4087fb
call fcn.0040aebc
cmp byte [0x4421c6], bl
je 0x4087be
mov eax, dword [0x441fe8]
cmp eax, ebx
je 0x4087be
push ebx
push ebx
push 0x2414
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x34]
push ebx
push eax
call esi
test eax, eax
je 0x4087ee
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x34]
push ebx
push eax
jmp 0x4087cb
call fcn.0040497a
call fcn.0040a23c
mov ebx, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0041d42a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret