Function at 0x41b510
Capabilities:
Accept command line arguments
Create directory
Get common file path
Log keystrokes via polling
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
mov eax, dword [0x43c040]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
call fcn.0041b450
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x43e0b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
sub esp, 0xc
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x8c]
call fcn.00412450
lea eax, [esp + 0x48]
mov dword [esp + 0x88], 1
push eax
mov eax, ecx
mov dword [esp + 0x24], ebx
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], ebx
push eax
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x41b59f
lea eax, [esp + 0x1c]
push eax
call dword [esp + 0x4c]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0xc], eax
test eax, eax
je 0x41b650
mov esi, 1
cmp dword [esp + 0x18], esi
jle 0x41b649
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edi, [esi + 1]
push str._lang
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x41b601
cmp edi, dword [esp + 0x18]
jge 0x41b639
mov eax, dword [esp + 0xc]
inc esi
inc edi
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
movzx eax, ax
mov dword [esp + 0x14], eax
jmp 0x41b639
mov eax, dword [esp + 0xc]
push str._start
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x41b61d
mov dword [esp + 0x10], 1
jmp 0x41b639
mov eax, dword [esp + 0xc]
push str._activate
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x41b639
mov dword [0x43e0dc], 1
mov eax, dword [esp + 0xc]
inc esi
inc edi
cmp esi, dword [esp + 0x18]
jl 0x41b5d5
mov ebx, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x90]
push eax
push 1
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x90]
push 0x436718
push eax
call edi
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x90]
call fcn.0040ef00
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41b6ab
push 0
lea eax, [esp + 0x94]
push eax
call esi
push str.json
lea eax, [esp + 0x94]
push eax
call edi
lea ecx, [esp + 0x90]
call fcn.0040ef00
test eax, eax
jne 0x41b6d5
push eax
lea eax, [esp + 0x94]
push eax
call esi
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x437ccc
lea eax, [esp + 0x94]
push eax
call edi
lea ecx, [esp + 0x90]
call fcn.0040ef00
test eax, eax
jne 0x41b70d
push eax
lea eax, [esp + 0x94]
push eax
call esi
call fcn.0040ee70
push 0xa
push 0x10
mov esi, eax
push 0x43e0bc
push esi
call fcn.0041eff8
add esp, 0x10
mov ecx, 0x43d600
xor edi, edi
call fcn.00412ae0
test eax, eax
jne 0x41b754
mov ecx, 0x43d600
call fcn.00413140
test bx, bx
je 0x41b74c
mov word [0x43d602], bx
mov dword [0x43d688], esi
jmp 0x41b7ae
mov eax, 0x99
cmp word [0x43d600], ax
je 0x41b76d
mov word [0x43d600], ax
mov edi, 1
test bx, bx
je 0x41b787
cmp bx, word [0x43d602]
je 0x41b787
mov word [0x43d602], bx
mov edi, 1
cmp esi, dword [0x43d688]
je 0x41b7aa
cmp dword [0x43d604], 0
mov dword [0x43d688], esi
je 0x41b7aa
mov dword [0x43d604], 0
jmp 0x41b7ae
test edi, edi
je 0x41b7bf
push 0
xor edx, edx
mov ecx, 0x43d600
call fcn.00412490
add esp, 4
mov ecx, 0x10
mov eax, 0x43d5e8
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x41b7d0
cmp dword [0x43d604], ecx
nop
nop
nop
nop
nop
nop
cmp word [0x43d608], cx
nop
nop
nop
nop
nop
nop
mov dword [0x43c904], ecx
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x41ba4b
push 0x1004
call fcn.0041be18
add esp, 4
mov ecx, eax
call fcn.00412470
mov dword [0x43e0a0], eax
movzx eax, word [0x43d602]
push ecx
push eax
call fcn.004117f0
movzx eax, ax
push eax
push ecx
call fcn.00411550
mov eax, dword [0x43e0b8]
xorps xmm0, xmm0
push 0x1f4
push eax
movlpd qword [esp + 0x64], xmm0
mov dword [esp + 0x7c], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x80], str.DLNow_Main
mov dword [esp + 0x60], 0x41a8e0
mov dword [esp + 0x5c], 8
mov dword [esp + 0x58], 0x30
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f00
push esi
mov dword [esp + 0x70], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push esi
mov dword [esp + 0x70], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
mov dword [esp + 0x14], eax
test ax, ax
je 0x41ba4b
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
sub eax, 0x2fd
cdq
sub eax, edx
mov edi, eax
push 1
sar edi, 1
call esi
push 0
push dword [0x43e0b8]
sub eax, 0x244
push 0
push 0
cdq
push 0x244
sub eax, edx
push 0x2fd
sar eax, 1
sub eax, 0x28
push eax
push edi
push 0x108f0000
push str.DLNow_Video_Downloader_1.53
push dword [esp + 0xa0]
push 0x40100
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0
mov dword [0x43d5fc], eax
lea eax, [esp + 0x34]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x41ba33
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x43e0ac], 0
je 0x41bb1e
cmp dword [esp + 0x30], 0x100
jne 0x41bb1e
cmp dword [esp + 0x34], 0x56
jne 0x41b9e0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x41b9e0
push 0
push 0
push 0x302
push dword [0x43d5fc]
call esi
jmp 0x41ba1a
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
call fcn.00402770
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x41bad8
mov ecx, dword [esp + 0x34]
cmp ecx, 9
jne 0x41bab2
push dword [0x43e0a8]
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x41b941
push dword [0x43e0b8]
mov eax, dword [esp + 0x18]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x24], 0
jne 0x41ba64
push dword [esp + 0x1c]
call dword [esp + 0x50]
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov ecx, dword [0x43e0a0]
test ecx, ecx
je 0x41ba74
push ecx
call fcn.0041bbc0
call fcn.0041b4f0
test esi, esi
je 0x41bb53
push 0x104
lea eax, [esp + 0x94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41bb9b
sub esp, 0xc
lea ecx, [esp + 0x9c]
call fcn.0040fb50
jmp 0x41bb98
cmp ecx, 0x28
je 0x41bac1
cmp ecx, 0x26
je 0x41bac1
cmp ecx, 0x2e
jne 0x41bb18
push dword [esp + 0x38]
push ecx
push dword [esp + 0x38]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
jmp 0x41ba1a
mov eax, dword [esp + 0x34]
cmp eax, 0x28
je 0x41ba14
cmp eax, 0x26
jne 0x41bb18
push edi
push dword [0x43e0a8]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x41ba14
mov ecx, dword [0x43e0ac]
call fcn.004014d0
test eax, eax
jle 0x41ba14
push esi
jmp 0x41ba12
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x41ba1a
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x41ba1a
cmp dword [0x43e0e0], 0
je 0x41bb9b
push 0x104
lea eax, [esp + 0x94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41bb9b
xor eax, eax
lea ecx, [esp + 0x90]
cmp dword [0x43e0e0], 2
mov edx, str._activate
push 0
push 5
push 0
cmovne edx, eax
call fcn.00410220
add esp, 0xc
cmp dword [esp + 0x28], 0
jl 0x41bba8
call dword [sym.imp.ole32.dll_OleUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]