Function at 0x4028af
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create directory
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4acd07
mov eax, dword fs:[0]
push eax
mov eax, 0x8084
call fcn.00488010
mov eax, dword [0x4f8560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
or dword [ebp - 0x8078], 0xffffffff
lea eax, [ebp - 0x8090]
xor ebx, ebx
mov dword [ebp - 0x8090], 8
push eax
mov dword [ebp - 0x806c], ebx
mov dword [ebp - 0x8080], ebx
mov dword [edi + 0xf4], ebx
mov dword [ebp - 0x8084], ebx
mov dword [ebp - 0x808c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.004640f7
push ebx
push 0x4f9d58
push 0x4fe6e0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x104
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.00489480
lea ebx, [edi + 0xe8]
mov dword [ebp - 0x8060], ebx
lea esi, [edi + 0xec]
pop ecx
pop ecx
test eax, eax
je 0x4029bb
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x420]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.00402266
lea eax, [ebp - 0x420]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
call fcn.00402266
push 0x4ca068
call fcn.0048cb73
pop ecx
push eax
push 0x4ca068
mov ecx, ebx
call fcn.00403393
push str.DiskInfo.txt
call fcn.0048cb73
pop ecx
push eax
push str.DiskInfo.txt
mov ecx, esi
call fcn.00403393
lea ecx, [ebp - 0x8074]
call fcn.0040364a
and dword [ebp - 4], 0
push dword [ebx]
push 0
push str.DebugMode
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
push 2
pop eax
cmp eax, ecx
push ecx
sbb eax, eax
not eax
and eax, ecx
mov dword [0x4fe968], eax
lea eax, [ebp - 0x8074]
push 0x4ca738
push eax
call fcn.00403636
add esp, 0xc
push dword [ebx]
push dword [ebp - 0x8074]
push str.DebugMode
push str.Setting
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
and dword [ebp - 0x8068], 0
lea eax, [ebp - 0x8068]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x8068], 1
mov ebx, eax
mov dword [ebp - 0x807c], ebx
jle 0x402be1
lea ecx, [ebp - 0x8064]
call fcn.0040364a
mov byte [ebp - 4], 1
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x402a97
xor eax, eax
jmp 0x402a9e
push ebx
call fcn.0048cb73
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x8064]
call fcn.00402266
push str._Earthlight
push dword [ebp - 0x8064]
call fcn.0048cff9
pop ecx
pop ecx
test eax, eax
jne 0x402ae9
cmp dword [ebp - 0x8068], 2
mov dword [ebp - 0x806c], 1
jle 0x402ae9
mov eax, dword [ebp - 0x807c]
push dword [eax + 8]
call fcn.00490f02
pop ecx
mov dword [ebp - 0x8078], eax
push str._Startup
push dword [ebp - 0x8064]
call fcn.0048cff9
pop ecx
pop ecx
test eax, eax
jne 0x402b60
mov eax, dword [ebp - 0x8060]
push dword [eax]
push 0x1e
push str.StartupWaitTime
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
js 0x402b2a
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0x944]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push ebx
push ebx
lea eax, [ebp - 0x944]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x8064]
jmp 0x4031f5
push str._Exit
push dword [ebp - 0x8064]
call fcn.0048cff9
pop ecx
pop ecx
test eax, eax
jne 0x402b80
mov dword [ebp - 0x8080], 1
push str._Copy
push dword [ebp - 0x8064]
call fcn.0048cff9
lea ebx, [edi + 0xf0]
pop ecx
pop ecx
test eax, eax
jne 0x402ba4
push esi
mov ecx, ebx
call fcn.00401ffd
push str._CopyExit
push dword [ebp - 0x8064]
call fcn.0048cff9
pop ecx
pop ecx
test eax, eax
jne 0x402bcc
push esi
mov ecx, ebx
call fcn.00401ffd
mov dword [edi + 0xf4], 1
xor ebx, ebx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x8064]
add ecx, 0xfffffff0
call fcn.0040259b
jmp 0x402be3
xor ebx, ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x8060], esp
push str.8.14.0
call fcn.00402306
mov byte [ebp - 4], 5
mov byte [ebp - 4], bl
call fcn.0043bfae
mov ecx, esp
mov dword [ebp - 0x807c], esp
push str.2022_01_15
call fcn.00402306
mov byte [ebp - 4], 6
mov byte [ebp - 4], bl
call fcn.0043bfae
cmp dword [ebp - 0x806c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
jne 0x402c92
push ecx
mov ecx, esp
mov dword [ebp - 0x8060], esp
push str.CreateMutex
call fcn.00402306
mov byte [ebp - 4], 7
mov byte [ebp - 4], bl
call fcn.0043bfae
mov dword [esp], 0x4ca17c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x8084], eax
call esi
cmp eax, 0xb7
jne 0x402c92
push ecx
mov ecx, esp
mov dword [ebp - 0x8060], esp
push str.ERROR_ALREADY_EXISTS
call fcn.00402306
mov byte [ebp - 4], 8
mov byte [ebp - 4], bl
call fcn.0043bfae
pop ecx
jmp 0x4031fd
lea ecx, [ebp - 0x8088]
call fcn.0040364a
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x8070]
call fcn.0040364a
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00489480
pop ecx
pop ecx
test eax, eax
je 0x402cdc
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [edi + 0xd8]
push 0x4ca1c8
push eax
call fcn.00403636
push str.CdiResource_themes_
lea ecx, [ebp - 0x218]
mov ebx, str._s_s
push ecx
lea eax, [edi + 0xf8]
push ebx
push eax
call fcn.00403636
push str.CdiResourcelanguage_
lea ecx, [ebp - 0x218]
push ecx
lea eax, [edi + 0xfc]
push ebx
push eax
call fcn.00403636
push str.CdiResourcegadget_
lea eax, [ebp - 0x218]
push eax
lea eax, [edi + 0xdc]
push ebx
push eax
call fcn.00403636
add esp, 0x3c
lea ebx, [edi + 0xe8]
lea eax, [ebp - 0x620]
push dword [ebx]
push 0x100
push eax
push 0x4c9ff4
push str.SmartDir
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x620]
push 0x4c9ff4
push eax
call fcn.00490f86
pop ecx
pop ecx
test eax, eax
jne 0x402dc4
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402dc4
call esi
cmp eax, 0xb7
je 0x402dc4
push str.Smart_
lea eax, [ebp - 0x218]
push eax
lea eax, [edi + 0xd4]
push str._s_s
push eax
call fcn.00403636
add esp, 0x10
jmp 0x402e34
lea eax, [ebp - 0x620]
push eax
lea ebx, [edi + 0xd4]
push 0x4ca26c
push ebx
call fcn.00403636
add esp, 0xc
lea eax, [ebp - 0x8060]
mov ecx, ebx
push 1
push eax
call fcn.0040330c
mov byte [ebp - 4], 0xc
push 0x4ca734
push dword [eax]
call fcn.00490f86
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x8060]
add ecx, 0xfffffff0
call fcn.0040259b
test esi, esi
je 0x402e2e
lea eax, [ebp - 0x620]
push eax
push 0x4ca1c8
push ebx
call fcn.00403636
add esp, 0xc
lea ebx, [edi + 0xe8]
lea esi, [edi + 0xe0]
call fcn.004390d8
test eax, eax
je 0x402e4a
push str.CdiResourceAlertMail4.exe
jmp 0x402e58
call fcn.00439037
test eax, eax
je 0x402e6f
push str.CdiResourceAlertMail.exe
lea eax, [ebp - 0x218]
push eax
push str._s_s
push esi
call fcn.00403636
add esp, 0x10
jmp 0x402e87
push 0x4c9ff4
call fcn.0048cb73
pop ecx
push eax
push 0x4c9ff4
mov ecx, esi
call fcn.00402266
push str.CdiResourceopusopusdec.exe
lea eax, [ebp - 0x218]
mov esi, str._s_s
push eax
lea eax, [edi + 0xe4]
push esi
push eax
call fcn.00403636
push 0x4ca32c
push dword [edi + 0xf8]
lea eax, [ebp - 0x8088]
mov dword [edi + 0x100], 3
push esi
push eax
mov dword [edi + 0x104], 6
call fcn.00403636
push str.English
push dword [edi + 0xfc]
lea eax, [ebp - 0x8070]
push str._s_s.lang
push eax
call fcn.00403636
mov esi, 0x11c
lea eax, [ebp - 0x73c]
push esi
push 0
push eax
call fcn.00488da0
add esp, 0x3c
mov dword [ebp - 0x73c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x73c]
push eax
call esi
test eax, eax
jne 0x402f30
lea eax, [ebp - 0x73c]
mov dword [ebp - 0x73c], 0x114
push eax
call esi
push dword [ebx]
lea esi, [edi + 0xcc]
push 0
push str.IE8MODE
push 0x4ca374
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea eax, [ebp - 0x218]
push eax
je 0x402fd3
push str._sCdiResourcedialogGraph8.html
push esi
call fcn.00403636
mov edx, str.Graph8.html
mov ecx, dword [esi]
add esp, 0xc
call fcn.0040322b
test eax, eax
je 0x4031d9
lea eax, [ebp - 0x218]
push eax
lea eax, [edi + 0xd0]
push str._sCdiResourcedialogOption.html
push eax
call fcn.00403636
mov ecx, dword [ebp - 0x8070]
add esp, 0xc
mov edx, str.English
call fcn.0040322b
test eax, eax
je 0x4031d9
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x402fe5
cmp dword [ebp - 0x738], 6
jae 0x402fc9
push eax
push eax
push str.CrystalDiskInfo_is_required_Administrator_Privileges.
call fcn.00464a4f
call fcn.00403288
jmp 0x4031d9
push str._sCdiResourcedialogGraph.html
push esi
call fcn.00403636
mov edx, str.Graph.html
jmp 0x402f65
xor ebx, ebx
cmp dword [ebp - 0x806c], ebx
je 0x403029
push dword [ebp - 0x8078]
push ecx
lea ecx, [ebp - 0x1784]
call fcn.00423732
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x1784]
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.0045b7ce
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1784]
call fcn.0042399f
jmp 0x4031b2
push ecx
mov ecx, esp
mov dword [ebp - 0x8060], esp
push str.AfxOleInit__
call fcn.00402306
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0xb
call fcn.0043bfae
pop ecx
call fcn.00464de0
push ecx
mov dword [ebp - 0x8060], esp
mov ecx, esp
test eax, eax
je 0x4030e6
xor ebx, ebx
push str.AfxOleGetMessageFilter____SetMessagePendingDelay
inc ebx
call fcn.00402306
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0xb
call fcn.0043bfae
pop ecx
call fcn.00465024
push ecx
mov ecx, esp
mov dword [ebp - 0x807c], esp
push str.AfxOleGetMessageFilter____EnableNotRespondingDialog_FALSE_
mov eax, dword [eax + 0x40]
mov dword [eax + 0x3c], 0xea60
call fcn.00402306
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0xb
call fcn.0043bfae
pop ecx
call fcn.00465024
push ecx
mov ecx, esp
mov dword [ebp - 0x8078], esp
push str.AfxOleGetMessageFilter____EnableBusyDialog_FALSE_
mov eax, dword [eax + 0x40]
and dword [eax + 0x2c], 0
call fcn.00402306
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0xb
call fcn.0043bfae
pop ecx
call fcn.00465024
mov eax, dword [eax + 0x40]
and dword [eax + 0x28], 0
jmp 0x403108
push str.CoInitializeEx_NULL__COINIT_APARTMENTTHREADED__
call fcn.00402306
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0xb
call fcn.0043bfae
pop ecx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push dword [ebp - 0x8080]
lea ecx, [ebp - 0x805c]
push 0
call fcn.00403687
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x805c]
push ecx
mov ecx, esp
mov dword [ebp - 0x8060], esp
push str.dlg.DoModal__
mov dword [edi + 0x20], eax
xor esi, esi
call fcn.00402306
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x20
call fcn.0043bfae
pop ecx
lea ecx, [ebp - 0x805c]
call fcn.0045b7ce
cmp eax, 0x174b
jne 0x40315e
inc esi
mov edi, dword [ebp - 0x8084]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40319f
push 0x104
lea eax, [ebp - 0x944]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
xor ecx, ecx
lea eax, [ebp - 0x944]
push ecx
push ecx
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x805c]
call fcn.00404389
test ebx, ebx
jne 0x4031d9
push ecx
mov ecx, esp
mov dword [ebp - 0x8060], esp
push str.CoUninitialize___
call fcn.00402306
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0xb
call fcn.0043bfae
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x8070]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x8088]
lea ecx, [ecx - 0x10]
call fcn.0040259b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x8074]
lea ecx, [ecx - 0x10]
call fcn.0040259b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487643
leave
ret