Function at 0x4184bd
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Set current directory

Disassembly:
push 0x95c
mov eax, 0x42974d
call fcn.004280f6
push 0x42f1bc
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4184f4
push str.SetDllDirectoryW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x418564
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov esi, 0x400
lea eax, [ebp - 0x410]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041cb50
add esp, 0xc
lea eax, [ebp - 0x810]
push esi
push ebx
push eax
call fcn.0041cb50
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x410]
add esp, 0xc
mov edi, 0x200
push edi
push eax
push 0x46
push ebx
call esi
push edi
lea eax, [ebp - 0x810]
push eax
push 0x47
push ebx
call esi
push 0x10
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
inc eax
call fcn.004280a5
ret 0x10
push 0x430074
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [ebp + 8]
mov dword [0x438004], eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x114
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x41912a
cmp dword [ebp - 0x118], 2
jne 0x41912a
lea ecx, [ebp - 0x8d4]
call fcn.00406fe9
lea ecx, [ebp - 0x854]
call fcn.00406fe9
lea ecx, [ebp - 0x8c8]
call fcn.00406fe9
lea ecx, [ebp - 0x8a0]
call fcn.00406fe9
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
lea ecx, [ebp - 0x888]
call fcn.0040700d
lea eax, [ebp - 0x854]
push eax
lea edx, [ebp - 0x8d4]
lea ecx, [ebp - 0x888]
call fcn.0040681f
push dword [ebp - 0x888]
call fcn.0041928c
pop ecx
lea ecx, [ebp - 0x894]
call fcn.00406fe9
lea ecx, [ebp - 0x894]
call fcn.00407ca8
lea ecx, [ebp - 0x854]
call fcn.004067e7
push ecx
xor ebx, ebx
lea ecx, [ebp - 0x854]
mov byte [ebp - 0x811], bl
call fcn.00406b48
xor ecx, ecx
inc ecx
mov dword [ebp - 0x818], ecx
test al, al
je 0x418670
mov eax, dword [ebp - 0x854]
add eax, 4
mov byte [ebp - 0x811], cl
push eax
lea ecx, [ebp - 0x854]
call fcn.004070c5
lea ecx, [ebp - 0x854]
call fcn.004067e7
lea ecx, [ebp - 0x888]
call fcn.00406d21
lea eax, [ebp - 0x888]
push eax
push ecx
mov ecx, dword [ebp - 0x894]
call fcn.00417a41
test al, al
jne 0x4186b6
cmp byte [ebp - 0x811], bl
jne 0x4190d7
push 0x10
push 0x42fa28
push str.Cant_load_config_info
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4190d7
push 0x4300e4
lea ecx, [ebp - 0x8bc]
call fcn.0040704a
lea ecx, [ebp - 0x860]
call fcn.00406fe9
mov ecx, dword [ebp - 0x854]
mov byte [ebp - 0x819], bl
call fcn.00406c27
test al, al
je 0x4186f9
xor eax, eax
mov cl, bl
inc eax
mov byte [ebp - 0x811], al
mov byte [ebp - 0x819], al
jmp 0x41870a
xor eax, eax
inc eax
movzx ecx, al
xor eax, eax
cmp dword [ebp - 0x850], eax
cmovne ecx, eax
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x818], cl
mov dword [ebp - 0x830], ecx
cmp dword [ebp - 0x884], ebx
je 0x418991
lea edx, [ebp - 0x828]
mov dword [ebp - 0x828], ebx
lea ecx, [ebp - 0x888]
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x820], ebx
call fcn.004075bc
test al, al
jne 0x418774
cmp byte [ebp - 0x811], bl
jne 0x418766
push 0x10
push 0x42fa28
push str.Config_failed
push ebx
call edi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x818], ebx
jmp 0x41885c
push str.Title
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x83c]
call fcn.0040782f
push str.BeginPrompt
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x86c]
call fcn.0040782f
push 0x43013c
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x848]
call fcn.0040782f
mov ecx, dword [ebp - 0x848]
mov edx, 0x430148
call fcn.00406bb2
mov edx, dword [ebp - 0x830]
movzx ecx, dl
xor edx, edx
test al, al
cmovne ecx, edx
mov edx, str.Directory
mov byte [ebp - 0x818], cl
lea ecx, [ebp - 0x828]
call fcn.004077d9
mov esi, dword [ebp - 0x828]
test eax, eax
js 0x418808
mov eax, dword [esi + eax*4]
lea ecx, [ebp - 0x8bc]
add eax, 0xc
push eax
call fcn.0040712d
cmp dword [ebp - 0x868], ebx
je 0x418897
cmp byte [ebp - 0x811], bl
jne 0x418897
push 0x24
push dword [ebp - 0x83c]
push dword [ebp - 0x86c]
push ebx
call edi
cmp eax, 6
je 0x418897
push dword [ebp - 0x848]
mov dword [ebp - 0x818], ebx
call fcn.0041928c
pop ecx
push dword [ebp - 0x86c]
call fcn.0041928c
pop ecx
push dword [ebp - 0x83c]
call fcn.0041928c
pop ecx
mov esi, dword [ebp - 0x824]
mov ebx, dword [ebp - 0x828]
test esi, esi
je 0x418891
dec esi
mov edi, dword [ebx + esi*4]
test edi, edi
je 0x418868
push dword [edi + 0xc]
call fcn.0041928c
pop ecx
push dword [edi]
call fcn.0041928c
pop ecx
push 0x18
push edi
call fcn.004193b4
pop ecx
pop ecx
jmp 0x418868
push ebx
jmp 0x4190b9
push str.RunProgram
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x878]
call fcn.0040782f
push eax
lea ecx, [ebp - 0x860]
call fcn.0040712d
push dword [ebp - 0x878]
call fcn.0041928c
lea edx, [ebp - 0x828]
mov dword [esp], str.ExecuteFile
lea ecx, [ebp - 0x878]
call fcn.0040782f
push eax
lea ecx, [ebp - 0x8c8]
call fcn.0040712d
push dword [ebp - 0x878]
call fcn.0041928c
lea edx, [ebp - 0x828]
mov dword [esp], str.ExecuteParameters
lea ecx, [ebp - 0x878]
call fcn.0040782f
push eax
lea ecx, [ebp - 0x8a0]
call fcn.0040712d
push dword [ebp - 0x878]
call fcn.0041928c
pop ecx
push dword [ebp - 0x848]
call fcn.0041928c
pop ecx
push dword [ebp - 0x86c]
call fcn.0041928c
pop ecx
push dword [ebp - 0x83c]
call fcn.0041928c
mov eax, dword [ebp - 0x824]
pop ecx
test eax, eax
je 0x41898a
dec eax
mov dword [ebp - 0x830], eax
mov edi, dword [esi + eax*4]
test edi, edi
je 0x418980
push dword [edi + 0xc]
call fcn.0041928c
pop ecx
push dword [edi]
call fcn.0041928c
pop ecx
push 0x18
push edi
call fcn.004193b4
mov eax, dword [ebp - 0x830]
pop ecx
pop ecx
test eax, eax
jne 0x418951
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call fcn.0041928c
pop ecx
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 0x8b0], bl
call fcn.00406fe9
cmp byte [ebp - 0x819], bl
jne 0x4189df
push ecx
lea ecx, [ebp - 0x8b0]
call fcn.00408422
test al, al
jne 0x4189df
cmp byte [ebp - 0x811], bl
jne 0x4189d1
push 0x10
push 0x42fa28
push str.Can_not_create_temp_folder_archive
push ebx
call edi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x818], ebx
jmp 0x419098
push 0x18
call fcn.0041943f
mov esi, eax
pop ecx
push esi
mov dword [esi + 4], ebx
mov dword [esi], vtable.CCodecs.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov word [esi + 0x14], bx
call dword [0x4302f4]
mov ecx, esi
call fcn.004140ec
test eax, eax
je 0x418a2e
push 0x10
push 0x42fa28
push str.Can_not_load_codecs
push ebx
call edi
xor eax, eax
inc eax
mov dword [ebp - 0x818], eax
jmp 0x41908b
cmp byte [ebp - 0x819], bl
je 0x418a41
mov eax, dword [ebp - 0x854]
add eax, 0x18
jmp 0x418a47
mov eax, dword [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x86c]
call fcn.0040700d
lea ecx, [ebp - 0x828]
mov byte [ebp - 0x829], bl
call fcn.00406fe9
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
lea eax, [ebp - 0x829]
push eax
push dword [ebp - 0x818]
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x894]
call fcn.00417665
test eax, eax
je 0x418b3c
cmp byte [ebp - 0x811], bl
jne 0x418ab0
cmp eax, 1
je 0x418acb
cmp byte [ebp - 0x829], bl
jne 0x418acb
cmp eax, 0x80004004
jne 0x418ade
mov edi, dword [ebp - 0x828]
push edi
call fcn.0041928c
xor eax, eax
inc eax
pop ecx
mov dword [ebp - 0x818], eax
jmp 0x41907f
push 8
lea edx, [ebp - 0x828]
pop ecx
call fcn.004095fa
mov eax, 0x80004005
cmp dword [ebp - 0x824], ebx
jne 0x418b0b
mov edx, eax
lea ecx, [ebp - 0x878]
call fcn.00407d16
push eax
lea ecx, [ebp - 0x828]
call fcn.0040712d
push dword [ebp - 0x878]
call fcn.0041928c
pop ecx
push 7
pop edx
lea ecx, [ebp - 0x878]
call fcn.0040955c
mov edi, dword [ebp - 0x828]
push 0x10
push dword [eax]
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x878]
call fcn.0041928c
pop ecx
jmp 0x418ab6
push dword [ebp - 0x828]
call fcn.0041928c
pop ecx
lea ecx, [ebp - 0x83c]
call fcn.00406d21
sub esp, 0xc
lea eax, [ebp - 0x894]
mov ecx, esp
push eax
call fcn.00407094
lea ecx, [ebp - 0x83c]
call fcn.00417e05
test al, al
je 0x418c01
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x828]
call fcn.00407094
lea ecx, [ebp - 0x828]
call fcn.00408dd0
push str.postSigningData
lea ecx, [ebp - 0x828]
call fcn.004072c2
or dword [ebp - 0x818], 0xffffffff
push ecx
push 2
push 1
push 0x40000000
push dword [ebp - 0x828]
lea ecx, [ebp - 0x818]
call fcn.00408c34
lea eax, [ebp - 0x830]
mov dword [ebp - 0x830], ebx
push eax
push dword [ebp - 0x838]
lea ecx, [ebp - 0x818]
push dword [ebp - 0x83c]
call fcn.00408d4b
lea ecx, [ebp - 0x818]
call fcn.00408c6b
push dword [ebp - 0x828]
call fcn.0041928c
pop ecx
push dword [ebp - 0x83c]
call fcn.0041928c
pop ecx
lea ecx, [ebp - 0x848]
call fcn.00406d21
lea eax, [ebp - 0x828]
mov dword [ebp - method.AutoCharBuffer.virtual_0], vtable.AutoCharBuffer.0
push eax
lea edx, [ebp - 0x848]
mov dword [ebp - 0x824], ebx
lea ecx, [ebp - 0x894]
mov dword [ebp - 0x820], ebx
call fcn.004181a1
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x83c]
call fcn.00407094
lea ecx, [ebp - 0x83c]
call fcn.00408dd0
push str.zoneIdProvenanceData
lea ecx, [ebp - 0x83c]
call fcn.004072c2
or dword [ebp - 0x818], 0xffffffff
push ecx
push 2
push 1
push 0x40000000
push dword [ebp - 0x83c]
lea ecx, [ebp - 0x818]
call fcn.00408c34
lea eax, [ebp - 0x830]
mov dword [ebp - 0x830], ebx
push eax
push dword [ebp - 0x844]
lea ecx, [ebp - 0x818]
push dword [ebp - 0x848]
call fcn.00408d4b
cmp dword [ebp - 0x820], ebx
jbe 0x418ce7
cmp dword [ebp - 0x824], ebx
je 0x418ce7
lea eax, [ebp - 0x830]
push eax
push dword [ebp - 0x820]
lea ecx, [ebp - 0x818]
push dword [ebp - 0x824]
call fcn.00408d4b
lea ecx, [ebp - 0x818]
call fcn.00408c6b
push dword [ebp - 0x83c]
call fcn.0041928c
pop ecx
lea ecx, [ebp - 0x828]
call fcn.00417ea6
push dword [ebp - 0x848]
call fcn.0041928c
pop ecx
cmp byte [ebp - 0x819], bl
je 0x418d28
mov dword [ebp - 0x818], ebx
jmp 0x41907f
lea ecx, [ebp - 0x87c]
call fcn.00406fe9
lea ecx, [ebp - 0x87c]
mov byte [ebp - 0x870], 1
call fcn.004081d7
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test eax, eax
jne 0x418d5d
xor ebx, ebx
inc ebx
jmp 0x41906e
cmp dword [ebp - 0x8c4], ebx
je 0x418e6a
lea eax, [ebp - 0x8c8]
push eax
lea ecx, [ebp - 0x83c]
call fcn.00407094
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x910], 0x3c
mov dword [ebp - 0x90c], 0x140
mov dword [ebp - 0x908], ebx
mov dword [ebp - 0x904], ebx
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x850], ebx
je 0x418dd6
cmp dword [ebp - 0x89c], ebx
je 0x418dc4
push 0x20
lea ecx, [ebp - 0x8a0]
call fcn.004067b6
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.00407309
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x848]
call fcn.00407094
mov eax, dword [ebp - 0x848]
xor ecx, ecx
cmp dword [ebp - 0x844], ecx
mov dword [ebp - 0x8f8], ebx
cmove eax, ecx
mov dword [ebp - 0x8f4], 1
mov dword [ebp - 0x8fc], eax
lea eax, [ebp - 0x910]
push eax
mov dword [ebp - 0x8d8], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x8f0], 0x20
ja 0x418e5f
cmp byte [ebp - 0x811], bl
jne 0x418e42
push 0x10
push 0x42fa28
push str.Can_not_open_file
push ebx
call edi
push dword [ebp - 0x848]
call fcn.0041928c
pop ecx
push dword [ebp - 0x83c]
call fcn.0041928c
pop ecx
jmp 0x418d55
mov edi, dword [ebp - 0x8d8]
jmp 0x419042
cmp dword [ebp - 0x85c], ebx
jne 0x418eb1
push str.setup.exe
lea ecx, [ebp - 0x860]
call fcn.004070c5
mov ecx, dword [ebp - 0x860]
call fcn.00408b44
test al, al
jne 0x418eb1
cmp byte [ebp - 0x811], bl
jne 0x418d55
push 0x10
push 0x42fa28
push str.Can_not_find_setup.exe
push ebx
call edi
jmp 0x418d55
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x848]
call fcn.00407094
lea ecx, [ebp - 0x848]
call fcn.00408dd0
push str.__T_
lea ecx, [ebp - 0x83c]
call fcn.0040700d
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x860]
call fcn.0040744f
push dword [ebp - 0x83c]
call fcn.0041928c
pop ecx
push dword [ebp - 0x848]
call fcn.0041928c
pop ecx
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x83c]
call fcn.00407094
push 0x4302b8
lea ecx, [ebp - 0x848]
call fcn.0040700d
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x860]
call fcn.0040744f
push dword [ebp - 0x848]
call fcn.0041928c
pop ecx
cmp dword [ebp - 0x850], ebx
je 0x418f7d
push 0x20
lea ecx, [ebp - 0x860]
call fcn.004067b6
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0x860]
call fcn.00407309
push dword [ebp - 0x85c]
xor eax, eax
mov dword [ebp - 0x968], 0x44
push dword [ebp - 0x860]
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x964], ebx
push dword [ebp - 0x8b8]
mov dword [ebp - 0x960], ebx
push dword [ebp - 0x8bc]
mov dword [ebp - 0x95c], ebx
mov dword [ebp - 0x93c], ebx
mov word [ebp - 0x936], ax
mov dword [ebp - 0x934], ebx
call fcn.00406f3f
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x848]
call fcn.00407094
push dword [ebp - 0x828]
call fcn.0041928c
pop ecx
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x968]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x848]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x419030
cmp byte [ebp - 0x811], bl
jne 0x418e42
lea ecx, [ebp - 0x83c]
call fcn.00417cb1
jmp 0x418e42
push dword [ebp - 0x91c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 0x920]
push dword [ebp - 0x848]
call fcn.0041928c
pop ecx
push dword [ebp - 0x83c]
call fcn.0041928c
pop ecx
test edi, edi
je 0x41906e
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x87c]
mov dword [ebp - 0x818], ebx
call fcn.0041798a
push dword [ebp - 0x86c]
call fcn.0041928c
pop ecx
mov dword [ebp - 4], 0xf
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov dword [ebp - 4], 0x10
cmp byte [ebp - 0x8b0], 0
je 0x4190b3
lea ecx, [ebp - 0x8ac]
call fcn.0040802c
push dword [ebp - 0x8ac]
call fcn.0041928c
pop ecx
push dword [ebp - 0x860]
call fcn.0041928c
pop ecx
push dword [ebp - 0x8bc]
call fcn.0041928c
pop ecx
push dword [ebp - 0x888]
call fcn.0041928c
pop ecx
push dword [ebp - 0x894]
call fcn.0041928c
pop ecx
push dword [ebp - 0x8a0]
call fcn.0041928c
pop ecx
push dword [ebp - 0x8c8]
call fcn.0041928c
pop ecx
push dword [ebp - 0x854]
call fcn.0041928c
pop ecx
push dword [ebp - 0x8d4]
call fcn.0041928c
mov eax, dword [ebp - 0x818]
pop ecx
jmp 0x41855c
push 0x10
push 0x42fa28
push str.Unsupported_Windows_version
push 0
jmp 0x418553