Function at 0x47f1c0
Capabilities:
Accept command line arguments
Check if file exists
Create directory
Create process on windows
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511696
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1094
call fcn.004825c0
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
mov eax, dword [0x562e30]
test al, 1
jne 0x47f218
or eax, 1
mov dword [0x562d10], 0
mov dword [0x562e30], eax
push str.RtlGetVersion
push str.ntdll.dll
mov dword [0x562d14], 0x11c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x47f246
push 0x562d14
call eax
mov ecx, dword [0x562d18]
mov edx, dword [0x562d1c]
test ecx, ecx
je 0x47f317
mov eax, ecx
shl eax, 8
or eax, edx
cmp eax, 0x602
ja 0x47f2a2
je 0x47f296
cmp eax, 0x501
je 0x47f287
cmp eax, 0x601
jne 0x47f2b0
mov dword [0x562d10], 2
jmp 0x47f317
mov dword [0x562d10], 1
jmp 0x47f317
mov dword [0x562d10], 3
jmp 0x47f317
cmp eax, 0x603
je 0x47f30d
cmp eax, 0xa00
je 0x47f2bc
mov dword [0x562d10], 0
jmp 0x47f317
mov eax, dword [0x562d20]
cmp eax, 0x3fab
jb 0x47f2d4
mov dword [0x562d10], 8
jmp 0x47f317
cmp eax, 0x3ad7
jb 0x47f2e7
mov dword [0x562d10], 7
jmp 0x47f317
cmp eax, 0x3839
jb 0x47f2fa
mov dword [0x562d10], 6
jmp 0x47f317
cmp eax, 0x295a
jb 0x47f317
mov dword [0x562d10], 5
jmp 0x47f317
mov dword [0x562d10], 4
mov eax, dword [0x562e30]
test al, 1
jne 0x47f332
or eax, 1
mov dword [0x562d10], 0
mov dword [0x562e30], eax
test ecx, ecx
je 0x47f36d
cmp ecx, 6
ja 0x47f344
jb 0x47f36d
cmp edx, 3
ja 0x47f344
jb 0x47f36d
push str.shcore.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x47f368
push str.SetProcessDpiAwareness
push esi
call edi
push 1
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x562e30]
test al, 1
jne 0x47f385
or eax, 1
mov dword [0x562d10], 0
mov dword [0x562e30], eax
jmp 0x47f394
cmp dword [0x562d10], 1
jne 0x47f394
call dword [sym.imp.rime.dll_void___cdecl_SuppressAbortMessage_void_]
lea eax, [ebp - 0x10a4]
mov dword [ebp - 0x10a4], 0x14
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x3c]
push eax
movups xmmword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x2c], xmm0
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x3c]
push str.SYSTEM
push eax
call fcn.004c05ec
add esp, 8
test eax, eax
jne 0x47f3de
mov eax, 1
jmp 0x47f5e6
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x1044], 8
push eax
mov dword [ebp - 0x1040], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push dword [ebp + 8]
mov ecx, 0x559300
push 0
call fcn.0047cca0
push 0x47d060
call fcn.004c027b
add esp, 4
push 0x55f0c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x55f0bc], 0
je 0x47f45d
push 0x55f0c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x47f544
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push 0x55ecb4
push 0
mov byte [0x55f0bc], 1
mov dword [0x55947c], 0
call edi
push 0x5c
push 0x55ecb4
call fcn.004b5345
mov edx, eax
add esp, 8
test edx, edx
je 0x47f539
mov ecx, edx
mov eax, 0x104
sub ecx, 0x559478
sub ecx, 0x583c
push 0xffffffffffffffff
sar ecx, 1
push str._bugreport.exe
sub eax, ecx
push eax
push edx
call fcn.004c0530
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xffffffffffffffff
push eax
push 0x1000
push 0x559764
call fcn.004c0530
push 0xffffffffffffffff
push 0x52ad90
push 0x40
push 0x55ebb4
call fcn.004c0530
push 0xffffffffffffffff
push str.server
push 0x40
push 0x55ec34
call fcn.004c0530
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.bdbugreport__u
push 0xffffffffffffffff
push 0x55eebc
call fcn.0047b950
add esp, 0x10
push 0x47c5e0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor ecx, ecx
cmp eax, 0x47c5e0
cmove eax, ecx
mov dword [0x559478], eax
push 0x55f0c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp + 0x10]
mov eax, str._userdir
mov ecx, edx
nop
mov si, word [eax]
cmp si, word [ecx]
jne 0x47f576
test si, si
je 0x47f572
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x47f576
add eax, 4
add ecx, 4
test si, si
jne 0x47f550
xor eax, eax
jmp 0x47f57b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47f604
lea eax, [ebp - 0x1054]
push eax
call fcn.00438a50
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x47f59a
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x1054]
call fcn.004065a0
lea eax, [ebp - 0x1054]
push eax
call fcn.00438a50
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x47f5c5
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0x519b24
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1054]
call fcn.004065a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edx
mov eax, str._weaseldir
nop dword [eax + eax]
mov si, word [eax]
cmp si, word [ecx]
jne 0x47f636
test si, si
je 0x47f632
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x47f636
add eax, 4
add ecx, 4
test si, si
jne 0x47f610
xor eax, eax
jmp 0x47f63b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47f650
lea eax, [ebp - 0x1054]
push eax
call fcn.0047ef20
jmp 0x47f5ba
mov byte [ebp - 0x109a], 0
mov ecx, edx
mov eax, 0x519c74
nop
mov si, word [eax]
cmp si, word [ecx]
jne 0x47f686
test si, si
je 0x47f682
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x47f686
add eax, 4
add ecx, 4
test si, si
jne 0x47f660
xor eax, eax
jmp 0x47f68b
sbb eax, eax
or eax, 1
test eax, eax
je 0x47f6ca
mov eax, str._quit
mov cx, word [eax]
cmp cx, word [edx]
jne 0x47f6ba
test cx, cx
je 0x47f6b6
mov cx, word [eax + 2]
cmp cx, word [edx + 2]
jne 0x47f6ba
add eax, 4
add edx, 4
test cx, cx
jne 0x47f694
xor eax, eax
jmp 0x47f6bf
sbb eax, eax
or eax, 1
mov byte [ebp - 0x1099], 0
test eax, eax
jne 0x47f6d1
mov byte [ebp - 0x1099], 1
lea ecx, [ebp - 0x1044]
call fcn.0045ba60
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, esp
lea ecx, [ebp - 0x1044]
mov dword [eax + 0x24], 0
call fcn.0045be50
test al, al
je 0x47f719
cmp byte [ebp - 0x1099], 0
mov byte [ebp - 0x109a], 1
je 0x47f719
lea ecx, [ebp - 0x1044]
call fcn.0045bef0
lea ecx, [ebp - 0x1044]
mov dword [ebp - 4], 0xffffffff
call fcn.0045bc90
cmp byte [ebp - 0x1099], 0
jne 0x47f5e4
cmp byte [ebp - 0x109a], 0
jne 0x47f5e4
push 0x800
lea eax, [ebp - 0x83c]
push 0
push eax
call fcn.004b62b0
add esp, 0xc
lea eax, [ebp - 0x83c]
push 0x400
push eax
push 0
call edi
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.Updater.exe
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47f85b
xorps xmm0, xmm0
mov dword [ebp - 0x1098], 0x44
push 0x800
lea eax, [ebp - 0x103c]
movlpd qword [ebp - 0x1094], xmm0
push 0
push eax
movlpd qword [ebp - 0x108c], xmm0
movlpd qword [ebp - 0x1084], xmm0
movlpd qword [ebp - 0x107c], xmm0
movlpd qword [ebp - 0x1074], xmm0
movlpd qword [ebp - 0x106c], xmm0
movlpd qword [ebp - 0x1064], xmm0
movlpd qword [ebp - 0x105c], xmm0
movups xmmword [ebp - 0x104c], xmm0
call fcn.004b62b0
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x103c]
push str.cmd.exe__c_start______ls____stageapp
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1098]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x103c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [ebp - 0x1054]
push eax
call fcn.00438a50
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x47f872
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x1054]
call fcn.004065a0
lea ecx, [ebp - 0x108c]
mov dword [ebp - 4], 1
call fcn.0047fbc0
mov eax, dword [0x562e30]
mov byte [ebp - 4], 2
test al, 1
jne 0x47f8b7
or eax, 1
mov dword [0x562d10], 0
mov dword [0x562e30], eax
mov eax, dword [0x562d18]
test eax, eax
je 0x47f8e4
cmp eax, 6
ja 0x47f8c7
jb 0x47f8e4
push str.RegisterApplicationRestart
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
call eax
lea ecx, [ebp - 0x108c]
call fcn.0047fe60
lea ecx, [ebp - 0x108c]
mov dword [ebp - 0x10a0], eax
call fcn.0047fdf0
jmp 0x47f91e
mov edi, dword [0x563074]
add edi, 0x10
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x559338]
test esi, esi
je 0x47f987
cmp dword [esi + 4], 0
jle 0x47f955
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x559338]
test esi, esi
je 0x47f987
mov eax, dword [esi]
test eax, eax
je 0x47f96e
push eax
call fcn.004bffbc
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00481e07
add esp, 8
push edi
mov dword [0x559338], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x559334]
test esi, esi
je 0x47f9e0
mov eax, dword [esi]
test eax, eax
je 0x47f9b7
push eax
call fcn.004bffbc
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47f9ce
push eax
call fcn.004bffbc
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.00481e07
add esp, 8
mov esi, dword [0x55932c]
test esi, esi
je 0x47fa13
cmp dword [esi], 0
je 0x47fa13
nop
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x47f9fd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x47f9f0
mov esi, dword [0x553b28]
mov ecx, dword [0x553b2c]
cmp esi, ecx
jae 0x47fa3d
mov eax, dword [esi]
test eax, eax
je 0x47fa36
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x553b2c]
add esi, 4
cmp esi, ecx
jb 0x47fa23
mov ecx, 0x559300
call fcn.0047e530
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00407830
cmp dword [eax], 1
jne 0x47fa5d
call dword [sym.imp.rime.dll_void___cdecl_SuppressAbortMessage_void_]
mov eax, dword [ebp - 0x10a0]
jmp 0x47f5e6