Function at 0x4031a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [esp + 0x2b0]
push 0x4151d8
mov dword [0x41536c], edi
mov dword [0x4151d8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40382d
cmp dword [0x4151e8], esi
je 0x40382d
mov eax, dword [str.Tally.ini]
mov ecx, dword [0x412168]
mov dx, word [0x41216c]
push edi
mov dword [0x41526c], eax
mov dword [0x415270], ecx
mov word [0x415274], dx
call fcn.004030f0
add esp, 4
test eax, eax
je 0x40382d
push edi
call fcn.00402c10
add esp, 4
cmp eax, esi
mov dword [esp + 0x10], eax
je 0x40382d
push 3
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x31c
call fcn.004081b2
mov ebp, eax
xor eax, eax
mov ecx, 0x41
mov edi, ebp
rep stosd dword es:[edi], eax
lea ebx, [ebp + 0x104]
mov ecx, 0x41
mov edi, ebx
rep stosd dword es:[edi], eax
add esp, 4
lea edi, [ebp + 0x208]
mov ecx, 0x41
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x1ac]
push eax
mov dword [ebp + 0x30c], esi
mov dword [ebp + 0x310], esi
mov dword [ebp + 0x318], esi
mov dword [ebp + 0x314], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
je 0x40337a
cmp eax, 0x104
ja 0x40337a
push 3
lea ecx, [esp + 0x1ac]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00408280
mov eax, 0x412170
add esp, 0xc
mov byte [esp + 0x2b], 0
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4032d3
lea edi, [esp + 0x28]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4032e1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, ebp
lea ecx, [esp + 0x28]
lea eax, [esp + 0x28]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403305
xor eax, eax
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x34], cl
inc eax
test cl, cl
jne 0x403311
mov eax, 0x412178
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403325
lea edi, [esp + 0x34]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403333
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, ebx
lea ecx, [esp + 0x34]
lea eax, [esp + 0x34]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403355
lea edx, [ebp + 0x208]
lea ecx, [esp + 0x28]
lea eax, [esp + 0x28]
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403370
mov edx, dword [esp + 0x10]
push ebx
push 0x412180
push 0x412188
push ebp
push edx
call fcn.00405e80
add esp, 0x14
test eax, eax
jne 0x4033f8
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x34], cl
inc eax
test cl, cl
jne 0x403397
mov eax, 0x412190
mov esi, eax
jmp 0x4033b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4033b0
lea edi, [esp + 0x34]
sub eax, esi
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4033c0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, ebx
lea ecx, [esp + 0x34]
lea eax, [esp + 0x34]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4033e2
mov dword [ebp + 0x314], 0
jmp 0x403402
mov dword [ebp + 0x314], 1
mov edi, dword [esp + 0x10]
lea esi, [ebp + 0x208]
push esi
push 0x412198
push 0x4121a0
push ebp
push edi
call fcn.00405e80
add esp, 0x14
test eax, eax
jne 0x403447
mov edx, esi
lea ecx, [esp + 0x28]
lea eax, [esp + 0x28]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403431
mov dword [ebp + 0x318], 0
jmp 0x403451
mov dword [ebp + 0x318], 1
mov edx, dword [esp + 0x2b0]
push ebp
push edi
push edx
call fcn.00402fc0
add esp, 0xc
cmp eax, 1
jne 0x403795
cmp dword [0x4151e8], 2
jne 0x40348a
push str.tallylicserver.exe
push ebp
push 0x4121bc
lea eax, [esp + 0xb0]
push eax
jmp 0x40349d
push str.tallylic9xserver.exe
push ebp
push 0x4121dc
lea ecx, [esp + 0xb0]
push ecx
call fcn.0040800d
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x10
xor eax, eax
xor edx, edx
mov ecx, 0x11
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x64], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x64]
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x40], edx
push 0x4121e4
lea edx, [esp + 0xc8]
push edx
mov dword [esp + 0x88], 0x44
call esi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x403598
mov eax, dword [esp + 0x14]
push 0x1d4c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x403542
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4121e8
push 0x4121f8
push str.Internal_Error_30
jmp 0x40355a
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40358a
push eax
push str.CleanService
push 0x412230
push str.Internal_Error_31
mov eax, dword [esp + 0x20]
push eax
call fcn.00405e30
mov ecx, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x29c
ret 0x10
mov eax, dword [esp + 0x14]
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebx
mov eax, dword [0x41212c]
test eax, eax
mov edi, dword [esp + 0x10]
je 0x4035f1
mov edx, dword [esp + 0x2b0]
push ebp
push edi
push edx
call fcn.00403000
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x4035d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateDialogParam
push str.ShowCopyDialog
push str.Internal_Error_32
jmp 0x403824
push ebp
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0x7e8
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4035f5
mov ebp, dword [esp + 0x24]
cmp dword [0x415370], 1
jne 0x403729
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x64]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x40], eax
push 0x41228c
lea eax, [esp + 0xc8]
push eax
mov dword [esp + 0x88], 0x44
call esi
test eax, eax
jne 0x403671
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push eax
push 0x412290
push 0x4122a0
push 0x4122b0
push ecx
jmp 0x403825
mov edx, dword [esp + 0x14]
push 0x1d4c0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4036d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
push eax
push 0x4122c4
push str.GetExitCodeProcess
push str.Internal_Error_34
push edx
call fcn.00405e30
mov eax, dword [esp + 0x28]
add esp, 0x14
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x29c
ret 0x10
mov eax, dword [esp + 0x24]
test eax, eax
je 0x403717
mov edx, dword [esp + 0x10]
push eax
push str.InstallService
push str.ProcessExitCode
push str.Internal_Error_35
push edx
call fcn.00405e30
mov eax, dword [esp + 0x28]
add esp, 0x14
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x29c
ret 0x10
mov edx, dword [esp + 0x14]
push edx
call ebx
mov eax, dword [esp + 0x18]
push eax
call ebx
mov edi, dword [esp + 0x10]
mov eax, dword [0x415374]
test eax, eax
je 0x40377b
mov ecx, dword [esp + 0x2b0]
push edi
push ecx
call fcn.00403030
mov esi, eax
add esp, 8
test esi, esi
jne 0x403764
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateDialog
push str.ShowModemInstallDialog
push str.Internal_Error_36
jmp 0x403824
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0x401
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esp + 0x2b0]
push edi
push edx
call fcn.00403060
add esp, 8
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4037a5
cmp eax, 2
jne 0x40380e
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ebp, dword [esp + 0x24]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x50]
push eax
call esi
test eax, eax
jle 0x4037f7
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x44]
push ecx
push ebp
call edi
test eax, eax
jne 0x4037e6
lea edx, [esp + 0x44]
push edx
call ebx
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x50]
push ecx
call esi
test eax, eax
jg 0x4037c8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DialogBoxParam
push str.ShowSetupDialog
push str.Internal_Error_37
push edi
call fcn.00405e30
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x29c
ret 0x10