Function at 0x4585ee
Capabilities:
Accept command line arguments
Acquire debug privileges
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x1210]
mov eax, 0x1210
call fcn.00476b40
push 0xffffffffffffffff
push 0x4b23ab
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x120c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Initial_setup_information_r_n
lea eax, [ebp - 0x14]
push 0x4f7cb8
push eax
call fcn.00403a39
push dword [eax]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00404da7
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00402820
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.Command_Line:__s
call fcn.00404da7
push str.SetupTemplate_version_:_14.0.1.1191_Base_Revision_2669373
call fcn.00404da7
add esp, 0xc
call fcn.00456184
call fcn.00401295
cmp eax, esi
je 0x458693
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx]
lea ecx, [ebp + 0x624]
call fcn.0044ea9e
xor edi, edi
lea eax, [ebp + 0x624]
mov ebx, 0x4f7c20
inc edi
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.0043a091
lea ecx, [ebp - 0xd]
call fcn.00453f76
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push str.SeDebugPrivilege
mov byte [ebp - 4], 2
call edi
push eax
lea ecx, [ebp - 0xd]
call fcn.00455d6c
push 1
push str.SeRestorePrivilege
call edi
push eax
lea ecx, [ebp - 0xd]
call fcn.00455d6c
lea ecx, [ebp + 0x64c]
call fcn.0044d1dc
mov edi, eax
cmp edi, esi
jne 0x458742
call fcn.004575dc
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 1
call fcn.004404fe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x624]
call fcn.0044e53a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120c]
xor ecx, ebp
call fcn.0047549a
add ebp, 0x1210
leave
ret
lea eax, [ebp + 0x64c]
lea ecx, [ebp + 0x624]
mov dword [0x4f7c70], eax
call fcn.0044d1f9
push esi
push esi
push 0xbc
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
lea edx, [ebp - 0x1c]
mov ecx, edi
mov dword [ebp - 0x1c], esi
call fcn.00457c91
test eax, eax
jne 0x4587ec
push esi
push esi
push 0x75
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
push esi
push esi
push 0xe17
lea ecx, [ebp + 0x64c]
call fcn.0044d8b0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004575dc
mov ecx, edi
call fcn.0045f79c
mov ebx, eax
cmp ebx, esi
je 0x4587d7
mov ecx, edi
call fcn.0045f2f3
mov ecx, eax
call fcn.0043cea6
mov eax, dword [eax]
mov ecx, dword [ebx]
push 1
push eax
push ebx
call dword [ecx + 0x84]
cmp dword [ebp - 0x1c], esi
je 0x458702
mov ecx, edi
call fcn.0045f7cc
jmp 0x458702
mov ecx, edi
call fcn.0045f2be
test eax, eax
je 0x458894
xor eax, eax
push 0x206
mov word [ebp + 0x1004], ax
lea eax, [ebp + 0x1006]
push esi
push eax
call fcn.00475420
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.entclient360entu.dll
lea eax, [ebp + 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x458894
lea eax, [ebp + 0x1004]
push eax
call fcn.00431135
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x458894
push str.CheckEnv
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x458894
push esi
call eax
cmp eax, 1
jne 0x458702
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, edi
call fcn.0045f458
test eax, eax
je 0x458957
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00461709
push str.parent
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.004024e0
mov eax, dword [ebp - 0x14]
push dword [eax - 0xc]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 4
call fcn.00403c21
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
mov ecx, edi
call fcn.0045f458
test eax, eax
je 0x45893d
push dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.00461709
push str.grandpa
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.004024e0
mov eax, dword [ebp - 0x24]
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 6
call fcn.00403c21
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402820
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00402820
push esi
push esi
push 0xbd
call fcn.00402d6a
mov ecx, eax
call fcn.00402dfb
mov dword [ebp - 0x5c], 0x4bf88c
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x5c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 7
call fcn.0045670b
push esi
push esi
lea ecx, [ebp + 0x624]
call fcn.0045686b
test eax, eax
jne 0x4589ec
push esi
push esi
push 0xe17
lea ecx, [ebp + 0x64c]
call fcn.0044d8b0
call fcn.004575dc
lea ecx, [ebp - 0x4c]
call fcn.0044060c
lea ecx, [ebp - 0x58]
call fcn.0044060c
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], 1
call fcn.004404fe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x624]
call fcn.0044e53a
mov eax, esi
jmp 0x45871f
mov ecx, edi
call fcn.0045f2f3
mov ecx, eax
call fcn.0043ce2c
cmp dword [eax], esi
jne 0x458a1b
mov ecx, edi
call fcn.0045f2f3
mov ecx, eax
call fcn.0043ce30
test eax, eax
je 0x458a2a
mov ecx, edi
call fcn.0045f2be
test eax, eax
jne 0x458a2a
push esi
push dword [ebp + 0x628]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x458a6a
push 5
push dword [ebp + 0x628]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0x628]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x628]
call edi
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [ebp + 0x628]
call edi
lea ecx, [ebp - 0x5c]
call fcn.004563df
mov edi, eax
call fcn.004575dc
push 0x4e20
call fcn.00455c35
mov ecx, eax
call fcn.00455b6e
push esi
mov ecx, ebx
call fcn.0043a091
mov ecx, ebx
call fcn.00456810
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion360Clear
lea ecx, [ebp]
call fcn.0043cdde
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion360JJX
lea ecx, [ebp + 0x20c]
mov byte [ebp - 4], 8
call fcn.0043cdde
push str.Software360Safe
lea ecx, [ebp + 0x418]
mov byte [ebp - 4], 9
call fcn.0043cdbd
lea ecx, [ebp + 0x418]
call fcn.0043cdb2
lea ecx, [ebp + 0x20c]
mov byte [ebp - 4], 8
call fcn.0043cdb2
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.0043cdb2
mov esi, edi
jmp 0x4589ba