Function at 0x43dfe0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10e4
call fcn.00465d30
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x50
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov ebx, ecx
push esi
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, reloc.ADVAPI32.dll_TraceMessage
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
cmp dword [ebx + 0x10], esi
je 0x43e045
cmp dword [ebx + 0x50], esi
jne 0x43e061
cmp dword [ebx + 0x44], 5
je 0x43e061
push 0x41c864
push 2
call fcn.004400fc
mov eax, 0x8000ffff
jmp 0x43e591
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x41c898
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
push 0x41c8cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
test edi, edi
je 0x43e0cf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41c8dc
push edi
call esi
mov ebx, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
test ebx, ebx
jne 0x43e152
push 0x41c8f0
push edi
call esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test eax, eax
jne 0x43e152
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
mov ebx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor eax, eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push 0x40
setne al
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
pop edx
lea ecx, [ebp - 0x48]
lea eax, [eax*2 + 0x64]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, 0x41c984
call fcn.0043dbf8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov edi, 0x105
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x43e25c
call fcn.0044eae9
test eax, eax
mov eax, edi
lea edi, reloc.ADVAPI32.dll_TraceMessage
je 0x43e1df
push 0x41c994
jmp 0x43e1e4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x43e0cf
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x41c904
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x43e180
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
push 0x402b40
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x43e196
xor ebx, ebx
inc ebx
jmp 0x43e0d5
push 0x41c924
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x43e1c4
push 0x402c70
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x43e1c4
push 0x401c04
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x43e0cf
push 0x41c954
push 4
call fcn.004400fc
xor eax, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov ebx, eax
jmp 0x43e0d5
push 0x41c9b0
call fcn.0042c8f1
test eax, eax
js 0x43e25c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00440bc3
test eax, eax
jne 0x43e214
test ebx, ebx
jne 0x43e214
push 0x105
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x81
jmp 0x43e247
call fcn.00444778
call fcn.00454391
test eax, eax
je 0x43e236
call fcn.004412f6
mov dword [0x467d0c], eax
mov dword [reloc.ole32.dll_CoCreateInstance], 1
push 0x105
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xd6
push dword [0x4683ec]
call esi
test eax, eax
jle 0x43e25c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
jmp 0x43e261
push 0x41c9c8
lea eax, [ebp - 0x48]
push eax
push 0x3f
pop eax
lea ebx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0043dc57
mov ebx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
pop ecx
pop ecx
test ebx, ebx
je 0x43e3ce
cmp dword [0x468600], 0
je 0x43e2c3
push 0x100
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xb5
push dword [0x4683ec]
call esi
test eax, eax
je 0x43e2c3
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x5d5
push dword [0x468600]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x41c9f8
push 4
pop edi
push edi
call fcn.004400fc
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call ebx
test eax, eax
jne 0x43e3c3
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp eax, 0x78
jne 0x43e304
push 0x41ca30
jmp 0x43e3c8
cmp eax, 0x422
je 0x43e34b
cmp eax, 0x70
je 0x43e344
cmp eax, 0x50
jne 0x43e321
push 0x41cadc
push 2
jmp 0x43e3c9
test eax, eax
jle 0x43e32f
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x41cb18
push 2
pop esi
call fcn.00440126
pop ecx
pop ecx
jmp 0x43e3ce
push 0x41ca98
jmp 0x43e350
push 0x41ca64
push edi
call fcn.004400fc
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp dword [eax + 0x4c], 0
jne 0x43e3ce
push 0x400
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xa1
push dword [0x4683ec]
call esi
test eax, eax
je 0x43e3b9
push 0x200
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push reloc.KERNEL32.dll_InitializeCriticalSection
push dword [0x4683ec]
call esi
test eax, eax
je 0x43e3b9
push 0x1011
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x43e3ce
mov eax, 0x80004005
jmp 0x43e591
push 0x41cb54
push edi
call fcn.004400fc
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp dword [esi + 0x44], 5
je 0x43e3e5
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0043dd87
call fcn.0044134a
mov eax, dword [0x467d10]
mov ebx, dword [esi]
and eax, 8
push eax
call fcn.0044b13d
mov ebx, eax
push ebx
push 0x41cb70
push 4
pop esi
call fcn.00440126
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
pop ecx
pop ecx
je 0x43e41f
mov edi, 0x41c72c
call fcn.0044dd48
test ebx, ebx
js 0x43e4ff
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edi, dword [edi + 4]
test edi, edi
je 0x43e467
cmp dword [edi], 0
je 0x43e467
cmp dword [edi + 4], 0
je 0x43e467
cmp dword [edi + 0x28], 0
jle 0x43e467
call fcn.0043f0b4
mov edi, eax
push edi
push 0x41cb98
call fcn.00440126
pop ecx
pop ecx
test edi, edi
js 0x43e465
cmp ebx, 0xd2af9
je 0x43e467
mov ebx, edi
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [edi + 0x54]
test ecx, ecx
je 0x43e4ff
call fcn.0044fd78
mov edi, eax
test edi, edi
je 0x43e4ff
cmp dword [edi + 0xa0], 0
je 0x43e4ff
cmp dword [edi + 0xa8], 0
je 0x43e4ff
mov eax, dword [edi + 0xc]
test eax, eax
jne 0x43e4a1
mov eax, 0x401424
push eax
push 0x41cbcc
call fcn.00440126
pop ecx
pop ecx
push 0
call fcn.0043dcb4
mov ecx, edi
call fcn.0044f74b
cmp eax, 0xbc2
je 0x43e4dd
cmp eax, 0x80070bc2
je 0x43e4dd
cmp eax, 0xd2af9
je 0x43e4dd
test ebx, ebx
js 0x43e4e2
test eax, eax
jns 0x43e4e2
mov ebx, eax
jmp 0x43e4e2
mov ebx, 0xd2af9
cmp dword [edi + 0xc], 0
mov ecx, 0x401424
je 0x43e4f0
mov ecx, dword [edi + 0xc]
push eax
push ecx
push 0x41cbe8
call fcn.00440126
add esp, 0xc
xor eax, eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
setne al
lea eax, [eax*2 + 0x65]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x43e57e
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
call eax
test eax, eax
jne 0x43e573
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
jle 0x43e561
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x41cc10
push 2
pop esi
call fcn.00440126
pop ecx
pop ecx
jmp 0x43e57e
push 0x41cc48
push esi
call fcn.004400fc
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x43e58f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret