Function at 0x42f060
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46993e
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor ebx, ebx
cmp edi, ebx
je 0x42f1fc
mov ecx, edi
call fcn.00432ee0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.00419e60
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x23c], ebx
call fcn.004213f0
mov eax, dword [esp + 0x10]
or ebp, 0xffffffff
lea ecx, [eax - 0xc]
mov dword [esp + 0x238], ebp
cmp ecx, dword [0x484060]
je 0x42f107
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42f107
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044ee34
add esp, 4
mov ecx, esi
call fcn.00421a00
mov ecx, edi
call fcn.00433760
test eax, eax
je 0x42f1fc
mov ecx, edi
call fcn.00430620
cmp eax, ebx
je 0x42f1fc
mov ecx, edi
call fcn.00432db0
cmp eax, 1
je 0x42f142
cmp eax, 2
je 0x42f142
cmp eax, 3
jne 0x42f147
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x14]
call fcn.00418550
mov eax, dword [eax]
push eax
call fcn.0044f0f1
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00415c20
mov ecx, edi
call fcn.0042c550
test eax, eax
je 0x42f18f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x6c]
call eax
cmp eax, esi
je 0x42f18f
test ebx, ebx
je 0x42f18f
push 4
mov ecx, edi
call fcn.00432dc0
mov ecx, edi
call fcn.00432ec0
test eax, eax
je 0x42f1fc
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
test eax, eax
jne 0x42f203
push 0x96
lea ecx, [esp + 0x18]
call fcn.00418550
mov esi, eax
push 0xab
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 1
call fcn.00418550
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 2
call fcn.00432ef0
lea ecx, [esp + 0x10]
call fcn.00415c20
lea ecx, [esp + 0x14]
call fcn.00415c20
xor eax, eax
jmp 0x42f34d
mov ecx, edi
call fcn.0042c550
mov esi, eax
call fcn.0042c290
test eax, eax
jne 0x42f272
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418550
mov esi, eax
push 0xa9
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 3
call fcn.00418550
mov byte [esp + 0x238], 4
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
call fcn.00432ef0
lea ecx, [esp + 0x14]
call fcn.00415c20
lea ecx, [esp + 0x10]
call fcn.00415c20
xor eax, eax
jmp 0x42f34d
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, edi
test eax, eax
jne 0x42f2f9
call fcn.00432e80
test eax, eax
je 0x42f2c3
call fcn.0042ee30
test eax, eax
je 0x42f26b
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418550
mov esi, eax
push 0xa8
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 5
call fcn.00418550
mov byte [esp + 0x238], 6
jmp 0x42f246
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418550
mov esi, eax
push 0xa7
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 7
call fcn.00418550
mov byte [esp + 0x238], 8
jmp 0x42f246
call fcn.00432e80
mov ecx, edi
test eax, eax
je 0x42f374
call fcn.00432e90
test eax, eax
jne 0x42f343
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418550
mov esi, eax
push 0x97
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 9
call fcn.00418550
mov byte [esp + 0x238], 0xa
jmp 0x42f246
call fcn.0042ee30
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0044e20c
add esp, 0x22c
ret
call fcn.00432ee0
mov ecx, eax
call fcn.004211b0
mov ecx, edi
test eax, eax
je 0x42f49f
call fcn.00432db0
test eax, eax
jne 0x42f3c9
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418550
mov esi, eax
push 0xb8
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xb
call fcn.00418550
mov byte [esp + 0x238], 0xc
jmp 0x42f246
mov ecx, edi
call fcn.00432db0
cmp eax, 3
jne 0x42f40b
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418550
mov esi, eax
push 0x92
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xd
call fcn.00418550
mov byte [esp + 0x238], 0xe
jmp 0x42f246
mov ecx, edi
call fcn.00432db0
push 0x96
lea ecx, [esp + 0x14]
cmp eax, 4
jne 0x42f44d
call fcn.00418550
mov esi, eax
push 0x257
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xf
call fcn.00418550
mov byte [esp + 0x238], 0x10
jmp 0x42f246
call fcn.00418550
mov esi, eax
push 0xac
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0x11
call fcn.00418550
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 0x12
call fcn.00432ef0
lea ecx, [esp + 0x14]
call fcn.00415c20
lea ecx, [esp + 0x10]
call fcn.00415c20
jmp 0x42f348
call fcn.00432db0
cmp eax, 4
ja case.0x42f4a9.3
jmp dword [eax*4 + 0x42f6fc]
push 0
mov ecx, edi
call fcn.00432e30
mov ecx, eax
call fcn.0041a060
test eax, eax
je 0x42f26b
mov ecx, edi
call fcn.0042c550
mov ecx, edi
mov esi, eax
call fcn.004330d0
mov ebx, eax
test ebx, ebx
je 0x42f348
test esi, esi
je 0x42f348
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
mov ebp, dword [ebx]
push esi
call ecx
mov edx, dword [ebp + 0x50]
push eax
push ebx
call edx
movzx eax, ax
test ax, ax
jne 0x42f348
mov eax, dword [0x484064]
mov dword [esp + 0x10], eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2c]
push esi
mov dword [esp + 0x23c], 0x19
call edx
push eax
lea eax, [esp + 0x14]
push 0x9b
push eax
call fcn.00420f40
add esp, 0xc
push 0x96
lea ecx, [esp + 0x20]
call fcn.00418550
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 0x1a
call fcn.00432ef0
lea ecx, [esp + 0x1c]
call fcn.00415c20
lea ecx, [esp + 0x10]
call fcn.00415c20
xor eax, eax
jmp 0x42f34d
mov ecx, edi
call fcn.00432ee0
mov ecx, eax
call fcn.004211c0
mov eax, dword [eax]
cmp dword [eax - 8], 0
je 0x42f5ad
mov ecx, edi
call fcn.00432ee0
mov ecx, eax
call fcn.004211c0
push eax
mov ecx, edi
call fcn.00432d80
mov ecx, eax
call fcn.00417f50
mov ecx, edi
call fcn.00432d80
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00419e20
call fcn.0042eec0
add esp, 4
test eax, eax
jne case.0x42f4a9.3
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2e]
push edx
mov word [esp + 0x30], cx
call fcn.0044e220
add esp, 0xc
push 0x104
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.0x42f4a9.3
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.00419e60
mov ebx, 0x13
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], ebx
call fcn.004222d0
inc eax
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
call fcn.0041e550
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 0x14
call fcn.00417f50
lea ecx, [esp + 0x14]
mov byte [esp + 0x238], bl
call fcn.00415c20
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00432d80
mov ecx, eax
call fcn.00417f50
lea ecx, [esp + 0x10]
mov dword [esp + 0x238], ebp
call fcn.00415c20
jmp case.0x42f4a9.3
push 0x257
lea ecx, [esp + 0x1c]
call fcn.00418550
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 0x15
call fcn.00419e60
lea ecx, [esp + 0x18]
mov byte [esp + 0x238], 0x17
call fcn.00415c20
push 0x96
lea ecx, [esp + 0x24]
call fcn.00418550
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x248], 0x18
call fcn.00432f60
lea ecx, [esp + 0x20]
call fcn.00415c20
lea ecx, [esp + 0x10]
call fcn.00415c20
xor eax, eax
jmp 0x42f34d