Function at 0x448613
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x28
mov eax, 0x48a3fa
call fcn.004677c7
xor ebx, ebx
cmp edi, ebx
jne 0x448644
xor eax, eax
jmp 0x448ccb
mov ecx, edi
call fcn.0044c754
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x14]
call fcn.004029f9
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], ebx
call fcn.0042dfba
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
call fcn.0042e2bd
push 0xe10
call fcn.00447b35
pop ecx
mov ecx, edi
call fcn.0044e4a4
test eax, eax
je 0x44863d
push edi
call fcn.0042db1c
pop ecx
mov esi, edi
call fcn.00447860
mov ecx, edi
call fcn.0044a084
cmp eax, ebx
je 0x44863d
mov ecx, edi
call fcn.0044c6bb
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4486cd
cmp eax, 2
je 0x4486cd
mov dword [ebp - 0x14], ebx
cmp eax, 3
jne 0x4486d0
mov dword [ebp - 0x14], ecx
push 0x284e
lea ecx, [ebp - 0x10]
call fcn.00421f25
push dword [eax]
call fcn.004689e7
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004023e9
mov ecx, edi
call fcn.00428edd
cmp eax, ebx
je 0x448715
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
cmp eax, esi
je 0x448715
cmp dword [ebp - 0x14], ebx
je 0x448715
push 4
mov ecx, edi
call fcn.0044c6c2
mov ecx, edi
call fcn.00428edd
mov esi, eax
call fcn.00447cc6
test eax, eax
jne 0x44878a
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0xa9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.00421f25
mov esi, dword [esi]
mov eax, dword [eax]
push 1
push 0x40
push esi
push eax
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0044cf46
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
push 0xe17
call fcn.00447b35
pop ecx
jmp 0x44863d
mov ecx, edi
call fcn.0044c71f
test eax, eax
jne 0x4487a4
mov ecx, edi
call fcn.00448331
test eax, eax
jne 0x44863d
push edi
call fcn.00447f9e
pop ecx
test eax, eax
jne 0x44863d
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, edi
test eax, eax
jne 0x448854
call fcn.0044c71f
test eax, eax
je 0x448802
call fcn.0044815c
test eax, eax
je 0x44863d
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0xa8
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 3
call fcn.00421f25
mov byte [ebp - 4], 4
jmp 0x448829
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0xa7
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 5
call fcn.00421f25
mov byte [ebp - 4], 6
push 1
push 0x40
push dword [esi]
mov ecx, edi
push dword [eax]
push ebx
call fcn.0044cf46
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004023e9
jmp 0x44863d
call fcn.0044c71f
mov ecx, edi
test eax, eax
je 0x448895
call fcn.0044c726
test eax, eax
jne 0x448c72
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0x97
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 7
call fcn.00421f25
mov byte [ebp - 4], 8
jmp 0x448829
call fcn.0044c754
mov ecx, eax
call fcn.0042dd05
test eax, eax
je 0x448a05
mov ecx, edi
call fcn.0044c6bb
test eax, eax
jne 0x4488e0
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0xb8
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 9
call fcn.00421f25
mov byte [ebp - 4], 0xa
jmp 0x448829
mov ecx, edi
call fcn.0044c6bb
cmp eax, 3
jne 0x448918
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0x92
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xb
call fcn.00421f25
mov byte [ebp - 4], 0xc
jmp 0x448829
mov ecx, edi
call fcn.0044c6bb
cmp eax, 4
jne 0x448950
push 0x96
lea ecx, [ebp - 0x18]
call fcn.00421f25
mov esi, eax
push 0x257
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xd
call fcn.00421f25
mov byte [ebp - 4], 0xe
jmp 0x448829
push 0x4c4f30
lea ecx, [ebp - 0x14]
call fcn.00401ce4
push 0x920
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xf
call fcn.00402a5a
push 0x491d28
lea ecx, [ebp - 0x14]
call fcn.00407163
test eax, eax
jne 0x4489d2
push 0x96
lea ecx, [ebp - 0x1c]
call fcn.00421f25
mov esi, eax
push 0xac
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x10
call fcn.00421f25
mov esi, dword [esi]
mov eax, dword [eax]
push 1
push 0x40
push esi
push eax
push ebx
mov ecx, edi
mov byte [ebp - 4], 0x11
call fcn.0044cf46
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xf
call fcn.004023e9
mov ecx, edi
call fcn.0044c703
mov ecx, edi
mov dword [eax], ebx
call fcn.0044c70a
mov ecx, edi
mov dword [eax], ebx
call fcn.0044c711
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov dword [eax], 1
call fcn.004023e9
jmp 0x448c72
push edi
call fcn.0044802d
pop ecx
test eax, eax
je 0x44863d
mov ecx, edi
call fcn.0044c6bb
cmp eax, ebx
je 0x448b7a
jle 0x448c72
cmp eax, 2
jle 0x448ac0
cmp eax, 3
je 0x448ab0
cmp eax, 4
jne 0x448c72
push 0x257
lea ecx, [ebp - 0x24]
call fcn.00421f25
push dword [eax]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0x16
call fcn.004029f9
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x18
call fcn.004023e9
push 0x96
lea ecx, [ebp - 0x34]
call fcn.00421f25
mov eax, dword [eax]
push 0x40
push eax
push dword [ebp - 0x1c]
mov ecx, edi
push ebx
mov byte [ebp - 4], 0x19
call fcn.0044cfed
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x18
call fcn.004023e9
push 0xe17
call fcn.00447b35
pop ecx
mov ecx, dword [ebp - 0x1c]
jmp 0x448847
push 0xe17
call fcn.00447b35
pop ecx
jmp 0x448c72
push 0xe11
mov dword [ebp - 0x14], ebx
call fcn.00447b35
mov esi, str.Close_self_protect.
push esi
lea eax, [ebp - 0x30]
push 0x4c3870
push eax
call fcn.0040d822
push dword [eax]
mov dword [ebp - 4], 0x12
call fcn.0041f6df
mov ecx, dword [ebp - 0x30]
or dword [ebp - 4], 0xffffffff
add esp, 0x14
add ecx, 0xfffffff0
call fcn.004023e9
lea eax, [ebp - 0x14]
push eax
push ebx
mov ecx, edi
call fcn.0044c6fc
mov ecx, eax
call fcn.00425439
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push 0x4c3874
push eax
call fcn.0040d822
push dword [eax]
mov dword [ebp - 4], 0x13
call fcn.0041f6df
mov ecx, dword [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004023e9
cmp dword [ebp - 0x10], ebx
je 0x448b56
push 0xe12
call fcn.00447b35
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x448b67
mov ecx, edi
call fcn.00448195
jmp 0x44877a
cmp dword [ebp - 0x10], ebx
jne 0x448c72
push 0xe13
jmp 0x44877f
mov ecx, edi
call fcn.0044c754
mov ecx, eax
call fcn.0042dd09
mov eax, dword [eax]
cmp dword [eax - 0xc], ebx
je 0x448bae
mov ecx, edi
call fcn.0044c754
mov ecx, eax
call fcn.0042dd09
mov ecx, edi
mov esi, eax
call fcn.0044c69d
push esi
mov ecx, eax
call fcn.00401d13
mov ecx, edi
call fcn.0044c69d
push ecx
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.00402ee2
call fcn.004310d7
pop ecx
cmp eax, ebx
jne 0x448c63
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.004670a0
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x448c63
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004029f9
push ebx
push 0x5c
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0x14
call fcn.00406e85
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00421af0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call fcn.00401d13
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.004023e9
mov ecx, edi
call fcn.0044c69d
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00401d13
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, edi
call fcn.0044e032
cmp eax, ebx
je 0x44863d
push 0x4c4f30
lea ecx, [ebp - 0x20]
call fcn.00401ce4
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
mov dword [ebp - 4], 0x1a
call fcn.0044d477
mov ecx, edi
call fcn.0044c8ca
cmp eax, ebx
je 0x448cb5
push dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov ecx, dword [ebp - 0x18]
call fcn.0042dd58
push dword [eax]
call fcn.00447758
pop ecx
push 1
call fcn.00447742
pop ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004023e9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x20c
leave
ret