Function at 0x439f20
Capabilities:
Accept command line arguments
Enumerate process modules
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x482fe9
mov eax, dword fs:[0]
push eax
mov eax, 0x2a34
call fcn.00462bf0
mov eax, dword [0x4a60f8]
xor eax, esp
mov dword [esp + 0x2a30], eax
push ebx
push edi
mov eax, dword [0x4a60f8]
xor eax, esp
push eax
lea eax, [esp + 0x2a40]
mov dword fs:[0], eax
xor ebx, ebx
cmp esi, ebx
je 0x43a100
mov ecx, esi
call fcn.00423f00
mov edi, eax
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.0041d2c0
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x2a4c], ebx
call fcn.00424180
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov dword [esp + 0x2a48], 0xffffffff
cmp ecx, dword [0x4a4010]
je 0x439fcf
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x439fcf
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00462471
add esp, 4
mov ecx, edi
call fcn.00424900
mov ecx, dword [0x4a7d4c]
cmp ecx, ebx
je 0x439fee
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
push ebx
push ebx
push 0xe10
call eax
mov ecx, esi
call fcn.004412c0
test eax, eax
je 0x43a100
mov ecx, esi
call fcn.0045eaf0
cmp eax, ebx
je 0x43a100
mov ecx, esi
call fcn.0043e9d0
cmp eax, 1
je 0x43a022
cmp eax, 2
je 0x43a022
cmp eax, 3
jne 0x43a027
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x10]
call fcn.0041c430
mov eax, dword [eax]
push eax
call fcn.0046275a
add esp, 4
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.0041b2e0
mov ecx, esi
call fcn.00448340
test eax, eax
je 0x43a06f
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push eax
call edx
cmp eax, edi
je 0x43a06f
test ebx, ebx
je 0x43a06f
push 4
mov ecx, esi
call fcn.0043e9e0
mov ecx, esi
call fcn.00448340
mov ecx, eax
call fcn.00437770
test eax, eax
jne 0x43a107
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041c430
mov edi, eax
push 0xa9
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 1
call fcn.0041c430
mov edi, dword [edi]
mov eax, dword [eax]
push 1
push 0x30
push edi
push eax
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 2
call fcn.00440a60
lea ecx, [esp + 0xc]
call fcn.0041b2e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2a48], 0xffffffff
call fcn.0041b2e0
mov ecx, dword [0x4a7d4c]
test ecx, ecx
je 0x43a100
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push 0
push 0
push 0xe17
call edx
xor eax, eax
jmp 0x43a74c
mov ecx, esi
call fcn.0043ec40
test eax, eax
je 0x43a100
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
test eax, eax
jne 0x43a12c
mov ecx, esi
call fcn.004391b0
xor eax, eax
jmp 0x43a74c
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, esi
test eax, eax
jne 0x43a1e2
call fcn.0043eab0
test eax, eax
je 0x43a185
call fcn.004398f0
test eax, eax
je 0x43a1db
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041c430
mov edi, eax
push 0xa8
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 3
call fcn.0041c430
mov byte [esp + 0x2a48], 4
jmp 0x43a1b6
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041c430
mov edi, eax
push 0xa7
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 5
call fcn.0041c430
mov byte [esp + 0x2a48], 6
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
call fcn.00440a60
lea ecx, [esp + 0xc]
call fcn.0041b2e0
lea ecx, [esp + 0x1c]
call fcn.0041b2e0
xor eax, eax
jmp 0x43a74c
call fcn.0043eab0
mov ecx, esi
test eax, eax
je 0x43a3be
call fcn.0043eac0
test eax, eax
jne 0x43a257
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c430
mov edi, eax
push 0x97
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2a4c], 7
call fcn.0041c430
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 8
call fcn.00440a60
lea ecx, [esp + 0x18]
call fcn.0041b2e0
lea ecx, [esp + 0x14]
call fcn.0041b2e0
xor eax, eax
jmp 0x43a74c
mov eax, dword [0x4a4014]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x2a4c], 9
call fcn.0043fd40
push 0x48c620
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.0041d3e0
push 0x800
lea ecx, [esp + 0x2240]
push 0
push ecx
mov byte [esp + 0x2a54], 0xa
call fcn.00461950
push 0x2000
lea edx, [esp + 0x44]
push 0
push edx
mov dword [esp + 0x34], 0
call fcn.00461950
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
push 0x800
lea ecx, [esp + 0x3c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x43a33b
xor edi, edi
cmp dword [esp + 0x1c], edi
jbe 0x43a33b
jmp 0x43a2f0
mov eax, dword [esp + edi*4 + 0x34]
push 0x400
lea edx, [esp + 0x2240]
push edx
push eax
call fcn.00439980
add esp, 0xc
test eax, eax
je 0x43a334
lea ecx, [esp + 0x223c]
push ecx
call fcn.00464f68
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2240]
push edx
push eax
call fcn.004626b1
add esp, 0xc
test eax, eax
je 0x43a352
inc edi
cmp edi, dword [esp + 0x1c]
jb 0x43a2f0
lea ecx, [esp + 0xc]
call fcn.0041b2e0
lea ecx, [esp + 0x10]
call fcn.0041b2e0
jmp case.default.0x43a52e
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041c430
mov edi, eax
push 0xe5
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a4c], 0xb
call fcn.0041c430
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 0xc
call fcn.00440a60
lea ecx, [esp + 0x14]
call fcn.0041b2e0
lea ecx, [esp + 0x18]
call fcn.0041b2e0
lea ecx, [esp + 0xc]
call fcn.0041b2e0
lea ecx, [esp + 0x10]
call fcn.0041b2e0
xor eax, eax
jmp 0x43a74c
call fcn.00423f00
mov ecx, eax
call fcn.00423f10
test eax, eax
je 0x43a50d
mov ecx, esi
call fcn.0043e9d0
test eax, eax
jne 0x43a43a
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041c430
mov edi, eax
push 0xb8
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0xd
call fcn.0041c430
mov byte [esp + 0x2a48], 0xe
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
call fcn.00440a60
lea ecx, [esp + 0x14]
call fcn.0041b2e0
lea ecx, [esp + 0x18]
call fcn.0041b2e0
xor eax, eax
jmp 0x43a74c
mov ecx, esi
call fcn.0043e9d0
cmp eax, 3
jne 0x43a479
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041c430
mov edi, eax
push 0x92
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0xf
call fcn.0041c430
mov byte [esp + 0x2a48], 0x10
jmp 0x43a40e
mov ecx, esi
call fcn.0043e9d0
push 0x96
lea ecx, [esp + 0x1c]
cmp eax, 4
jne 0x43a4bb
call fcn.0041c430
mov edi, eax
push 0x257
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0x11
call fcn.0041c430
mov byte [esp + 0x2a48], 0x12
jmp 0x43a40e
call fcn.0041c430
mov edi, eax
push 0xac
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0x13
call fcn.0041c430
mov edi, dword [edi]
mov eax, dword [eax]
push 1
push 0x40
push edi
push eax
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 0x14
call fcn.00440a60
lea ecx, [esp + 0x14]
call fcn.0041b2e0
lea ecx, [esp + 0x18]
call fcn.0041b2e0
jmp case.default.0x43a52e
push esi
call fcn.00439320
add esp, 4
test eax, eax
je 0x43a100
mov ecx, esi
call fcn.0043e9d0
cmp eax, 4
ja case.default.0x43a52e
jmp dword [eax*4 + 0x43a774]
mov edx, 0xe11
call fcn.004367b0
mov edx, 0xe12
jmp 0x43a6e2
mov ecx, esi
call fcn.00423f00
mov ecx, eax
call fcn.00423f20
mov eax, dword [eax]
cmp dword [eax - 8], 0
je 0x43a57c
mov ecx, esi
call fcn.00423f00
mov ecx, eax
call fcn.00423f20
push eax
mov ecx, esi
call fcn.0043e9a0
mov ecx, eax
call fcn.0041be30
mov ecx, esi
call fcn.0043e9a0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0041d280
call fcn.00429050
add esp, 4
test eax, eax
jne case.default.0x43a52e
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x203e]
push edx
mov word [esp + 0x2040], cx
call fcn.00461950
add esp, 0xc
push 0x104
lea eax, [esp + 0x2038]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.default.0x43a52e
lea ecx, [esp + 0x2034]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041d2c0
mov ebx, 0x15
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2a4c], ebx
call fcn.004271a0
inc eax
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.00428000
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4c], 0x16
call fcn.0041be30
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a48], bl
call fcn.0041b2e0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0043e9a0
mov ecx, eax
call fcn.0041be30
lea ecx, [esp + 0x10]
call fcn.0041b2e0
jmp case.default.0x43a52e
push 0x257
lea ecx, [esp + 0x30]
call fcn.0041c430
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 0x17
call fcn.0041d2c0
mov bl, 0x19
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2a48], bl
call fcn.0041b2e0
push 0x96
lea ecx, [esp + 0x34]
call fcn.0041c430
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push 0x40
push eax
push ecx
push 0
mov ecx, esi
mov byte [esp + 0x2a58], 0x1a
call fcn.00440b40
lea ecx, [esp + 0x30]
mov byte [esp + 0x2a48], bl
call fcn.0041b2e0
mov edx, 0xe17
call fcn.004367b0
lea ecx, [esp + 0xc]
call fcn.0041b2e0
xor eax, eax
jmp 0x43a74c
mov edx, 0xe17
call fcn.004367b0
mov edx, dword [0x4a4014]
mov dword [esp + 0x20], edx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x2a4c], 0x1b
call fcn.0043fd40
mov ecx, esi
call fcn.0043ec90
test eax, eax
je 0x43a734
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
mov ecx, dword [esp + 0x28]
call fcn.00423fd0
mov ecx, dword [eax]
push ecx
call fcn.00436540
add esp, 4
push 0
call fcn.00436520
add esp, 4
lea ecx, [esp + 0x20]
call fcn.0041b2e0
mov eax, 1
mov ecx, dword [esp + 0x2a40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x2a30]
xor ecx, esp
call fcn.00461932
add esp, 0x2a40
ret