Function at 0x437ad0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x472e54
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x490d68]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
mov eax, dword [0x490d68]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor ebp, ebp
cmp edi, ebp
je 0x437c70
mov ecx, edi
call fcn.0043bec0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.0041e3d0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x244], ebp
call fcn.00426a80
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov dword [esp + 0x240], 0xffffffff
cmp ecx, dword [0x48f010]
je 0x437b78
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x437b78
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00457d84
add esp, 4
mov ecx, esi
call fcn.004271f0
mov ecx, edi
call fcn.0043cc00
test eax, eax
je 0x437c70
mov ecx, edi
call fcn.0043bd20
cmp eax, ebp
je 0x437c70
mov ecx, edi
call fcn.0043bd90
cmp eax, 1
je 0x437bb7
cmp eax, 2
je 0x437bb7
cmp eax, 3
je 0x437bb7
xor ebx, ebx
jmp 0x437bbc
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov eax, dword [eax]
push eax
call fcn.00458041
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0041a630
mov ecx, edi
call fcn.0043bd30
cmp eax, ebp
je 0x437c04
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x70]
call eax
cmp eax, esi
je 0x437c04
cmp ebx, ebp
je 0x437c04
push 4
mov ecx, edi
call fcn.0043bda0
mov ecx, edi
call fcn.0043bea0
cmp eax, ebp
je 0x437c70
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
test eax, eax
jne 0x437c77
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041caa0
mov esi, eax
push 0xab
lea ecx, [esp + 0x14]
mov dword [esp + 0x244], 1
call fcn.0041caa0
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push ebp
mov ecx, edi
mov byte [esp + 0x254], 2
call fcn.0043bed0
lea ecx, [esp + 0x10]
call fcn.0041a630
lea ecx, [esp + 0x14]
call fcn.0041a630
xor eax, eax
jmp 0x437dc0
mov ecx, edi
call fcn.0043bd30
mov esi, eax
call fcn.00434d90
test eax, eax
jne 0x437ce5
push 0x96
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov esi, eax
push 0xa9
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 3
call fcn.0041caa0
mov byte [esp + 0x240], 4
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push ebp
mov ecx, edi
call fcn.0043bed0
lea ecx, [esp + 0x14]
call fcn.0041a630
lea ecx, [esp + 0x10]
call fcn.0041a630
xor eax, eax
jmp 0x437dc0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, edi
test eax, eax
jne 0x437d6c
call fcn.0043be60
test eax, eax
je 0x437d36
call fcn.004378a0
test eax, eax
je 0x437cde
push 0x96
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov esi, eax
push 0xa8
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 5
call fcn.0041caa0
mov byte [esp + 0x240], 6
jmp 0x437cba
push 0x96
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov esi, eax
push 0xa7
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 7
call fcn.0041caa0
mov byte [esp + 0x240], 8
jmp 0x437cba
call fcn.0043be60
mov ecx, edi
test eax, eax
je 0x437de7
call fcn.0043be70
test eax, eax
jne 0x437db6
push 0x96
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov esi, eax
push 0x97
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 9
call fcn.0041caa0
mov byte [esp + 0x240], 0xa
jmp 0x437cba
call fcn.004378a0
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0045715c
add esp, 0x234
ret
call fcn.0043bec0
mov ecx, eax
call fcn.004267c0
mov ecx, edi
test eax, eax
je 0x437f3b
call fcn.0043bd90
test eax, eax
jne 0x437e3c
push 0x96
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov esi, eax
push 0xb8
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 0xb
call fcn.0041caa0
mov byte [esp + 0x240], 0xc
jmp 0x437cba
mov ecx, edi
call fcn.0043bd90
cmp eax, 3
jne 0x437e7e
push 0x96
lea ecx, [esp + 0x14]
call fcn.0041caa0
mov esi, eax
push 0x92
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 0xd
call fcn.0041caa0
mov byte [esp + 0x240], 0xe
jmp 0x437cba
mov ecx, edi
call fcn.0043bd90
push 0x96
lea ecx, [esp + 0x14]
cmp eax, 4
jne 0x437ec0
call fcn.0041caa0
mov esi, eax
push 0x257
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 0xf
call fcn.0041caa0
mov byte [esp + 0x240], 0x10
jmp 0x437cba
call fcn.0041caa0
mov esi, eax
push 0xac
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 0x11
call fcn.0041caa0
mov esi, dword [esi]
mov eax, dword [eax]
push 1
push 0x40
push esi
push eax
push ebp
mov ecx, edi
mov byte [esp + 0x254], 0x12
call fcn.0043bed0
lea ecx, [esp + 0x14]
call fcn.0041a630
lea ecx, [esp + 0x10]
mov dword [esp + 0x240], 0xffffffff
call fcn.0041a630
mov ecx, edi
call fcn.0043be20
mov ecx, edi
mov dword [eax], ebp
call fcn.0043be30
mov ecx, edi
mov dword [eax], ebp
call fcn.0043be40
mov dword [eax], 1
jmp 0x437dbb
call fcn.0043bd90
cmp eax, 4
ja case.0x437f49.3
jmp dword [eax*4 + 0x438208]
lea eax, [esp + 0x10]
push eax
push ebp
mov ecx, edi
mov dword [esp + 0x18], ebp
call fcn.0043be10
mov ecx, eax
call fcn.0041f680
cmp dword [esp + 0x10], ebp
je 0x437fca
push 0x96
lea ecx, [esp + 0x24]
call fcn.0041caa0
mov esi, eax
push 0xd0
lea ecx, [esp + 0x18]
mov dword [esp + 0x244], 0x13
call fcn.0041caa0
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x30
push ecx
push edx
push ebp
mov ecx, edi
mov byte [esp + 0x254], 0x14
call fcn.0043bed0
lea ecx, [esp + 0x14]
call fcn.0041a630
lea ecx, [esp + 0x20]
call fcn.0041a630
xor eax, eax
jmp 0x437dc0
cmp eax, ebp
je 0x437cde
mov ecx, edi
call fcn.0043bd30
mov ecx, edi
mov esi, eax
call fcn.0043c330
mov ebx, eax
cmp ebx, ebp
je 0x437dbb
cmp esi, ebp
je 0x437dbb
mov eax, dword [esi]
mov ecx, dword [eax + 0x30]
mov ebp, dword [ebx]
push esi
call ecx
mov edx, dword [ebp + 0x54]
push eax
push ebx
call edx
movzx eax, ax
test ax, ax
jne 0x437dbb
mov eax, dword [0x48f014]
mov dword [esp + 0x10], eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x30]
push esi
mov dword [esp + 0x244], 0x1b
call edx
push eax
lea eax, [esp + 0x14]
push 0x9b
push eax
call fcn.00426550
add esp, 0xc
push 0x96
lea ecx, [esp + 0x28]
call fcn.0041caa0
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 1
push 0x10
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x254], 0x1c
call fcn.0043bed0
lea ecx, [esp + 0x24]
call fcn.0041a630
lea ecx, [esp + 0x10]
call fcn.0041a630
xor eax, eax
jmp 0x437dc0
mov ecx, edi
call fcn.0043bec0
mov ecx, eax
call fcn.004267d0
mov eax, dword [eax]
cmp dword [eax - 8], ebp
je 0x4380b6
mov ecx, edi
call fcn.0043bec0
mov ecx, eax
call fcn.004267d0
push eax
mov ecx, edi
call fcn.0043bd60
mov ecx, eax
call fcn.0041c4a0
mov ecx, edi
call fcn.0043bd60
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0041e390
call fcn.00437930
add esp, 4
cmp eax, ebp
jne case.0x437f49.3
push 0x206
lea edx, [esp + 0x32]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x38], cx
call fcn.00457170
add esp, 0xc
push 0x104
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.0x437f49.3
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041e3d0
mov ebx, 0x15
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x244], ebx
call fcn.00427aa0
inc eax
push eax
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call fcn.004234c0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x244], 0x16
call fcn.0041c4a0
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], bl
call fcn.0041a630
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.0043bd60
mov ecx, eax
call fcn.0041c4a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x240], 0xffffffff
call fcn.0041a630
jmp case.0x437f49.3
push 0x257
lea ecx, [esp + 0x2c]
call fcn.0041caa0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x244], 0x17
call fcn.0041e3d0
lea ecx, [esp + 0x28]
mov byte [esp + 0x240], 0x19
call fcn.0041a630
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041caa0
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0x40
push ecx
push edx
push ebp
mov ecx, edi
mov byte [esp + 0x250], 0x1a
call fcn.0043bf30
lea ecx, [esp + 0x1c]
call fcn.0041a630
lea ecx, [esp + 0x10]
call fcn.0041a630
xor eax, eax
jmp 0x437dc0