Function at 0x4b1150
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1840
call fcn.0044c8e0
mov eax, dword [0x502204]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x8f4], 0
mov dword [ebp - 0x1828], ebx
mov dword [ebp - 0x1814], edi
mov byte [ebx + 0x8f5], 0
jne 0x4b1b0d
push 0x43
mov byte [ebp - 0x180d], 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne al
mov byte [ebx + 6], al
lea eax, [ebp - 0x181c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4b12a8
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1820], 0
push eax
push 0x800
lea eax, [ebp - 0x180c]
push eax
push 1
push dword [ebp - 0x181c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4b12a8
push dword [ebp - 0x181c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x800
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x100c]
push 0x800
push 0
push eax
call fcn.0044eee0
add esp, 0xc
mov dword [ebp - 0x1818], 0x400
lea eax, [ebp - 0x183c]
mov dword [ebp - 0x1824], 0x400
push eax
lea eax, [ebp - 0x1824]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 0x180c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
lea eax, [ebp - 0x80c]
push str.SYSTEM
push eax
call fcn.00477e16
add esp, 8
test eax, eax
jne 0x4b12a4
lea eax, [ebp - 0x100c]
push str.NT_AUTHORITY
push eax
call fcn.00477e16
add esp, 8
test eax, eax
je 0x4b12a8
xor al, al
jmp 0x4b12aa
mov al, 1
push edi
mov ecx, ebx
mov byte [ebx + 7], al
call fcn.004af5c0
neg al
push 0x208
sbb al, al
and byte [ebp - 0x180d], al
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4b132f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x1814]
mov edi, eax
call fcn.004a7c10
push 0x4e5b20
mov esi, eax
push 0x4e3d38
push esi
call fcn.004a4cb0
add esp, 0xc
push edi
push 0x4e3cfc
push esi
call fcn.004a4cb0
mov edi, dword [ebp - 0x1814]
add esp, 0xc
xor al, al
jmp 0x4b13b4
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1340
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x216], 0x5c
jne 0x4b1377
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x4b1b22
xor eax, eax
mov word [ebp + ecx - 0x214], ax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x1838]
call fcn.004b7750
mov esi, dword [ebp - 0x1830]
lea ecx, [ebx + 0x2c]
lea eax, [esi + 4]
push eax
call fcn.004a5ed0
test esi, esi
je 0x4b13b2
push esi
call fcn.00459651
add esp, 4
mov al, 1
and byte [ebp - 0x180d], al
lea eax, [ebp - 0x924]
push 0x114
push 0
push eax
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x124]
push 0x114
push 0
push eax
call fcn.0044eee0
add esp, 0xc
lea edx, [ebp - 0x124]
lea ecx, [ebp - 0x924]
call fcn.004ab0a0
mov esi, dword [ebp - 0x920]
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x1818], eax
cmp esi, 6
jae 0x4b1417
mov word [ebx], 0
jmp 0x4b14a7
push 0x400
lea ecx, [ebp - 0x180c]
mov byte [ebx], 1
push ecx
push 0
call eax
lea ecx, [ebp - 0x180c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1433
sub ecx, edx
sar ecx, 1
push 0x4e5a84
lea eax, [ebp + ecx*2 - 0x1824]
push eax
call fcn.00477e16
add esp, 8
test eax, eax
sete al
mov byte [ebx + 1], al
mov eax, dword [ebp - 0x91c]
cmp esi, 6
ja 0x4b1471
jne 0x4b14a7
cmp eax, 2
jb 0x4b14a7
mov byte [ebx + 0x904], 1
cmp esi, 0xa
jae 0x4b14a0
cmp esi, 6
jne 0x4b1487
cmp eax, 4
jae 0x4b14a0
mov eax, dword [ebp - 0x120]
cmp eax, 0xa
jae 0x4b14a0
cmp eax, 6
jne 0x4b14a7
cmp dword [ebp - 0x11c], 4
jb 0x4b14a7
mov byte [ebx + 0x905], 1
push edi
mov ecx, ebx
call fcn.004af2c0
test al, al
jne 0x4b14bb
mov byte [ebp - 0x180d], al
jmp 0x4b152c
push edi
mov ecx, ebx
call fcn.004aefc0
test al, al
jne 0x4b14cf
mov byte [ebp - 0x180d], al
jmp 0x4b152c
xor eax, eax
lea edi, [ebx + 0x5c]
mov word [edi], ax
xor ecx, ecx
mov esi, dword [ebx + 0x54]
add esi, 4
movzx eax, word [esi]
test ax, ax
je 0x4b1518
mov edx, eax
nop dword [eax]
movzx eax, dx
lea esi, [esi + 2]
shl ecx, 4
add ecx, eax
mov edx, ecx
and edx, 0xf0000000
je 0x4b150e
mov eax, edx
shr eax, 0x18
xor eax, edx
xor ecx, eax
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x4b14f0
push 0x10
push 0x11
push edi
push ecx
call fcn.004793ce
mov edi, dword [ebp - 0x1814]
add esp, 0x10
push str.2584
lea eax, [ebx + 0x7e]
push 0xb
push eax
call fcn.004785e4
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0xc
call esi
call esi
push eax
lea ecx, [ebx + 0x8b4]
call fcn.004a5ed0
mov eax, dword [ebx + 0x8bc]
lea ecx, [ebx + 0x8c4]
add eax, 4
push eax
call fcn.004a5ed0
lea ecx, [ebx + 0x8c4]
call fcn.004a4510
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0044eee0
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0
call dword [ebp - 0x1818]
test eax, eax
jne 0x4b15c4
mov ecx, edi
call fcn.004a7c10
push 0x4e5cc4
push 0x4e3d38
push eax
call fcn.004a4cb0
add esp, 0xc
xor al, al
jmp 0x4b16b2
xor eax, eax
lea ecx, [ebp - 0x214]
mov word [ebp - 0xe], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b15d3
sub ecx, edx
sar ecx, 1
mov dword [ebx + 0x8e8], ecx
lea edi, [ecx + 1]
mov ecx, dword [ebx + 0x8ec]
mov esi, dword [ecx]
cmp edi, esi
jbe 0x4b1628
lea esi, [esi*2 + 0x10]
and esi, 0xfff0
cmp edi, esi
cmovae esi, edi
lea eax, [esi*2 + 4]
push eax
push ecx
call fcn.00478579
mov dword [ebx + 0x8ec], eax
add esp, 8
mov dword [eax], esi
mov ecx, dword [ebx + 0x8ec]
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ecx + 4]
push eax
call fcn.0044e3e0
add esp, 0xc
lea ecx, [ebx + 0x8e4]
call fcn.004a4510
xor edx, edx
xor eax, eax
lea edi, [edx + 0x5c]
lea ebx, [edx + 0x2f]
nop dword [eax]
nop dword [eax + eax]
movzx ecx, word [ebp + eax*2 - 0x214]
xor esi, esi
cmp si, cx
je 0x4b1684
cmp di, cx
je 0x4b1679
cmp bx, cx
jne 0x4b167c
lea edx, [eax + 1]
inc eax
cmp eax, 0x103
jl 0x4b1660
mov ebx, dword [ebp - 0x1828]
lea eax, [ebp - 0x214]
lea eax, [eax + edx*2]
push eax
lea ecx, [ebx + 0x8d4]
call fcn.004a5ed0
lea ecx, [ebx + 0x8d4]
call fcn.004a4510
mov edi, dword [ebp - 0x1814]
mov al, 1
and al, byte [ebp - 0x180d]
xor esi, esi
mov ecx, dword [str.iexplore.exe]
mov byte [ebp - 0x180d], al
mov word [ebx + 2], 0
test ecx, ecx
je 0x4b16f7
mov eax, dword [ebx + 0x8cc]
push ecx
add eax, 4
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b182e
mov ecx, dword [esi*4 + 0x4e6c44]
inc esi
test ecx, ecx
jne 0x4b16d0
xor al, al
push ecx
mov ecx, ebx
mov byte [ebx + 5], al
call fcn.004ae710
neg al
mov byte [ebx + 8], 0
push 0x4e66b8
sbb al, al
and byte [ebp - 0x180d], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b17d1
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.safari.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b17d1
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.nlnotes.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b17d1
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.baidumusic.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b17d1
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.qq.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b17d1
push str.qqmusic.exe
mov ecx, ebx
call fcn.004aed40
test al, al
jne 0x4b17d1
push str.aliworkbench.exe
mov ecx, ebx
call fcn.004aed40
test al, al
jne 0x4b17d1
push str.aliapp.exe
mov ecx, ebx
call fcn.004aed40
test al, al
je 0x4b17d5
mov byte [ebx + 8], 1
mov al, byte [ebx + 0x91b]
test al, al
je 0x4b1835
cmp al, 1
jne 0x4b17ec
mov byte [ebx + 8], al
mov al, byte [ebx + 0x91b]
test al, al
je 0x4b1835
cmp al, 1
jne 0x4b1835
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.opera.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b1835
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.theworld.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b1835
mov al, 1
jmp 0x4b1837
mov al, 1
jmp 0x4b16f9
xor al, al
mov byte [ebx + 9], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.specialforce.exe
push eax
call fcn.0044f2a3
test eax, eax
push str.coreldrw.exe
sete al
mov byte [ebx + 0x8f9], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
push eax
call fcn.0044f2a3
test eax, eax
push str.main.exe
setne al
mov byte [ebx + 0x8fa], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
mov byte [ebx + 0x8fb], 1
push eax
call fcn.0044f2a3
add esp, 0x18
test eax, eax
je 0x4b1932
push 4
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
call fcn.0046c3ce
add esp, 4
mov dword [ebp - 0x1830], eax
lea ecx, [ebp - 0x1838]
mov dword [ebp - 0x182c], 0
mov dword [eax], 0
call fcn.004a60e0
lea ecx, [ebp - 0x1838]
call fcn.004ade20
mov esi, dword [ebp - 0x1830]
test al, al
je 0x4b1925
mov ecx, str.WebZen
lea eax, [esi + 4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b1916
test dx, dx
je 0x4b1912
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b1916
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b18f0
xor eax, eax
jmp 0x4b191b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4b1925
mov byte [ebx + 0x8fb], al
test esi, esi
je 0x4b1932
push esi
call fcn.00459651
add esp, 4
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.gonline.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b196c
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.lataleclient.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b196c
xor al, al
jmp 0x4b196e
mov al, 1
mov byte [ebx + 0x8fc], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
mov byte [ebx + 0x8fd], 0
push str.powerpnt.exe
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
je 0x4b199d
mov byte [ebx + 0x8fd], 1
push ecx
mov ecx, ebx
call fcn.004aeb40
mov ecx, dword [str.dnf.exe]
neg al
sbb al, al
xor esi, esi
and al, byte [ebp - 0x180d]
mov byte [ebp - 0x180d], al
test ecx, ecx
je 0x4b19e8
mov eax, dword [ebx + 0x8cc]
push ecx
add eax, 4
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b1ab0
mov ecx, dword [esi*4 + 0x4e6b84]
inc esi
test ecx, ecx
jne 0x4b19c1
mov al, byte [ebx + 4]
push ecx
mov ecx, ebx
mov byte [ebx + 0x8f7], al
call fcn.004ae8d0
mov ecx, dword [0x4e6bc0]
neg al
sbb al, al
xor esi, esi
and al, byte [ebp - 0x180d]
mov byte [ebp - 0x180d], al
test ecx, ecx
je 0x4b1a3c
mov eax, dword [ebx + 0x8cc]
push ecx
add eax, 4
push eax
call fcn.0044f2a3
add esp, 8
test eax, eax
jne 0x4b1ab7
mov ecx, dword [esi*4 + 0x4e6bc4]
inc esi
test ecx, ecx
jne 0x4b1a15
xor al, al
mov byte [ebx + 0x8fe], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
push str.acad.exe
push eax
call fcn.0044f2a3
test eax, eax
push str.flash.exe
setne al
mov byte [ebx + 0x8ff], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
push eax
call fcn.0044f2a3
test eax, eax
push str.ppstream.exe
setne al
mov byte [ebx + 0x900], al
mov eax, dword [ebx + 0x8cc]
add eax, 4
push eax
call fcn.0044f2a3
add esp, 0x18
test eax, eax
setne al
mov byte [ebx + 0x901], al
mov al, byte [ebx + 0x91b]
test al, al
jne 0x4b1abb
jmp 0x4b1ac0
mov al, 1
jmp 0x4b19eb
mov al, 1
jmp 0x4b1a3e
cmp al, 1
sete al
push ecx
mov ecx, ebx
mov byte [ebx + 0x902], al
call fcn.004afeb0
cmp byte [ebp - 0x180d], 0
jne 0x4b1b06
mov ecx, edi
call fcn.004a7c10
push 0x4e5a64
push 0x4e3d38
push eax
call fcn.004a4cb0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret 4
mov byte [ebx + 0x8f4], 1
mov ecx, dword [ebp - 8]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c8c5
mov esp, ebp
pop ebp
ret 4
call fcn.0044d18d
int3