Function at 0x404340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x74
push ebx
push esi
push edi
push 0xa
push 0x4bbba0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4e7ebc], eax
mov eax, dword [ebp + 8]
push 0x4e6d58
mov dword [0x4e7ecc], eax
call esi
push 0x4e6d40
call esi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x4e86f8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40448c
xor ecx, ecx
mov word [0x4e86f8], cx
mov eax, 0x4bd2c4
mov dword [0x4e86f4], eax
mov eax, dword [sym.imp.MSVCR100.dll___argc]
mov eax, dword [eax]
mov edi, 1
mov byte [esp + 0x2c], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x22], 0
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], edi
cmp eax, edi
jle 0x404730
mov ebx, dword [sym.imp.MSVCR100.dll__wcsicmp]
jmp 0x4043f0
cmp byte [esp + 0x22], 0
mov ecx, dword [sym.imp.MSVCR100.dll___wargv]
mov edx, dword [ecx]
mov esi, dword [edx + edi*4]
je 0x4044ff
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x44]
push 0x4bbc68
push ecx
call dword [sym.imp.MSVCR100.dll__swprintf]
add esp, 0xc
cmp word [esp + 0x40], 0
mov edi, eax
je 0x4045c0
lea edx, [esp + 0x23]
push edx
push 3
lea eax, [esp + 0x40]
push eax
push edi
lea ecx, [esp + 0x50]
push ecx
mov ecx, 0x4ea1d0
call fcn.0043d1c0
test eax, eax
jne 0x404472
cmp byte [esp + 0x23], al
mov edx, dword [esp + 0x38]
setne al
mov ecx, edi
inc eax
push eax
push edx
push 0x4ea1d0
lea edx, [esp + 0x4c]
call fcn.0043d770
test eax, eax
je 0x4045c0
push 1
push 0
push 0xffffffffffffffff
push esi
push eax
call fcn.004a2810
inc dword [esp + 0x28]
mov edi, dword [esp + 0x24]
jmp 0x40471d
cmp word [0x4e86f8], 0
je 0x4043a5
mov eax, 0x4e86f8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4044a2
sub eax, edx
sar eax, 1
mov ebx, eax
lea edi, [ebx + ebx]
lea eax, [edi + 2]
call fcn.0049b590
mov esi, eax
test esi, esi
jne 0x4044df
push 0x4e86f8
push 0x4bd2fc
mov ecx, 0x4ea1d0
call fcn.00449df0
xor eax, eax
jmp 0x4043aa
test ebx, ebx
je 0x4044f2
push edi
push 0x4e86f8
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
xor edx, edx
mov word [edi + esi], dx
mov eax, esi
jmp 0x4043aa
push 0x4bbc70
push esi
call ebx
add esp, 8
test eax, eax
je 0x404718
push str._restart
push esi
call ebx
add esp, 8
test eax, eax
je 0x404718
push 0x4bbc8c
push esi
call ebx
add esp, 8
test eax, eax
je 0x40470f
push str._force
push esi
call ebx
add esp, 8
test eax, eax
je 0x40470f
push str._ErrorStdOut
push esi
call ebx
add esp, 8
test eax, eax
jne 0x404566
mov byte [0x4eacc7], 1
jmp 0x40471d
push str._iLib
push esi
call ebx
add esp, 8
test eax, eax
jne 0x4045ce
mov eax, dword [sym.imp.MSVCR100.dll___argc]
inc edi
cmp edi, dword [eax]
jge 0x4045c0
push 0x38
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
test eax, eax
je 0x404599
mov esi, eax
call fcn.00403f40
mov ecx, eax
jmp 0x40459b
xor ecx, ecx
mov edx, dword [sym.imp.MSVCR100.dll___wargv]
mov dword [0x4eacc8], ecx
mov edx, dword [edx]
mov edx, dword [edx + edi*4]
push 0x15
mov eax, 0xfde9
call fcn.0049c090
test al, al
jne 0x40471d
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4bbccc
push esi
call ebx
add esp, 8
test eax, eax
je 0x404703
push str._Execute
push esi
call ebx
add esp, 8
test eax, eax
je 0x404703
push 3
push 0x4bbce8
push esi
call dword [sym.imp.MSVCR100.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40461b
add esi, 6
call fcn.00403dd0
mov dword [0x4e7eec], eax
jmp 0x40471d
cmp dword [0x4e9890], 0xffffffff
jne 0x4046de
push 6
push str._Debug
push esi
call dword [sym.imp.MSVCR100.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4046de
movzx eax, word [esi + 0xc]
test ax, ax
je 0x404653
cmp eax, 0x3d
jne 0x4046de
cmp eax, 0x3d
jne 0x4046be
add esi, 0xe
push 0x3a
push esi
call dword [sym.imp.MSVCR100.dll_wcsrchr]
mov edi, eax
add esp, 8
test edi, edi
je 0x404699
sub eax, esi
sar eax, 1
push eax
push esi
mov eax, 0x4e5d5c
call fcn.0049ba10
push 0xffffffffffffffff
add edi, 2
push edi
mov eax, 0x4e5d68
call fcn.0049ba10
mov edi, dword [esp + 0x34]
add esp, 0x10
jmp 0x40471d
push 0xffffffffffffffff
push esi
mov eax, 0x4e5d5c
call fcn.0049ba10
add esp, 8
push 0x4e5d68
mov eax, str.9000
call fcn.00404b40
mov edi, dword [esp + 0x24]
jmp 0x40471d
push 0x4e5d5c
mov eax, str.127.0.0.1
call fcn.00404b40
push 0x4e5d68
mov eax, str.9000
call fcn.00404b40
jmp 0x40471d
cmp dword [0x4e7ebc], 0
mov byte [esp + 0x22], 1
jne 0x4046f9
lea ecx, [edi + 1]
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ecx
jmp 0x40471d
dec edi
lea ecx, [edi + 1]
mov dword [esp + 0x30], ecx
jmp 0x40471d
mov dword [0x4e7ebc], 0
jmp 0x40471d
mov byte [0x4e8011], 1
jmp 0x40471d
mov byte [esp + 0x2c], 1
mov edx, dword [sym.imp.MSVCR100.dll___argc]
inc edi
mov dword [esp + 0x24], edi
cmp edi, dword [edx]
jl 0x4043f0
lea eax, [esp + 0x23]
push eax
push 3
lea ecx, [esp + 0x40]
push ecx
push 0
push 0x4bbb9c
mov ecx, 0x4ea1d0
call fcn.0043d1c0
test eax, eax
jne 0x404770
cmp byte [esp + 0x23], al
mov edx, dword [esp + 0x38]
setne al
xor ecx, ecx
inc eax
push eax
push edx
push 0x4ea1d0
mov edx, 0x4bbb9c
call fcn.0043d770
mov ecx, eax
test ecx, ecx
je 0x4045c0
mov eax, dword [esp + 0x28]
dec eax
cdq
push 0x18
push edx
push eax
mov eax, ecx
call fcn.004010e0
lea eax, [esp + 0x23]
push eax
push 0xc1
lea ecx, [esp + 0x40]
push ecx
push 6
push str.A_Args
mov ecx, 0x4ea1d0
call fcn.0043d1c0
test eax, eax
jne 0x4047d6
cmp byte [esp + 0x23], al
mov edx, dword [esp + 0x38]
setne al
mov ecx, 6
inc eax
or eax, 0xc0
push eax
push edx
push 0x4ea1d0
mov edx, str.A_Args
call fcn.0043d770
mov esi, eax
test esi, esi
je 0x4045c0
mov eax, dword [sym.imp.MSVCR100.dll___argc]
mov ebx, dword [eax]
mov ecx, dword [sym.imp.MSVCR100.dll___wargv]
mov eax, dword [esp + 0x30]
mov edx, dword [ecx]
sub ebx, eax
lea eax, [edx + eax*4]
push eax
call fcn.0048f390
add esp, 4
test eax, eax
je 0x4045c0
mov edi, eax
mov ecx, esi
call fcn.004a2b40
call fcn.00404d50
cmp dword [0x4e7e8c], 0
je 0x404b2a
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CryptEncrypt
push esi
call edi
push str.CryptDecrypt
push esi
mov dword [0x4e892c], eax
call edi
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
push ecx
push edx
push 0x4ea1d0
mov dword [0x4e8930], eax
call fcn.0042a1c0
cmp eax, 1
jne 0x4045c0
mov esi, dword [0x4e4b24]
mov ecx, 0x42
mov edi, 0x4e6aa8
mov eax, 0x4ea1d0
rep movsd dword es:[edi], dword [esi]
call fcn.0042b7d0
cmp eax, 0xffffffff
jne 0x4048b0
mov esi, dword [0x4eacc8]
test esi, esi
je 0x4045c0
call fcn.00403e80
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
je 0x404b2a
mov eax, dword [0x4e8044]
test eax, eax
jne 0x404900
mov eax, dword [0x4e5d74]
cmp word [eax], 0
jne 0x4048f4
cmp dword [0x4e8990], 0
jne 0x4048f4
cmp dword [0x4e8020], 0
jne 0x4048f4
cmp dword [0x4e8024], 0
jne 0x4048f4
cmp byte [0x4e8048], 0
je 0x404978
mov dword [0x4e8044], 1
jmp 0x404905
cmp eax, 4
je 0x404978
cmp byte [esp + 0x2c], 0
jne 0x404983
cmp byte [0x4e8011], 0
jne 0x404a01
mov ecx, dword [0x4eacc0]
push ecx
push 0x4bbd60
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x404a01
mov eax, dword [0x4e8044]
cmp eax, 3
je 0x404b2a
cmp eax, 2
je 0x404971
fldz
mov edx, dword [0x4eacb4]
push 0
sub esp, 8
fstp qword [esp]
push edx
push 4
push str.An_older_instance_of_this_script_is_already_running.__Replace_it_with_this_instance__nNote:_To_avoid_this_message__see_SingleInstance_in_the_help_file.
call fcn.004a4470
add esp, 0x18
cmp eax, 7
je 0x404b2a
mov eax, 0x407
jmp 0x40499f
cmp byte [esp + 0x2c], 0
je 0x404a01
mov eax, dword [0x4eacc0]
push eax
push 0x4bbd60
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x404a01
mov eax, 0x406
push 0
push eax
push 0x44
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
xor esi, esi
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4049fd
cmp esi, 0x64
jne 0x4049ed
fldz
push 0
sub esp, 8
fstp qword [esp]
push 0
push 4
push str.Could_not_close_the_previous_instance_of_this_script.__Keep_waiting_
call fcn.004a4470
add esp, 0x18
cmp eax, 7
je 0x4045c0
xor esi, esi
push 0x32
inc esi
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4049c2
push 0x64
call ebx
call fcn.004a5230
mov eax, 0x4ea1d0
call fcn.0042a6f0
cmp eax, 1
jne 0x4045c0
push 0
push 4
push 0
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
push eax
call dword [sym.imp.MSVCR100.dll_setvbuf]
mov esi, dword [0x4e4a30]
add esp, 0x10
test esi, esi
je 0x404a61
imul esi, esi, 0xd4
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [0x4e8934], eax
test eax, eax
je 0x404a61
push esi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp byte [0x4eae8a], 0
jne 0x404a85
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 0x1ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edx, dword [0x4e5d60]
test edx, edx
je 0x404acb
cmp dword [edx + 8], 0
je 0x404acb
mov eax, dword [0x4e5d6c]
test eax, eax
je 0x404aa6
mov eax, dword [eax]
mov ecx, eax
test eax, eax
jne 0x404aab
mov ecx, 0x4bbf48
mov eax, dword [edx]
test eax, eax
jne 0x404ab6
mov eax, 0x4bbf48
push ecx
push eax
call fcn.0040aa80
test eax, eax
jne 0x404acb
mov esi, 0x4e9880
call fcn.00406590
push 0x4a1e30
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [0x4e8040], eax
call fcn.00413780
push 3
push 0
push str.Clipboard
mov ecx, 0x4ea1d0
mov byte [0x4eacc4], 1
mov byte [0x4e86ed], 0
call fcn.0043d150
test eax, eax
je 0x404b0c
call fcn.00403e20
push 0x4ea1d0
call fcn.0042ac70
test eax, eax
je 0x4045c0
push 0
push 0xa
call fcn.00401510
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10