Function at 0x43cf70
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov eax, 0x204c
mov ebp, esp
push edi
push esi
push ebx
call fcn.005d4d10
sub esp, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2038], ecx
mov dword [esp + 4], 0x726bc0
mov dword [esp], 0x835180
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2020], 0x726baa
mov dword [esp + 8], eax
call fcn.0041eed0
lea eax, [ebp - 0x201c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
cmp ebx, dword [ebp - 0x201c]
mov dword [ebp - 0x202c], eax
mov eax, dword [ebp - 0x2038]
jae 0x43d243
lea edx, [eax + 0x6000]
lea ecx, [eax + 0x4000]
mov dword [ebp - 0x2030], edx
lea edx, [eax + 0xc000]
add eax, 0x8000
mov dword [ebp - 0x2040], ecx
mov dword [ebp - 0x203c], eax
mov dword [ebp - 0x2034], edx
jmp 0x43d055
mov dword [esp + 4], 0x726bcc
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d075
mov dword [esp], 0x726bcc
call fcn.005e72a0
lea eax, [esi + eax*2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2030]
mov dword [esp], eax
call fcn.005e72b8
add ebx, 1
cmp dword [ebp - 0x201c], ebx
jbe 0x43d0bc
mov eax, dword [ebp - 0x202c]
lea edi, [ebx*4]
mov esi, dword [eax + ebx*4]
cmp word [esi], 0x2f
jne 0x43d012
mov ecx, 0x2d
mov word [esi], cx
jmp 0x43d012
mov dword [esp + 4], 0x726be0
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d110
mov dword [esp], 0x726be0
add ebx, 1
call fcn.005e72a0
lea eax, [esi + eax*2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2034]
mov dword [esp], eax
call fcn.005e72b8
cmp dword [ebp - 0x201c], ebx
ja 0x43d055
mov eax, dword [0x8531d4]
mov dword [esp + 8], 0x1000
mov dword [0x8531f4], eax
mov eax, dword [ebp - 0x2038]
add eax, 0x10000
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2040]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 0x202c]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 4], 0x726bf8
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d150
mov dword [esp], 0x726bf8
call fcn.005e72a0
lea eax, [esi + eax*2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x203c]
mov dword [esp], eax
call fcn.005e72b8
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726c12
mov dword [esp], esi
add eax, 0xe000
mov dword [ebp - 0x2044], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d19e
mov dword [esp], 0x726c12
call fcn.005e72a0
lea eax, [esi + eax*2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2044]
mov dword [esp], eax
call fcn.005e72b8
jmp 0x43d04a
mov dword [esp + 4], 0x726c28
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d1db
mov dword [esp], 0x726c28
call fcn.005e72a0
lea eax, [esi + eax*2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2040]
mov dword [esp], eax
call fcn.005e72b8
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726c3c
mov dword [esp], esi
add eax, 0x14000
mov dword [ebp - 0x2044], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d20f
mov dword [esp], 0x726c3c
jmp 0x43d17f
mov eax, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726c56
mov dword [esp], esi
add eax, 0x18000
mov dword [ebp - 0x2044], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d253
mov dword [esp], 0x726c56
jmp 0x43d17f
add eax, 0x4000
mov dword [ebp - 0x2040], eax
jmp 0x43d0bc
mov dword [esp + 4], 0x726c74
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d295
mov dword [esp], 0x726c74
call fcn.005e72a0
lea eax, [esi + eax*2]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2038]
add eax, 0x16000
mov dword [esp], eax
call fcn.005e72b8
jmp 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov edx, 0x726f14
mov eax, esi
call fcn.0043cca0
test al, al
jne 0x43d04a
mov eax, dword [ebp - 0x2038]
mov edx, 0x726c96
lea ecx, [eax + 0x2000]
mov eax, esi
call fcn.0043cca0
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726ca6
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c00c
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726cbe
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c010
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726cd2
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c014
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726ce2
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c018
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726cf2
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c01c
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726d02
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c020
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x726d12
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c024
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 8], 0x70ec60
mov dword [esp + 4], 0x726d26
mov dword [esp], esi
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 8], 0x855500
mov dword [esp + 4], str._MWT_b
mov dword [esp], esi
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 8], 0x8554fc
mov dword [esp + 4], 0x726d4c
mov dword [esp], esi
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 8], 0x8554f8
mov dword [esp + 4], 0x726d60
mov dword [esp], esi
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 8], 0x70ec64
mov dword [esp + 4], str.qAul
mov dword [esp], esi
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov dword [esp + 4], str.L_H
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43d4fc
mov eax, dword [ebp - 0x2038]
mov dword [eax + 0x1c008], 1
jmp 0x43d04a
mov eax, dword [sym.imp.msvcrt.dll__wcsicmp]
mov dword [esp + 4], 0x726f22
mov dword [esp], esi
mov dword [ebp - 0x2044], eax
call eax
test eax, eax
je 0x43d676
mov dword [esp + 4], 0x726f3c
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43dbd4
mov dword [esp + 4], 0x726f58
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43dbbf
mov dword [esp + 4], 0x726f76
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43dbaa
mov dword [esp + 4], 0x726f90
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43db95
mov dword [esp + 4], 0x726faa
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43db80
mov dword [esp + 4], 0x726fc8
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43db6b
mov dword [esp + 4], 0x726fe6
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43db56
mov dword [esp + 4], 0x726ffa
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43db44
mov dword [esp + 4], 0x727016
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43db09
mov dword [esp + 4], 0x726db4
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43da19
mov dword [esp + 4], 0x726dec
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
jne 0x43d68b
mov eax, dword [ebp - 0x202c]
add ebx, 1
mov eax, dword [eax + edi + 4]
mov edi, dword [ebp - 0x2038]
mov dword [esp + 4], eax
mov eax, edi
add eax, 0xa000
mov dword [esp], eax
call fcn.005e72b8
or dword [edi + 0x1c000], 0x108680
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x200000
jmp 0x43d04a
mov dword [esp + 4], 0x726df8
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
jne 0x43d6af
mov eax, dword [ebp - 0x201c]
sub eax, ebx
cmp eax, 3
je 0x43d70a
mov dword [esp + 4], 0x727068
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43d8fc
mov dword [esp + 4], 0x726e38
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
jne 0x43d83d
mov edx, dword [ebp - 0x2038]
mov eax, dword [edx + 0x1c000]
mov dword [ebp - 0x2044], eax
and eax, 0xfffffffd
or eax, 0x4000000
mov dword [edx + 0x1c000], eax
jmp 0x43d04a
mov ecx, dword [ebp - 0x202c]
lea eax, [ebx*4 + 8]
lea ebx, [ebp - 0x2018]
mov edx, ecx
lea edi, [ecx + eax - 4]
add edx, eax
mov eax, dword [edx]
mov dword [ebp - 0x2030], edx
mov dword [esp + 0xc], eax
mov eax, dword [edi]
mov dword [esp + 4], 0x727030
mov dword [esp], 0x835180
mov dword [esp + 8], eax
call fcn.0041eed0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], 0x727044
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x72704e
mov dword [esp], 0x8330e0
call esi
mov edx, dword [ebp - 0x2030]
mov dword [esp + 0xc], 0x8350e0
mov dword [esp + 8], 0x8554a0
mov dword [0x8554ac], 1
mov eax, dword [edx]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call fcn.0041c730
mov eax, dword [0x8350e0]
mov dword [esp + 4], 0x72705c
mov dword [esp], 0x835180
mov dword [esp + 0xc], eax
mov eax, dword [0x8554a0]
mov dword [esp + 8], eax
call fcn.0041eed0
mov eax, dword [0x8350e0]
test eax, eax
je 0x43d7eb
or dword [0x8554a0], 0x80000000
mov dword [esp + 8], 0x8330e0
mov dword [esp + 4], 0x726e0c
mov dword [esp], ebx
call esi
mov dword [esp + 0xc], 1
mov ecx, 0x8554b8
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x726e30
call fcn.00440110
mov eax, dword [ebp - 0x2038]
sub esp, 0x10
mov dword [eax + 0x1c004], 2
jmp 0x43d0bc
mov dword [esp + 4], 0x72706e
mov dword [esp], esi
mov edi, dword [ebp - 0x2044]
call edi
test eax, eax
je 0x43da07
mov dword [esp + 4], 0x727080
mov dword [esp], esi
call edi
test eax, eax
je 0x43d9f5
mov dword [esp + 4], 0x727094
mov dword [esp], esi
call edi
test eax, eax
je 0x43dbfe
mov dword [esp + 4], 0x7270a2
mov dword [esp], esi
call edi
test eax, eax
je 0x43dbe9
mov dword [esp + 4], 0x7270bc
mov dword [esp], esi
call edi
test eax, eax
je 0x43dc10
mov dword [esp + 4], 0x7270d2
mov dword [esp], esi
call edi
test eax, eax
je 0x43d9e0
mov dword [esp + 4], 0x7270ea
mov dword [esp], esi
call edi
test eax, eax
je 0x43d93c
mov ecx, 0x8330e0
mov edx, 0x7270fa
mov eax, esi
call fcn.0043cca0
test al, al
je 0x43d910
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x10000
jmp 0x43d04a
call fcn.004423f0
mov dword [0x8531c4], 2
jmp 0x43d0bc
mov dword [esp + 4], 0x726e4c
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
jne 0x43d951
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x20000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x20000000
jmp 0x43d04a
mov dword [esp + 4], 0x727114
mov dword [esp], esi
mov edi, dword [ebp - 0x2044]
call edi
test eax, eax
je 0x43dc9b
mov dword [esp + 4], 0x727134
mov dword [esp], esi
call edi
test eax, eax
je 0x43dc89
mov dword [esp + 4], 0x727154
mov dword [esp], esi
call edi
test eax, eax
je 0x43dcb0
mov dword [esp + 4], 0x727168
mov dword [esp], esi
call edi
test eax, eax
mov eax, dword [ebp - 0x2038]
je 0x43dc7a
lea ecx, [eax + 0x12000]
mov edx, 0x727184
mov eax, esi
call fcn.0043cca0
test al, al
je 0x43dc25
mov eax, dword [ebp - 0x2038]
mov dword [eax + 0x1c004], 1
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x2000000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 4
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 1
jmp 0x43d04a
lea eax, [ebp - 0x2006]
xor edx, edx
mov dword [esp + 4], 0x726db4
mov dword [ebp - 0x2014], 0
mov dword [ebp - 0x200c], pe_nt_image_headers32
mov dword [ebp - 0x2010], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 0x2008], 0
mov dword [ebp - 0x2018], 0x75d6e8
mov word [ebp - 0x2006], dx
mov dword [esp], eax
call sub.SHELL32.dll_StrStrIW
sub esp, 8
add eax, 8
mov dword [esp + 8], eax
lea eax, [ebp - 0x2018]
mov dword [esp + 4], 0x726dbc
mov dword [esp], eax
call fcn.00403910
mov eax, dword [ebp - 0x2010]
mov dword [esp + 4], 0x726dd2
mov dword [esp], 0x835180
mov dword [esp + 8], eax
call fcn.0041eed0
call fcn.00404140
mov eax, dword [ebp - 0x2010]
mov dword [esp], eax
call fcn.0046f9c0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x726de2
mov dword [esp], 0x835180
mov dword [0x8554a0], eax
call fcn.0041eed0
mov eax, dword [ebp - 0x2038]
mov dword [ebp - 0x2018], 0x75d500
mov dword [eax + 0x1c004], 2
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x43d0bc
mov dword [esp], eax
call fcn.006eb310
jmp 0x43d0bc
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x1000000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x20
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x8000000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x800000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x80000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x10000000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x8000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x4000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x400
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x80
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x10
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x200
jmp 0x43d04a
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 8], 0x83718c
mov dword [esp + 4], 0x726e72
mov dword [esp], esi
call fcn.0043cea0
sub esp, 0xc
test al, al
jne 0x43d04a
mov dword [esp + 4], 0x726e86
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
jne 0x43dcc5
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x800
jmp 0x43d04a
or dword [eax + 0x1c000], 0x400000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x40
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x40000
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x100
jmp 0x43d04a
mov dword [esp + 4], 0x72718e
mov dword [esp], esi
mov edi, dword [ebp - 0x2044]
call edi
test eax, eax
je 0x43dd3d
mov dword [esp + 4], 0x7271a6
mov dword [esp], esi
call edi
test eax, eax
mov eax, dword [ebp - 0x2038]
je 0x43ddca
lea ecx, [eax + 0x1a000]
mov edx, 0x7271b8
mov eax, esi
call fcn.0043cca0
test al, al
jne 0x43d04a
mov dword [esp + 4], 0x726e9c
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
jne 0x43dd52
mov eax, dword [ebp - 0x2038]
mov dword [eax + 0x1c02c], 0x20
jmp 0x43d04a
mov eax, dword [ebp - 0x2038]
or dword [eax + 0x1c000], 0x1000
jmp 0x43d04a
mov dword [esp + 4], 0x7271d8
mov dword [esp], esi
mov eax, dword [ebp - 0x2044]
call eax
test eax, eax
je 0x43de28
mov ecx, dword [ebp - 0x2038]
mov dword [esp + 4], 0x7271e4
mov dword [esp], esi
mov eax, ecx
add eax, 0x1c028
mov dword [esp + 8], eax
call fcn.0043cea0
sub esp, 0xc
test al, al
je 0x43ddd9
mov edi, dword [ebp - 0x2038]
mov dword [esp + 4], 0
lea ecx, [ebp - 0x2020]
mov eax, dword [edi + 0x1c028]
mov dword [esp], eax
call fcn.0040c750
add eax, 0x3e8
sub esp, 8
mov dword [edi + 0x1c028], eax
jmp 0x43d04a
or dword [eax + 0x1c000], 0x2000
jmp 0x43d04a
mov dword [esp + 4], 0x726ea8
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43de3d
mov dword [esp], esi
call fcn.00402360
mov dword [esp + 8], esi
mov dword [esp + 4], 0x726efc
mov dword [esp], 0x835180
call fcn.0041e920
mov eax, dword [ebp - 0x2038]
cmp dword [eax + 0x1c004], 2
jne 0x43d04a
jmp 0x43d0bc
mov eax, dword [ebp - 0x2038]
mov dword [eax + 0x1c02c], 0x40
jmp 0x43d04a
mov dword [esp + 4], 0x726ed0
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
je 0x43de5e
mov dword [esp], esi
call fcn.004023e0
jmp 0x43ddf8
mov dword [esp + 4], 0x726ef0
mov dword [esp], esi
call sub.SHELL32.dll_StrStrIW
sub esp, 8
test eax, eax
jne 0x43d04a
jmp 0x43ddf8