Function at 0x404ac0
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
push ebx
push esi
push edi
push 0xa
push str.E4847ED08866458F8DD35F94B37001C0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4ca7bc], eax
mov eax, dword [ebp + 8]
push 0x4ca7a0
mov dword [0x4ca7b8], eax
call esi
push 0x4ca788
call esi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [esp + 0x48]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x404b2b
push ecx
lea eax, [esp + 0x4c]
mov ecx, 0x4c9990
push eax
call fcn.004699d0
mov eax, dword [0x4c9994]
test eax, eax
je 0x404bfa
mov eax, dword [eax]
mov ebx, 0x4b6ba9
test eax, eax
cmovne ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x404bfa
cmp byte [ebx], 0
je 0x404bfa
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x404b60
sub esi, ecx
lea edi, [esi + 1]
cmp esi, 0x7fff
ja 0x404be6
cmp dword [0x4cbf8c], 0
jne 0x404b8b
call fcn.0049ba10
mov dword [0x4cbf8c], eax
test eax, eax
je 0x404be6
mov ecx, dword [0x4cbf88]
cmp edi, dword [ecx + 8]
jbe 0x404ba8
call fcn.0049ba10
mov ecx, dword [0x4cbf88]
mov dword [ecx + 0xc], eax
test eax, eax
je 0x404be6
mov ebx, dword [ecx + 4]
mov eax, edi
mov dword [0x4cbf84], ebx
and eax, 3
je 0x404bbd
sub edi, eax
add edi, 4
sub dword [ecx + 8], edi
lea eax, [ebx + edi]
mov dword [ecx + 4], eax
test ebx, ebx
je 0x404be2
test esi, esi
je 0x404bdc
push esi
push dword [esp + 0x1c]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x404bff
mov ebx, dword [esp + 0x18]
push ebx
push str.Out_of_memory.
mov ecx, 0x4cc848
call fcn.0043ee10
xor ebx, ebx
jmp 0x404bff
mov ebx, 0x4b6ba9
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov dword [0x4ca784], ebx
mov ebx, 1
mov byte [esp + 0x18], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x1c], ebx
call esi
mov edi, ebx
mov eax, dword [eax]
mov dword [esp + 0x20], eax
call esi
cmp dword [eax], ebx
jle 0x404d80
mov ebx, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
nop dword [eax + eax]
mov dword [esp + 0x14], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
cmp byte [esp + 0x13], 0
mov eax, dword [eax]
mov esi, dword [eax + edi*4]
je 0x404cde
push dword [esp + 0x1c]
lea eax, [esp + 0x2c]
push 0x4b6cf0
push eax
call fcn.004053e0
add esp, 0xc
mov dword [esp + 0x14], eax
cmp byte [esp + 0x28], 0
je 0x40529f
lea ecx, [esp + 0x12]
push ecx
push 3
lea ecx, [esp + 0x2c]
push ecx
push eax
lea eax, [esp + 0x38]
mov ecx, 0x4cc848
push eax
call fcn.00430700
test eax, eax
jne 0x404cc7
cmp byte [esp + 0x12], al
mov ecx, 0x4cc848
setne al
inc eax
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x30]
push dword [esp + 0x1c]
push eax
call fcn.00430c50
test eax, eax
je 0x40529f
push 1
push 0
push 0xffffffffffffffff
push esi
mov ecx, eax
call fcn.004a2db0
inc dword [esp + 0x1c]
jmp 0x404d6d
push 0x4b6cf4
push esi
call ebx
add esp, 8
test eax, eax
je 0x404d68
push str._restart
push esi
call ebx
add esp, 8
test eax, eax
je 0x404d68
push 0x4b6d04
push esi
call ebx
add esp, 8
test eax, eax
je 0x404d5f
push str._force
push esi
call ebx
add esp, 8
test eax, eax
je 0x404d5f
push 0xc
push str._ErrorStdOut
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x404d4f
mov al, byte [esi + 0xc]
lea ecx, [esi + 0xd]
xor edx, edx
mov byte [0x4cce7b], 1
cmp al, 0x3d
cmovne ecx, edx
call fcn.004222d0
mov dword [0x4cce7c], eax
jmp 0x404d6d
mov eax, dword [esp + 0x14]
dec edi
mov byte [esp + 0x13], 1
mov dword [esp + 0x20], eax
jmp 0x404d6d
mov byte [0x4ca766], 1
jmp 0x404d6d
mov byte [esp + 0x18], 1
inc edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp edi, dword [eax]
jl 0x404c40
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x12]
mov ecx, 0x4cc848
push eax
push 3
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4b6c08
call fcn.00430700
mov esi, eax
test esi, esi
jne 0x404dca
cmp byte [esp + 0x12], al
mov ecx, 0x4cc848
setne al
inc eax
push eax
push dword [esp + 0x18]
push esi
push 0x4b6c08
call fcn.00430c50
mov esi, eax
test esi, esi
je 0x40529f
cmp byte [esi + 0x17], 0
jne 0x404dd3
mov esi, dword [esi + 0xc]
mov cl, byte [esi + 0x15]
test cl, 2
je 0x404dec
mov eax, dword [esi]
and cl, 0x3d
mov byte [esi + 0x15], cl
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov cl, byte [esi + 0x15]
lea eax, [ebx - 1]
and cl, 0x8b
cdq
or cl, 0x18
mov dword [esi], eax
mov dword [esi + 4], edx
mov byte [esi + 0x15], cl
jge 0x404e0d
mov ecx, esi
call fcn.004013b0
and byte [esi + 0x15], 0x8f
jmp 0x404e1d
cmp dword [0x4ca760], 0
je 0x404e1d
mov ecx, esi
call fcn.004013b0
lea eax, [esp + 0x12]
mov ecx, 0x4cc848
push eax
push 0xc1
lea eax, [esp + 0x1c]
push eax
push 6
push str.A_Args
call fcn.00430700
mov edi, eax
test edi, edi
jne 0x404e6f
cmp byte [esp + 0x12], al
mov ecx, 0x4cc848
setne al
add eax, 0xc1
push eax
push dword [esp + 0x18]
push 6
push str.A_Args
call fcn.00430c50
mov edi, eax
test edi, edi
je 0x40529f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov ebx, dword [esp + 0x20]
mov esi, dword [eax]
sub esi, ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, esi
mov eax, dword [eax]
lea ecx, [eax + ebx*4]
call fcn.0048e8f0
test eax, eax
je 0x40529f
push eax
mov ecx, edi
call fcn.004a3160
mov ecx, dword [0x4c8024]
call fcn.00404520
cmp dword [0x4ca604], 0
mov dword [ecx + 0xb4], 0
mov dword [ecx + 0x20], 1
mov dword [ecx + 0xc9], 0x1010001
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0xffffffff
mov dword [ecx + 0x24], 0xa
mov dword [ecx + 0xb8], 5
mov dword [ecx + 0xc0], 0
mov word [ecx + 0xcd], 1
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], CreateStatusWindowA
mov dword [ecx + 0x40], CreateStatusWindowA
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x50], 0x2af8
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x54], 0x64
mov dword [ecx + 0x58], 0x14
mov dword [ecx + 0x5c], 0xa
mov dword [ecx + 0x60], 0xffffffff
mov dword [ecx + 0x64], 0xffffffff
mov dword [ecx + 0x68], 0xffffffff
mov dword [ecx + 0x6c], 0xa
mov dword [ecx + 0x70], 0xffffffff
mov byte [ecx + 0xcf], 2
mov dword [ecx + 0xd0], 0x1000000
mov byte [ecx + 0xd4], 1
mov eax, dword [str._0.6f]
mov dword [ecx + 0x74], eax
mov ax, word [0x4b6ea0]
mov word [ecx + 0x78], ax
mov word [ecx + 0xd5], 0x44
mov byte [ecx + 0xd9], 1
mov dword [ecx + 0xdc], 0
je 0x405294
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CryptEncrypt
push edi
call esi
push str.CryptDecrypt
push edi
mov dword [0x4ca780], eax
call esi
sub esp, 8
mov dword [0x4ca77c], eax
mov ecx, 0x4cc848
push dword [esp + 0x20]
sub esp, 8
call fcn.00422ec0
cmp eax, 1
jne 0x40529f
mov esi, dword [0x4c8024]
mov ecx, 0x3a
mov edi, 0x4ca640
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4cc848
call fcn.00423fa0
cmp eax, 0xffffffff
je 0x40529f
test eax, eax
je 0x405294
mov eax, dword [0x4ca778]
test eax, eax
jne 0x405075
cmp word [0x4cb218], ax
jne 0x405067
cmp dword [0x4cb200], eax
jne 0x405067
cmp dword [0x4ca774], eax
jne 0x405067
cmp dword [0x4ca770], eax
jne 0x405067
cmp byte [0x4ca765], al
je 0x405071
mov eax, 1
mov dword [0x4ca778], eax
test eax, eax
je 0x4050ea
cmp eax, 4
je 0x4050ea
cmp byte [esp + 0x18], 0
jne 0x4050f1
cmp byte [0x4ca766], 0
jne 0x40516c
push dword [0x4cce74]
push dword [0x4c802c]
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x40516c
mov eax, dword [0x4ca778]
cmp eax, 3
je 0x405294
cmp eax, 2
je 0x4050e3
push 0
push dword [0x4cce68]
xorps xmm3, xmm3
mov edx, 4
mov ecx, str.An_older_instance_of_this_script_is_already_running.__Replace_it_with_this_instance__nNote:_To_avoid_this_message__see_SingleInstance_in_the_help_file.
call fcn.004a4cd0
add esp, 8
cmp eax, 7
je 0x405294
mov eax, 0x407
jmp 0x40510e
cmp byte [esp + 0x18], 0
je 0x40516c
push dword [0x4cce74]
push dword [0x4c802c]
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x40516c
mov eax, 0x406
push 0
push eax
push 0x44
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x32
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405168
cmp esi, 0x64
jne 0x405158
push 0
push 0
xorps xmm3, xmm3
lea edx, [esi - 0x60]
mov ecx, str.Could_not_close_the_previous_instance_of_this_script.__Keep_waiting_
call fcn.004a4cd0
add esp, 8
cmp eax, 7
je 0x40529f
xor esi, esi
push 0x32
inc esi
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x405131
push 0x64
call ebx
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push 0x4ca7ec
push 0
push 0x2000
call esi
test eax, eax
je 0x40519c
cmp dword [0x4ca7ec], 0
je 0x40519c
push 2
push 0
push 0
push 0x2001
call esi
mov ecx, 0x4cc848
call fcn.00423520
cmp eax, 1
jne 0x40529f
push 0
push 4
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_setvbuf]
mov eax, dword [0x4c8028]
add esp, 0x10
test eax, eax
je 0x4051fb
imul eax, eax, 0x70
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x4ca76c], eax
test eax, eax
je 0x4051fb
imul ecx, dword [0x4c8028], 0x70
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x4a2230
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [0x4ca768], eax
call fcn.0040c090
lea eax, [esp + 0x12]
mov byte [0x4cce78], 1
push eax
push 3
lea eax, [esp + 0x1c]
mov byte [0x4ca764], 0
push eax
push 0
push str.Clipboard
mov ecx, 0x4cc848
call fcn.00430700
mov esi, eax
test esi, esi
jne 0x405266
cmp byte [esp + 0x12], al
mov ecx, 0x4cc848
setne al
inc eax
push eax
push dword [esp + 0x18]
push esi
push str.Clipboard
call fcn.00430c50
mov esi, eax
test esi, esi
je 0x405286
cmp byte [esi + 0x17], 0
jne 0x40526f
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x15], 0
jl 0x405286
mov ecx, esi
call fcn.004013b0
mov al, byte [esi + 0x15]
and al, 0xf
or al, 0x80
mov byte [esi + 0x15], al
call fcn.004052b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret 0x10