Function at 0x474660
Capabilities:
Accept command line arguments
Acquire debug privileges
Check os version
Get common file path
Get hostname
Get memory capacity
Initialize winsock library
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x444
push ebx
push esi
push edi
xor edi, edi
push 0x10c
lea eax, [esp + 0xb4]
push edi
push eax
mov dword [esp + 0xb4], 0x114
mov dword [esp + 0xb8], edi
call fcn.004a30a0
add esp, 0xc
lea ecx, [esp + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push str.SetDllDirectoryW
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
cmp eax, edi
je 0x4746cb
push 0x4d9064
call eax
mov eax, dword [0x4ff520]
cmp eax, edi
je 0x4746e1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4ff520], edi
push edi
push 0x4000000
push edi
push 0x8000004
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.IsWow64Process
push str.kernel32.dll
mov dword [0x4ff520], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov esi, eax
cmp esi, edi
je 0x474733
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x10], edi
je 0x474733
mov byte [0x4feb96], 1
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x3c]
push edx
push 0x4fe8e8
mov esi, eax
mov dword [0x4fe8b8], ecx
mov dword [esp + 0x44], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x104
push 0x4fe698
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5c
push 0x4fe69e
call fcn.0049e9fa
xor ecx, ecx
add esp, 8
mov edi, esi
lea ebx, [esp + 0xc]
mov word [eax], cx
call fcn.0040a240
test eax, eax
je 0x47498e
push 1
push esi
push str.OpenLog
mov edi, ebx
call fcn.00474570
push 0
push esi
push str.Terminate
mov dword [esp + 0x40], eax
call fcn.00474570
push 0
push esi
test eax, eax
push str.WaitForIdle
setne byte [esp + 0x35]
call fcn.00474570
push 1
push esi
test eax, eax
push str.SaveAs
setne byte [esp + 0x33]
call fcn.00474570
push 1
push esi
push str.SaveAs1
mov dword [esp + 0x38], eax
call fcn.00474570
push 1
push esi
push str.SaveAs2
mov dword [esp + 0x24], eax
call fcn.00474570
push 1
push esi
push str.LoadConfig
mov ebx, eax
call fcn.00474570
push 0
push esi
push str.NoFilter
mov dword [esp + 0x3c], eax
call fcn.00474570
push 1
push esi
test eax, eax
push str.BackingFile
setne byte [esp + 0x30]
call fcn.00474570
push 1
push esi
push str.OriginalPath
mov dword [esp + 0x44], eax
call fcn.00474570
push 0
push esi
push str.PagingFile
mov dword [esp + 0x50], eax
call fcn.00474570
push 0
push esi
test eax, eax
push str.Profiling
setne byte [esp + 0x23]
call fcn.00474570
push 0
push esi
test eax, eax
push str.NoConnect
setne byte [esp + 0x2e]
call fcn.00474570
push 0
push esi
test eax, eax
push str.Client
setne byte [esp + 0x31]
call fcn.00474570
push 0
test eax, eax
push esi
setne byte [esp + 0x2e]
push str.Minimized
call fcn.00474570
push 0
push esi
test eax, eax
push str.Quiet
setne byte [esp + 0x36]
call fcn.00474570
push 0
push esi
test eax, eax
push 0x4eac78
setne byte [esp + 0x2f]
call fcn.00474570
push 0
push esi
test eax, eax
push 0x4eac7c
setne byte [esp + 0x34]
call fcn.00474570
test eax, eax
je 0x4748f6
or dword [0x4fd46c], 8
push 0
push esi
push str.ExternalCapture
lea edi, [esp + 0x18]
call fcn.00474570
push 0
push esi
test eax, eax
push str.Run32
setne byte [esp + 0x37]
call fcn.00474570
test eax, eax
setne byte [esp + 0x40]
cmp dword [esp + 0x34], 0
jne 0x474944
call fcn.00448eb0
test al, al
jne 0x474944
cmp byte [0x4feb96], al
je 0x474940
cmp byte [esp + 0x40], al
jne 0x474944
mov cl, 1
jmp 0x474946
xor cl, cl
cmp byte [0x4feb96], 0
mov byte [esp + 0x10], cl
je 0x47495e
cmp byte [esp + 0x40], 0
jne 0x47495e
mov al, 1
jmp 0x474960
xor al, al
mov byte [esp + 0x3c], al
mov edi, 6
test cl, cl
je 0x47499c
cmp dword [esp + 0xac], edi
jae 0x47499c
push ecx
mov ebx, esp
mov dword [esp + 0x1c], esp
push 0x4eacc8
call fcn.00402bd0
xor ecx, ecx
call fcn.00442aa0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test al, al
jne 0x475175
test cl, cl
jne 0x475175
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4749c9
push eax
push 0x104
push 0x4fe490
call fcn.0049ee55
add esp, 0xc
jmp 0x4749db
push 0x104
push 0x4fe490
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x4749f5
mov dword [esp + 0x10], 2
mov dword [esp + 0x2c], ebx
jmp 0x474a09
mov eax, dword [esp + 0x18]
test eax, eax
je 0x474a09
mov dword [esp + 0x10], 1
mov dword [esp + 0x2c], eax
cmp byte [esp + 0x28], 0
jne 0x47514f
cmp dword [esp + 0xc], 1
jne 0x4750eb
cmp byte [esp + 0x17], 0
je 0x474a31
cmp dword [esp + 0x38], 0
jne 0x4750eb
cmp dword [esp + 0x2c], 0
je 0x474a61
cmp dword [esp + 0x34], 0
jne 0x474a61
push 0x10
push 0x4d9784
push 0x4eae08
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x4fec00
call fcn.00414ff0
test al, al
jne 0x474a91
push 0x10
push 0x4d9784
push str.Procmon
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esp + 0x27], 0
je 0x474ae6
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0
push str.PROCMON_WINDOW_CLASS
call ebx
test eax, eax
jne 0x474acb
push 0x64
call edi
inc esi
cmp esi, 0x64
jl 0x474aa6
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0x8009
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esp + 0x29], 0
je 0x474b1d
push 0
push str.PROCMON_WINDOW_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x47498e
push 0
push 0
push 0x800a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
push 0x38
lea edx, [esp + 0x74]
push esi
mov ebx, 0x40
push edx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], esi
call fcn.004a30a0
add esp, 0xc
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [esp + 0xac], edi
mov eax, dword [esp + 0x70]
sbb ecx, ecx
and ecx, 0xef4f8a00
add ecx, 0x1dcd6500
xor edx, edx
sub eax, ecx
mov ecx, dword [esp + 0x74]
push esi
push 2
sbb ecx, edx
push ecx
push eax
call fcn.004c2c00
push esi
push 3
push edx
push eax
call fcn.004cb310
cmp edx, esi
mov dword [0x4fe8b0], eax
mov dword [0x4fe8b4], edx
jg 0x474baa
jl 0x474b96
cmp eax, 0x800000
jae 0x474b9d
mov eax, 0x800000
jmp 0x474baf
cmp edx, esi
jl 0x474bbc
jg 0x474baa
cmp eax, 0x3e800000
jb 0x474bbc
mov eax, 0x3e800000
xor edx, edx
mov dword [0x4fe8b4], edx
mov dword [0x4fe8b0], eax
add eax, 0x2000000
adc edx, esi
push str.SeDebugPrivilege
mov dword [0x4fe8c0], eax
mov dword [0x4fe8c4], edx
call fcn.00406a90
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
mov edx, dword [esp + 0x40]
push edx
call fcn.004481b0
push 0x18e
lea ecx, [esp + 0x2c6]
xor eax, eax
push esi
push ecx
mov word [esp + 0x2cc], ax
call fcn.004a30a0
add esp, 0xc
lea edx, [esp + 0x2c0]
push edx
push 0x202
call sub.WS2_32.dll_WSAStartup
push fcn.00474330
call fcn.0049f874
add esp, 4
push 1
call fcn.004a20ae
add esp, 4
push 1
push 0x474400
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x1ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp byte [0x4feb96], 0
mov eax, str.SoftwareSysinternalsProcess_Monitor32
jne 0x474c5f
mov eax, str.SoftwareSysinternalsProcess_Monitor
push esi
push 0x4fe48c
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push reloc.WS2_32.dll_accept
mov dword [0x4fe8a0], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [0x4fe48c]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
call fcn.0048b5d0
mov eax, dword [0x4ff0f8]
mov edx, 0x4fec00
call fcn.00415160
cmp dword [esp + 0x30], esi
je 0x474d1c
lea esi, [esp + 0x1c0]
call fcn.00410a10
mov edi, dword [esp + 0x30]
push 0
push 1
mov eax, esi
call fcn.00440ca0
test al, al
jne 0x474cf3
push 0x10
push 0x4d9784
push 0x4eb058
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, esi
push ecx
call fcn.00410a70
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x1c0]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
call fcn.0048b5d0
lea eax, [esp + 0x1c0]
push eax
call fcn.00410a70
cmp byte [esp + 0x2b], 0
je 0x474d2a
or dword [0x4fd46c], 0x10
cmp byte [esp + 0x24], 0
je 0x474d3d
push 0
mov esi, 0x4fecf0
call fcn.0045c250
call fcn.00449120
cmp dword [esp + 0x38], 0
je 0x474d71
mov ecx, dword [esp + 0x38]
push 0
push 0x4ff318
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, 0x4e8334
mov edi, 0x4ff318
call fcn.00448610
jmp 0x474d81
cmp byte [esp + 0x17], 0
je 0x474d81
xor edx, edx
mov word [0x4ff318], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x474d98
or dword [0x4fd46c], ebx
mov byte [0x4fe8a8], 1
cmp byte [esp + 0x22], 0
je 0x474da9
mov dword [0x4ff0f4], 1
call fcn.00493160
cmp dword [esp + 0x34], 0
je 0x474eaf
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x474eaf
push 0x2e
push eax
call fcn.0049ec5c
add esp, 8
test eax, eax
je 0x474de1
mov edi, eax
call fcn.0046f470
mov esi, eax
test esi, esi
jge 0x474e03
push 0x10
push 0x4d9784
push 0x4eb0d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x34]
push 0
push eax
push 0
call fcn.0046fb90
test al, al
je 0x47498e
mov eax, dword [esp + 0x10]
cmp eax, 2
setge cl
cmp eax, 1
movzx edx, cl
push edx
mov edx, dword [esi*8 + 0x4dcb70]
setge al
movzx ecx, al
mov eax, dword [esp + 0x30]
push ecx
push 1
push edx
push 0
push eax
push 0
push 0x4fec00
call fcn.004210b0
mov esi, eax
test esi, esi
je 0x474adb
push 0x4eb12c
lea ebx, [esp + 0x14]
call fcn.00402bd0
mov eax, esi
call fcn.0046f4a0
mov ecx, eax
mov eax, ebx
call fcn.004905d0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x474e83
add eax, 8
jne 0x474e88
mov eax, 0x4d9064
push 0x10
push 0x4d9784
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x10]
call fcn.00401970
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esp + 0x26], 0
jne 0x475092
push str.commdlg_FindReplace
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov esi, dword [ebp + 8]
push str.ACCELERATORS
push esi
mov dword [0x4fe8a4], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [esp + 0x18], eax
mov eax, esi
call fcn.00474230
mov bl, byte [esp + 0x2a]
push 0
push esi
push 0
push 0
push 0x12c
push 0x1f4
movzx ecx, bl
neg ecx
push 0xc8
sbb ecx, ecx
push 0x64
and ecx, 0x20000000
or ecx, 0xcf0000
push ecx
push str.Process_Monitor__
push str.PROCMON_WINDOW_CLASS
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4febb4], eax
test eax, eax
je 0x47498e
test bl, bl
je 0x474f3e
mov ecx, 2
jmp 0x474f4b
mov ecx, dword [ebp + 0x14]
cmp ecx, 1
jne 0x474f4b
mov ecx, 5
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x4febb4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 0x4fecf0
call fcn.0040e370
test al, al
jne 0x474f97
test bl, bl
jne 0x474f97
cmp byte [esp + 0x23], bl
jne 0x474f97
mov eax, dword [0x4febb4]
mov ecx, dword [0x4fe8b8]
push 1
push 0x464810
push eax
push str.FILTER_INIT
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.00470280
test al, al
je 0x474fae
push 0
push 0x4fec00
call fcn.00414260
jmp 0x475019
mov esi, dword [esp + 0x34]
test esi, esi
je 0x474fe8
cmp byte [0x4ff0f1], 0
je 0x474fd8
mov edx, dword [0x4febb4]
push 0
push 0x9c53
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x4febb4]
push 0
push esi
push eax
call fcn.0046fb90
jmp 0x475019
cmp byte [esp + 0x25], 0
jne 0x475019
cmp byte [0x4feb96], 0
jne 0x475019
mov edx, dword [0x4febb4]
xor ecx, ecx
cmp dword [esp + 0x38], ecx
setne cl
push ecx
push 0x9c87
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x475097
mov ebx, dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
lea ebx, [ebx]
call ebx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x4c]
push ecx
mov esi, eax
push edx
push esi
call edi
test eax, eax
jne 0x47507b
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x47507b
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x475040
jmp 0x475097
call fcn.0044f680
mov eax, dword [0x4fd484]
cmp eax, 0xffffffff
je 0x4750cd
xor esi, esi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push 8
lea edx, [esp + 0x54]
push edx
push eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
call dword [0x4feb9c]
push esi
call fcn.004524b0
mov byte [0x4feb94], 0
cmp dword [0x4feb90], 0
je 0x4750db
call fcn.0044fd30
call fcn.00448fb0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 4]
push eax
lea ebx, [esp + 0x34]
call fcn.00402bd0
mov ecx, ebx
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4eaddc
lea ebx, [esp + 0x24]
call fcn.00402bd0
push eax
call fcn.004907a0
mov eax, ebx
call fcn.00401970
lea eax, [esp + 0x30]
call fcn.00401970
mov eax, dword [esp + 0x10]
test eax, eax
je 0x475131
add eax, 8
jne 0x475136
mov eax, 0x4d9064
push 0x10
push 0x4d9784
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x10]
call fcn.00401970
mov eax, dword [ebp + 8]
push 0
push 0x401670
push 0
push str.USAGE
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
push ecx
lea ebx, [esp + 0x1c]
call fcn.0044d9b0
mov eax, dword [eax]
test eax, eax
je 0x47518c
mov eax, dword [eax]
jmp 0x47518e
xor eax, eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [ebp + 0x14]
push ecx
push eax
push edx
call fcn.00448a10
test al, al
lea edi, [esp + 0x18]
sete bl
call fcn.00401010
test bl, bl
je 0x474adb
push ecx
mov ebx, esp
mov dword [esp + 0x1c], esp
push 0x4ead40
jmp 0x474982