Function at 0x4ad0a70a
Capabilities:
Accept command line arguments
Get common file path
Query environment variable

Disassembly:
sub esp, 0x58
push ebx
push esi
mov eax, 0x4ad359e0
push edi
push eax
mov dword [0x4ad2ca78], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.4ad02e2d
push 1
push 0x4ad18212
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.4ad01e68
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push dword [esp + 0x68]
mov dword [0x4ad280d0], eax
call fcn.4ad0adb3
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
test eax, eax
mov esi, 0x4ad220a0
je 0x4ad0a769
call edi
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push esi
call fcn.4ad02e4d
xor ebx, ebx
push ebx
mov edi, 0x4ad31400
push edi
call fcn.4ad03be2
call fcn.4ad0aba2
push esi
push dword [esp + 0x6c]
call fcn.4ad0ac8b
cmp word [0x4ad31400], 0x5c
je 0x4ad119f2
push ebp
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x4ad31620
push eax
mov dword [0x4ad289ec], eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
call fcn.4ad0a8a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, 0x20c
push ebp
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
push ebp
push ebx
mov dword [0x4ad2ca80], eax
call esi
push eax
call edi
cmp dword [0x4ad2ca80], ebx
mov dword [0x4ad2ca84], eax
pop ebp
je 0x4ad0a828
cmp eax, ebx
je 0x4ad0a828
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x4ad11a35
mov ecx, dword [0x4ad2ca80]
cmp ecx, ebx
je 0x4ad0a828
mov eax, dword [0x4ad2ca84]
cmp eax, ebx
je 0x4ad0a828
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [0x4ad2cabc], ebx
je 0x4ad0e522
mov edi, dword [esp + 0x68]
cmp dword [edi + 8], ebx
je 0x4ad0ee9a
push 0x4ad0bcc4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ad0bd10
push eax
mov dword [0x4ad359d4], eax
call esi
push 0x4ad0bcfc
push dword [0x4ad359d4]
mov dword [0x4ad2ca6c], eax
call esi
push 0x4ad0bce4
push dword [0x4ad359d4]
mov dword [0x4ad2ca70], eax
call esi
mov dword [0x4ad2ca74], eax
cmp dword [edi], ebx
jne 0x4ad0a89a
cmp dword [edi + 4], ebx
jne 0x4ad0a89a
cmp dword [edi + 8], ebx
je 0x4ad0ee93
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add esp, 0x58
ret 4
push 1
call fcn.4ad03b84
test eax, eax
je 0x4ad0a834
cmp word [0x4ad2ca88], bx
jne 0x4ad0e56a
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4ad0e55d
mov ax, word [esp + 0x14]
mov word [0x4ad2ca88], ax
cmp word [0x4ad2ca88], bx
je 0x4ad0a834
xor eax, eax
mov ax, word [0x4ad2ca88]
push eax
call fcn.4ad0e57d
jmp 0x4ad0a834
xor eax, eax
jmp 0x4ad0a89d
push 0x20
lea eax, [esp + 0x28]
push eax
call fcn.4ad0eee0
lea eax, [esp + 0x24]
push eax
push 1
push 0x2350
call fcn.4ad0d276
push 0x4ad31870
call fcn.4ad03e14
push ebx
push 0x2334
call fcn.4ad0d276
add esp, 0x18
cmp byte [0x4ad359dc], bl
jne 0x4ad0a841
jmp 0x4ad11a4a
cmp word [0x4ad31402], 0x5c
jne 0x4ad0a7a4
cmp byte [0x4ad3a4d0], bl
jne 0x4ad0a7a4
push edi
push 1
push 0x23c8
call fcn.4ad0b54d
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 1
push edi
call fcn.4ad0c9a8
jmp 0x4ad0a7a4
mov eax, dword [0x4ad2ca80]
mov word [eax], bx
mov eax, dword [0x4ad2ca84]
mov word [eax], bx
jmp 0x4ad0a828
cmp byte [0x4ad2ca64], bl
je 0x4ad0a841
push ebx
push 0x239f
call fcn.4ad0d276
pop ecx
pop ecx
jmp 0x4ad0a841