Function at 0x405080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
push 0xa
push 0x4b9cc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4e5c14], eax
mov eax, dword [ebp + 8]
push 0x4e5bf8
mov dword [0x4e5c10], eax
call esi
push 0x4e5be0
call esi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x4e5980
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4051d0
mov word [0x4e5980], ax
mov edi, 0x4b9c10
xor bl, bl
mov dword [0x4e5bdc], edi
mov esi, 1
mov byte [esp + 0x14], bl
mov dword [esp + 0x1c], 0
mov byte [esp + 0xe], bl
mov dword [esp + 0x10], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov edi, esi
mov eax, dword [eax]
mov dword [esp + 0x18], eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [eax], esi
jle 0x40548a
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop word [eax + eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
cmp byte [esp + 0xe], 0
mov eax, dword [eax]
mov esi, dword [eax + edi*4]
je 0x40523d
push dword [esp + 0x10]
lea eax, [esp + 0x2c]
push 0x4b9d90
push eax
call fcn.00405be0
add esp, 0xc
mov dword [esp + 0x24], eax
cmp word [esp + 0x28], 0
je 0x405309
lea ecx, [esp + 0xf]
push ecx
push 3
lea ecx, [esp + 0x28]
push ecx
push eax
lea eax, [esp + 0x38]
mov ecx, 0x4e7d50
push eax
call fcn.0043b290
test eax, eax
jne 0x4051b4
cmp byte [esp + 0xf], al
mov ecx, 0x4e7d50
setne al
inc eax
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x30]
push dword [esp + 0x2c]
push eax
call fcn.0043b7f0
test eax, eax
je 0x405309
push 1
push 0
push 0xffffffffffffffff
push esi
mov ecx, eax
call fcn.004a05c0
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
jmp 0x405477
cmp word [0x4e5980], 0
je 0x4050e2
mov esi, 0x4e5980
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4051e6
sub esi, ecx
sar esi, 1
lea ebx, [esi + esi]
lea ecx, [ebx + 2]
call fcn.00499a70
mov edi, eax
test edi, edi
jne 0x40521f
push 0x4e5980
push 0x4cdaa4
mov ecx, 0x4e7d50
call fcn.00447cc0
jmp 0x4050e7
test esi, esi
je 0x405232
push ebx
push 0x4e5980
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebx + edi], ax
jmp 0x4050e7
push 0x4b9d98
push esi
call ebx
add esp, 8
test eax, eax
je 0x40546e
push str._restart
push esi
call ebx
add esp, 8
test eax, eax
je 0x40546e
push 0x4b9db4
push esi
call ebx
add esp, 8
test eax, eax
je 0x405465
push str._force
push esi
call ebx
add esp, 8
test eax, eax
je 0x405465
push str._ErrorStdOut
push esi
call ebx
add esp, 8
test eax, eax
jne 0x4052a4
mov byte [0x4e8847], 1
jmp 0x405473
push str._iLib
push esi
call ebx
add esp, 8
test eax, eax
jne 0x405317
inc edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp edi, dword [eax]
jge 0x405309
push 0x38
call fcn.004b64c6
add esp, 4
mov esi, eax
mov ecx, esi
call fcn.00404bd0
mov dword [esi], vtable.TextFile.0
mov dword [esi + 0x34], 0xffffffff
mov dword [0x4e8848], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov ecx, dword [0x4e8848]
push 0xfde9
push 0x15
mov eax, dword [eax]
push dword [eax + edi*4]
call fcn.0049a1b0
test al, al
jne 0x405473
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4b9df4
push esi
call ebx
add esp, 8
test eax, eax
je 0x405459
push str._Execute
push esi
call ebx
add esp, 8
test eax, eax
je 0x405459
push 3
push 0x4b9e10
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x405364
lea ecx, [esi + 6]
call fcn.00404b50
mov dword [0x4e5bd8], eax
jmp 0x405473
cmp dword [0x4e4ad8], 0xffffffff
jne 0x405434
push 6
push str._Debug
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x405434
movzx eax, word [esi + 0xc]
test ax, ax
je 0x40539c
cmp eax, 0x3d
jne 0x405434
cmp eax, 0x3d
jne 0x405412
add esi, 0xe
push 0x3a
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
mov ebx, eax
sub esp, 8
mov ecx, esi
test ebx, ebx
je 0x4053ec
mov edx, ebx
sub edx, esi
sar edx, 1
push edx
mov edx, 0x4e4aac
call fcn.00499db0
add esp, 4
lea ecx, [ebx + 2]
mov edx, 0x4e4ab8
push 0xffffffffffffffff
call fcn.00499db0
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0xc
jmp 0x405473
push 0xffffffffffffffff
mov edx, 0x4e4aac
call fcn.00499db0
add esp, 8
mov ecx, 0x4e4ab8
push str.9000
call fcn.004059b0
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
jmp 0x405473
push ecx
push str.127.0.0.1
mov ecx, 0x4e4aac
call fcn.004059b0
push ecx
push str.9000
mov ecx, 0x4e4ab8
call fcn.004059b0
jmp 0x405473
cmp dword [0x4e5c14], 0
mov byte [esp + 0xe], 1
jne 0x40544f
lea eax, [edi + 1]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
jmp 0x405473
dec edi
lea eax, [edi + 1]
mov dword [esp + 0x18], eax
jmp 0x405473
mov dword [0x4e5c14], 0
jmp 0x405473
mov byte [0x4e5bba], 1
jmp 0x405473
mov byte [esp + 0x14], 1
mov esi, dword [esp + 0x10]
inc edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp edi, dword [eax]
jl 0x405130
mov bl, byte [esp + 0x14]
lea eax, [esp + 0xf]
mov ecx, 0x4e7d50
push eax
push 3
lea eax, [esp + 0x2c]
push eax
push 0
push 0x4b9cc4
call fcn.0043b290
mov ecx, eax
test ecx, ecx
jne 0x4054d4
cmp byte [esp + 0xf], al
setne al
inc eax
push eax
push dword [esp + 0x28]
push ecx
push 0x4b9cc4
mov ecx, 0x4e7d50
call fcn.0043b7f0
mov ecx, eax
test ecx, ecx
je 0x405309
push 0x18
lea eax, [esi - 1]
cdq
push edx
push eax
call fcn.00401510
lea eax, [esp + 0xf]
mov ecx, 0x4e7d50
push eax
push 0xc1
lea eax, [esp + 0x2c]
push eax
push 6
push str.A_Args
call fcn.0043b290
mov edi, eax
test edi, edi
jne 0x405533
cmp byte [esp + 0xf], al
mov ecx, 0x4e7d50
setne al
add eax, 0xc1
push eax
push dword [esp + 0x28]
push 6
push str.A_Args
call fcn.0043b7f0
mov edi, eax
test edi, edi
je 0x405309
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov esi, dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov ecx, dword [esp + 0x18]
sub esi, ecx
mov edx, esi
mov eax, dword [eax]
lea ecx, [eax + ecx*4]
call fcn.0048dcc0
test eax, eax
je 0x405309
push eax
mov ecx, edi
call fcn.004a0920
mov ecx, dword [0x4e30fc]
call fcn.00404a50
cmp dword [0x4e5834], 0
mov dword [ecx + 0xd4], 0
mov dword [ecx + 0x20], 1
mov dword [ecx + 0xe9], 0x1010001
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0xffffffff
mov dword [ecx + 0x24], 0xa
mov dword [ecx + 0xd8], 5
mov dword [ecx + 0xe0], 0
mov word [ecx + 0xed], 1
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], connect
mov dword [ecx + 0x40], connect
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x50], 0x2af8
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x54], 0x64
mov dword [ecx + 0x58], 0x14
mov dword [ecx + 0x5c], 0xa
mov dword [ecx + 0x60], 0xffffffff
mov dword [ecx + 0x64], 0xffffffff
mov dword [ecx + 0x68], 0xffffffff
mov dword [ecx + 0x6c], 0xa
mov dword [ecx + 0x70], 0xffffffff
mov byte [ecx + 0xef], 2
mov dword [ecx + 0xf0], 0x1000000
mov byte [ecx + 0xf4], 1
movq xmm0, qword [str._0.6f]
movq qword [ecx + 0x74], xmm0
mov eax, dword [0x4ba07c]
mov dword [ecx + 0x7c], eax
mov word [ecx + 0xf5], 0x44
mov byte [ecx + 0xf9], 1
mov dword [ecx + 0xfc], 0
je 0x405989
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CryptEncrypt
push edi
call esi
push str.CryptDecrypt
push edi
mov dword [0x4e5bd4], eax
call esi
sub esp, 8
mov dword [0x4e5bd0], eax
push dword [esp + 0x1c]
push dword [esp + 0x28]
push ecx
mov ecx, 0x4e7d50
call fcn.00429e90
cmp eax, 1
jne 0x405309
mov esi, dword [0x4e30fc]
mov ecx, 0x42
mov edi, 0x4e5870
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4e7d50
call fcn.0042b610
cmp eax, 0xffffffff
jne 0x405713
mov ecx, dword [0x4e8848]
test ecx, ecx
je 0x405309
call fcn.00404c30
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
je 0x405989
mov eax, dword [0x4e5bcc]
test eax, eax
jne 0x405759
cmp word [0x4e66f8], ax
jne 0x40574d
cmp dword [0x4e66e0], eax
jne 0x40574d
cmp dword [0x4e5bc8], eax
jne 0x40574d
cmp dword [0x4e5bc4], eax
jne 0x40574d
cmp byte [0x4e5bb9], al
je 0x4057c9
mov dword [0x4e5bcc], 1
jmp 0x40575e
cmp eax, 4
je 0x4057c9
test bl, bl
jne 0x4057cd
cmp byte [0x4e5bba], bl
jne 0x40584b
push dword [0x4e8840]
push 0x4b9e88
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x40584b
mov eax, dword [0x4e5bcc]
cmp eax, 3
je 0x405989
cmp eax, 2
je 0x4057c2
push 0
push dword [0x4e8834]
xorps xmm3, xmm3
mov edx, 4
mov ecx, str.An_older_instance_of_this_script_is_already_running.__Replace_it_with_this_instance__nNote:_To_avoid_this_message__see_SingleInstance_in_the_help_file.
call fcn.004a2130
add esp, 8
cmp eax, 7
je 0x405989
mov eax, 0x407
jmp 0x4057e9
test bl, bl
je 0x40584b
push dword [0x4e8840]
push 0x4b9e88
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x40584b
mov eax, 0x406
push 0
push eax
push 0x44
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x32
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x405847
nop dword [eax]
cmp esi, 0x64
jne 0x405837
push 0
push 0
xorps xmm3, xmm3
lea edx, [esi - 0x60]
mov ecx, str.Could_not_close_the_previous_instance_of_this_script.__Keep_waiting_
call fcn.004a2130
add esp, 8
cmp eax, 7
je 0x405309
xor esi, esi
push 0x32
inc esi
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x405810
push 0x64
call ebx
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x4e5d60
push 0
push 0x2000
call esi
test eax, eax
je 0x40587b
cmp dword [0x4e5d60], 0
je 0x40587b
push 2
push 0
push 0
push 0x2001
call esi
mov ecx, 0x4e7d50
call fcn.0042a5a0
cmp eax, 1
jne 0x405309
push 0
push 4
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_setvbuf]
mov eax, dword [0x4e3100]
add esp, 0x10
test eax, eax
je 0x4058e0
imul eax, eax, 0xd4
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [0x4e5bc0], eax
test eax, eax
je 0x4058e0
imul ecx, dword [0x4e3100], 0xd4
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [0x4e4ab0]
test esi, esi
je 0x40592a
cmp dword [esi + 8], 0
je 0x40592a
mov eax, dword [0x4e4abc]
mov edx, 0x4ba070
test eax, eax
je 0x405909
mov eax, dword [eax]
mov ecx, edx
test eax, eax
cmovne ecx, eax
jmp 0x40590e
mov ecx, 0x4ba070
mov eax, dword [esi]
test eax, eax
push ecx
cmovne edx, eax
push edx
call fcn.0040b0e0
test eax, eax
jne 0x40592a
mov ecx, 0x4e4ac8
call fcn.004070e0
push 0x49fbe0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [0x4e5bbc], eax
call fcn.00413850
push 3
push 0
push str.Clipboard
mov ecx, 0x4e7d50
mov byte [0x4e8844], 1
mov byte [0x4e5bb8], 0
call fcn.0043b220
test eax, eax
je 0x40596d
mov ecx, eax
call fcn.00404ba0
mov ecx, 0x4e7d50
call fcn.0042ab30
test eax, eax
je 0x405309
xor edx, edx
lea ecx, [edx + 0xa]
call fcn.00401a20
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10