Function at 0x404aa0
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x144
push ebx
push esi
push edi
push 0xa
push str.E4847ED08866458F8DD35F94B37001C0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4eb7a4], eax
mov eax, dword [ebp + 8]
push 0x4eb788
mov dword [0x4eb7a0], eax
call esi
push 0x4eb770
call esi
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [esp + 0x48]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x404b0b
push ecx
lea eax, [esp + 0x4c]
mov ecx, 0x4ea238
push eax
call fcn.004696e0
mov eax, dword [0x4ea23c]
test eax, eax
je 0x404bda
mov eax, dword [eax]
mov ebx, 0x4d5231
test eax, eax
cmovne ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x404bda
cmp byte [ebx], 0
je 0x404bda
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x404b40
sub esi, ecx
lea edi, [esi + 1]
cmp esi, 0x7fff
ja 0x404bc6
cmp dword [0x4ecf74], 0
jne 0x404b6b
call fcn.0049b400
mov dword [0x4ecf74], eax
test eax, eax
je 0x404bc6
mov ecx, dword [0x4ecf70]
cmp edi, dword [ecx + 8]
jbe 0x404b88
call fcn.0049b400
mov ecx, dword [0x4ecf70]
mov dword [ecx + 0xc], eax
test eax, eax
je 0x404bc6
mov ebx, dword [ecx + 4]
mov eax, edi
mov dword [0x4ecf6c], ebx
and eax, 3
je 0x404b9d
sub edi, eax
add edi, 4
sub dword [ecx + 8], edi
lea eax, [ebx + edi]
mov dword [ecx + 4], eax
test ebx, ebx
je 0x404bc2
test esi, esi
je 0x404bbc
push esi
push dword [esp + 0x18]
push ebx
call fcn.004b4620
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x404bdf
mov ebx, dword [esp + 0x14]
push ebx
push str.Out_of_memory.
mov ecx, 0x4ed830
call fcn.0043ed90
xor ebx, ebx
jmp 0x404bdf
mov ebx, 0x4d5231
mov dword [0x4eb76c], ebx
mov ebx, 1
mov byte [esp + 0x14], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x1c], ebx
call fcn.004b6744
mov edi, ebx
mov eax, dword [eax]
mov dword [esp + 0x20], eax
call fcn.004b6744
cmp dword [eax], ebx
jle 0x404d58
mov dword [esp + 0x18], edi
call fcn.004b674a
cmp byte [esp + 0x13], 0
mov eax, dword [eax]
mov esi, dword [eax + edi*4]
je 0x404cac
push ebx
lea eax, [esp + 0x2c]
push 0x4d5378
push eax
call fcn.004053b0
add esp, 0xc
mov ebx, eax
cmp byte [esp + 0x28], 0
je 0x405272
lea eax, [esp + 0x12]
mov ecx, 0x4ed830
push eax
push 3
lea eax, [esp + 0x2c]
push eax
push ebx
lea eax, [esp + 0x38]
push eax
call fcn.00430710
test eax, eax
jne 0x404c90
cmp byte [esp + 0x12], al
mov ecx, 0x4ed830
setne al
inc eax
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.00430c50
test eax, eax
je 0x405272
push 1
push 0
push 0xffffffffffffffff
push esi
mov ecx, eax
call fcn.004a2730
mov ebx, dword [esp + 0x1c]
inc ebx
mov dword [esp + 0x1c], ebx
jmp 0x404d4a
push 0x4d537c
push esi
call fcn.004b626e
add esp, 8
test eax, eax
je 0x404d45
push str._restart
push esi
call fcn.004b626e
add esp, 8
test eax, eax
je 0x404d45
push 0x4d538c
push esi
call fcn.004b626e
add esp, 8
test eax, eax
je 0x404d3c
push str._force
push esi
call fcn.004b626e
add esp, 8
test eax, eax
je 0x404d3c
push 0xc
push str._ErrorStdOut
push esi
call fcn.004b653e
add esp, 0xc
test eax, eax
jne 0x404d2c
mov al, byte [esi + 0xc]
lea ecx, [esi + 0xd]
xor edx, edx
mov byte [0x4ede63], 1
cmp al, 0x3d
cmovne ecx, edx
call fcn.00422210
mov dword [0x4ede64], eax
jmp 0x404d4a
mov eax, dword [esp + 0x18]
dec edi
mov byte [esp + 0x13], 1
mov dword [esp + 0x20], eax
jmp 0x404d4a
mov byte [0x4eb74e], 1
jmp 0x404d4a
mov byte [esp + 0x14], 1
inc edi
call fcn.004b6744
cmp edi, dword [eax]
jl 0x404c12
lea eax, [esp + 0x12]
mov ecx, 0x4ed830
push eax
push 3
lea eax, [esp + 0x20]
push eax
push 0
push 0x4d5290
call fcn.00430710
mov esi, eax
test esi, esi
jne 0x404da2
cmp byte [esp + 0x12], al
mov ecx, 0x4ed830
setne al
inc eax
push eax
push dword [esp + 0x1c]
push esi
push 0x4d5290
call fcn.00430c50
mov esi, eax
test esi, esi
je 0x405272
cmp byte [esi + 0x17], 0
jne 0x404dab
mov esi, dword [esi + 0xc]
mov cl, byte [esi + 0x15]
test cl, 2
je 0x404dc4
mov eax, dword [esi]
and cl, 0x3d
mov byte [esi + 0x15], cl
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov cl, byte [esi + 0x15]
lea eax, [ebx - 1]
and cl, 0x8b
cdq
or cl, 0x18
mov dword [esi], eax
mov dword [esi + 4], edx
mov byte [esi + 0x15], cl
jge 0x404de5
mov ecx, esi
call fcn.004013b0
and byte [esi + 0x15], 0x8f
jmp 0x404df5
cmp dword [0x4eb748], 0
je 0x404df5
mov ecx, esi
call fcn.004013b0
lea eax, [esp + 0x12]
mov ecx, 0x4ed830
push eax
push 0xc1
lea eax, [esp + 0x20]
push eax
push 6
push str.A_Args
call fcn.00430710
mov edi, eax
test edi, edi
jne 0x404e47
cmp byte [esp + 0x12], al
mov ecx, 0x4ed830
setne al
add eax, 0xc1
push eax
push dword [esp + 0x1c]
push 6
push str.A_Args
call fcn.00430c50
mov edi, eax
test edi, edi
je 0x405272
call fcn.004b6744
mov ebx, dword [esp + 0x20]
mov esi, dword [eax]
sub esi, ebx
call fcn.004b674a
mov edx, esi
mov eax, dword [eax]
lea ecx, [eax + ebx*4]
call fcn.0048e4a0
test eax, eax
je 0x405272
push eax
mov ecx, edi
call fcn.004a2ae0
mov ecx, dword [0x4e88cc]
call fcn.00404510
cmp dword [0x4eb5ec], 0
mov dword [ecx + 0xb4], 0
mov dword [ecx + 0x20], 1
mov dword [ecx + 0xc9], 0x1010001
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0xffffffff
mov dword [ecx + 0x24], 0xa
mov dword [ecx + 0xb8], 5
mov dword [ecx + 0xc0], 0
mov word [ecx + 0xcd], 1
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], CreateStatusWindowA
mov dword [ecx + 0x40], CreateStatusWindowA
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x50], 0x2af8
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x54], 0x64
mov dword [ecx + 0x58], 0x14
mov dword [ecx + 0x5c], 0xa
mov dword [ecx + 0x60], 0xffffffff
mov dword [ecx + 0x64], 0xffffffff
mov dword [ecx + 0x68], 0xffffffff
mov dword [ecx + 0x6c], 0xa
mov dword [ecx + 0x70], 0xffffffff
mov byte [ecx + 0xcf], 2
mov dword [ecx + 0xd0], 0x1000000
mov byte [ecx + 0xd4], 1
mov eax, dword [str._0.6f]
mov dword [ecx + 0x74], eax
mov ax, word [0x4d5528]
mov word [ecx + 0x78], ax
mov word [ecx + 0xd5], 0x44
mov byte [ecx + 0xd9], 1
mov dword [ecx + 0xdc], 0
je 0x405267
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CryptEncrypt
push edi
call esi
push str.CryptDecrypt
push edi
mov dword [0x4eb768], eax
call esi
sub esp, 8
mov dword [0x4eb764], eax
mov ecx, 0x4ed830
push dword [esp + 0x1c]
sub esp, 8
call fcn.00422dd0
cmp eax, 1
jne 0x405272
mov esi, dword [0x4e88cc]
mov ecx, 0x3a
mov edi, 0x4eb628
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4ed830
call fcn.00423eb0
cmp eax, 0xffffffff
je 0x405272
test eax, eax
je 0x405267
mov eax, dword [0x4eb760]
test eax, eax
jne 0x40504b
cmp word [0x4ec200], ax
jne 0x40503d
cmp dword [0x4ec1e8], eax
jne 0x40503d
cmp dword [0x4eb75c], eax
jne 0x40503d
cmp dword [0x4eb758], eax
jne 0x40503d
cmp byte [0x4eb74d], al
je 0x405047
mov eax, 1
mov dword [0x4eb760], eax
test eax, eax
je 0x4050c0
cmp eax, 4
je 0x4050c0
cmp byte [esp + 0x14], 0
jne 0x4050c7
cmp byte [0x4eb74e], 0
jne 0x405142
push dword [0x4ede5c]
push dword [0x4e88d4]
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x405142
mov eax, dword [0x4eb760]
cmp eax, 3
je 0x405267
cmp eax, 2
je 0x4050b9
push 0
push dword [0x4ede50]
xorps xmm3, xmm3
mov edx, 4
mov ecx, str.An_older_instance_of_this_script_is_already_running.__Replace_it_with_this_instance__nNote:_To_avoid_this_message__see_SingleInstance_in_the_help_file.
call fcn.004a4620
add esp, 8
cmp eax, 7
je 0x405267
mov eax, 0x407
jmp 0x4050e4
cmp byte [esp + 0x14], 0
je 0x405142
push dword [0x4ede5c]
push dword [0x4e88d4]
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x405142
mov eax, 0x406
push 0
push eax
push 0x44
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x32
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40513e
cmp esi, 0x64
jne 0x40512e
push 0
push 0
xorps xmm3, xmm3
lea edx, [esi - 0x60]
mov ecx, str.Could_not_close_the_previous_instance_of_this_script.__Keep_waiting_
call fcn.004a4620
add esp, 8
cmp eax, 7
je 0x405272
xor esi, esi
push 0x32
inc esi
call ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x405107
push 0x64
call ebx
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push 0x4eb7d4
push 0
push 0x2000
call esi
test eax, eax
je 0x405172
cmp dword [0x4eb7d4], 0
je 0x405172
push 2
push 0
push 0
push 0x2001
call esi
mov ecx, 0x4ed830
call fcn.00423430
cmp eax, 1
jne 0x405272
push 0
push 4
push 0
push eax
call fcn.004b8727
add esp, 4
push eax
call fcn.004b8625
mov eax, dword [0x4e88d0]
add esp, 0x10
test eax, eax
je 0x4051ce
imul eax, eax, 0x70
push eax
call fcn.004b6720
add esp, 4
mov dword [0x4eb754], eax
test eax, eax
je 0x4051ce
imul ecx, dword [0x4e88d0], 0x70
push ecx
push 0
push eax
call fcn.004b4390
add esp, 0xc
push 0x4a1bb0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [0x4eb750], eax
call fcn.0040c020
lea eax, [esp + 0x12]
mov byte [0x4ede60], 1
push eax
push 3
lea eax, [esp + 0x20]
mov byte [0x4eb74c], 0
push eax
push 0
push str.Clipboard
mov ecx, 0x4ed830
call fcn.00430710
mov esi, eax
test esi, esi
jne 0x405239
cmp byte [esp + 0x12], al
mov ecx, 0x4ed830
setne al
inc eax
push eax
push dword [esp + 0x1c]
push esi
push str.Clipboard
call fcn.00430c50
mov esi, eax
test esi, esi
je 0x405259
cmp byte [esi + 0x17], 0
jne 0x405242
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x15], 0
jl 0x405259
mov ecx, esi
call fcn.004013b0
mov al, byte [esi + 0x15]
and al, 0xf
or al, 0x80
mov byte [esi + 0x15], al
call fcn.00405280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret 0x10