Function at 0x4338ae
Capabilities:
Accept command line arguments

Disassembly:
push 8
push pe_nt_image_headers32
mov eax, 0x43f352
call fcn.0043a70f
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x84], eax
mov ecx, eax
mov dword [ebp - 0x74], ecx
push eax
push eax
push 1
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, dword [0x449004]
lea esi, [esi - 0x10]
lea edi, [ebp - 0x100]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [0x449020], ecx
mov dword [0x449024], ecx
push 0x449018
mov edi, section..data
push edi
push 0x408290
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventRegister]
test eax, eax
jne 0x433954
mov ecx, dword [0x449004]
movzx eax, word [ecx]
push eax
push ecx
push 2
push dword [0x44901c]
push dword [0x449018]
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventSetInformation]
cmp dword [section..data], 5
jbe 0x4339e5
mov ecx, dword [0x44900c]
mov esi, 0x4000
and ecx, esi
xor edx, edx
mov eax, edx
or eax, ecx
je 0x4339e5
mov ecx, dword [0x449014]
mov eax, ecx
and eax, esi
cmp edx, dword [0x449010]
jne 0x4339e5
cmp eax, ecx
jne 0x4339e5
mov dword [ebp - 0xb8], 0x2000000
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0x98], 1
lea eax, [ebp - 0x98]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x60]
push eax
push 4
push edx
push edx
push 0x407e79
push edi
call fcn.0040830b
mov ecx, dword [0x449018]
mov eax, dword [0x44901c]
xor edx, edx
mov dword [section..data], edx
mov dword [0x449018], edx
mov dword [0x44901c], edx
push eax
push ecx
call dword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventUnregister]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
xor eax, eax
mov esi, eax
mov dword [ebp - 0x98], esi
push eax
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
js 0x433a34
inc esi
mov dword [ebp - 0x98], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x434149
xor eax, eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 4
cmp dword [0x4498fc], eax
je 0x433a6f
mov dword [0x4498fc], eax
mov dword [0x44965c], eax
push eax
call fcn.004359fe
mov edi, dword [0x4498d0]
mov dword [ebp - 0x74], edi
jmp 0x43413b
call fcn.00434969
test eax, eax
je 0x434138
push ecx
lea ecx, [ebp - 0xb0]
call fcn.0043443c
mov byte [ebp - 4], 5
cmp dword [ebx + 8], 1
jne 0x434032
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
cmp eax, 0xffffffff
jne 0x433afa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x80], edi
mov byte [ebp - 4], 4
cmp byte [ebp - 0xb0], 0
jne 0x433ad4
mov edi, dword [ebp - 0xa8]
mov ecx, edi
call dword [0x44a344]
mov ecx, dword [ebp - 0xac]
call edi
mov edi, dword [ebp - 0x80]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
call fcn.00411764
mov byte [ebp - 4], 2
cmp esi, 1
jne 0x433aef
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
mov eax, edi
mov ecx, dword [ebp - 0x1c]
call fcn.0043a6ed
ret
push ecx
push dword [sym.imp.msvcrt.dll_fclose]
lea ecx, [ebp - 0x6c]
call fcn.00434486
mov byte [ebp - 4], 6
push ecx
push dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
lea ecx, [ebp - 0xf0]
call fcn.004344cb
mov byte [ebp - 4], 7
push 1
call fcn.004347c4
xor edi, edi
mov eax, dword [0x4497b8]
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x78]
call dword [sym.imp.framedynos.dll_public:_void___thiscall_CHString::constructor_void_]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x90]
cmp eax, 2
jne 0x433b64
push dword [0x4497c0]
lea ecx, [ebp - 0x78]
call dword [sym.imp.framedynos.dll_public:_class_CHString_const____thiscall_CHString::operator_unsigned_short_int_const__]
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x433b6e
mov dword [0x4497b8], edi
mov eax, dword [0x4497cc]
mov dword [ebp - 0xd8], eax
mov dword [0x4497cc], edi
xor edi, edi
inc edi
mov dword [0x449788], edi
push 0x406778
lea ecx, [ebp - 0xc8]
call fcn.004117f0
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x7c]
call fcn.0041156f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xc8]
call fcn.00411764
push 0x406784
lea ecx, [ebp - 0xcc]
call fcn.00411596
push 0xa
pop ecx
mov byte [ebp - 4], cl
push eax
lea ecx, [ebp - 0x7c]
call fcn.004116d9
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xcc]
call fcn.00411764
push dword [0x449750]
lea ecx, [ebp - 0xd0]
call fcn.004117f0
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x7c]
call fcn.004116d9
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd0]
call fcn.00411764
push 0x406654
lea ecx, [ebp - 0xd4]
call fcn.00411596
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x7c]
call fcn.004116d9
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd4]
call fcn.00411764
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x433c48
mov ecx, dword [eax]
xor eax, eax
jmp 0x433c4c
xor eax, eax
mov ecx, eax
push eax
push eax
push eax
call fcn.00431a9a
mov dword [0x4498e0], edi
cmp byte [0x449530], 0
jne 0x433f5f
xor edi, edi
mov dword [ebp - 0x8c], edi
push 0x1ffe
call fcn.004399fc
pop ecx
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x433e67
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xe4]
call fcn.00416a63
mov byte [ebp - 4], 0xd
push edi
call fcn.0043a4fd
pop ecx
push eax
push 0xffe
push dword [ebp - 0x8c]
call dword [sym.imp.msvcrt.dll_fgetws]
add esp, 0xc
test eax, eax
je 0x433e56
mov dword [ebp - 0x9c], edi
lea edx, [ebp - 0x9c]
mov ecx, dword [ebp - 0x8c]
call fcn.004304c3
test eax, eax
je 0x433e2c
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xc4]
call fcn.00434513
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xa0], edi
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00416a63
mov byte [ebp - 4], 0xf
push ecx
lea edx, [ebp - 0xa0]
mov ecx, dword [ebp - 0x9c]
call fcn.0043045c
test eax, eax
je 0x433dbf
push dword [ebp - 0xa0]
mov ecx, 0x449180
call fcn.004202d7
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xfc]
call fcn.004169fd
mov byte [ebp - 4], 0xd
cmp byte [ebp - 0xc4], 0
jne 0x433d70
push dword [ebp - 0xbc]
mov edi, dword [ebp - 0xc0]
mov ecx, edi
call dword [0x44a344]
call edi
xor edi, edi
mov eax, dword [0x449190]
mov dword [ebp - 0x80], eax
mov ecx, dword [0x449194]
mov edx, dword [0x449180]
cmp ecx, 8
mov eax, edx
jae 0x433d90
mov eax, 0x449180
mov edi, dword [ebp - 0x80]
push 0xa
pop esi
cmp word [eax + edi*2 - 2], si
mov esi, dword [ebp - 0x98]
mov edi, dword [ebp - 0x94]
jne 0x433e1b
cmp ecx, 8
jae 0x433db3
mov edx, 0x449180
xor ecx, ecx
mov eax, dword [ebp - 0x80]
mov word [edx + eax*2 - 2], cx
jmp 0x433e1b
xor eax, eax
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xa4], eax
mov dword [0x4496b8], 0xbbef
push edi
call fcn.004359fe
mov ecx, dword [0x4498d0]
mov dword [ebp - 0x74], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xfc]
call fcn.004169fd
mov byte [ebp - 4], 0xd
cmp byte [ebp - 0xc4], 0
jne 0x433e1b
push dword [ebp - 0xbc]
mov edi, dword [ebp - 0xc0]
mov ecx, edi
call dword [0x44a344]
call edi
xor edi, edi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe4]
call fcn.004169fd
jmp 0x433e8f
xor eax, eax
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xa4], eax
mov dword [0x4496b8], 0xbbef
push edi
call fcn.004359fe
mov ecx, dword [0x4498d0]
mov dword [ebp - 0x74], ecx
jmp 0x433e1b
xor eax, eax
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xa4], eax
jmp 0x433e1b
xor eax, eax
inc eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0xa4], eax
mov dword [0x4496b8], 0xbbef
push edi
call fcn.004359fe
mov ecx, dword [0x4498d0]
mov dword [ebp - 0x74], ecx
cmp byte [0x449530], 0
jne 0x433f5f
mov dword [0x4498e0], edi
mov eax, dword [ebp - 0xd8]
mov dword [0x4497cc], eax
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x433ebc
mov dword [0x4497b8], eax
push 1
call fcn.004359fe
cmp dword [ebp - 0x84], 0
jne 0x433f5f
mov dword [0x4498dc], edi
mov ecx, 0x4498ec
call dword [sym.imp.framedynos.dll_public:_void___thiscall_CHString::Empty_void_]
cmp byte [0x449530], 0
jne 0x433f5f
lea eax, [ebp - 0xb4]
push eax
call fcn.0043441a
push dword [eax]
mov ecx, 0x449540
call fcn.00434c5d
mov ecx, dword [0x4498d0]
mov dword [ebp - 0x74], ecx
cmp eax, 2
je 0x433f5f
mov eax, dword [0x4497b8]
mov dword [ebp - 0x80], eax
cmp eax, 1
jne 0x433f2a
mov ecx, 0x4498ec
call fcn.004342e1
mov eax, dword [ebp - 0x80]
cmp eax, 2
je 0x433f38
call fcn.00434275
test eax, eax
je 0x433f5f
call fcn.004342ab
test eax, eax
je 0x433f5f
cmp dword [0x449730], 1
jne 0x434020
mov eax, dword [ebp - 0x80]
cmp eax, 2
jne 0x433fbe
call fcn.00434275
test eax, eax
jne 0x433fbb
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x78]
call dword [sym.imp.framedynos.dll_public:_void___thiscall_CHString::destructor_void_]
xor edi, edi
push edi
call fcn.004347c4
mov byte [ebp - 4], 6
cmp byte [ebp - 0xf0], 0
jne 0x433f97
push dword [ebp - 0xe8]
mov edi, dword [ebp - 0xec]
mov ecx, edi
call dword [0x44a344]
call edi
mov byte [ebp - 4], 5
cmp byte [ebp - 0x6c], 0
jne 0x434115
push dword [ebp - 0x64]
mov edi, dword [ebp - 0x68]
mov ecx, edi
call dword [0x44a344]
call edi
pop ecx
jmp 0x434115
mov eax, dword [ebp - 0x80]
mov dword [0x449730], edi
cmp eax, 2
jne 0x433fd6
push 1
push edi
mov ecx, 0x44973c
call fcn.00428913
mov eax, dword [ebp - 0x90]
mov dword [0x4497b8], eax
cmp eax, 2
jne 0x434020
push dword [ebp - 0x78]
lea ecx, [ebp - 0x88]
call fcn.004117f0
mov byte [ebp - 4], 0x10
mov eax, dword [eax]
test eax, eax
je 0x434002
mov eax, dword [eax]
jmp 0x434004
mov eax, edi
push 1
push eax
mov ecx, 0x44973c
call fcn.00428913
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x88]
call fcn.00411764
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x78]
call dword [sym.imp.framedynos.dll_public:_void___thiscall_CHString::destructor_void_]
jmp 0x433b2c
cmp dword [ebx + 8], 4
jne 0x434045
mov ecx, dword [ebp - 0x88]
call fcn.00433810
jmp 0x434047
xor eax, eax
test al, al
je 0x434090
mov byte [ebp - 4], 4
cmp byte [ebp - 0xb0], 0
jne 0x43406e
mov edi, dword [ebp - 0xa8]
mov ecx, edi
call dword [0x44a344]
mov ecx, dword [ebp - 0xac]
call edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
call fcn.00411764
mov byte [ebp - 4], 2
cmp esi, 1
jne 0x434089
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
xor eax, eax
jmp 0x433af1
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
mov ecx, 0x449180
call fcn.004202d7
cmp dword [0x449190], 0
je 0x434115
push 1
call fcn.004359fe
lea eax, [ebp - 0x88]
push eax
call fcn.0043441a
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0xb4]
push eax
call fcn.004343f0
cmp edx, dword [eax]
je 0x4340de
cmp word [edx], 0x20
je 0x4340de
add edx, 2
jmp 0x4340c3
lea eax, [ebp - 0xb4]
push eax
call fcn.004343f0
cmp edx, dword [eax]
je 0x434115
push edx
mov ecx, 0x449540
call fcn.00434c5d
mov ecx, dword [0x4498d0]
mov dword [ebp - 0x74], ecx
cmp dword [0x4497b8], 1
jne 0x434115
mov ecx, 0x4498ec
call fcn.004342e1
mov byte [ebp - 4], 4
cmp byte [ebp - 0xb0], 0
jne 0x434138
mov edi, dword [ebp - 0xa8]
mov ecx, edi
call dword [0x44a344]
mov ecx, dword [ebp - 0xac]
call edi
mov edi, dword [ebp - 0x74]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
call fcn.00411764
jmp 0x434172
xor edi, edi
cmp dword [0x4496c8], edi
je 0x434163
push edi
push 0x449628
mov ecx, 0x4495a0
call fcn.00421222
push edi
call fcn.004359fe
mov edi, dword [0x4498d0]
mov dword [ebp - 0x74], edi
mov byte [ebp - 4], 2
cmp esi, 1
jne 0x434181
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
jmp 0x433aef