Function at 0x45f8a0
Capabilities:
Accept command line arguments
Acquire debug privileges
Check os version
Get common file path
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x114
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x158]
push 0
push eax
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x15c], 0
call fcn.00471730
add esp, 0xc
mov dword [ebp - 0x160], 0x11c
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x440]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45f95c
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 4
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x434]
push eax
push 0
push 0x4a75e4
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SetDllDirectoryW
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x45f980
push 0x490b00
call eax
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov esi, eax
mov edi, 1
test esi, esi
je 0x45f9ce
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
movzx eax, byte [0x4bdfb7]
cmp dword [ebp - 0x41c], 0
cmovne eax, edi
mov byte [0x4bdfb7], al
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [0x4be600], ebx
lea eax, [ebp - 0x418]
mov dword [ebp - 0x434], esi
push eax
push 0x4bdfb8
mov dword [ebp - 0x418], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x104
push 0x4be1c0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5c
push 0x4be1c6
call fcn.00472ae7
xor ecx, ecx
push esi
mov word [eax], cx
lea eax, [ebp - 0x3f4]
push eax
push 0x49794c
call fcn.0040ba20
add esp, 0x14
test eax, eax
setne al
test al, al
je 0x45ff25
push 1
push esi
lea eax, [ebp - 0x3f4]
push eax
push str.OpenLog
call fcn.0044ce20
push 0
mov edi, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.Terminate
mov dword [ebp - 0x420], edi
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.WaitForIdle
setne byte [ebp - 0x40e]
call fcn.0044ce20
push 1
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.SaveAs
setne byte [ebp - 0x401]
call fcn.0044ce20
add esp, 0x40
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x3f4]
push 1
push esi
push eax
push str.SaveAs1
call fcn.0044ce20
push 1
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.SaveAs2
call fcn.0044ce20
push 0
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.SaveApplyFilter
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.EnableBootLogging
setne byte [ebp - 0x3fa]
call fcn.0044ce20
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x3f4]
setne byte [ebp - 0x402]
push 1
push esi
push eax
push str.ConvertBootLog
call fcn.0044ce20
push 1
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.LoadConfig
call fcn.0044ce20
push 0
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.NoFilter
call fcn.0044ce20
push 1
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.BackingFile
setne byte [ebp - 0x412]
call fcn.0044ce20
add esp, 0x40
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x3f4]
push 1
push esi
push eax
push str.OriginalPath
call fcn.0044ce20
push 0
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.PagingFile
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push 0x497c84
setne byte [ebp - 0x3f9]
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.NoConnect
setne byte [ebp - 0x40d]
call fcn.0044ce20
add esp, 0x40
test eax, eax
lea eax, [ebp - 0x3f4]
setne byte [ebp - 0x405]
push 0
push esi
push eax
push str.Client
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.Minimized
setne byte [ebp - 0x404]
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.Quiet
setne byte [ebp - 0x403]
call fcn.0044ce20
push 1
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.Runtime
setne byte [ebp - 0x411]
call fcn.0044ce20
add esp, 0x40
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x3f4]
push 0
push esi
push eax
push 0x4a77c8
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
setne bh
push 0x4a77cc
mov byte [ebp - 0x40f], bh
call fcn.0044ce20
add esp, 0x20
test eax, eax
setne al
test al, al
je 0x45fccf
or dword [0x4bc120], 8
push 0
push esi
lea eax, [ebp - 0x3f4]
push eax
push str.ExternalCapture
call fcn.0044ce20
push 0
test eax, eax
lea eax, [ebp - 0x3f4]
push esi
push eax
push str.Run32
setne byte [ebp - 0x410]
call fcn.0044ce20
add esp, 0x20
test eax, eax
setne bl
mov byte [ebp - 0x40c], bl
test edi, edi
jne 0x45fd30
push edi
push esi
lea eax, [ebp - 0x3f4]
push eax
push 0x490b00
call fcn.0044ce20
add esp, 0x10
mov dword [ebp - 0x420], eax
mov edi, eax
test bh, bh
jne 0x45fd52
test edi, edi
jne 0x45fd52
call fcn.00436ab0
test al, al
jne 0x45fd52
mov al, byte [0x4bdfb7]
test al, al
je 0x45fd4e
test bl, bl
jne 0x45fd57
mov bh, 1
jmp 0x45fd59
mov al, byte [0x4bdfb7]
xor bh, bh
mov byte [ebp - 0x418], bh
test al, al
je 0x45fd6b
test bl, bl
jne 0x45fd6b
mov bl, 1
jmp 0x45fd6d
xor bl, bl
mov byte [ebp - 0x3f8], bl
test edi, edi
je 0x45fdb4
test bl, bl
je 0x45fdb4
push 0x5a0
call fcn.004705b4
add esp, 4
test eax, eax
je 0x45fd95
mov ecx, eax
call fcn.004158b0
jmp 0x45fd97
xor eax, eax
push edi
mov ecx, eax
call fcn.00468ca0
cmp eax, 0xffffffff
je 0x45fdb4
and al, 1
neg al
sbb al, al
and al, bl
mov bl, al
mov byte [ebp - 0x3f8], bl
test bh, bh
je 0x45fe58
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x400], 0
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x45fe1a
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x45c], 4
push eax
lea eax, [ebp - 0x400]
push eax
push 0
push 0
push str.EnableLUA
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x15c], 6
jb 0x45fe2c
cmp dword [ebp - 0x400], 0
jne 0x45fe58
push 0
push ecx
mov edi, esp
push str.Process_Monitor_must_be_run_from_an_administrator_account.
call fcn.0046b670
push eax
push str.Process_Monitor_must_be_run_from_an_administrator_account.
call fcn.0046b800
add esp, 0xc
mov dword [edi], eax
call fcn.004380f0
add esp, 8
jmp 0x45ff25
test bl, bl
jne 0x460891
test bh, bh
jne 0x460891
mov eax, dword [ebp - 0x458]
test eax, eax
je 0x45fe87
push eax
push 0x104
push 0x4be3e0
call fcn.00470605
add esp, 0xc
jmp 0x45fe99
push 0x104
push 0x4be3e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x3f8], 0
test eax, eax
je 0x45febb
mov dword [ebp - 0x3f8], 2
mov ebx, eax
jmp 0x45fed9
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x45fed3
mov dword [ebp - 0x3f8], 1
mov ebx, eax
jmp 0x45fed9
mov ebx, dword [ebp - 0x448]
cmp byte [ebp - 0x40f], 0
jne 0x460872
cmp dword [ebp - 0x3f4], 1
jne 0x4607dd
cmp byte [ebp - 0x3f9], 0
je 0x45ff09
cmp dword [ebp - 0x41c], 0
jne 0x4607dd
test ebx, ebx
je 0x45ff46
test edi, edi
jne 0x45ff46
push 0x10
push 0x49794c
push str.The__SaveAs_option_is_valid_only_when_used_with__OpenLog
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470e77
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x45ff8d
push eax
push dword [0x4be5fc]
call fcn.00447280
add esp, 8
test al, al
je 0x460105
push 0
mov ecx, 0x4bda08
call fcn.00417fa0
push 0
call fcn.0043add0
add esp, 4
mov ecx, 0x4bda08
push 0
call fcn.004160b0
xor edi, edi
jmp 0x45ff2a
cmp byte [ebp - 0x3fa], 0
je 0x45ffea
test ebx, ebx
jne 0x45ffea
push str.The__SaveApplyFilter_option_is_valid_only_when_used_with__SaveAs
call fcn.0046b670
push eax
push str.The__SaveApplyFilter_option_is_valid_only_when_used_with__SaveAs
call fcn.0046b800
add esp, 0xc
mov dword [ebp - 0x400], eax
lea ecx, [ebp - 0x400]
push 0x10
push 0x49794c
call fcn.0046b310
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x400]
test ecx, ecx
je 0x45ff25
call fcn.0046b840
jmp 0x45ff25
mov ecx, 0x4bda08
call fcn.004174c0
test al, al
jne 0x460009
push 0x10
push 0x49794c
push str.Procmon_was_unable_to_allocate_sufficient_memory_to_run._nTry_increasing_the_size_of_your_page_file.
jmp 0x45ff1d
cmp byte [ebp - 0x401], 0
je 0x460057
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
lea ebx, [ebx]
push 0
push str.PROCMON_WINDOW_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x460040
push 0x64
call ebx
inc edi
cmp edi, 0x64
jl 0x460020
jmp 0x45ff25
push 0
push 0
push 0x8009
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
jmp 0x45ff2a
mov ecx, dword [ebp - 0x444]
or eax, 0xffffffff
mov dword [ebp - 0x430], eax
test ecx, ecx
je 0x4600b7
lea eax, [ebp - 0x430]
push eax
push 0x4984cc
push ecx
call fcn.00473ed1
add esp, 0xc
cmp eax, 1
je 0x460095
push 0x10
push 0x49794c
push str.Runtime_parameter_must_be_specified_in_seconds.
jmp 0x45ff1d
mov eax, dword [ebp - 0x430]
test eax, eax
je 0x4600a6
cmp eax, 0xe10
jbe 0x4600b7
push 0x10
push 0x49794c
push str.Runtime_parameter_must_be_between_1_and_3600_seconds.
jmp 0x45ff1d
cmp byte [ebp - 0x402], 0
je 0x4600d7
push eax
push 1
push 1
push 0
call fcn.0040e970
add esp, 0x10
movzx edi, al
jmp 0x45ff2a
cmp byte [ebp - 0x40e], 0
je 0x46010c
push 0
push str.PROCMON_WINDOW_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x45ff25
push 0
push 0
push 0x800a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
jmp 0x45ff2a
push 0x4000000
mov ecx, 0x4bec00
call fcn.0044dcc0
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x44], 0x40
push 0
push eax
mov dword [ebp - 0x40], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp - 0x15c], 6
mov ecx, dword [ebp - 0x3c]
sbb eax, eax
and eax, 0xef4f8a00
add eax, 0x1dcd6500
sub ecx, eax
mov eax, dword [ebp - 0x38]
push 0
sbb eax, 0
shld eax, ecx, 1
push 3
add ecx, ecx
push eax
push ecx
call fcn.00473940
mov dword [0x4bdf98], eax
mov dword [0x4bdf9c], edx
test edx, edx
jg 0x46019e
jl 0x46018a
cmp eax, 0x800000
jae 0x460191
mov eax, 0x800000
jmp 0x4601a3
test edx, edx
jl 0x4601b0
jg 0x46019e
cmp eax, 0x3e800000
jb 0x4601b0
mov eax, 0x3e800000
xor edx, edx
mov dword [0x4bdf98], eax
mov dword [0x4bdf9c], edx
add eax, 0x2000000
push str.SeDebugPrivilege
adc edx, 0
mov dword [0x4bdfa0], eax
mov dword [0x4bdfa4], edx
call fcn.0040ed30
add esp, 4
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 1
push str.ProcMon_Log_File
push str.ProcMon.Logfile.1
push 0x4a4440
push dword [ebp - 0x40c]
call fcn.00434d50
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x3f0], ax
lea eax, [ebp - 0x3ee]
push eax
call fcn.00471730
add esp, 0x20
lea eax, [ebp - 0x3f0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push fcn.00453c40
call fcn.0047333c
push 1
call fcn.00474a1b
add esp, 8
push 1
push 0x447190
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x1ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp byte [0x4bdfb7], 0
mov ecx, str.SoftwareSysinternalsProcess_Monitor
push 0
push 0x4be5f0
push 0
push 0xf003f
push 0
push 0
mov eax, str.SoftwareSysinternalsProcess_Monitor32
cmove eax, ecx
push 0
push eax
push reloc.WS2_32.dll_accept
mov dword [0x4be5f4], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [0x4be5f0]
lea ecx, [ebp - 0x428]
call fcn.004659d0
lea eax, [ebp - 0x428]
push eax
call fcn.00465f80
add esp, 4
lea ecx, [ebp - 0x428]
call fcn.004659f0
push dword [0x4be7a0]
mov ecx, 0x4bda08
call fcn.00419150
cmp dword [ebp - 0x42c], 0
je 0x460357
lea ecx, [ebp - 0x260]
call fcn.004156d0
push 0
push 1
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x260]
call fcn.00430870
test al, al
jne 0x460320
push 0x10
push 0x49794c
push str.The_selected_configuration_file_cannot_be_opened
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x260]
call fcn.00415b30
mov edi, 2
jmp 0x45ff2a
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x428]
call fcn.004659b0
lea eax, [ebp - 0x428]
push eax
call fcn.00465f80
add esp, 4
lea ecx, [ebp - 0x428]
call fcn.004659f0
lea ecx, [ebp - 0x260]
call fcn.00415b30
cmp byte [ebp - 0x410], 0
je 0x460367
or dword [0x4bc120], 0x10
cmp byte [ebp - 0x412], 0
je 0x46037c
push 0
mov ecx, 0x4bda8c
call fcn.00458a30
push 0x4bebd4
push str.DeviceNameMap
push dword [0x4be5f0]
call fcn.00436c90
mov eax, dword [ebp - 0x41c]
add esp, 0xc
test eax, eax
je 0x4603ca
push 0
push 0x4be9c0
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x4a4440
push 0x104
push 0x4be9c0
call fcn.00435f40
add esp, 0xc
jmp 0x4603db
cmp byte [ebp - 0x3f9], 0
je 0x4603db
xor eax, eax
mov word [0x4be9c0], ax
call fcn.00436bb0
test al, al
je 0x4603f2
or dword [0x4bc120], 0x40
mov byte [0x4bdfa9], 1
mov eax, dword [0x4be79c]
mov ecx, 1
cmp byte [ebp - 0x40d], 0
push 2
cmovne eax, ecx
mov dword [0x4be79c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.0046d880
test edi, edi
je 0x460552
test ebx, ebx
je 0x460552
push 0x2e
push ebx
call fcn.00472b95
add esp, 8
test eax, eax
je 0x460541
push eax
call fcn.0044cf20
add esp, 4
mov dword [ebp - 0x40c], eax
test eax, eax
js 0x460541
push 0
push edi
push 0
call fcn.00452e40
add esp, 0xc
test al, al
je 0x45ff25
push 0
mov ecx, 0x4bda08
call fcn.00417fa0
cmp dword [ebp - 0x3f8], 2
mov ecx, 0x4bda08
setge al
cmp dword [ebp - 0x3f8], 1
movzx eax, al
push eax
setge al
movzx eax, al
push eax
mov eax, dword [ebp - 0x40c]
push 1
push dword [eax*8 + 0x4a440c]
xor eax, eax
cmp byte [ebp - 0x3fa], al
setne al
push eax
push ebx
push 0
call fcn.00421230
mov edi, eax
test edi, edi
je 0x460105
push str.The_file_was_not_saved.
call fcn.0046b670
push eax
push str.The_file_was_not_saved.
call fcn.0046b800
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x40c]
push edi
push eax
call fcn.00459fb0
add esp, 0x14
lea ecx, [ebp - 0x3f8]
push eax
call fcn.0046b4b0
mov ecx, dword [ebp - 0x40c]
test ecx, ecx
je 0x46050e
call fcn.0046b840
push 0x10
push 0x49794c
lea ecx, [ebp - 0x3f8]
call fcn.0046b310
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x3f8]
test ecx, ecx
je 0x45ff25
call fcn.0046b840
jmp 0x45ff25
push 0x10
push 0x49794c
push str.Invalid_file_extension_in__SaveAs_option
jmp 0x45ff1d
cmp byte [ebp - 0x404], 0
jne 0x4607b2
push str.commdlg_FindReplace
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov ebx, dword [ebp - 0x438]
push str.ACCELERATORS
push ebx
mov dword [0x4be5ec], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push ebx
mov dword [ebp - 0x40c], eax
call fcn.0044e4b0
mov edi, dword [sym.imp.KERNEL32.dll_MulDiv]
add esp, 4
push 0
push ebx
push 0
push 0
push 0x60
push dword [0x4bd898]
push 0x12c
call edi
push eax
push 0x60
push dword [0x4bd894]
push 0x1f4
call edi
push eax
push 0x60
push dword [0x4bd898]
push 0xc8
call edi
push eax
push 0x60
push dword [0x4bd894]
push 0x64
call edi
mov bl, byte [ebp - 0x403]
mov ecx, 0x20000000
push eax
xor eax, eax
test bl, bl
cmovne eax, ecx
or eax, 0xcf0000
push eax
push str.Process_Monitor___Sysinternals:_www.sysinternals.com
push str.PROCMON_WINDOW_CLASS
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, eax
mov dword [0x4be5fc], ecx
test ecx, ecx
je 0x45ff25
test bl, bl
je 0x46061f
mov eax, 2
jmp 0x46062d
mov eax, dword [ebp + 0x14]
mov edx, 5
cmp eax, 1
cmove eax, edx
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4be5fc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, 0x4bda8c
call fcn.00413e80
test al, al
jne 0x460679
test bl, bl
jne 0x460679
cmp byte [ebp - 0x411], bl
jne 0x460679
push 1
push 0x44c650
push dword [0x4be5fc]
push str.FILTER_INIT
push dword [0x4be600]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 0
push dword [0x4be5fc]
call fcn.00447280
add esp, 8
test al, al
je 0x46069b
push 0
mov ecx, 0x4bda08
call fcn.00417fa0
jmp 0x46070d
mov edi, dword [ebp - 0x420]
test edi, edi
je 0x4606d9
cmp byte [0x4be795], 0
je 0x4606c6
push 0
push 0x9c53
push 0x111
push dword [0x4be5fc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [0x4be5fc]
call fcn.00452e40
add esp, 0xc
jmp 0x46070d
cmp byte [ebp - 0x405], 0
jne 0x46070d
cmp byte [0x4bdfb7], 0
jne 0x46070d
xor eax, eax
cmp dword [ebp - 0x41c], eax
setne al
push eax
push 0x9c87
push 0x111
push dword [0x4be5fc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x430]
cmp eax, 0xffffffff
je 0x46072f
imul eax, eax, 0x3e8
push 0
push eax
push 2
push dword [0x4be5fc]
call dword [sym.imp.USER32.dll_SetTimer]
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x478]
push 0
push 0
push 0
push eax
call ebx
test eax, eax
je 0x4607b7
mov esi, dword [ebp - 0x40c]
mov edi, edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
lea eax, [ebp - 0x478]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x460797
lea eax, [ebp - 0x478]
push eax
push edi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x460797
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0x478]
push eax
call ebx
test eax, eax
jne 0x460750
mov esi, dword [ebp - 0x434]
jmp 0x4607b7
call fcn.0043a690
push 0
call fcn.0043add0
push 0x4bebd4
push str.DeviceNameMap
push dword [0x4be5f0]
call fcn.00437cc0
add esp, 0x10
xor edi, edi
jmp 0x45ff2a
mov edi, dword [esi + 4]
push edi
call fcn.0046b670
push eax
push edi
call fcn.0046b800
push str.Invalid_argument:
mov dword [ebp - 0x42c], eax
call fcn.0046b670
push eax
push str.Invalid_argument:
call fcn.0046b800
add esp, 0x18
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x42c]
lea ecx, [ebp - 0x420]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0046b3d0
mov ecx, dword [ebp - 0x420]
test ecx, ecx
je 0x460839
call fcn.0046b840
mov ecx, dword [ebp - 0x42c]
test ecx, ecx
je 0x460848
call fcn.0046b840
push 0x10
push 0x49794c
lea ecx, [ebp - 0x400]
call fcn.0046b310
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x400]
test ecx, ecx
je 0x460872
call fcn.0046b840
push 0
push 0x40bfe0
push 0
push str.USAGE
push dword [ebp - 0x438]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x45ff25
push dword [ebp - 0x424]
lea ecx, [ebp - 0x424]
call fcn.00402130
mov eax, dword [eax]
test eax, eax
je 0x4608ac
mov eax, dword [eax]
jmp 0x4608ae
xor eax, eax
push dword [ebp - 0x418]
push dword [ebp - 0x3f8]
push eax
push dword [ebp + 0x14]
call fcn.004377d0
add esp, 0x10
lea ecx, [ebp - 0x424]
test al, al
sete bl
call fcn.004021d0
test bl, bl
je 0x460105
push 0
push ecx
mov edi, esp
push str.Unable_to_extract_x64_image._Run_Process_Monitor_from_a_writable_directory.
call fcn.0046b670
push eax
push str.Unable_to_extract_x64_image._Run_Process_Monitor_from_a_writable_directory.
jmp 0x45fe41