Function at 0x4019ba
Capabilities:
Get common file path
Patch process command line

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x67c
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [esp], 0x4be09e
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push ebx
mov dword [esp + 4], str.NtQueryInformationProcess
mov dword [esp], eax
call esi
push edx
push edx
test eax, eax
jne 0x4019f6
xor eax, eax
jmp 0x401d24
mov dword [esp], 0x4be09e
mov ebx, eax
call edi
push edx
mov dword [esp + 4], str.RtlEnterCriticalSection
mov dword [esp], eax
call esi
push ecx
push ecx
mov dword [ebp - 0x65c], eax
test eax, eax
je 0x4019ef
mov dword [esp], 0x4be09e
call edi
push edx
mov dword [esp + 4], str.RtlLeaveCriticalSection
mov dword [esp], eax
call esi
push ecx
push ecx
mov dword [ebp - 0x660], eax
test eax, eax
je 0x4019ef
mov dword [esp], 0x4be09e
call edi
push edx
mov dword [esp + 4], str.RtlInitUnicodeString
mov dword [esp], eax
call esi
mov edi, eax
push ecx
push ecx
test eax, eax
je 0x4019ef
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [esp], 0x438
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
sub esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x4019ef
lea eax, [ebp - 0x648]
xor ecx, ecx
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov dword [esp], esi
call ebx
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
sub esp, 0x14
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x658]
mov dword [esp + 8], eax
lea eax, [ebp - 0x644]
mov dword [esp + 0xc], 4
mov dword [esp + 4], eax
mov dword [esp], esi
call ebx
sub esp, 0x14
test eax, eax
je 0x4019ef
xor edx, edx
lea eax, [ebp - 0x654]
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x658]
mov dword [esp], esi
add eax, 0xc
mov dword [esp + 4], eax
call ebx
sub esp, 0x14
test eax, eax
je 0x4019ef
lea edx, [ebp - 0x630]
mov dword [esp + 4], 0x104
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea edx, [ebp - 0x630]
push ebx
push ebx
mov dword [esp], edx
mov dword [esp + 8], 0x4be112
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll_wcscat_s]
mov dword [esp], 0x104
call sub.msvcrt.dll_malloc
lea edx, [ebp - 0x630]
mov dword [esp + 4], 0x105
mov dword [esp + 8], edx
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy_s]
mov eax, dword [ebp - 0x658]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
mov eax, dword [ebp - 0x65c]
call eax
push eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x658]
mov eax, dword [eax + 0x10]
add eax, 0x38
mov dword [esp], eax
call edi
push eax
push eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x658]
mov eax, dword [eax + 0x10]
add eax, 0x40
mov dword [esp], eax
call edi
push eax
push eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], 0x104
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
sub esp, 0xc
mov dword [esp], 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
push eax
mov eax, dword [ebp - 0x658]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x654]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x64c], eax
mov edx, dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
lea eax, [ebp - 0x650]
xor ecx, ecx
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x64c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 4], eax
mov dword [ebp - 0x664], edx
call edx
sub esp, 0x14
test eax, eax
je 0x4019ef
mov eax, dword [ebp - 0x650]
xor edx, edx
mov dword [esp + 0x10], edx
movzx ecx, word [eax + 0x26]
mov dword [esp + 0xc], ecx
lea ecx, [ebp - 0x428]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x28]
mov dword [esp], esi
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x664]
call edx
sub esp, 0x14
test eax, eax
je 0x4019ef
lea eax, [ebp - 0x428]
mov dword [esp + 4], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov eax, dword [ebp - 0x650]
jne 0x401cce
add eax, 0x24
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
push ecx
push ecx
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x650]
add eax, 0x2c
mov dword [esp], eax
call edi
push ebx
push ebx
jmp 0x401ce4
mov eax, dword [eax]
mov ecx, dword [ebp - 0x65c]
mov dword [ebp - 0x64c], eax
cmp eax, ecx
jne 0x401c0e
mov eax, dword [ebp - 0x658]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
mov eax, dword [ebp - 0x660]
call eax
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x428]
push edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x630]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret