Function at 0x43a3f0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4752a3
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
je 0x43a5c5
call fcn.00425cf0
mov esi, eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x18]
call fcn.0041e0e0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x250], ebx
call fcn.00426010
mov eax, dword [esp + 0x14]
or ebp, 0xffffffff
lea ecx, [eax - 0xc]
mov dword [esp + 0x24c], ebp
cmp ecx, dword [0x493010]
je 0x43a49c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43a49c
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0045c814
add esp, 4
mov ecx, esi
call fcn.00426790
mov ecx, dword [0x496cf4]
cmp ecx, ebx
je 0x43a4bb
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
push ebx
push ebx
push 0xe10
call eax
mov ecx, edi
call fcn.004403d0
test eax, eax
je 0x43a5c5
mov ecx, edi
call fcn.0043b390
cmp eax, ebx
je 0x43a5c5
mov ecx, edi
call fcn.0043e4e0
cmp eax, 1
je 0x43a4ef
cmp eax, 2
je 0x43a4ef
cmp eax, 3
jne 0x43a4f4
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x18]
call fcn.0041c830
mov eax, dword [eax]
push eax
call fcn.0045cad1
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0041a500
mov ecx, edi
call fcn.004374f0
test eax, eax
je 0x43a53c
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push eax
call edx
cmp eax, esi
je 0x43a53c
test ebx, ebx
je 0x43a53c
push 4
mov ecx, edi
call fcn.0043e4f0
mov ecx, edi
call fcn.004374f0
mov esi, eax
call fcn.00437230
test eax, eax
jne 0x43a5cc
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041c830
mov esi, eax
push 0xa9
lea ecx, [esp + 0x18]
mov dword [esp + 0x250], 1
call fcn.0041c830
mov esi, dword [esi]
mov eax, dword [eax]
push 1
push 0x30
push esi
push eax
push 0
mov ecx, edi
mov byte [esp + 0x260], 2
call fcn.0043f9e0
lea ecx, [esp + 0x14]
call fcn.0041a500
lea ecx, [esp + 0x18]
mov dword [esp + 0x24c], ebp
call fcn.0041a500
mov ecx, dword [0x496cf4]
test ecx, ecx
je 0x43a5c5
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push 0
push 0
push 0xe17
call edx
xor eax, eax
jmp 0x43ab5d
mov ecx, edi
call fcn.0043e5f0
test eax, eax
je 0x43a5c5
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
test eax, eax
jne 0x43a5f1
mov ecx, edi
call fcn.00439670
xor eax, eax
jmp 0x43ab5d
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, edi
test eax, eax
jne 0x43a6a7
call fcn.0043e5b0
test eax, eax
je 0x43a64a
call fcn.0043a340
test eax, eax
je 0x43a6a0
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c830
mov esi, eax
push 0xa8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 3
call fcn.0041c830
mov byte [esp + 0x24c], 4
jmp 0x43a67b
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c830
mov esi, eax
push 0xa7
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 5
call fcn.0041c830
mov byte [esp + 0x24c], 6
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
call fcn.0043f9e0
lea ecx, [esp + 0x18]
call fcn.0041a500
lea ecx, [esp + 0x14]
call fcn.0041a500
xor eax, eax
jmp 0x43ab5d
call fcn.0043e5b0
mov ecx, edi
test eax, eax
je 0x43a6f2
call fcn.0043e5c0
test eax, eax
jne case.default.0x43a86c
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c830
mov esi, eax
push 0x97
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 7
call fcn.0041c830
mov byte [esp + 0x24c], 8
jmp 0x43a67b
call fcn.00425cf0
mov ecx, eax
call fcn.00425d00
test eax, eax
je 0x43a84b
mov ecx, edi
call fcn.0043e4e0
test eax, eax
jne 0x43a747
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c830
mov esi, eax
push 0xb8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 9
call fcn.0041c830
mov byte [esp + 0x24c], 0xa
jmp 0x43a67b
mov ecx, edi
call fcn.0043e4e0
cmp eax, 3
jne 0x43a789
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c830
mov esi, eax
push 0x92
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 0xb
call fcn.0041c830
mov byte [esp + 0x24c], 0xc
jmp 0x43a67b
mov ecx, edi
call fcn.0043e4e0
push 0x96
lea ecx, [esp + 0x18]
cmp eax, 4
jne 0x43a7cb
call fcn.0041c830
mov esi, eax
push 0x257
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 0xd
call fcn.0041c830
mov byte [esp + 0x24c], 0xe
jmp 0x43a67b
call fcn.0041c830
mov esi, eax
push 0xac
lea ecx, [esp + 0x1c]
mov dword [esp + 0x250], 0xf
call fcn.0041c830
mov esi, dword [esi]
mov eax, dword [eax]
push 1
push 0x40
push esi
push eax
push 0
mov ecx, edi
mov byte [esp + 0x260], 0x10
call fcn.0043f9e0
lea ecx, [esp + 0x18]
call fcn.0041a500
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], ebp
call fcn.0041a500
mov ecx, edi
call fcn.0043e570
mov ecx, edi
mov dword [eax], 0
call fcn.0043e580
mov ecx, edi
mov dword [eax], 0
call fcn.0043e590
mov dword [eax], 1
jmp case.default.0x43a86c
push edi
call fcn.004397d0
add esp, 4
test eax, eax
je 0x43a5c5
mov ecx, edi
call fcn.0043e4e0
cmp eax, 4
ja case.default.0x43a86c
jmp dword [eax*4 + 0x43ab88]
mov edx, 0xe11
mov dword [esp + 0x14], 0
call fcn.00437000
push str.Close_self_protect.
push 0x496cb4
lea eax, [esp + 0x3c]
push eax
call fcn.0041e280
mov eax, dword [eax]
push eax
mov dword [esp + 0x250], 0x11
call fcn.004197f0
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x24c], ebp
call fcn.0041a500
lea ecx, [esp + 0x14]
push ecx
push 0
mov ecx, edi
call fcn.0043e560
mov ecx, eax
call fcn.0041fad0
push str.Close_self_protect.
push 0x496d10
lea edx, [esp + 0x28]
push edx
mov esi, eax
call fcn.0041e280
mov eax, dword [eax]
push eax
mov dword [esp + 0x250], 0x12
call fcn.004197f0
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x24c], ebp
call fcn.0041a500
test esi, esi
je 0x43a91e
mov edx, 0xe12
call fcn.00437000
cmp dword [esp + 0x14], 0
je 0x43a93b
call fcn.004398f0
mov edx, 0xe17
call fcn.00437000
xor eax, eax
jmp 0x43ab5d
test esi, esi
jne case.default.0x43a86c
mov edx, 0xe13
call fcn.00437000
xor eax, eax
jmp 0x43ab5d
mov ecx, edi
call fcn.00425cf0
mov ecx, eax
call fcn.00425d10
mov eax, dword [eax]
cmp dword [eax - 8], 0
je 0x43a987
mov ecx, edi
call fcn.00425cf0
mov ecx, eax
call fcn.00425d10
push eax
mov ecx, edi
call fcn.0043e4b0
mov ecx, eax
call fcn.0041c230
mov ecx, edi
call fcn.0043e4b0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0041e0a0
call fcn.0042ac70
add esp, 4
test eax, eax
jne 0x43aa53
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x42]
push edx
mov word [esp + 0x44], cx
call fcn.0045bc00
add esp, 0xc
push 0x104
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43aa53
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x18]
call fcn.0041e0e0
mov ebx, 0x13
push 0x5c
lea ecx, [esp + 0x18]
mov dword [esp + 0x250], ebx
call fcn.004290b0
inc eax
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
call fcn.00423710
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x250], 0x14
call fcn.0041c230
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24c], bl
call fcn.0041a500
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0043e4b0
mov ecx, eax
call fcn.0041c230
lea ecx, [esp + 0x14]
mov dword [esp + 0x24c], ebp
call fcn.0041a500
mov ecx, edi
call fcn.0043fe50
test eax, eax
jne case.default.0x43a86c
jmp 0x43ab5d
push 0x257
lea ecx, [esp + 0x28]
call fcn.0041c830
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x250], 0x15
call fcn.0041e0e0
mov bl, 0x17
lea ecx, [esp + 0x24]
mov byte [esp + 0x24c], bl
call fcn.0041a500
push 0x96
lea ecx, [esp + 0x2c]
call fcn.0041c830
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
push 0x40
push eax
push ecx
push 0
mov ecx, edi
mov byte [esp + 0x25c], 0x18
call fcn.0043fab0
lea ecx, [esp + 0x28]
mov byte [esp + 0x24c], bl
call fcn.0041a500
mov edx, 0xe17
call fcn.00437000
lea ecx, [esp + 0x14]
call fcn.0041a500
xor eax, eax
jmp 0x43ab5d
mov edx, 0xe17
call fcn.00437000
mov edx, dword [0x493014]
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov dword [esp + 0x250], 0x19
call fcn.0043f650
mov ecx, edi
call fcn.0043e7e0
test eax, eax
je 0x43ab45
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
mov ecx, dword [esp + 0x30]
call fcn.00425e00
mov ecx, dword [eax]
push ecx
call fcn.00436d90
add esp, 4
push 1
call fcn.00436d70
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0041a500
mov eax, 1
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0045bbec
add esp, 0x23c
ret