Function at 0x4a4b10
Capabilities:
Accept command line arguments
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
push ebx
push esi
push edi
call fcn.004bf6a0
mov eax, str.MAIN
call fcn.004a8dc0
mov eax, dword [ebp + 8]
push 0x731ff8
mov dword [0x734df4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [0x735b94], eax
call fcn.004af5a0
test al, al
je 0x4a4b70
mov ecx, dword [0x735b94]
mov eax, dword [ecx]
lea edi, [esp + 0x48]
call fcn.004ad090
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor bl, bl
push str._installer
mov byte [esp + 0x14], bl
call fcn.004af5f0
test al, al
je 0x4a4c1e
push str.Settings
push str.SoftwareNCH_SoftwareDebut_s
mov esi, 0x104
lea edi, [esp + 0x50]
mov bl, 1
call fcn.004af0d0
add esp, 8
lea eax, [esp + 0x250]
push eax
push 0x6bc0cc
push str.CurrentVersion
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x250], 0
push str.VersionCheckAfterCrash
sete cl
mov eax, str.Settings
mov byte [esp + 0x14], cl
call fcn.004a54a0
push str.LastCrashCheck
mov eax, str.Settings
call fcn.004a54a0
push str.OSCheck
mov eax, str.Settings
call fcn.004a54a0
push str.OSCheckWinRelease
mov eax, str.Settings
call fcn.004a54a0
push str.NewerVersion
mov eax, str.Settings
call fcn.004a54a0
cmp dword [0x731ff8], 1
mov byte [esp + 0x14], 0
jle 0x4a4eef
mov edx, dword [0x735b94]
mov edi, dword [edx + 4]
cmp word [edi], 0x2d
jne 0x4a4eef
mov ecx, str._installsched
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4a4c76
test dx, dx
je 0x4a4c72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a4c76
add eax, 4
add ecx, 4
test dx, dx
jne 0x4a4c50
xor eax, eax
jmp 0x4a4c7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4a4c94
call fcn.0050d690
call fcn.0050d5f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._sevendays
mov eax, edi
jmp 0x4a4ca0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4a4cc6
test dx, dx
je 0x4a4cc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a4cc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4a4ca0
xor eax, eax
jmp 0x4a4ccb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4a4cf0
mov esi, str.SevenDays
call fcn.004bac00
call fcn.004b64a0
test al, al
je 0x4a51ba
mov byte [esp + 0x14], 1
call fcn.004a4920
mov ecx, str._surveysched
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4a4d1d
test dx, dx
je 0x4a4d19
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a4d1d
add eax, 4
add ecx, 4
test dx, dx
jne 0x4a4cf7
xor eax, eax
jmp 0x4a4d22
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4a4d38
call fcn.004a2a20
test al, al
je 0x4a51ba
call fcn.004a4920
mov ecx, str._notifyinstalled
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4d81
call fcn.0050d740
push str.LGXl
call fcn.004bf140
test al, al
je 0x4a51ba
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.005519b0
call fcn.00552240
call fcn.00551fa0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._notifytrialextension
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4da1
call fcn.0052b320
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._systemnotifyevent
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4dc1
call fcn.00551a70
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._downgrade
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4dde
call fcn.0050d7d0
test al, al
je 0x4a51ba
cmp dword [0x731ff8], 2
jle 0x4a4e63
mov ecx, str._exe
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4e1c
mov ecx, dword [0x735b94]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx + 8]
call fcn.004b19a0
xor eax, eax
cmp dword [esp + 0x14], eax
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._elevated
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4e3a
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._setautorun
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4e63
mov edx, dword [0x735b94]
mov esi, dword [edx + 8]
call fcn.004c1e60
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._extfind
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4e83
call fcn.0050a7e0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._extsuite
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4ea3
call fcn.0050ab40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xf
push str._installrelated
push edi
call fcn.0069cfe9
add esp, 0xc
test eax, eax
jne 0x4a4ecf
mov eax, dword [0x735b94]
mov edx, dword [eax + 8]
call fcn.004b9670
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._suite
mov eax, edi
call fcn.00401160
test eax, eax
jne 0x4a4eef
call fcn.004a1cc0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x735ba0]
test eax, eax
jne 0x4a4f08
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x735ba0], eax
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a4f1a
call eax
test bl, bl
jne 0x4a4f4c
push 0x104
lea ecx, [esp + 0x254]
push ecx
push str.LQUIET
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x4a4f4c
mov edx, dword [esp + 0x10]
push edx
call fcn.004f2220
test al, al
je 0x4a51ba
mov esi, dword [0x731ff8]
cmp esi, 2
jl 0x4a5036
push str._uninstall
call fcn.004af5f0
test al, al
je 0x4a4fa3
cmp esi, 3
mov byte [esp + 0x10], 0
jl 0x4a4f81
push str._quiet
call fcn.004af5f0
mov byte [esp + 0x10], al
call fcn.004a4980
test al, al
je 0x4a51ba
mov eax, dword [esp + 0x10]
push eax
call fcn.0049e1c0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str._uninstall2
call fcn.004af5f0
test al, al
je 0x4a4fde
cmp esi, 3
mov byte [esp + 0x10], 0
jl 0x4a4fc9
push str._quiet
call fcn.004af5f0
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0049e380
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [0x735b94]
mov esi, dword [edx + 4]
mov ecx, str._bootstrap
mov eax, esi
call fcn.00401160
test eax, eax
jne 0x4a500c
call fcn.004a4980
push 1
call fcn.004c4110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str._installer
mov eax, esi
call fcn.00401160
test eax, eax
jne 0x4a5036
call fcn.004a4980
call fcn.00552240
push 0
call fcn.004c4110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x4e20
mov esi, 0x736788
call fcn.004b0fc0
push 0x6bc140
push str.NCHSoftware_InstanceWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
mov dword [esp + 0x18], eax
je 0x4a51b0
cmp dword [0x731ff8], 0
jle 0x4a516e
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4a50e7
cmp dword [esp + 0x10], 0
je 0x4a50e7
lea esi, [esp + 0x2c]
call fcn.0049bbc0
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x4a50d3
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
setne al
test al, al
je 0x4a50d3
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x14]
lea edi, [esp + 0x18]
mov dword [esp + 0x18], 0x6dbbf0
call fcn.004c9910
lea esi, [esp + 0x2c]
call fcn.0041ec20
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push 0x10404
call fcn.004aefd0
mov ecx, dword [0x731ff8]
add esp, 4
cmp ecx, 0x80
mov ebx, eax
mov dword [ebx], ecx
jle 0x4a510c
mov dword [ebx], 0x80
xor edi, edi
cmp dword [ebx], edi
jle 0x4a513b
lea esi, [ebx + 4]
jmp 0x4a5120
mov edx, dword [0x735b94]
mov edx, dword [edx + edi*4]
call fcn.004011d0
add edi, 1
add esi, 0x208
cmp edi, dword [ebx]
jl 0x4a5120
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4a
push ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x10404
mov dword [esp + 0x34], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call fcn.0069d0cc
add esp, 4
jmp 0x4a517e
push 0
push 0
push 0x8068
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x736990]
test eax, eax
je 0x4a51ba
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [0x736990]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x736990], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x14]
push eax
call fcn.004a4890
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10