Function at 0x42ff30
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46a6ce
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor ebx, ebx
cmp edi, ebx
je 0x4300cc
mov ecx, edi
call fcn.00434000
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.0041a210
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x23c], ebx
call fcn.00421a90
mov eax, dword [esp + 0x10]
or ebp, 0xffffffff
lea ecx, [eax - 0xc]
mov dword [esp + 0x238], ebp
cmp ecx, dword [0x485060]
je 0x42ffd7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42ffd7
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044fbd4
add esp, 4
mov ecx, esi
call fcn.00422200
mov ecx, edi
call fcn.00434ba0
test eax, eax
je 0x4300cc
mov ecx, edi
call fcn.004315d0
cmp eax, ebx
je 0x4300cc
mov ecx, edi
call fcn.00433ed0
cmp eax, 1
je 0x430012
cmp eax, 2
je 0x430012
cmp eax, 3
jne 0x430017
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x14]
call fcn.00418850
mov eax, dword [eax]
push eax
call fcn.0044fe91
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00416500
mov ecx, edi
call fcn.0042d420
test eax, eax
je 0x43005f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x6c]
call eax
cmp eax, esi
je 0x43005f
test ebx, ebx
je 0x43005f
push 4
mov ecx, edi
call fcn.00433ee0
mov ecx, edi
call fcn.00433fe0
test eax, eax
je 0x4300cc
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
test eax, eax
jne 0x4300d3
push 0x96
lea ecx, [esp + 0x18]
call fcn.00418850
mov esi, eax
push 0xab
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 1
call fcn.00418850
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 2
call fcn.00434010
lea ecx, [esp + 0x10]
call fcn.00416500
lea ecx, [esp + 0x14]
call fcn.00416500
xor eax, eax
jmp 0x43021d
mov ecx, edi
call fcn.0042d420
mov esi, eax
call fcn.0042d160
test eax, eax
jne 0x430142
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418850
mov esi, eax
push 0xa9
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 3
call fcn.00418850
mov byte [esp + 0x238], 4
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
call fcn.00434010
lea ecx, [esp + 0x14]
call fcn.00416500
lea ecx, [esp + 0x10]
call fcn.00416500
xor eax, eax
jmp 0x43021d
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, edi
test eax, eax
jne 0x4301c9
call fcn.00433fa0
test eax, eax
je 0x430193
call fcn.0042fd00
test eax, eax
je 0x43013b
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418850
mov esi, eax
push 0xa8
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 5
call fcn.00418850
mov byte [esp + 0x238], 6
jmp 0x430116
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418850
mov esi, eax
push 0xa7
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 7
call fcn.00418850
mov byte [esp + 0x238], 8
jmp 0x430116
call fcn.00433fa0
mov ecx, edi
test eax, eax
je 0x430244
call fcn.00433fb0
test eax, eax
jne 0x430213
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418850
mov esi, eax
push 0x97
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 9
call fcn.00418850
mov byte [esp + 0x238], 0xa
jmp 0x430116
call fcn.0042fd00
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0044efac
add esp, 0x22c
ret
call fcn.00434000
mov ecx, eax
call fcn.00421820
mov ecx, edi
test eax, eax
je 0x43039d
call fcn.00433ed0
test eax, eax
jne 0x430299
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418850
mov esi, eax
push 0xb8
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xb
call fcn.00418850
mov byte [esp + 0x238], 0xc
jmp 0x430116
mov ecx, edi
call fcn.00433ed0
cmp eax, 3
jne 0x4302db
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418850
mov esi, eax
push 0x92
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xd
call fcn.00418850
mov byte [esp + 0x238], 0xe
jmp 0x430116
mov ecx, edi
call fcn.00433ed0
push 0x96
lea ecx, [esp + 0x14]
cmp eax, 4
jne 0x43031d
call fcn.00418850
mov esi, eax
push 0x257
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xf
call fcn.00418850
mov byte [esp + 0x238], 0x10
jmp 0x430116
call fcn.00418850
mov esi, eax
push 0xac
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0x11
call fcn.00418850
mov esi, dword [esi]
mov eax, dword [eax]
push 1
push 0x40
push esi
push eax
push 0
mov ecx, edi
mov byte [esp + 0x24c], 0x12
call fcn.00434010
lea ecx, [esp + 0x14]
call fcn.00416500
lea ecx, [esp + 0x10]
mov dword [esp + 0x238], ebp
call fcn.00416500
mov ecx, edi
call fcn.00433f60
mov ecx, edi
mov dword [eax], 0
call fcn.00433f70
mov ecx, edi
mov dword [eax], 0
call fcn.00433f80
mov dword [eax], 1
jmp 0x430218
call fcn.00433ed0
cmp eax, 4
ja case.0x4303a7.3
jmp dword [eax*4 + 0x4305f8]
push 0
mov ecx, edi
call fcn.00433f50
mov ecx, eax
call fcn.0041a570
test eax, eax
je 0x43013b
mov ecx, edi
call fcn.0042d420
mov ecx, edi
mov esi, eax
call fcn.00434290
mov ebx, eax
test ebx, ebx
je 0x430218
test esi, esi
je 0x430218
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
mov ebp, dword [ebx]
push esi
call ecx
mov edx, dword [ebp + 0x50]
push eax
push ebx
call edx
movzx eax, ax
test ax, ax
jne 0x430218
mov eax, dword [0x485064]
mov dword [esp + 0x10], eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2c]
push esi
mov dword [esp + 0x23c], 0x19
call edx
push eax
lea eax, [esp + 0x14]
push 0x9b
push eax
call fcn.004215b0
add esp, 0xc
push 0x96
lea ecx, [esp + 0x20]
call fcn.00418850
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 0x1a
call fcn.00434010
lea ecx, [esp + 0x1c]
call fcn.00416500
lea ecx, [esp + 0x10]
call fcn.00416500
xor eax, eax
jmp 0x43021d
mov ecx, edi
call fcn.00434000
mov ecx, eax
call fcn.00421830
mov eax, dword [eax]
cmp dword [eax - 8], 0
je 0x4304ab
mov ecx, edi
call fcn.00434000
mov ecx, eax
call fcn.00421830
push eax
mov ecx, edi
call fcn.00433ea0
mov ecx, eax
call fcn.00418250
mov ecx, edi
call fcn.00433ea0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0041a1d0
call fcn.0042fd90
add esp, 4
test eax, eax
jne case.0x4303a7.3
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2e]
push edx
mov word [esp + 0x30], cx
call fcn.0044efc0
add esp, 0xc
push 0x104
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.0x4303a7.3
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041a210
mov ebx, 0x13
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], ebx
call fcn.00422a90
inc eax
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
call fcn.0041eab0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 0x14
call fcn.00418250
lea ecx, [esp + 0x14]
mov byte [esp + 0x238], bl
call fcn.00416500
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00433ea0
mov ecx, eax
call fcn.00418250
lea ecx, [esp + 0x10]
mov dword [esp + 0x238], ebp
call fcn.00416500
jmp case.0x4303a7.3
push 0x257
lea ecx, [esp + 0x1c]
call fcn.00418850
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 0x15
call fcn.0041a210
lea ecx, [esp + 0x18]
mov byte [esp + 0x238], 0x17
call fcn.00416500
push 0x96
lea ecx, [esp + 0x24]
call fcn.00418850
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x248], 0x18
call fcn.00434080
lea ecx, [esp + 0x20]
call fcn.00416500
lea ecx, [esp + 0x10]
call fcn.00416500
xor eax, eax
jmp 0x43021d