Function at 0x42f6f0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46972e
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor ebx, ebx
cmp edi, ebx
je 0x42f88c
mov ecx, edi
call fcn.00433490
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.00419e10
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x23c], ebx
call fcn.00421470
mov eax, dword [esp + 0x10]
or ebp, 0xffffffff
lea ecx, [eax - 0xc]
mov dword [esp + 0x238], ebp
cmp ecx, dword [0x484060]
je 0x42f797
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42f797
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0044ec74
add esp, 4
mov ecx, esi
call fcn.00421a80
mov ecx, edi
call fcn.00433c60
test eax, eax
je 0x42f88c
mov ecx, edi
call fcn.0044b2e0
cmp eax, ebx
je 0x42f88c
mov ecx, edi
call fcn.00433360
cmp eax, 1
je 0x42f7d2
cmp eax, 2
je 0x42f7d2
cmp eax, 3
jne 0x42f7d7
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x14]
call fcn.00418500
mov eax, dword [eax]
push eax
call fcn.0044ef31
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00415e60
mov ecx, edi
call fcn.00433300
test eax, eax
je 0x42f81f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x6c]
call eax
cmp eax, esi
je 0x42f81f
test ebx, ebx
je 0x42f81f
push 4
mov ecx, edi
call fcn.00433370
mov ecx, edi
call fcn.00433470
test eax, eax
je 0x42f88c
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
test eax, eax
jne 0x42f893
push 0x96
lea ecx, [esp + 0x18]
call fcn.00418500
mov esi, eax
push 0xab
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 1
call fcn.00418500
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 2
call fcn.004334a0
lea ecx, [esp + 0x10]
call fcn.00415e60
lea ecx, [esp + 0x14]
call fcn.00415e60
xor eax, eax
jmp 0x42f9dd
mov ecx, edi
call fcn.00433300
mov esi, eax
call fcn.0042c930
test eax, eax
jne 0x42f902
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418500
mov esi, eax
push 0xa9
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 3
call fcn.00418500
mov byte [esp + 0x238], 4
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
call fcn.004334a0
lea ecx, [esp + 0x14]
call fcn.00415e60
lea ecx, [esp + 0x10]
call fcn.00415e60
xor eax, eax
jmp 0x42f9dd
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, edi
test eax, eax
jne 0x42f989
call fcn.00433430
test eax, eax
je 0x42f953
call fcn.0042f4c0
test eax, eax
je 0x42f8fb
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418500
mov esi, eax
push 0xa8
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 5
call fcn.00418500
mov byte [esp + 0x238], 6
jmp 0x42f8d6
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418500
mov esi, eax
push 0xa7
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 7
call fcn.00418500
mov byte [esp + 0x238], 8
jmp 0x42f8d6
call fcn.00433430
mov ecx, edi
test eax, eax
je 0x42fa04
call fcn.00433440
test eax, eax
jne 0x42f9d3
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418500
mov esi, eax
push 0x97
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 9
call fcn.00418500
mov byte [esp + 0x238], 0xa
jmp 0x42f8d6
call fcn.0042f4c0
mov eax, 1
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0044e04c
add esp, 0x22c
ret
call fcn.00433490
mov ecx, eax
call fcn.00421230
mov ecx, edi
test eax, eax
je 0x42fb2f
call fcn.00433360
test eax, eax
jne 0x42fa59
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418500
mov esi, eax
push 0xb8
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xb
call fcn.00418500
mov byte [esp + 0x238], 0xc
jmp 0x42f8d6
mov ecx, edi
call fcn.00433360
cmp eax, 3
jne 0x42fa9b
push 0x96
lea ecx, [esp + 0x14]
call fcn.00418500
mov esi, eax
push 0x92
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xd
call fcn.00418500
mov byte [esp + 0x238], 0xe
jmp 0x42f8d6
mov ecx, edi
call fcn.00433360
push 0x96
lea ecx, [esp + 0x14]
cmp eax, 4
jne 0x42fadd
call fcn.00418500
mov esi, eax
push 0x257
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0xf
call fcn.00418500
mov byte [esp + 0x238], 0x10
jmp 0x42f8d6
call fcn.00418500
mov esi, eax
push 0xac
lea ecx, [esp + 0x18]
mov dword [esp + 0x23c], 0x11
call fcn.00418500
mov ecx, dword [esi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 0x12
call fcn.004334a0
lea ecx, [esp + 0x14]
call fcn.00415e60
lea ecx, [esp + 0x10]
call fcn.00415e60
jmp 0x42f9d8
call fcn.00433360
cmp eax, 4
ja case.0x42fb39.3
jmp dword [eax*4 + 0x42fd8c]
push 0
mov ecx, edi
call fcn.004333e0
mov ecx, eax
call fcn.0041a010
test eax, eax
je 0x42f8fb
mov ecx, edi
call fcn.00433300
mov ecx, edi
mov esi, eax
call fcn.00433680
mov ebx, eax
test ebx, ebx
je 0x42f9d8
test esi, esi
je 0x42f9d8
mov eax, dword [esi]
mov ecx, dword [eax + 0x2c]
mov ebp, dword [ebx]
push esi
call ecx
mov edx, dword [ebp + 0x50]
push eax
push ebx
call edx
movzx eax, ax
test ax, ax
jne 0x42f9d8
mov eax, dword [0x484064]
mov dword [esp + 0x10], eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2c]
push esi
mov dword [esp + 0x23c], 0x19
call edx
push eax
lea eax, [esp + 0x14]
push 0x9b
push eax
call fcn.00420fc0
add esp, 0xc
push 0x96
lea ecx, [esp + 0x20]
call fcn.00418500
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x24c], 0x1a
call fcn.004334a0
lea ecx, [esp + 0x1c]
call fcn.00415e60
lea ecx, [esp + 0x10]
call fcn.00415e60
xor eax, eax
jmp 0x42f9dd
mov ecx, edi
call fcn.00433490
mov ecx, eax
call fcn.00421240
mov eax, dword [eax]
cmp dword [eax - 8], 0
je 0x42fc3d
mov ecx, edi
call fcn.00433490
mov ecx, eax
call fcn.00421240
push eax
mov ecx, edi
call fcn.00433330
mov ecx, eax
call fcn.00417f00
mov ecx, edi
call fcn.00433330
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00419dd0
call fcn.0042f550
add esp, 4
test eax, eax
jne case.0x42fb39.3
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x2e]
push edx
mov word [esp + 0x30], cx
call fcn.0044e060
add esp, 0xc
push 0x104
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.0x42fb39.3
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
call fcn.00419e10
mov ebx, 0x13
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], ebx
call fcn.00422350
inc eax
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
call fcn.0041e580
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 0x14
call fcn.00417f00
lea ecx, [esp + 0x14]
mov byte [esp + 0x238], bl
call fcn.00415e60
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00433330
mov ecx, eax
call fcn.00417f00
lea ecx, [esp + 0x10]
mov dword [esp + 0x238], ebp
call fcn.00415e60
jmp case.0x42fb39.3
push 0x257
lea ecx, [esp + 0x1c]
call fcn.00418500
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 0x15
call fcn.00419e10
lea ecx, [esp + 0x18]
mov byte [esp + 0x238], 0x17
call fcn.00415e60
push 0x96
lea ecx, [esp + 0x24]
call fcn.00418500
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0x40
push ecx
push edx
push 0
mov ecx, edi
mov byte [esp + 0x248], 0x18
call fcn.00433510
lea ecx, [esp + 0x20]
call fcn.00415e60
lea ecx, [esp + 0x10]
call fcn.00415e60
xor eax, eax
jmp 0x42f9dd