Function at 0x40498b
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7fc]
sub esp, 0x87c
mov eax, dword [0x430158]
xor eax, ebp
mov dword [ebp + 0x7f8], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
mov dword [ebp - 0x18], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x4245b4
push dword [ebp + 0x804]
mov ecx, 0x431628
push 0x42f058
call fcn.00401a48
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
and dword [ebp - 0x24], 0
mov dword [0x431658], eax
mov esi, 0x424bd0
lea edi, [ebp + 0x7f0]
lea eax, [ebp + 0x7f0]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x18]
movsw word es:[edi], word [esi]
call fcn.00401209
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x404f53
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov edi, 0x424bc8
push str.UnregServer
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404b25
push str.RegServer
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404b48
push str.Embedding
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404eff
push str.BugReport
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404b66
push str.CloseIEUpdate
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404b8c
mov eax, dword [0x42f0b4]
push str.runasAdmin
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00404894
mov eax, dword [ebp - 0x14]
add esp, 0xc
push dword [eax - 8]
push eax
push ebx
call esi
test eax, eax
je 0x404c29
lea ecx, [ebp - 0x14]
call fcn.00404825
push str.runasUser
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00404894
mov eax, dword [ebp - 0x14]
add esp, 0xc
push dword [eax - 8]
push eax
push ebx
call esi
test eax, eax
je 0x404d6d
lea ecx, [ebp - 0x14]
call fcn.00404825
push str.runasUserGetResult
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00404894
mov eax, dword [ebp - 0x14]
add esp, 0xc
push dword [eax - 8]
push eax
push ebx
call esi
test eax, eax
lea eax, [ebp + 0x7f0]
push eax
push ebx
je 0x404e0d
call fcn.00401209
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.0040216b
test ebx, ebx
jne 0x404a17
jmp 0x404f53
xor esi, esi
push esi
push esi
push 0x64
mov edi, 0x431628
push edi
call fcn.00404565
push esi
push 1
mov ecx, edi
call fcn.0040478d
mov dword [ebp - 0x24], eax
jmp 0x404f53
push 0
push 1
push 0x64
mov esi, 0x431628
push esi
call fcn.00404565
push 0
push 1
mov ecx, esi
call fcn.00404728
jmp 0x404b40
lea ecx, [ebp - 0x20]
call fcn.00406ad7
push dword [ebp + 0x810]
lea ecx, [ebp - 0x20]
push dword [ebp - 0x18]
call fcn.00407388
lea ecx, [ebp - 0x20]
call fcn.00405217
jmp 0x404f53
mov esi, str.BaiduBarX.dll
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00409319
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004048a7
lea ecx, [ebp - 0x18]
call fcn.0040216b
push dword [ebp - 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
jne 0x404beb
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.004092bf
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004048a7
push eax
lea ecx, [ebp - 0x14]
call fcn.00403c3f
lea ecx, [ebp - 0x18]
call fcn.0040216b
lea ecx, [ebp - 0x20]
call fcn.0040216b
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x404ef5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x404ef5
push 0x424ad8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404c1d
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404ef5
lea eax, [ebp + 0x7f0]
push eax
push ebx
call fcn.00401209
pop ecx
pop ecx
mov edi, eax
call fcn.00408aaa
test eax, eax
je 0x404ce6
lea eax, [ebp - 0x18]
push str.BaiduBarX.dll
push eax
call fcn.004092bf
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004048a7
lea ecx, [ebp - 0x18]
call fcn.0040216b
push dword [ebp - 0x1c]
call fcn.00408cfd
test eax, eax
pop ecx
je 0x404eed
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404eed
test edi, edi
je 0x404cda
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x404cda
lea esi, [eax + eax]
mov eax, esi
call fcn.0040ee80
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.004012a9
test eax, eax
je 0x404cda
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x404cbe
sub ecx, esi
je 0x404cda
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404cda
call eax
mov dword [ebp - 0x24], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404eed
xor esi, esi
push 0x7fe
lea eax, [ebp - 0xe]
push esi
push eax
mov word [ebp - 0x10], si
call fcn.0040ede0
push edi
push str.runasAdmin
push str.__s___s
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push 0x400
push eax
call fcn.0040ee5a
lea eax, [ebp - 0x18]
push eax
call fcn.0040920d
push 0x38
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.0040ede0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x50], eax
add esp, 0x34
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], str.runas
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [ebp - 0x18]
jmp 0x404ef0
lea eax, [ebp + 0x7f0]
push eax
push ebx
call fcn.00401209
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x18]
push str.BaiduBarX.dll
push eax
call fcn.004092bf
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004048a7
lea ecx, [ebp - 0x18]
call fcn.0040216b
push dword [ebp - 0x1c]
call fcn.00408cfd
test eax, eax
pop ecx
je 0x404eed
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404eed
test edi, edi
je 0x404cda
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x404cda
lea esi, [eax + eax]
mov eax, esi
call fcn.0040ee80
mov eax, esp
push 0
push esi
push edi
push eax
call fcn.004012a9
test eax, eax
je 0x404cda
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x404e01
jmp 0x404cc5
call fcn.00401209
xor edi, edi
cmp eax, edi
pop ecx
pop ecx
je 0x404ef5
mov ecx, dword [0x42f0b4]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp + 0x7f0]
push ecx
push eax
mov dword [ebp - 0x20], edi
call fcn.004048f9
add esp, 0x10
lea eax, [ebp - 0x28]
push str.BaiduBarX.dll
push eax
call fcn.004092bf
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004048a7
lea ecx, [ebp - 0x28]
call fcn.0040216b
push dword [ebp - 0x18]
call fcn.00408cfd
test eax, eax
pop ecx
je 0x404ee5
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x404ee5
cmp dword [ebp - 0x1c], edi
je 0x404e95
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x404e99
xor eax, eax
jmp 0x404eb0
lea esi, [eax + eax]
mov eax, esi
call fcn.0040ee80
mov eax, esp
push edi
push esi
push dword [ebp - 0x1c]
push eax
call fcn.004012a9
cmp dword [ebp - 0x20], edi
je 0x404eb8
mov edi, dword [ebp - 0x20]
test eax, eax
je 0x404ede
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x404ec1
sub ecx, esi
je 0x404ede
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404ede
push edi
call eax
mov dword [ebp - 0x24], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x18]
call fcn.0040216b
lea ecx, [ebp - 0x1c]
call fcn.0040216b
lea ecx, [ebp - 0x14]
call fcn.0040216b
jmp 0x404f53
mov esi, 0x431628
mov ecx, esi
call fcn.00401cc9
push 1
push 4
mov ecx, esi
call fcn.004020f9
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
xor ebx, ebx
jmp 0x404f34
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
call edi
test eax, eax
jne 0x404f20
mov ecx, esi
call fcn.0040213b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x431628
call fcn.004020a7
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7f8]
xor ecx, ebp
call fcn.0040dfe9
add ebp, 0x7fc
leave
ret 0x10