Function at 0x49d9a0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e932b
mov eax, dword fs:[0]
push eax
sub esp, 0x870
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx + 0xcd0], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x87c], esi
je 0x49d9e9
mov al, 1
jmp 0x49e019
push str.initruntime_safemode
mov byte [ebp - 0x86e], 1
call fcn.004b01d0
add esp, 4
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
push str.initruntime_safemode
setne al
mov byte [ebx + 8], al
call fcn.004b0260
add esp, 4
push str.initruntime_installpath
call fcn.004b01d0
add esp, 4
mov ecx, ebx
push esi
call fcn.0049e250
neg al
push str.initruntime_installpath
sbb al, al
and al, byte [ebp - 0x86e]
mov byte [ebp - 0x86d], al
call fcn.004b0260
add esp, 4
push str.initruntime_TempPath
call fcn.004b01d0
add esp, 4
lea eax, [ebp - 0x21c]
push 0x208
push 0
push eax
call fcn.005c0be0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x49daca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.0049c7f0
push 0x7923ac
mov esi, eax
push 0x791e68
push esi
call fcn.0049a160
add esp, 0xc
push edi
push 0x791e58
push esi
call fcn.0049a160
mov esi, dword [ebp - 0x87c]
add esp, 0xc
mov byte [ebp - 0x86e], 0
jmp 0x49db6b
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49dad3
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x21e], 0x5c
jne 0x49db0a
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x49e037
xor eax, eax
mov word [ebp + ecx - 0x21c], ax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x744]
call fcn.0049a8e0
lea eax, [ebp - 0x744]
push eax
lea ecx, [ebx + 0x254]
call fcn.00499d10
cmp byte [ebp - 0x628], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x49db64
mov eax, dword [ebp - 0x73c]
lea ecx, [ebp - 0x738]
cmp eax, ecx
je 0x49db64
push eax
call fcn.005cff1c
add esp, 4
mov byte [ebp - 0x86e], 1
push str.initruntime_TempPath
call fcn.004b0260
add esp, 4
push str.initruntime_VistaIE7
call fcn.004b01d0
mov al, byte [ebp - 0x86e]
mov ecx, ebx
and byte [ebp - 0x86d], al
call fcn.0049e040
neg al
push str.initruntime_VistaIE7
sbb al, al
and byte [ebp - 0x86d], al
call fcn.004b0260
add esp, 4
push str.initruntime_DataPath
call fcn.004b01d0
add esp, 4
mov ecx, ebx
push esi
call fcn.0049e310
test al, al
jne 0x49dbd0
mov byte [ebp - 0x86d], al
jmp 0x49dc8e
call fcn.004b0410
test al, al
je 0x49dbfc
push str.initruntime_ProfilePath
mov dword [ebp - 0x874], str.initruntime_ProfilePath
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call fcn.004bcd00
mov ecx, eax
call fcn.004bd010
push esi
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.0049e7e0
test al, al
jne 0x49dc17
mov byte [ebp - 0x86d], al
jmp 0x49dc7c
xor eax, eax
lea edi, [ebx + 0x6e4]
mov word [edi], ax
lea esi, [ebx + 0x4a8]
cmp byte [ebx + 0x5b8], al
jne 0x49dc36
mov esi, dword [ebx + 0x4a4]
movzx eax, word [esi + 4]
add esi, 4
xor ecx, ecx
test ax, ax
je 0x49dc6e
mov edx, eax
movzx eax, dx
lea esi, [esi + 2]
shl ecx, 4
add ecx, eax
mov edx, ecx
and edx, 0xf0000000
je 0x49dc64
mov eax, edx
shr eax, 0x18
xor eax, edx
xor ecx, eax
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x49dc46
push 0x10
push 0x11
push edi
push ecx
call fcn.005db168
add esp, 0x10
lea ecx, [ebp - 0x874]
mov dword [ebp - 4], 0xffffffff
call fcn.004b0360
push str.initruntime_DataPath
call fcn.004b0260
add esp, 4
push str.initruntime_SetBuildNo
call fcn.004b01d0
add esp, 4
cmp word [0x8015c8], 0
je 0x49dcd1
mov ecx, 0x8015c8
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49dcc0
sub ecx, edx
sar ecx, 1
jne 0x49dd33
xor ecx, ecx
cmp byte [0x7f8e75], cl
je 0x49dce5
mov eax, dword [0x7f8e78]
test eax, eax
cmovne ecx, eax
push 0x200
lea eax, [ebp - 0x61c]
xorps xmm0, xmm0
push eax
push ecx
movlpd qword [ebp - 0x878], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x61c]
call fcn.004a6930
movzx eax, word [ebp - 0x872]
push eax
push str._04d
push 0x200
push 0x8015c8
call fcn.00475a40
add esp, 0x10
push 0x8015c8
lea eax, [ebx + 0x706]
push 0xb
push eax
call fcn.005d0460
add esp, 0xc
push str.initruntime_SetBuildNo
call fcn.004b0260
add esp, 4
push str.initruntime_SetCommandLine
call fcn.004b01d0
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 4
call esi
call esi
test eax, eax
mov ecx, 0x786008
cmovne ecx, eax
mov dword [ebp - 0x874], ecx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49dd80
sub ecx, edx
sar ecx, 1
mov dword [ebx + 0x720], ecx
lea edi, [ecx + 1]
push edi
lea ecx, [ebx + 0x724]
call fcn.0049a590
cmp byte [ebx + 0x838], 0
lea ecx, [ebx + 0x728]
jne 0x49ddb9
mov ecx, dword [ebx + 0x724]
lea eax, [edi + edi]
add ecx, 4
push eax
push dword [ebp - 0x874]
push ecx
call fcn.005c0660
add esp, 0xc
lea eax, [ebx + 0x71c]
lea ecx, [ebx + 0x840]
push eax
call fcn.00499d10
mov eax, dword [ebx + 0x844]
lea edi, [ebx + 0x848]
inc eax
mov ecx, edi
push eax
call fcn.0049a590
cmp byte [edi + 0x114], 0
je 0x49de04
add edi, 4
jmp 0x49de06
mov edi, dword [edi]
mov esi, dword [ebx + 0x844]
xor ecx, ecx
test esi, esi
jle 0x49de2d
movzx edx, word [edi + ecx*2 + 4]
lea eax, [edx - 0x41]
cmp ax, 0x19
ja 0x49de28
lea eax, [edx + 0x20]
mov word [edi + ecx*2 + 4], ax
inc ecx
cmp ecx, esi
jl 0x49de12
push str.initruntime_SetCommandLine
call fcn.004b0260
add esp, 4
push str.initruntime_CheckConfig
call fcn.004b01d0
mov edi, dword [ebp - 0x87c]
lea eax, [ebp - 0x86e]
add esp, 4
mov byte [ebp - 0x86e], 0
mov ecx, ebx
push eax
push edi
call fcn.0049fad0
neg al
push str.initruntime_CheckConfig
sbb al, al
and byte [ebp - 0x86d], al
call fcn.004b0260
add esp, 4
cmp byte [ebp - 0x86e], 0
jne 0x49deaf
push str.initruntime_SetProcessShortName
call fcn.004b01d0
add esp, 4
mov ecx, ebx
push edi
call fcn.0049ec70
neg al
push str.initruntime_SetProcessShortName
sbb al, al
and byte [ebp - 0x86d], al
call fcn.004b0260
add esp, 4
push str.initruntime_CheckIgnoreCancel
call fcn.004b01d0
add esp, 4
cmp byte [ebx + 0xcd2], 0
jne 0x49dee5
mov eax, dword [ebx]
mov ecx, ebx
push str.outlook.exe
call dword [eax + 4]
push eax
call fcn.005d0064
add esp, 8
test eax, eax
jne 0x49dee5
mov byte [ebx + 0xd44], 1
push str.initruntime_CheckIgnoreCancel
call fcn.004b0260
add esp, 4
lea ecx, [ebp - 0x86c]
call fcn.00499a50
lea edx, [ebp - 0x86c]
mov dword [ebp - 4], 1
mov ecx, edi
call fcn.004a40b0
cmp byte [ebx + 0xa80], 0
lea eax, [ebx + 0x970]
jne 0x49df26
mov eax, dword [ebx + 0x96c]
add eax, 4
push str.explorer.exe
push eax
call fcn.005d0064
add esp, 8
test eax, eax
je 0x49df69
cmp byte [ebx + 0xa80], 0
lea eax, [ebx + 0x970]
jne 0x49df50
mov eax, dword [ebx + 0x96c]
add eax, 4
push str.searchui.exe
push eax
call fcn.005d0064
add esp, 8
test eax, eax
je 0x49df69
xor al, al
jmp 0x49df6b
mov al, 1
mov byte [ebx + 0xd45], al
xor esi, esi
mov eax, dword [str.Notepad.exe]
test eax, eax
je 0x49dfbb
nop dword [eax]
cmp byte [ebx + 0xa80], 0
lea ecx, [ebx + 0x970]
jne 0x49df95
mov ecx, dword [ebx + 0x96c]
push eax
lea eax, [ecx + 4]
push eax
call fcn.005d0064
add esp, 8
test eax, eax
je 0x49dfb4
mov eax, dword [esi*4 + 0x77d9a4]
inc esi
test eax, eax
jne 0x49df80
jmp 0x49dfbb
mov byte [ebx + 0x2209], 1
cmp byte [ebp - 0x86d], 0
jne 0x49dfe2
mov ecx, edi
call fcn.0049c7f0
push 0x792370
push 0x791e68
push eax
call fcn.0049a160
add esp, 0xc
xor bl, bl
jmp 0x49dfeb
mov byte [ebx + 0xcd0], 1
mov bl, 1
cmp byte [ebp - 0x750], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x49e017
mov eax, dword [ebp - 0x864]
lea ecx, [ebp - 0x860]
cmp eax, ecx
je 0x49e017
push eax
call fcn.005cff1c
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret 4
call fcn.005bee13
int3