Function at 0x4274d8
Capabilities:
Accept command line arguments
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x66
push 0
push 0
dec ecx
jne 0x4274e0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42820e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x428186
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x427648
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x278]
push eax
call sub.kernel32.dll_GetLocalTime
push 0x428224
lea eax, [ebp - 0x27c]
push eax
movzx eax, word [ebp - 0x278]
mov cl, 0x30
mov edx, 4
call fcn.00408754
push dword [ebp - 0x27c]
push 0x428244
lea eax, [ebp - 0x280]
push eax
movzx eax, word [ebp - 0x276]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x280]
push 0x428244
lea eax, [ebp - 0x284]
push eax
movzx eax, word [ebp - 0x272]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x284]
push 0x428250
lea eax, [ebp - 0x288]
push eax
movzx eax, word [ebp - 0x270]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x288]
push 0x42825c
lea eax, [ebp - 0x28c]
push eax
movzx eax, word [ebp - 0x26e]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x28c]
push 0x42825c
lea eax, [ebp - 0x290]
push eax
movzx eax, word [ebp - 0x26c]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x290]
push 0x428250
lea eax, [ebp - 0x294]
push eax
movzx eax, word [ebp - 0x26a]
mov cl, 0x30
mov edx, 1
call fcn.00408754
push dword [ebp - 0x294]
push 0x428268
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 0x10
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427652
xor eax, eax
push ebp
push 0x427697
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428280
lea eax, [ebp - 0x298]
call fcn.0041d988
push dword [ebp - 0x298]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4276a1
xor eax, eax
push ebp
push 0x4276e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0042922c
cmp dword [ebp - 0xc], 0
je 0x4276dc
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4282a0
push dword [ebp - 0xc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4276f0
xor eax, eax
push ebp
push 0x427757
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x125]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4282c0
lea eax, [ebp - 0x29c]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.004047d0
push dword [ebp - 0x29c]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427761
xor eax, eax
push ebp
push 0x4277a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4282e0
lea eax, [ebp - 0x2a0]
call fcn.0042953c
push dword [ebp - 0x2a0]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4277b0
xor eax, eax
push ebp
push 0x4277f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004295e8
cmp dword [ebp - 0xc], 0
je 0x4277eb
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428300
push dword [ebp - 0xc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4277ff
xor eax, eax
push ebp
push 0x427844
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00429630
cmp dword [ebp - 0xc], 0
je 0x42783a
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428320
push dword [ebp - 0xc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42784e
xor eax, eax
push ebp
push 0x427893
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0042969c
cmp dword [ebp - 0xc], 0
je 0x427889
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428340
push dword [ebp - 0xc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42789d
xor eax, eax
push ebp
push 0x42792f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00429774
cmp dword [ebp - 0xc], 0
je 0x427925
call fcn.004297ec
mov ebx, eax
cmp ebx, 1
jne 0x4278e6
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428360
push dword [ebp - 0xc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
jmp 0x427925
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428380
lea eax, [ebp - 0x2a4]
push eax
mov cl, 0x30
mov edx, 1
mov eax, ebx
call fcn.00408664
push dword [ebp - 0x2a4]
push 0x4283a0
push dword [ebp - 0xc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 6
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427939
xor eax, eax
push ebp
push 0x42797e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4283ac
lea eax, [ebp - 0x2a8]
call fcn.004298d8
push dword [ebp - 0x2a8]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427988
xor eax, eax
push ebp
push 0x4279e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c8]
call fcn.00409508
cmp byte [ebp - 0x2b8], 0
je 0x4279d7
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4283cc
lea eax, [ebp - 0x2cc]
call fcn.00429a30
push dword [ebp - 0x2cc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4279eb
xor eax, eax
push ebp
push 0x427ac2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4283e4
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4283f4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428410
push ebp
lea edx, [ebp - 0x2d0]
mov al, byte [ebp - 0x125]
call fcn.0042737c
pop ecx
push dword [ebp - 0x2d0]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.004048e0
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.0041d7f0
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
call fcn.00407ccc
mov ebx, eax
mov al, byte [ebp - 0x125]
call fcn.00407ccc
cmp bl, al
je 0x427aa8
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428430
push ebp
lea edx, [ebp - 0x2d4]
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
call fcn.0042737c
pop ecx
push dword [ebp - 0x2d4]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.004048e0
mov eax, dword [ebp - 8]
mov edx, 0x428274
call fcn.00404828
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427acc
xor eax, eax
push ebp
push 0x427b11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x42843c
lea eax, [ebp - 0x2d8]
call fcn.00429ae4
push dword [ebp - 0x2d8]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427b1b
xor eax, eax
push ebp
push 0x427b6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x42845c
lea eax, [ebp - 0x2dc]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.004087e4
push dword [ebp - 0x2dc]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427b77
xor eax, eax
push ebp
push 0x427bbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x42847c
lea eax, [ebp - 0x2e0]
call fcn.0042ad10
push dword [ebp - 0x2e0]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427bc6
xor eax, eax
push ebp
push 0x427c24
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x48697c], 0
je 0x427c1a
call fcn.00402a38
test eax, eax
jle 0x427c1a
mov eax, dword [ebp - 8]
push dword [eax]
push 0x42849c
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x2e4]
call fcn.00404758
push dword [ebp - 0x2e4]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427c2e
xor eax, eax
push ebp
push 0x427c86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4284bc
lea edx, [ebp - 0x2ec]
xor eax, eax
call fcn.0041d7f0
mov eax, dword [ebp - 0x2ec]
lea edx, [ebp - 0x2e8]
call fcn.0041d890
push dword [ebp - 0x2e8]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427c90
xor eax, eax
push ebp
push 0x427d31
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x125]
push eax
mov eax, dword [0x489664]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea edx, [ebp - 0x2f0]
xor eax, eax
call fcn.0041d7f0
mov eax, dword [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x2f4]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.004047d0
mov eax, dword [ebp - 0x2f4]
pop edx
call fcn.00407d58
test al, al
jne 0x427d27
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4284dc
lea eax, [ebp - 0x2f8]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.004047d0
push dword [ebp - 0x2f8]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427d3b
xor eax, eax
push ebp
push 0x427f96
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x125]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x427f8c
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
push ebp
push 0x427ed2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x254]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x254]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea edx, [ebp - 0x2fc]
xor eax, eax
call fcn.0041d7f0
mov eax, dword [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x300]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.004047d0
mov eax, dword [ebp - 0x300]
pop edx
call fcn.00407d58
test al, al
je 0x427ded
mov eax, dword [ebp - 8]
mov edx, 0x4284fc
call fcn.00404828
mov eax, dword [ebp - 8]
jmp 0x427dfd
mov eax, dword [ebp - 8]
mov edx, 0x42851c
call fcn.00404828
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
push dword [eax]
lea eax, [ebp - 0x304]
push eax
movzx eax, word [ebp - 0x278]
mov cl, 0x30
mov edx, 4
call fcn.00408754
push dword [ebp - 0x304]
push 0x428244
lea eax, [ebp - 0x308]
push eax
movzx eax, word [ebp - 0x276]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x308]
push 0x428244
lea eax, [ebp - 0x30c]
push eax
movzx eax, word [ebp - 0x272]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x30c]
push 0x428430
lea eax, [ebp - 0x310]
push eax
movzx eax, word [ebp - 0x270]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x310]
push 0x42825c
lea eax, [ebp - 0x314]
push eax
movzx eax, word [ebp - 0x26e]
mov cl, 0x30
mov edx, 2
call fcn.00408754
push dword [ebp - 0x314]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 0xb
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427edc
cmp dword [0x4869ac], 0
je 0x427eef
mov eax, dword [0x4869ac]
cmp dword [eax], 0
jne 0x427f57
lea eax, [ebp - 0x318]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.004047d0
mov eax, dword [ebp - 0x318]
call fcn.00409a14
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x427f20
cmp dword [ebp - 0x20], 0
je 0x427f8c
mov eax, dword [ebp - 8]
push dword [eax]
push 0x42853c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x31c]
call fcn.00409b00
push dword [ebp - 0x31c]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
jmp 0x427f8c
mov eax, dword [ebp - 8]
push dword [eax]
push 0x42853c
lea eax, [ebp - 0x320]
mov edx, dword [0x4869ac]
mov edx, dword [edx]
call fcn.00404758
push dword [ebp - 0x320]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427fa0
xor eax, eax
push ebp
push 0x428044
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x428554
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
test ebx, ebx
je 0x42803a
push 0x104
lea eax, [ebp - 0x125]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_1
test eax, eax
jbe 0x42803a
lea eax, [ebp - 0x324]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.004047d0
mov eax, dword [ebp - 0x324]
call fcn.00409a14
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x428005
cmp dword [ebp - 0x20], 0
je 0x42803a
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428568
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x328]
call fcn.00409b00
push dword [ebp - 0x328]
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42804e
xor eax, eax
push ebp
push 0x428087
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428588
push 0x4285a8
push 0x428274
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x428091
xor eax, eax
push ebp
push 0x428172
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
jne 0x42813b
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00423824
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00423930
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4285b8
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.004048e0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0040496c
je 0x428168
push 1
mov eax, 0x4285d0
mov ecx, 0x7fffffff
mov edx, dword [ebp - 0xc]
call fcn.0040818c
mov edx, eax
add edx, 2
lea eax, [ebp - 0xc]
mov ecx, 0x7fffffff
call fcn.00404ac0
mov eax, dword [ebp - 8]
push dword [eax]
push 0x428274
push 0x4285f8
push dword [ebp - 0xc]
push 0x428618
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.004048e0
jmp 0x428168
mov eax, dword [ebp - 8]
push dword [eax]
push 0x4285f8
lea eax, [ebp - 0x32c]
mov edx, 0x486774
call fcn.004047c4
push dword [ebp - 0x32c]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.004048e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42817c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4281c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428215
lea eax, [ebp - 0x334]
mov edx, 0x1b
call fcn.00404584
lea eax, [ebp - 0x2c8]
mov edx, dword [0x409418]
call fcn.00404fc4
lea eax, [ebp - 0x2a8]
mov edx, 0xc
call fcn.00404584
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404584
ret