Function at 0x43a960
Capabilities:
Accept command line arguments
Enumerate process modules
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x480549
mov eax, dword fs:[0]
push eax
mov eax, 0x2a34
call fcn.00462620
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x2a30], eax
push ebx
push edi
mov eax, dword [0x4a30f8]
xor eax, esp
push eax
lea eax, [esp + 0x2a40]
mov dword fs:[0], eax
xor ebx, ebx
cmp esi, ebx
je 0x43ab40
mov ecx, esi
call fcn.00424940
mov edi, eax
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x14]
call fcn.0041deb0
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x2a4c], ebx
call fcn.00424bb0
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov dword [esp + 0x2a48], 0xffffffff
cmp ecx, dword [0x4a1010]
je 0x43aa0f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x43aa0f
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00461ef0
add esp, 4
mov ecx, edi
call fcn.00425330
mov ecx, dword [0x4a4d4c]
cmp ecx, ebx
je 0x43aa2e
mov edx, dword [ecx]
mov eax, dword [edx + 0x28]
push ebx
push ebx
push 0xe10
call eax
mov ecx, esi
call fcn.00441d20
test eax, eax
je 0x43ab40
mov ecx, esi
call fcn.0043bae0
cmp eax, ebx
je 0x43ab40
mov ecx, esi
call fcn.0043f460
cmp eax, 1
je 0x43aa62
cmp eax, 2
je 0x43aa62
cmp eax, 3
jne 0x43aa67
mov ebx, 1
push 0x284e
lea ecx, [esp + 0x10]
call fcn.0041d020
mov eax, dword [eax]
push eax
call fcn.004621d9
add esp, 4
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.0041c130
mov ecx, esi
call fcn.004485d0
test eax, eax
je 0x43aaaf
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push eax
call edx
cmp eax, edi
je 0x43aaaf
test ebx, ebx
je 0x43aaaf
push 4
mov ecx, esi
call fcn.0043f470
mov ecx, esi
call fcn.004485d0
mov ecx, eax
call fcn.004381a0
test eax, eax
jne 0x43ab47
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041d020
mov edi, eax
push 0xa9
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 1
call fcn.0041d020
mov edi, dword [edi]
mov eax, dword [eax]
push 1
push 0x30
push edi
push eax
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 2
call fcn.004414c0
lea ecx, [esp + 0xc]
call fcn.0041c130
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2a48], 0xffffffff
call fcn.0041c130
mov ecx, dword [0x4a4d4c]
test ecx, ecx
je 0x43ab40
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
push 0
push 0
push 0xe17
call edx
xor eax, eax
jmp 0x43b18c
mov ecx, esi
call fcn.0043f6d0
test eax, eax
je 0x43ab40
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push eax
call edx
test eax, eax
jne 0x43ab6c
mov ecx, esi
call fcn.00439be0
xor eax, eax
jmp 0x43b18c
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov ecx, esi
test eax, eax
jne 0x43ac22
call fcn.0043f540
test eax, eax
je 0x43abc5
call fcn.0043a320
test eax, eax
je 0x43ac1b
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041d020
mov edi, eax
push 0xa8
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 3
call fcn.0041d020
mov byte [esp + 0x2a48], 4
jmp 0x43abf6
push 0x96
lea ecx, [esp + 0x20]
call fcn.0041d020
mov edi, eax
push 0xa7
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 5
call fcn.0041d020
mov byte [esp + 0x2a48], 6
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
call fcn.004414c0
lea ecx, [esp + 0xc]
call fcn.0041c130
lea ecx, [esp + 0x1c]
call fcn.0041c130
xor eax, eax
jmp 0x43b18c
call fcn.0043f540
mov ecx, esi
test eax, eax
je 0x43adfe
call fcn.0043f550
test eax, eax
jne 0x43ac97
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041d020
mov edi, eax
push 0x97
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2a4c], 7
call fcn.0041d020
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 8
call fcn.004414c0
lea ecx, [esp + 0x18]
call fcn.0041c130
lea ecx, [esp + 0x14]
call fcn.0041c130
xor eax, eax
jmp 0x43b18c
mov eax, dword [0x4a1014]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x2a4c], 9
call fcn.00440930
push 0x489718
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.0041dfe0
push 0x800
lea ecx, [esp + 0x2240]
push 0
push ecx
mov byte [esp + 0x2a54], 0xa
call fcn.00461880
push 0x2000
lea edx, [esp + 0x44]
push 0
push edx
mov dword [esp + 0x34], 0
call fcn.00461880
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
push 0x800
lea ecx, [esp + 0x3c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x43ad7b
xor edi, edi
cmp dword [esp + 0x1c], edi
jbe 0x43ad7b
jmp 0x43ad30
mov eax, dword [esp + edi*4 + 0x34]
push 0x400
lea edx, [esp + 0x2240]
push edx
push eax
call fcn.0043a3b0
add esp, 0xc
test eax, eax
je 0x43ad74
lea ecx, [esp + 0x223c]
push ecx
call fcn.00463b89
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x2240]
push edx
push eax
call fcn.00462130
add esp, 0xc
test eax, eax
je 0x43ad92
inc edi
cmp edi, dword [esp + 0x1c]
jb 0x43ad30
lea ecx, [esp + 0xc]
call fcn.0041c130
lea ecx, [esp + 0x10]
call fcn.0041c130
jmp case.default.0x43af6e
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041d020
mov edi, eax
push 0xe5
lea ecx, [esp + 0x18]
mov byte [esp + 0x2a4c], 0xb
call fcn.0041d020
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 0xc
call fcn.004414c0
lea ecx, [esp + 0x14]
call fcn.0041c130
lea ecx, [esp + 0x18]
call fcn.0041c130
lea ecx, [esp + 0xc]
call fcn.0041c130
lea ecx, [esp + 0x10]
call fcn.0041c130
xor eax, eax
jmp 0x43b18c
call fcn.00424940
mov ecx, eax
call fcn.00424950
test eax, eax
je 0x43af4d
mov ecx, esi
call fcn.0043f460
test eax, eax
jne 0x43ae7a
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041d020
mov edi, eax
push 0xb8
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0xd
call fcn.0041d020
mov byte [esp + 0x2a48], 0xe
mov ecx, dword [edi]
mov edx, dword [eax]
push 1
push 0x40
push ecx
push edx
push 0
mov ecx, esi
call fcn.004414c0
lea ecx, [esp + 0x14]
call fcn.0041c130
lea ecx, [esp + 0x18]
call fcn.0041c130
xor eax, eax
jmp 0x43b18c
mov ecx, esi
call fcn.0043f460
cmp eax, 3
jne 0x43aeb9
push 0x96
lea ecx, [esp + 0x1c]
call fcn.0041d020
mov edi, eax
push 0x92
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0xf
call fcn.0041d020
mov byte [esp + 0x2a48], 0x10
jmp 0x43ae4e
mov ecx, esi
call fcn.0043f460
push 0x96
lea ecx, [esp + 0x1c]
cmp eax, 4
jne 0x43aefb
call fcn.0041d020
mov edi, eax
push 0x257
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0x11
call fcn.0041d020
mov byte [esp + 0x2a48], 0x12
jmp 0x43ae4e
call fcn.0041d020
mov edi, eax
push 0xac
lea ecx, [esp + 0x18]
mov dword [esp + 0x2a4c], 0x13
call fcn.0041d020
mov edi, dword [edi]
mov eax, dword [eax]
push 1
push 0x40
push edi
push eax
push 0
mov ecx, esi
mov byte [esp + 0x2a5c], 0x14
call fcn.004414c0
lea ecx, [esp + 0x14]
call fcn.0041c130
lea ecx, [esp + 0x18]
call fcn.0041c130
jmp case.default.0x43af6e
push esi
call fcn.00439d50
add esp, 4
test eax, eax
je 0x43ab40
mov ecx, esi
call fcn.0043f460
cmp eax, 4
ja case.default.0x43af6e
jmp dword [eax*4 + 0x43b1b4]
mov edx, 0xe11
call fcn.004371e0
mov edx, 0xe12
jmp 0x43b122
mov ecx, esi
call fcn.00424940
mov ecx, eax
call fcn.00424960
mov eax, dword [eax]
cmp dword [eax - 8], 0
je 0x43afbc
mov ecx, esi
call fcn.00424940
mov ecx, eax
call fcn.00424960
push eax
mov ecx, esi
call fcn.0043f430
mov ecx, eax
call fcn.0041ca20
mov ecx, esi
call fcn.0043f430
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0041de70
call fcn.00429930
add esp, 4
test eax, eax
jne case.default.0x43af6e
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x203e]
push edx
mov word [esp + 0x2040], cx
call fcn.00461880
add esp, 0xc
push 0x104
lea eax, [esp + 0x2038]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je case.default.0x43af6e
lea ecx, [esp + 0x2034]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041deb0
mov ebx, 0x15
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2a4c], ebx
call fcn.00427bc0
inc eax
push eax
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.00428a20
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2a4c], 0x16
call fcn.0041ca20
lea ecx, [esp + 0x24]
mov byte [esp + 0x2a48], bl
call fcn.0041c130
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0043f430
mov ecx, eax
call fcn.0041ca20
lea ecx, [esp + 0x10]
call fcn.0041c130
jmp case.default.0x43af6e
push 0x257
lea ecx, [esp + 0x30]
call fcn.0041d020
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2a4c], 0x17
call fcn.0041deb0
mov bl, 0x19
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2a48], bl
call fcn.0041c130
push 0x96
lea ecx, [esp + 0x34]
call fcn.0041d020
mov eax, dword [eax]
mov ecx, dword [esp + 0xc]
push 0x40
push eax
push ecx
push 0
mov ecx, esi
mov byte [esp + 0x2a58], 0x1a
call fcn.004415a0
lea ecx, [esp + 0x30]
mov byte [esp + 0x2a48], bl
call fcn.0041c130
mov edx, 0xe17
call fcn.004371e0
lea ecx, [esp + 0xc]
call fcn.0041c130
xor eax, eax
jmp 0x43b18c
mov edx, 0xe17
call fcn.004371e0
mov edx, dword [0x4a1014]
mov dword [esp + 0x20], edx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x2a4c], 0x1b
call fcn.00440930
mov ecx, esi
call fcn.0043f760
test eax, eax
je 0x43b174
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
mov ecx, dword [esp + 0x28]
call fcn.00424a00
mov ecx, dword [eax]
push ecx
call fcn.00436f70
add esp, 4
push 0
call fcn.00436f50
add esp, 4
lea ecx, [esp + 0x20]
call fcn.0041c130
mov eax, 1
mov ecx, dword [esp + 0x2a40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x2a30]
xor ecx, esp
call fcn.00461862
add esp, 0x2a40
ret