Function at 0x40c7c0
Capabilities:
Get common file path
Patch process command line

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x684
mov eax, dword [0x577400]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, str.ntdll.dll
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov ecx, eax
lea eax, str.NtQueryInformationProcess
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jne 0x40c821
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
lea eax, str.ntdll.dll
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov ecx, eax
lea eax, str.RtlEnterCriticalSection
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 0
jne 0x40c86d
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
lea eax, str.ntdll.dll
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov ecx, eax
lea eax, str.RtlLeaveCriticalSection
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jne 0x40c8b9
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
lea eax, str.ntdll.dll
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
sub esp, 4
mov ecx, eax
lea eax, str.RtlInitUnicodeString
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
jne 0x40c905
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
xor ecx, ecx
mov dword [esp], 0x438
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov dword [ebp - 0x66c], eax
mov eax, 0xffffffff
cmp dword [ebp - 0x66c], eax
jne 0x40c95b
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
mov eax, dword [ebp - 0x65c]
lea ecx, [ebp - 0x640]
mov edx, dword [ebp - 0x66c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], 0
call eax
sub esp, 0x14
lea eax, [ebp - 0x644]
lea ecx, [ebp - 0x640]
add ecx, 4
mov edx, dword [ebp - 0x66c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
cmp eax, 0
jne 0x40c9e6
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
lea eax, [ebp - 0x648]
mov ecx, dword [ebp - 0x644]
add ecx, 0xc
mov edx, dword [ebp - 0x66c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
cmp eax, 0
jne 0x40ca39
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
lea eax, [ebp - 0x216]
mov dword [esp], eax
mov dword [esp + 4], 0x104
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
sub esp, 8
lea ecx, [ebp - 0x216]
lea eax, str.explorer.exe
mov dword [esp], ecx
mov dword [esp + 4], 0x105
mov dword [esp + 8], eax
call fcn.00402c11
mov dword [esp], 0x104
call fcn.00401582
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x216]
mov ecx, dword [ebp - 0x670]
mov dword [esp], ecx
mov dword [esp + 4], 0x104
mov dword [esp + 8], eax
call fcn.0040399a
mov eax, dword [ebp - 0x660]
mov ecx, dword [ebp - 0x644]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], ecx
call eax
sub esp, 4
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x670]
mov edx, dword [ebp - 0x644]
mov edx, dword [edx + 0x10]
add edx, 0x38
mov dword [esp], edx
mov dword [esp + 4], ecx
call eax
sub esp, 8
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x670]
mov edx, dword [ebp - 0x644]
mov edx, dword [edx + 0x10]
add edx, 0x40
mov dword [esp], edx
mov dword [esp + 4], ecx
call eax
sub esp, 8
lea eax, [ebp - 0x626]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
mov eax, dword [ebp - 0x644]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x648]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x64c]
lea ecx, [ebp - 0x650]
mov edx, dword [ebp - 0x66c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
cmp eax, 0
jne 0x40cb99
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
mov eax, dword [ebp - 0x64c]
movzx eax, word [eax + 0x26]
lea ecx, [ebp - 0x41e]
mov edx, dword [ebp - 0x64c]
mov edx, dword [edx + 0x28]
mov esi, dword [ebp - 0x66c]
xor edi, edi
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
cmp eax, 0
jne 0x40cbf2
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
lea eax, [ebp - 0x41e]
lea ecx, [ebp - 0x626]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040376a
cmp eax, 0
jne 0x40cc5a
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x670]
mov edx, dword [ebp - 0x64c]
add edx, 0x24
mov dword [esp], edx
mov dword [esp + 4], ecx
call eax
sub esp, 8
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x670]
mov edx, dword [ebp - 0x64c]
add edx, 0x2c
mov dword [esp], edx
mov dword [esp + 4], ecx
call eax
sub esp, 8
jmp 0x40cc7a
mov eax, dword [ebp - 0x64c]
mov eax, dword [eax]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x650]
cmp eax, dword [ebp - 0x674]
jne 0x40cb49
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x644]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], ecx
call eax
sub esp, 4
mov eax, dword [ebp - 0x66c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [ebp - 0x41e]
lea ecx, [ebp - 0x216]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040376a
cmp eax, 0
jne 0x40ccd3
mov dword [ebp - 0x654], 0
jmp 0x40ccdd
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x678], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004030b7
mov eax, dword [ebp - 0x678]
add esp, 0x684
pop esi
pop edi
pop ebp
ret