Function at 0x403a80
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da590
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x11c8
call fcn.004b60d0
mov eax, dword [0x522008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
call dword [sym.imp.IMM32.dll_ImmDisableIME]
mov byte [ebp - 0x1114], 1
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1100], 0
mov dword [ebp - 0x10fc], 7
mov word [ebp - 0x1110], ax
mov dword [ebp - 0x10e8], eax
mov word [ebp - 0x10f8], ax
mov dword [ebp - 0x118c], eax
lea eax, [ebp - 0x118c]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x10e4], 7
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1188], eax
test eax, eax
je 0x403c1d
mov edi, 1
cmp dword [ebp - 0x118c], edi
jle 0x403c16
mov esi, dword [eax + edi*4]
mov ecx, str.__t1
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403b86
test dx, dx
je 0x403b82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403b86
add eax, 4
add ecx, 4
test dx, dx
jne 0x403b60
xor eax, eax
jmp 0x403b8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403b97
mov byte [ebp - 0x1114], al
jmp 0x403c03
push 4
push str.__e
push esi
call fcn.004bbf68
add esp, 0xc
test eax, eax
jne 0x403bcb
add esi, 8
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403bb3
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x10f8]
jmp 0x403bfd
push 4
push str.__s
push esi
call fcn.004bbf68
add esp, 0xc
test eax, eax
jne 0x403c03
add esi, 8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403be7
sub eax, edx
lea ecx, [ebp - 0x1110]
sar eax, 1
push eax
push esi
call fcn.004023b0
mov eax, dword [ebp - 0x1188]
inc edi
cmp edi, dword [ebp - 0x118c]
jl 0x403b56
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x80
lea eax, [ebp - 0x98]
mov byte [ebp - 0x1181], 0
push 0
push eax
call fcn.004b7720
add esp, 0xc
lea eax, [ebp - 0x98]
push 0x28b2
push 0
push 3
push 2
push str._d._d._d._d
push 0xffffffffffffffff
push 0x40
push eax
call fcn.004027a0
add esp, 0x20
lea ecx, [ebp - 0x1168]
call fcn.00402a50
lea ecx, [ebp - 0x1198]
call fcn.0040af50
push 0x20
xor eax, eax
mov dword [ebp - 0x10b8], 0
push str.helper_2345.child_process.common
lea ecx, [ebp - 0x10c8]
mov dword [ebp - 0x10b4], 7
mov word [ebp - 0x10c8], ax
call fcn.004023b0
lea eax, [ebp - 0x10c8]
push eax
lea ecx, [ebp - 0x1190]
call fcn.0040af60
lea ecx, [ebp - 0x10c8]
mov dword [ebp - 4], 2
call fcn.00402340
cmp byte [ebp - 0x1114], 0
mov dword [ebp - 4], 0xffffffff
je 0x404202
push 0x13
xor eax, eax
mov dword [ebp - 0x10b8], 0
push str.helper_2345explorer
lea ecx, [ebp - 0x10c8]
mov dword [ebp - 0x10b4], 7
mov word [ebp - 0x10c8], ax
call fcn.004023b0
lea eax, [ebp - 0x10c8]
push eax
lea ecx, [ebp - 0x1198]
call fcn.0040afd0
lea ecx, [ebp - 0x10c8]
mov dword [ebp - 4], 6
call fcn.00402340
cmp dword [ebp - 0x1198], 0
mov dword [ebp - 4], 0xffffffff
je 0x403d50
cmp byte [ebp - 0x1193], 0
je 0x403d50
mov esi, 0x32
jmp 0x40436b
mov eax, dword [0x524ce0]
test al, 1
jne 0x403d8a
or eax, 1
mov dword [0x524cd8], 0
mov dword [0x524ce0], eax
xor eax, eax
push 0x4f0160
mov dword [0x524cdc], 7
mov word [0x524cc8], ax
call fcn.004b5c2a
add esp, 4
cmp dword [0x524cd8], 0
jne 0x403edf
push 0x1000
lea eax, [ebp - 0x1098]
push 0
push eax
call fcn.004b7720
add esp, 0xc
lea eax, [ebp - 0x1098]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x1098], 0
je 0x403edf
push 0xb
xor eax, eax
mov dword [ebp - 0x10a0], 0
push str.hotspotessw
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 0x109c], 7
mov word [ebp - 0x10b0], ax
call fcn.004023b0
xor eax, eax
mov dword [ebp - 0x10b8], 0
lea ecx, [ebp - 0x1098]
mov dword [ebp - 0x10b4], 7
mov word [ebp - 0x10c8], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403e23
sub ecx, edx
lea eax, [ebp - 0x1098]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10c8]
call fcn.004023b0
lea eax, [ebp - 0x10b0]
push eax
lea eax, [ebp - 0x10c8]
push eax
lea eax, [ebp - 0x1180]
push eax
call fcn.0040b470
mov esi, eax
add esp, 0xc
cmp esi, 0x524cc8
je 0x403ea0
mov ecx, 0x524cc8
call fcn.00402340
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [0x524cc8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x524cd8], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x1180]
call fcn.00402340
lea ecx, [ebp - 0x10c8]
call fcn.00402340
lea ecx, [ebp - 0x10b0]
call fcn.00402340
push 0x524cc8
call fcn.00409050
add esp, 4
test al, al
jne 0x403edf
push 0x524cc8
call fcn.00409630
add esp, 4
push 0x524cc8
lea ecx, [ebp - 0x10e0]
call fcn.00402250
push 0xa
xor eax, eax
mov dword [ebp - 0x10a0], 0
push str.Statistics
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 0x109c], 7
mov word [ebp - 0x10b0], ax
call fcn.004023b0
lea eax, [ebp - 0x10b0]
push eax
lea eax, [ebp - 0x10e0]
push eax
lea eax, [ebp - 0x1180]
push eax
call fcn.0040b470
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x10e0]
cmp eax, esi
je 0x403f78
mov ecx, eax
call fcn.00402340
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x10e0], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
movq qword [ebp - 0x10d0], xmm0
mov word [esi], ax
lea ecx, [ebp - 0x1180]
mov dword [ebp - 4], 0x17
call fcn.00402340
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 4], 0x1b
call fcn.00402340
xor eax, eax
mov dword [ebp - 4], 0xffffffff
push eax
push 0x501cf0
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 0x10a0], 0
mov dword [ebp - 0x109c], 7
mov word [ebp - 0x10b0], ax
call fcn.004023b0
lea eax, [ebp - 0x10f8]
push eax
lea eax, [ebp - 0x1110]
push eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402250
lea ecx, [ebp - 0x1180]
call fcn.004038b0
add esp, 0x18
push eax
lea eax, [ebp - 0x10e0]
push eax
lea eax, [ebp - 0x10b0]
push eax
call fcn.00401950
mov ecx, eax
call fcn.00401a00
lea ecx, [ebp - 0x1180]
mov dword [ebp - 4], 0x1f
call fcn.00402340
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 4], 0x23
call fcn.00402340
mov dword [ebp - 4], 0x27
lea ecx, [ebp - 0x1150]
xor eax, eax
mov dword [ebp - 0x1140], 0
push 0xe
mov dword [ebp - 0x113c], 7
xorps xmm0, xmm0
mov word [ebp - 0x1150], ax
mov dword [ebp - 4], 0xffffffff
push 0x4fe2e0
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], eax
movlpd qword [ebp - 0x1128], xmm0
mov byte [ebp - 0x1120], al
call fcn.004023b0
xorps xmm0, xmm0
mov dword [ebp - 0x1138], 0
mov dword [ebp - 0x1134], 0
mov dword [ebp - 0x1130], 0
mov dword [ebp - 0x112c], 0
movlpd qword [ebp - 0x1128], xmm0
call fcn.00401950
mov ecx, dword [eax]
lea eax, [ebp - 0x1150]
push eax
add ecx, 0xb8
call fcn.00424e60
mov esi, dword [ebp - 0x1190]
mov byte [ebp - 0x1181], 1
test esi, esi
je 0x404103
cmp byte [ebp - 0x118b], 0
jne 0x40410e
lea ecx, [ebp - 0x1168]
call fcn.00402c80
test esi, esi
je 0x404123
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1190], 0
xorps xmm0, xmm0
mov word [ebp - 0x118c], 0
lea eax, [ebp - 0x11d8]
mov dword [ebp - 0x11d8], 0
push eax
movlpd qword [ebp - 0x11d0], xmm0
movlpd qword [ebp - 0x11c8], xmm0
mov dword [ebp - 0x11c0], 0
mov dword [ebp - 0x11bc], 0
mov dword [ebp - 0x11a0], 0
call fcn.004b4c50
add esp, 4
mov dword [ebp - 0x10a0], 0
xor eax, eax
mov dword [ebp - 0x109c], 7
lea ecx, [ebp - 0x10b0]
mov word [ebp - 0x10b0], ax
push 4
push str.rd10
call fcn.004023b0
mov eax, dword [ebp - 0x11bc]
cdq
mov edi, eax
mov esi, edx
call fcn.00401950
push esi
push edi
lea ecx, [ebp - 0x10b0]
push ecx
mov ecx, dword [eax]
call fcn.00424ec0
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 4], 0x28
call fcn.00402340
lea ecx, [ebp - 0x1150]
mov dword [ebp - 4], 0x2d
call fcn.00402340
lea ecx, [ebp - 0x10e0]
mov dword [ebp - 4], 0x31
call fcn.00402340
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1158], 0
jne 0x4042b6
cmp byte [ebp - 0x1181], 0
je 0x4042ac
push 4
xor eax, eax
mov dword [ebp - 0x10a0], 0
push str.rd02
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 0x109c], 7
mov word [ebp - 0x10b0], ax
call fcn.004023b0
call fcn.00401950
push 0
push 1
lea ecx, [ebp - 0x10b0]
push ecx
mov ecx, dword [eax]
call fcn.00424ec0
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 4], 0x35
call fcn.00402340
mov dword [ebp - 4], 0xffffffff
call fcn.00401950
mov ecx, eax
call fcn.00401f50
call fcn.00401950
mov esi, dword [eax]
cmp byte [esi], 0
je 0x4042ac
call fcn.0042b2a0
push esi
mov ecx, eax
call fcn.0042b730
push 0
mov ecx, esi
call fcn.00425b50
mov byte [esi], 0
mov esi, 0x33
jmp 0x40436b
cmp dword [ebp - 0x1154], 8
lea eax, [ebp - 0x1168]
cmovae eax, dword [ebp - 0x1168]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4042ac
push str.AssistMain
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1188], eax
test eax, eax
je 0x4042ac
cmp byte [ebp - 0x1114], 0
je 0x404327
call fcn.00401950
mov ecx, eax
call fcn.00401f50
call fcn.00401950
mov esi, dword [eax]
cmp byte [esi], 0
je 0x404327
call fcn.0042b2a0
push esi
mov ecx, eax
call fcn.0042b730
push 0
mov ecx, esi
call fcn.00425b50
mov byte [esi], 0
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x10b0]
call fcn.004021e0
lea eax, [ebp - 0x10b0]
push eax
call dword [ebp - 0x1188]
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x10b0]
mov dword [ebp - 4], 0x60
call fcn.00402340
push edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x1190]
call fcn.0040af80
lea ecx, [ebp - 0x1198]
call fcn.0040af80
lea ecx, [ebp - 0x1168]
mov dword [ebp - 4], 0x64
call fcn.00402340
lea ecx, [ebp - 0x10f8]
mov dword [ebp - 4], 0x69
call fcn.00402340
lea ecx, [ebp - 0x1110]
mov byte [ebp - 4], 0x6d
call fcn.00402340
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b5964
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10