Function at 0x4652d0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb3f1
mov eax, dword fs:[0]
push eax
sub esp, 0xc78
mov eax, dword [0x57b070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx + 0xa88], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc78], esi
je 0x465319
mov al, 1
jmp 0x465b35
mov byte [ebp - 0xc6e], 1
call fcn.0046cc30
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test al, al
je 0x46534a
call edi
push str.initruntime_safemode
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
push str.initruntime_safemode
setne al
mov byte [ebx + 8], al
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x46538b
call edi
push str.initruntime_installpath
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
push esi
mov ecx, ebx
call fcn.00465b60
neg al
push str.initruntime_installpath
sbb al, al
and byte [ebp - 0xc6e], al
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x4653ce
call edi
push str.initruntime_TempPath
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004a64e0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x46543a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00464450
push 0x55f2dc
mov esi, eax
push 0x558df8
push esi
call fcn.004623d0
add esp, 0xc
push edi
push 0x55eefc
push esi
call fcn.004623d0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add esp, 0xc
xor al, al
jmp 0x4654e7
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465443
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x21e], 0x5c
jne 0x46547a
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x4655e1
xor eax, eax
mov word [ebp + ecx - 0x21c], ax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xb44]
call fcn.00462ac0
cmp byte [ebp - 0xa28], 0
lea eax, [ebp - 0xb38]
lea ecx, [ebx + 0x130]
cmove eax, dword [ebp - 0xb3c]
add eax, 4
push eax
call fcn.00461ed0
cmp byte [ebp - 0xa28], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4654e5
mov eax, dword [ebp - 0xb3c]
lea ecx, [ebp - 0xb38]
cmp eax, ecx
je 0x4654e5
push eax
call fcn.004ac7ec
add esp, 4
mov al, 1
and al, byte [ebp - 0xc6e]
push str.initruntime_TempPath
mov byte [ebp - 0xc6d], al
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x465524
call edi
push str.initruntime_VistaIE7
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
push 0x114
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004a64e0
add esp, 0xc
lea eax, [ebp - 0xb34]
push 0x114
push 0
push eax
call fcn.004a64e0
add esp, 0xc
lea edx, [ebp - 0xb34]
lea ecx, [ebp - 0x12c]
call fcn.00469ab0
mov esi, dword [ebp - 0x128]
cmp esi, 6
jae 0x4655f7
mov word [ebx + 5], 0
cmp esi, 5
jne 0x4655ee
mov eax, dword [ebp - 0x124]
cmp eax, 1
jne 0x4655e6
mov byte [ebp - 0xc7c], 0
mov dword [ebp - 0xc80], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0xc74]
lea ecx, [ebp - 0xc80]
mov dword [ebp - 0xc74], 0xffffffff
call fcn.00469bc0
test al, al
je 0x4655ca
cmp dword [ebp - 0xc74], 2
jg 0x4655ca
mov byte [ebx + 4], 1
lea ecx, [ebp - 0xc80]
mov dword [ebp - 4], 0xffffffff
call fcn.004643f0
jmp 0x4656a1
call fcn.004a3739
test eax, eax
jne 0x4656a1
mov byte [ebx + 4], 1
jmp 0x4656a1
push 0x800
lea eax, [ebp - 0xa1c]
mov byte [ebx + 5], 1
push 0
push eax
call fcn.004a64e0
add esp, 0xc
lea eax, [ebp - 0xa1c]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0xa1c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465630
sub ecx, edx
sar ecx, 1
push 0x55f2f4
lea eax, [ebp + ecx*2 - 0xa34]
push eax
call fcn.004b2ecb
add esp, 8
test eax, eax
sete al
mov byte [ebx + 6], al
mov eax, dword [ebp - 0x124]
cmp esi, 6
ja 0x46566e
jne 0x4656a1
cmp eax, 2
jb 0x4656a1
mov byte [ebx + 0xa8a], 1
cmp esi, 0xa
jae 0x46569d
cmp esi, 6
jne 0x465684
cmp eax, 4
jae 0x46569d
mov eax, dword [ebp - 0xb30]
cmp eax, 0xa
jae 0x46569d
cmp eax, 6
jne 0x4656a1
cmp dword [ebp - 0xb2c], 4
jb 0x4656a1
mov byte [ebx + 7], 1
push str.initruntime_VistaIE7
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x4656d2
call edi
push str.initruntime_DataPath
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
mov esi, dword [ebp - 0xc78]
mov ecx, ebx
push esi
call fcn.00465c10
test al, al
jne 0x4656ef
mov byte [ebp - 0xc6d], al
jmp 0x4657ab
call fcn.0046cc30
test al, al
je 0x46571d
mov dword [ebp - 0xc74], str.initruntime_ProfilePath
call edi
push str.initruntime_ProfilePath
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
push esi
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.00465fe0
test al, al
jne 0x465738
mov byte [ebp - 0xc6d], al
jmp 0x465799
xor eax, eax
lea edi, [ebx + 0x5c0]
mov word [edi], ax
lea esi, [ebx + 0x384]
cmp byte [ebx + 0x494], al
jne 0x465757
mov esi, dword [ebx + 0x380]
movzx eax, word [esi + 4]
add esi, 4
xor ecx, ecx
test ax, ax
je 0x46578b
shl ecx, 4
lea esi, [esi + 2]
movzx eax, ax
add ecx, eax
mov edx, ecx
and edx, 0xf0000000
je 0x465783
mov eax, edx
shr eax, 0x18
xor eax, edx
xor ecx, eax
movzx eax, word [esi]
test ax, ax
jne 0x465765
push 0x10
push 0x11
push edi
push ecx
call fcn.004b80f1
add esp, 0x10
lea ecx, [ebp - 0xc74]
mov dword [ebp - 4], 0xffffffff
call fcn.0046cb80
push str.initruntime_DataPath
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test al, al
je 0x4657e2
call edi
push str.initruntime_SetBuildNo
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
cmp word [0x5844d0], 0
je 0x465805
mov ecx, 0x5844d0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4657f4
sub ecx, edx
sar ecx, 1
jne 0x465865
xor ecx, ecx
cmp byte [0x5838c9], cl
je 0x465819
mov eax, dword [0x5838cc]
test eax, eax
cmovne ecx, eax
xor eax, eax
mov word [ebp - 0xc7a], ax
lea eax, [ebp - 0x61c]
push 0x200
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0xc80]
lea ecx, [ebp - 0x61c]
call fcn.0046c9e0
movzx eax, word [ebp - 0xc7a]
push eax
push 0x55ef14
push 0x200
push 0x5844d0
call fcn.00425020
add esp, 0x10
push 0x5844d0
lea eax, [ebx + 0x5e2]
push 0xb
push eax
call fcn.004b3332
add esp, 0xc
push str.initruntime_SetBuildNo
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x4658ac
call edi
push str.initruntime_SetCommandLine
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
call esi
push eax
lea ecx, [ebx + 0x5f8]
call fcn.00461ed0
cmp byte [ebx + 0x714], 0
lea eax, [ebx + 0x604]
jne 0x4658d7
mov eax, dword [ebx + 0x600]
add eax, 4
lea ecx, [ebx + 0x71c]
push eax
call fcn.00461ed0
lea ecx, [ebx + 0x71c]
call fcn.004626b0
push str.initruntime_SetCommandLine
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x465922
call edi
push str.initruntime_CheckConfig
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
mov esi, dword [ebp - 0xc78]
lea eax, [ebp - 0xc6e]
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc6e], 0
call fcn.00466f40
neg al
push str.initruntime_CheckConfig
sbb al, al
and byte [ebp - 0xc6d], al
call fcn.0046cad0
add esp, 4
cmp byte [ebp - 0xc6e], 0
jne 0x4659a1
call fcn.0046cc30
test al, al
je 0x465982
call edi
push str.initruntime_SetProcessShortName
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
push esi
mov ecx, ebx
call fcn.00466420
neg al
push str.initruntime_SetProcessShortName
sbb al, al
and byte [ebp - 0xc6d], al
call fcn.0046cad0
add esp, 4
call fcn.0046cc30
test al, al
je 0x4659c5
call edi
push str.initruntime_CheckIgnoreCancel
push eax
call fcn.00473e30
mov ecx, eax
call fcn.00473fd0
mov ecx, eax
call fcn.00474340
mov al, byte [ebx + 0xa8a]
test al, al
jne 0x4659ef
mov eax, dword [ebx]
mov ecx, ebx
push str.outlook.exe
call dword [eax + 4]
push eax
call fcn.004b2ecb
add esp, 8
test eax, eax
jne 0x4659ef
mov byte [ebx + 0xae8], 1
push str.initruntime_CheckIgnoreCancel
call fcn.0046cad0
add esp, 4
lea ecx, [ebp - 0xc6c]
call fcn.00461c60
lea edx, [ebp - 0xc6c]
mov dword [ebp - 4], 2
mov ecx, esi
call fcn.0046aa60
cmp byte [ebx + 0x95c], 0
lea eax, [ebx + 0x84c]
jne 0x465a30
mov eax, dword [ebx + 0x848]
add eax, 4
push str.explorer.exe
push eax
call fcn.004b2ecb
add esp, 8
test eax, eax
je 0x465a78
cmp byte [ebx + 0x95c], 0
lea eax, [ebx + 0x84c]
jne 0x465a5a
mov eax, dword [ebx + 0x848]
add eax, 4
push str.searchui.exe
push eax
call fcn.004b2ecb
add esp, 8
test eax, eax
je 0x465a78
mov byte [ebx + 0xae9], 0
jmp 0x465a7f
mov byte [ebx + 0xae9], 1
xor esi, esi
cmp dword [str.Notepad.exe], esi
je 0x465ad3
mov eax, 0x548dd0
nop
cmp byte [ebx + 0x95c], 0
mov ecx, dword [eax]
lea eax, [ebx + 0x84c]
jne 0x465aa7
mov eax, dword [ebx + 0x848]
push ecx
add eax, 4
push eax
call fcn.004b2ecb
add esp, 8
test eax, eax
je 0x465acc
inc esi
cmp dword [esi*4 + 0x548dd0], 0
lea eax, [esi*4 + 0x548dd0]
jne 0x465a90
jmp 0x465ad3
mov byte [ebx + 0x1fad], 1
cmp byte [ebp - 0xc6d], 0
jne 0x465afe
mov ecx, dword [ebp - 0xc78]
call fcn.00464450
push 0x55f264
push 0x558df8
push eax
call fcn.004623d0
add esp, 0xc
xor bl, bl
jmp 0x465b07
mov byte [ebx + 0xa88], 1
mov bl, 1
cmp byte [ebp - 0xb50], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x465b33
mov ecx, dword [ebp - 0xc64]
lea eax, [ebp - 0xc60]
cmp ecx, eax
je 0x465b33
push ecx
call fcn.004ac7ec
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a35cb
mov esp, ebp
pop ebp
ret 4