Function at 0x401d30
Capabilities:
Accept command line arguments
Get common file path
Manipulate boot configuration

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
push 0x4057d0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], esi
jne 0x401d88
push 0x404708
call fcn.00401000
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 0x10
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x401dbc
cmp eax, 3
je 0x401dbc
push 0x4046f0
call fcn.00401000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x214
ret 0x10
call fcn.00401c40
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 3
jne 0x401e5c
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
lea edx, [esp + 0x128]
push 0x103
stosb byte es:[edi], al
mov eax, dword [esi + 8]
push edx
push 0xffffffffffffffff
push eax
push 0x200
push ebx
call ebp
mov esi, str._setdefault
lea eax, [esp + 0x120]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401e3b
cmp cl, bl
je 0x401e37
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401e3b
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401e17
xor eax, eax
jmp 0x401e40
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401e58
push 0x4046bc
call fcn.00401000
add esp, 4
mov byte [0x4053c8], 1
mov esi, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi + 4]
push ebx
push ebx
lea eax, [esp + 0x24]
push 0x103
push eax
push 0xffffffffffffffff
push ecx
push 0x200
push ebx
call ebp
push 0x103
push 0x404aa4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x401ec4
push 0x40469c
call fcn.00401000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x214
ret 0x10
call fcn.004011c0
or ecx, 0xffffffff
mov edi, 0x404aa4
xor eax, eax
mov byte [0x404aa6], 0x5c
mov byte [0x404aa7], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x404ba8
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.boot.ini
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x404ba8
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x404aa4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404cac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ORMLdr
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x404cac
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x404aa4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404db0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x404680
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, edi
mov edx, ecx
mov edi, 0x404db0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x103
and ecx, 3
push 0x4050bc
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str._bcdedit.exe
or ecx, 0xffffffff
xor eax, eax
push 0x103
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4052c4
mov esi, edi
mov edx, ecx
mov edi, 0x4050bc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str.powercfg.exe
or ecx, 0xffffffff
xor eax, eax
push str.Wow64DisableWow64FsRedirection
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.kernel32.dll
mov esi, edi
mov edx, ecx
mov edi, 0x4052c4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
cmp eax, ebx
je 0x402064
lea ecx, [esp + 0x18]
push ecx
call eax
mov esi, str._install
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402091
cmp cl, bl
je 0x40208d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402091
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40206d
xor eax, eax
jmp 0x402096
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4020b1
push 0x404610
call fcn.00401000
add esp, 4
call fcn.00401410
jmp 0x402143
mov esi, str._remove
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4020de
cmp cl, bl
je 0x4020da
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4020de
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4020ba
xor eax, eax
jmp 0x4020e3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4020fb
push 0x4045f4
call fcn.00401000
add esp, 4
call fcn.00401a70
jmp 0x402143
mov esi, str._rmdefault
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402128
cmp cl, bl
je 0x402124
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402128
add eax, 2
add esi, 2
cmp cl, bl
jne 0x402104
xor eax, eax
jmp 0x40212d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x402143
push 0x4045c8
call fcn.00401000
add esp, 4
call fcn.00401970
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call ebp
cmp eax, ebx
je 0x40215d
lea ecx, [esp + 0x18]
push ecx
call eax
call fcn.00402900
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x404598
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 0x10