Function at 0x10044b3d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp + 0x38c], eax
mov eax, dword [ebp + 0x398]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x78], eax
mov eax, dword [0x102dde3c]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x39c]
mov dword [ebp - 0x7c], ebx
cmp eax, ebx
jne 0x10044b9a
push str.IsProcessCritical
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [0x102dde3c], eax
cmp eax, ebx
je 0x10044bb5
cmp dword [ebp - 0x78], ebx
je 0x10044bb5
lea ecx, [ebp - 0x7c]
push ecx
push dword [ebp - 0x78]
call eax
test eax, eax
je 0x10044bb5
cmp dword [ebp - 0x7c], ebx
jne 0x10044e15
mov eax, dword [0x102dde38]
cmp eax, ebx
jne 0x10044bda
push str.ZwQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov dword [0x102dde38], eax
cmp eax, ebx
je 0x10044bf8
push ebx
push 4
lea ecx, [ebp - 0x80]
push ecx
push 0x1d
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call eax
test eax, eax
jl 0x10044bf8
cmp dword [ebp - 0x80], ebx
jne 0x10044e15
cmp edi, ebx
jne 0x10044c03
xor eax, eax
jmp 0x10044e18
push 0x10156e68
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10044bfc
push str.ntoskrnl.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.ntkrnlmp.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.ntkrnlpa.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.ntkrpamp.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.csrss.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.logonui.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.lsass.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.lsm.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.services.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.smss.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.wininit.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.winlogon.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.msmpeng.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.registry.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
push str.sgrmbroker.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
cmp byte [0x102d3d91], bl
jne 0x10044bfc
push str.svchost.exe
push edi
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10044bfc
push 0x400
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.10045030
add esp, 0xc
cmp byte [ebp + 0x3a0], bl
je 0x10044d9a
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call fcn.100449ea
pop ecx
pop ecx
jmp 0x10044dad
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp - 0x74]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x10044da3
cmp byte [ebp - 0x74], bl
je 0x10044bfc
lea eax, [ebp - 0x74]
push eax
call fcn.10045308
lea eax, [ebp - 0x74]
mov dword [esp], str._localservicenonetworkfirewall
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
lea eax, [ebp - 0x74]
push str._localservicenonetwork
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
lea eax, [ebp - 0x74]
push str._dcomlaunch
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
jne 0x10044e15
lea eax, [ebp - 0x74]
push str._rpcss
push eax
call fcn.10045450
pop ecx
pop ecx
test eax, eax
je 0x10044bfc
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x38c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
add ebp, 0x390
leave
ret