Function at 0x41eab0
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a160
push 0x424bca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x15b4
call fcn.00424a70
mov eax, dword [0x42c34c]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x154c], esi
lea ecx, [ebp - 0xb34]
call fcn.0041c9e0
mov dword [ebp - 0x1550], esi
mov dword [ebp - 4], esi
push 0x42d404
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [ebp - 0x15a0], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov dword [ebp - 0x1574], edi
push 0x104
lea eax, [ebp - 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x1d], 0
push esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x1554], eax
test eax, eax
jge 0x41eb68
mov dword [ebp - 4], 0xffffffff
mov eax, 1
jmp 0x41f169
push 0
push 0
push 0
push 2
push 2
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x1554], eax
test eax, eax
jl 0x41f0d2
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x42d420], eax
test eax, eax
jne 0x41ebb5
mov esi, 1
mov dword [ebp - 0x154c], esi
jmp 0x41f0d2
push 0
push ebx
push 0x42c1d8
mov ecx, 0x42c28c
call fcn.0041d920
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x42c2bc], eax
push str._UnRegServer
push edi
call fcn.0041e030
add esp, 8
test eax, eax
jne 0x41f031
push 0x42a13c
push edi
call fcn.0041e030
add esp, 8
test eax, eax
jne 0x41f031
push str._RegServer
push edi
call fcn.0041e030
add esp, 8
test eax, eax
jne 0x41eee2
push 0x42a124
push edi
call fcn.0041e030
add esp, 8
test eax, eax
jne 0x41eee2
push str._Embedding
push edi
call fcn.0041e030
add esp, 8
test eax, eax
jne 0x41ee1d
push 0x42a10c
push edi
call fcn.0041e030
add esp, 8
test eax, eax
jne 0x41ee1d
push 0xfffffffffffffff5
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call esi
mov dword [ebp - 0x155c], eax
cmp eax, 0xffffffff
je 0x41ec8e
test eax, eax
je 0x41ec8e
push 0
lea ecx, [ebp - 0x15ac]
push ecx
push 0
push 0x42a108
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41edea
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x41edea
push 1
push 0x41e0a0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x41ecbd
mov esi, 1
mov dword [ebp - 0x154c], esi
jmp 0x41f0d2
push 0xfffffffffffffff5
call esi
mov esi, eax
mov dword [ebp - 0x155c], esi
call fcn.0041d690
test eax, eax
je 0x41ed03
lea edx, [ebp - 0x15cc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, 0x3c
cmp word [ebp - 0x15ca], ax
jge 0x41ecf5
mov word [ebp - 0x15ca], ax
mov eax, dword [ebp - 0x15cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
push ecx
push 0x42a104
push str.CONIN_
mov esi, dword [sym.imp.MSVCR71.dll_freopen]
call esi
mov edx, dword [sym.imp.MSVCR71.dll__iob]
add edx, 0x20
push edx
push 0x42a0f8
push str.CONOUT_
call esi
add esp, 0x18
call fcn.00416c50
mov esi, eax
mov dword [ebp - 0x154c], esi
mov eax, dword [0x42d420]
test eax, eax
je 0x41ed52
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [ebp - 0x1548]
call fcn.0041c9e0
push 0x4e79
lea eax, [ebp - 0x1548]
push eax
call fcn.0041cb10
add esp, 8
push 1
lea ecx, [ebp - 0x1540]
push ecx
lea ecx, [ebp - 0x1580]
call fcn.0041c000
mov dword [ebp - 0x15b4], eax
mov eax, dword [eax]
mov dword [ebp - 0x15b0], eax
push eax
call dword [sym.imp.MSVCR71.dll_printf]
add esp, 4
mov eax, dword [ebp - 0x1580]
test eax, eax
je 0x41edb6
mov dword [ebp - 0x1570], eax
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [0x42d420]
test eax, eax
je 0x41edc8
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [sym.imp.MSVCR71.dll__iob]
push edx
mov edi, dword [sym.imp.MSVCR71.dll_fclose]
call edi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
call edi
add esp, 8
jmp 0x41f0d2
push 1
push 0x41e0a0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x41ee0b
mov esi, 1
mov dword [ebp - 0x154c], esi
jmp 0x41f0d2
call fcn.00416c50
mov esi, eax
mov dword [ebp - 0x154c], esi
jmp 0x41f0d2
push 0
push 0
push 1
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
call edi
mov dword [0x42d428], eax
test eax, eax
jne 0x41ee46
mov esi, 1
mov dword [ebp - 0x154c], esi
jmp 0x41f0d2
push 0
push 0
push 1
push 0
call edi
mov dword [0x42d42c], eax
test eax, eax
jne 0x41ee69
mov esi, 1
mov dword [ebp - 0x154c], esi
jmp 0x41f0d2
push 0
push 4
mov ecx, 0x42c28c
call fcn.0041da50
mov dword [ebp - 0x1554], eax
mov ecx, dword [0x42d42c]
mov dword [ebp - 0x1564], ecx
mov edx, dword [0x42d428]
mov dword [ebp - 0x1560], edx
push 0x1d4c0
push 0
lea eax, [ebp - 0x1564]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
jne 0x41eed3
call fcn.00416c50
mov ecx, dword [0x42d41c]
test ecx, ecx
je 0x41eec4
call fcn.00420810
push 0xffffffffffffffff
mov ecx, dword [0x42d42c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x42c28c
call fcn.0041daf0
jmp 0x41f0d2
push 0
push 1
push 0x64
push 0x42c28c
call fcn.0041e8f0
push 0
push 1
mov ecx, 0x42c28c
call fcn.0041e5b0
mov esi, eax
mov dword [ebp - 0x154c], esi
test esi, esi
jl 0x41efcc
call fcn.0041d690
test eax, eax
je 0x41f0d2
push 0
mov ecx, 0x42d3f0
call fcn.0041e990
mov esi, eax
mov dword [ebp - 0x154c], esi
test esi, esi
jl 0x41efcc
mov edx, dword [0x42d3f0]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov dword [ebp - 0x1558], eax
push eax
call fcn.0042486e
add esp, 4
mov esi, eax
mov dword [ebp - 0x159c], esi
mov dword [ebp - 0x1550], esi
test esi, esi
jne 0x41ef74
mov esi, 0x8007000e
mov dword [ebp - 0x154c], esi
jmp 0x41efcc
lea eax, [ebp - 0x1558]
push eax
push esi
mov ecx, dword [0x42d3f0]
push ecx
call dword [sym.imp.ADVAPI32.dll_MakeSelfRelativeSD]
test eax, eax
jne 0x41ef9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x154c], esi
jmp 0x41efcc
mov edx, dword [ebp - 0x1558]
push edx
push esi
push str.LaunchPermission
push str.AppID618A40F0_C774_11d2_BD4C_00C04F8EEC44
push SQLAllocConnect
call fcn.0041d5d0
add esp, 0x14
mov esi, eax
mov dword [ebp - 0x154c], esi
test esi, esi
jge 0x41f0d2
push esi
push 0x4e89
lea eax, [ebp - 0xb34]
push eax
call fcn.0041cb10
add esp, 0xc
push 0
lea ecx, [ebp - 0xb2c]
push ecx
lea ecx, [ebp - 0x158c]
call fcn.0041c000
mov dword [ebp - 0x1578], eax
mov eax, dword [eax]
mov dword [ebp - 0x1568], eax
push 0x1030
lea edx, [ebp - 0x120]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x158c]
test eax, eax
je 0x41f0d2
mov dword [ebp - 0x1584], eax
jmp 0x41f0c9
push 0
push ebx
push 0x42c220
mov ecx, 0x42c28c
call fcn.0041d920
push 0
push 0
push 0x64
push 0x42c28c
call fcn.0041e8f0
push 0
push 0
mov ecx, 0x42c28c
call fcn.0041e640
mov esi, eax
mov dword [ebp - 0x154c], esi
test esi, esi
jge 0x41f0d2
push esi
push 0x4e88
lea eax, [ebp - 0xb34]
push eax
call fcn.0041cb10
add esp, 0xc
push 0
lea ecx, [ebp - 0xb2c]
push ecx
lea ecx, [ebp - 0x1598]
call fcn.0041c000
mov dword [ebp - 0x15a4], eax
mov eax, dword [eax]
mov dword [ebp - 0x1590], eax
push 0x1030
lea edx, [ebp - 0x120]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x1598]
test eax, eax
je 0x41f0d2
mov dword [ebp - 0x15a8], eax
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x1550]
test eax, eax
je 0x41f0eb
mov dword [ebp - 0x156c], eax
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x42d428]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41f103
push eax
call edi
mov eax, dword [0x42d420]
test eax, eax
je 0x41f10f
push eax
call edi
mov eax, dword [0x42d42c]
test eax, eax
je 0x41f11b
push eax
call edi
push 0x42d404
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, 0x42c28c
call fcn.0041d9b0
mov dword [ebp - 4], 0xffffffff
jmp 0x41f167
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00424a57
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret