Function at 0x402ab6
Capabilities:
Accept command line arguments
Create process on windows
Link many functions at runtime
Shutdown system
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x4b0]
sub esp, 0x530
mov eax, dword [0x40d2f0]
xor eax, ebp
mov dword [ebp + 0x4ac], eax
push ebx
push esi
push edi
xor esi, esi
inc esi
push 4
mov dword [ebp - 0x6c], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov al, byte [edi]
xor ebx, ebx
mov dword [ebp - 0x60], edi
cmp al, 0x22
jne 0x402b19
jmp 0x402afb
cmp al, 0x22
je 0x402b09
inc edi
mov al, byte [edi]
mov dword [ebp - 0x60], edi
cmp al, bl
jne 0x402af7
cmp al, 0x22
jne 0x402b1d
inc edi
mov dword [ebp - 0x60], edi
jmp 0x402b1d
cmp al, 0x20
je 0x402b22
inc edi
mov al, byte [edi]
mov dword [ebp - 0x60], edi
cmp al, bl
jne 0x402b0f
cmp byte [edi], 0x20
jne 0x402b2b
inc edi
cmp byte [edi], 0x20
je 0x402b22
mov dword [ebp - 0x60], edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [edi], 0x2f
mov dword [ebp - 0x5c], eax
jne 0x402ba7
mov al, byte [edi + 1]
cmp al, 0x53
je 0x402b45
cmp al, 0x73
jne 0x402b4b
mov dword [0x40e8b8], esi
mov al, byte [edi + 1]
cmp al, 0x4d
je 0x402b56
cmp al, 0x6d
jne 0x402b62
cmp byte [edi + 2], 0x34
jne 0x402b62
mov dword [0x40e854], esi
mov al, byte [edi + 1]
cmp al, 0x58
je 0x402b6d
cmp al, 0x78
jne 0x402b88
mov al, byte [edi + 2]
cmp al, 0x3d
je 0x402b7c
cmp al, 0x31
je 0x402b7c
cmp al, 0x32
jne 0x402b88
mov dword [0x40e82c], esi
mov dword [0x40e854], esi
mov al, byte [edi + 1]
cmp al, 0x4d
je 0x402b93
cmp al, 0x6d
jne 0x402ba7
cmp byte [edi + 2], 0x35
jne 0x402ba7
cmp byte [edi + 3], 0x3d
jne 0x402ba7
lea eax, [edi + 4]
mov dword [0x40e830], eax
push 0x100
lea eax, [ebp + 0x12c]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, edi
cmp byte [edi], bl
je 0x402bcc
cmp byte [eax], 0x7f
je 0x402bcc
inc eax
cmp byte [eax], bl
jne 0x402bc2
cmp byte [eax], bl
je 0x402c02
mov byte [eax], bl
inc eax
xor edx, edx
jmp 0x402be7
cmp cl, 0x20
je 0x402bed
imul edx, edx, 0xa
movsx ecx, cl
lea edx, [edx + ecx - 0x30]
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x402bd7
add dword [0x40d178], edx
inc eax
push eax
lea eax, [ebp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [0x40e8a0], eax
jge 0x402c42
lea eax, [ebp + 0x12c]
push eax
call fcn.004026ee
pop ecx
mov ecx, dword [ebp + 0x4ac]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00403145
add ebp, 0x4b0
leave
ret 0x10
call section..text
mov eax, dword [0x40d178]
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push ebx
push eax
push dword [0x40e8a0]
lea ecx, [ebp + 0x12c]
mov dword [0x40e884], ebx
mov dword [0x40e894], eax
mov dword [0x40e88c], eax
mov dword [0x40e93c], ecx
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll__lread]
lea eax, [ebp - 0x55]
push eax
push dword [0x40e8a0]
call esi
cmp byte [ebp - 0x55], bl
je 0x402ce9
movzx eax, byte [ebp - 0x55]
push eax
lea eax, [ebp + 0x3ac]
push eax
push dword [0x40e8a0]
call esi
push 4
lea eax, [ebp - 0x70]
push eax
push dword [0x40e8a0]
call esi
push ebx
lea eax, [ebp + 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, ebx
mov dword [ebp - 0x64], eax
jl 0x402ce3
push 2
push ebx
push eax
call edi
cmp dword [ebp - 0x70], eax
je 0x402cd8
mov byte [ebp + 0x3ac], bl
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll__lclose]
jmp 0x402ce9
mov byte [ebp + 0x3ac], bl
push 4
push 0x40e8c0
push dword [0x40e8a0]
call esi
push 0xc
push 0x40e840
push dword [0x40e8a0]
call esi
push 8
push 0x40e91c
push dword [0x40e8a0]
call esi
push 0x48
push 0x40e8d4
push dword [0x40e8a0]
call esi
push 3
push 0x40e850
push dword [0x40e8a0]
call esi
test dword [0x40e8c0], 0x40000000
je 0x402d4a
mov dword [0x40e854], 1
lea eax, [ebp - 0x54]
mov dword [0x40e860], eax
movzx eax, byte [0x40e852]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [0x40e8a0]
call esi
mov eax, dword [0x40e910]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x40e940], 0x401f71
mov dword [0x40e944], 0x401193
mov dword [0x40e828], 0x40279f
jle 0x402dca
inc eax
push eax
push 2
call esi
push eax
mov dword [0x40e930], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push dword [0x40e90c]
mov dword [0x40e934], eax
push ebx
push dword [0x40e8a0]
mov dword [0x40e938], eax
call fcn.00401f71
mov dword [0x40e938], ebx
jmp 0x402dd4
mov dword [0x40e854], 1
test dword [0x40e8c0], 0x1000
je 0x402de7
mov byte [0x40e8c4], 1
push dword [ebp - 0x5c]
call fcn.00402833
pop ecx
test eax, eax
je 0x402c26
push dword [ebp - 0x5c]
call fcn.00402892
pop ecx
test eax, eax
je 0x402c26
mov eax, dword [0x40e950]
mov dword [0x40e880], eax
mov eax, dword [ebp - 0x5c]
mov dword [0x40e888], eax
mov dword [0x40e924], 0x40e840
cmp dword [0x40e908], ebx
je 0x402e89
push 1
push ebx
push dword [0x40e8a0]
call edi
push 2
push ebx
push dword [0x40e8a0]
mov dword [ebp - 0x64], eax
call edi
push ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x5c], eax
push dword [0x40e8a0]
call edi
mov eax, dword [0x40e908]
cmp dword [ebp - 0x5c], eax
je 0x402e89
push dword [ebp - 0x5c]
push eax
lea eax, [ebp + 0x22c]
push str.File_size_expected_ld__size_returned_ld.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x22c]
push eax
call fcn.004026ee
add esp, 0x14
jmp 0x402c26
mov eax, dword [0x40e8d4]
inc eax
push eax
push 2
call esi
push eax
mov dword [0x40e928], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push dword [0x40e8d8]
mov dword [0x40e92c], eax
push ebx
push dword [0x40e8a0]
mov dword [0x40e938], eax
call fcn.00401f71
mov dword [0x40e938], ebx
cmp byte [ebp - 0x55], bl
jne 0x402f22
lea eax, [ebp + 0x3ac]
push eax
call fcn.00402621
pop ecx
push ebx
lea eax, [ebp + 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, dword [sym.imp.KERNEL32.dll__lclose]
push eax
call esi
push 2
lea eax, [ebp + 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov edi, eax
cmp edi, ebx
jge 0x402f0c
lea eax, [ebp + 0x3ac]
jmp 0x402c1f
push ebx
push dword [0x40e8dc]
push edi
push dword [0x40e8a0]
call fcn.00401f71
push edi
call esi
xor edi, edi
inc edi
lea eax, [ebp + 0x3ac]
mov dword [ebp - 0x68], edi
mov byte [ebp + 0x32c], bl
push eax
cmp byte [0x40e8a8], bl
je 0x402f63
lea eax, [ebp + 0x22c]
push str.Could_not_extract_Wise0132.dll_to__s__CRC_does_not_match.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x22c]
push eax
call fcn.004026ee
add esp, 0x10
jmp 0x403023
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x402fc6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WiseMain
push esi
call edi
push str.UpdateScreen
push esi
mov dword [0x40e824], eax
call edi
push str.DisplayGraphics
push esi
mov dword [0x40e84c], eax
call edi
push str.DiskPrompt
push esi
mov dword [0x40e858], eax
call edi
push str.FileWrite
push esi
mov dword [0x40e94c], eax
call edi
push str.HandleFtp
push esi
mov dword [0x40e828], eax
call edi
xor edi, edi
mov dword [0x40e85c], eax
inc edi
mov eax, dword [0x40e824]
cmp eax, ebx
jne 0x402ffa
cmp byte [ebp - 0x55], bl
je 0x402fed
push ebx
push str.Install
push str.Demo_installations_only_run_on_the_computer_they_were_created_on.
push dword [0x40e950]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403023
push str.System_DLLs_corrupt_or_missing.
call fcn.004026ee
pop ecx
jmp 0x403023
lea ecx, [ebp + 0xac]
push ecx
lea ecx, [ebp + 0x32c]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp - 0x60]
push 0x40e880
call eax
movzx eax, ax
push esi
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00401083
cmp byte [ebp - 0x55], bl
jne 0x403046
push 0x200
lea eax, [ebp + 0x2a4]
push eax
lea eax, [ebp + 0x3ac]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov eax, dword [0x40e8cc]
cmp eax, ebx
je 0x403056
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x68], edi
je 0x4030cf
lea eax, [ebp + 0x298]
push eax
mov dword [ebp + 0x298], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x64]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4030b4
lea eax, [ebp - 0x7c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push dword [ebp - 0x64]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x74], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 2
pop eax
cmp dword [ebp + 0x2a8], eax
jne 0x4030c7
cmp dword [ebp - 0x68], 0x42
jne 0x4030c7
xor eax, eax
push ebx
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp byte [ebp + 0x32c], bl
je 0x4030e6
push 5
lea eax, [ebp + 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]