Function at 0x10044688
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x38c], eax
mov eax, dword [ebp + 0x398]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x78], eax
mov eax, dword [0x102dce3c]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x39c]
mov dword [ebp - 0x7c], ebx
cmp eax, ebx
jne 0x100446e5
push str.IsProcessCritical
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [0x102dce3c], eax
cmp eax, ebx
je 0x10044700
cmp dword [ebp - 0x78], ebx
je 0x10044700
lea ecx, [ebp - 0x7c]
push ecx
push dword [ebp - 0x78]
call eax
test eax, eax
je 0x10044700
cmp dword [ebp - 0x7c], ebx
jne 0x10044960
mov eax, dword [0x102dce38]
cmp eax, ebx
jne 0x10044725
push str.ZwQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov dword [0x102dce38], eax
cmp eax, ebx
je 0x10044743
push ebx
push 4
lea ecx, [ebp - 0x80]
push ecx
push 0x1d
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call eax
test eax, eax
jl 0x10044743
cmp dword [ebp - 0x80], ebx
jne 0x10044960
cmp edi, ebx
jne 0x1004474e
xor eax, eax
jmp 0x10044963
push 0x10155e68
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10044747
push str.ntoskrnl.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.ntkrnlmp.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.ntkrnlpa.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.ntkrpamp.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.csrss.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.logonui.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.lsass.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.lsm.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.services.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.smss.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.wininit.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.winlogon.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.msmpeng.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.registry.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
push str.sgrmbroker.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
cmp byte [0x102d2d91], bl
jne 0x10044747
push str.svchost.exe
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10044747
push 0x400
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.10044b80
add esp, 0xc
cmp byte [ebp + 0x3a0], bl
je 0x100448e5
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call fcn.10044535
pop ecx
pop ecx
jmp 0x100448f8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [ebp - 0x74]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x100448ee
cmp byte [ebp - 0x74], bl
je 0x10044747
lea eax, [ebp - 0x74]
push eax
call fcn.10044e58
lea eax, [ebp - 0x74]
mov dword [esp], str._localservicenonetworkfirewall
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
lea eax, [ebp - 0x74]
push str._localservicenonetwork
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
lea eax, [ebp - 0x74]
push str._dcomlaunch
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10044960
lea eax, [ebp - 0x74]
push str._rpcss
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x10044747
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x38c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x390
leave
ret