Function at 0x401d9d
Capabilities:
Accept command line arguments
Create thread
Query environment variable
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x40f030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0x444], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
push 0x402888
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x402820
push esi
lea eax, [ebp - 0x41c]
push eax
call fcn.00401b0b
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x41c]
push eax
push 0x402814
call esi
lea eax, [ebp - 0x41c]
push eax
push 0x40280c
call esi
push 1
push 0x4027d8
push 0x80000002
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x478], ebx
call fcn.00404509
test eax, eax
je 0x405380
push 0x4027a8
push 8
call fcn.00401d67
pop ecx
pop ecx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x438]
rep stosd dword es:[edi], eax
mov esi, 0x4023d4
lea edi, [ebp - 0x43c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x444]
xor esi, esi
inc esi
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], 0x4023e4
call fcn.004046d1
push 0x402768
push 0x53000001
push esi
push eax
mov dword [0x40f0e0], eax
call fcn.0040465e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ebx
push dword [ebp - 0x444]
mov ecx, 0x40f0e8
push 0x40f040
mov dword [ebp - 0x464], eax
call fcn.0040359a
mov esi, 0x402760
lea edi, [ebp - 0xc]
lea eax, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x464]
movsw word es:[edi], word [esi]
call fcn.00401d05
mov edi, eax
cmp edi, ebx
je 0x401f64
mov esi, dword [sym.imp.msvcrt.dll__wcsnicmp]
push 0xb
push 0x402748
push edi
call esi
add esp, 0xc
test eax, eax
je 0x4053a5
push 9
push 0x402734
push edi
call esi
add esp, 0xc
test eax, eax
je 0x405433
push 0xe
push 0x402714
push edi
call esi
add esp, 0xc
test eax, eax
je 0x4054ba
push 0x10
push 0x4026f0
push edi
call esi
add esp, 0xc
test eax, eax
je 0x4054ba
push 0xa
push 0x4026d8
push edi
call esi
add esp, 0xc
test eax, eax
je 0x4054e5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
cmp eax, ebx
jl 0x405500
push 0x40269c
push 8
call fcn.00401d67
pop ecx
or edi, 0xffffffff
pop ecx
push ebx
push ebx
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x468], edi
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x458], edi
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x450], edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
cmp esi, ebx
jl 0x405515
xor eax, eax
inc eax
push eax
push 2
mov dword [ebp - 0x464], eax
call fcn.00402f2e
mov esi, eax
cmp esi, ebx
jl 0x40552f
call fcn.0040453d
mov esi, eax
cmp esi, ebx
jl 0x405537
push ebx
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x46c]
push eax
push ebx
push 0x40f0e8
push 0x402ae6
push ebx
push ebx
call esi
mov dword [ebp - 0x448], eax
cmp eax, ebx
je 0x4023c7
cmp eax, edi
je 0x4023c7
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
push ebx
call edi
mov dword [ebp - 0x468], eax
cmp eax, ebx
je 0x4023bc
cmp eax, 0xffffffff
je 0x4023bc
lea eax, [ebp - 0x474]
push eax
push ebx
lea eax, [ebp - 0x468]
push eax
push 0x401735
push ebx
push ebx
call esi
mov dword [ebp - 0x440], eax
cmp eax, ebx
je 0x4023b1
cmp eax, 0xffffffff
je 0x4023b1
push ebx
push ebx
push ebx
push ebx
call edi
mov dword [ebp - 0x458], eax
cmp eax, ebx
je 0x4023a6
cmp eax, 0xffffffff
je 0x4023a6
lea ecx, [ebp - 0x494]
mov dword [0x40f118], eax
call fcn.0040303f
mov esi, eax
cmp esi, ebx
jl 0x40553f
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x214]
push eax
push 0xc
mov dword [ebp - 0x460], 0x104
call fcn.00402da9
mov esi, eax
cmp esi, ebx
jl 0x405556
push 0x101fffff
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x494]
call fcn.00402aa5
mov esi, eax
cmp esi, ebx
jl 0x40555e
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x16
mov dword [ebp - 0x460], 0x104
call fcn.00402da9
mov esi, eax
cmp esi, ebx
jl 0x405566
push 0x101fffff
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x494]
call fcn.00402aa5
mov esi, eax
cmp esi, ebx
jl 0x40556e
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x1a
mov dword [ebp - 0x460], 0x104
call fcn.00402da9
mov esi, eax
cmp esi, ebx
jl 0x405576
push 0x101fffff
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x494]
call fcn.00402aa5
mov esi, eax
cmp esi, ebx
jl 0x40557e
mov eax, dword [ebp - 0x494]
push 0x402640
push ebx
xor esi, esi
mov dword [ebp - 0x49c], eax
inc esi
push esi
lea eax, [ebp - 0x4a0]
push eax
mov dword [ebp - 0x4a0], 0xc
mov dword [ebp - 0x498], ebx
call edi
mov dword [ebp - 0x454], eax
cmp eax, ebx
je 0x40239b
cmp eax, 0xffffffff
je 0x40239b
push 0x4025e0
push ebx
push ebx
lea eax, [ebp - 0x4a0]
push eax
call edi
mov dword [ebp - 0x44c], eax
cmp eax, ebx
je 0x402390
cmp eax, 0xffffffff
je 0x402390
push 0x402580
push ebx
push ebx
lea eax, [ebp - 0x4a0]
push eax
call edi
mov dword [ebp - 0x45c], eax
cmp eax, ebx
je 0x402385
cmp eax, 0xffffffff
je 0x402385
push 0x402518
push 8
call fcn.00401d67
pop ecx
pop ecx
push 5
push 4
mov ecx, 0x40f0e8
call fcn.0040351f
mov esi, eax
cmp esi, ebx
jl 0x405586
mov eax, dword [ebp - 0x468]
push 0x2710
mov dword [ebp - 0x470], eax
push 1
lea eax, [ebp - 0x470]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, 0x80070000
cmp eax, 0x102
je 0x40558e
cmp esi, ebx
jl 0x4055a6
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov esi, eax
cmp esi, ebx
jl 0x405746
push 0x4024b8
push 8
call fcn.00401d67
pop ecx
pop ecx
mov ecx, 0x40f0e8
call fcn.0040289b
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x444], esi
jl 0x405751
push 0x402458
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x450], eax
cmp eax, ebx
je 0x40237a
cmp eax, 0xffffffff
je 0x40237a
push dword [ebp - 0x44c]
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
call esi
push dword [ebp - 0x454]
call esi
push 0x4023f8
push 8
call fcn.00401d67
mov eax, dword [ebp - 0x45c]
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x450]
pop ecx
pop ecx
mov dword [ebp - 0x4a4], eax
mov edi, 0x4ff
push 2
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x4ac]
push eax
push 3
call esi
jmp 0x405794
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40580e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40583a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405869
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405873
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40587d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405887
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x405891
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40589b
push 0x40f038
push 0x406650
lea ecx, [ebp - 0x480]
call fcn.00407c92
lea ecx, [ebp - 0x480]
call fcn.00407c1f
jmp 0x401e48
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp edi, ebx
jl 0x405405
push ebx
push ebx
push 0x64
mov esi, 0x40f0e8
push esi
call fcn.0040c81e
cmp eax, ebx
jge 0x4053d7
push eax
push 0x4065e0
push 1
call fcn.00401d67
add esp, 0xc
push ebx
push ebx
mov ecx, esi
call fcn.0040ca6b
mov edi, eax
cmp edi, ebx
jge 0x4053f6
push edi
push 0x406580
push 1
call fcn.00401d67
add esp, 0xc
mov ecx, esi
call fcn.0040a7a9
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x405415
push edi
push 0x406528
push 1
call fcn.00401d67
add esp, 0xc
lea ecx, [ebp - 0x480]
call fcn.00407c1f
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401d55
leave
ret 0x10
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp edi, ebx
jl 0x405405
push ebx
xor edi, edi
inc edi
push edi
push 0x64
mov esi, 0x40f0e8
push esi
call fcn.0040c81e
cmp eax, ebx
jge 0x405467
push eax
push 0x4065e0
push edi
call fcn.00401d67
add esp, 0xc
push ebx
push ebx
mov ecx, esi
call fcn.0040c9ff
cmp eax, ebx
jge 0x405483
push eax
push 0x4064d0
push edi
call fcn.00401d67
add esp, 0xc
push 0x406480
call fcn.0040d704
cmp eax, ebx
jge 0x4054a0
push eax
push 0x406420
push edi
call fcn.00401d67
add esp, 0xc
call fcn.0040abe9
mov edi, eax
cmp edi, ebx
jge 0x4053f6
push edi
push 0x4063c0
jmp 0x4053ec
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
jge 0x4054ce
mov edi, eax
jmp 0x405415
cmp word [edi], 0x52
sete al
movzx eax, al
push eax
call fcn.00408b63
mov edi, eax
jmp 0x4053fd
push 0x406380
push 8
call fcn.00401d67
pop ecx
pop ecx
push 1
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
jmp 0x401f64
push eax
push 0x406310
push 1
call fcn.00401d67
add esp, 0xc
jmp 0x401f74
push esi
push 0x406528
push 0x406300
push 1
call fcn.00401d67
add esp, 0x10
jmp 0x4056e8
push esi
push 0x4062a8
jmp 0x40551b
push esi
push 0x406268
jmp 0x40551b
push esi
push 0x4061f8
push 0x406300
push 1
call fcn.00401d67
add esp, 0x10
jmp 0x4055c5
push esi
push 0x4061a8
jmp 0x405545
push esi
push 0x406138
jmp 0x405545
push esi
push 0x4060e8
jmp 0x405545
push esi
push 0x406078
jmp 0x405545
push esi
push 0x406028
jmp 0x405545
push esi
push 0x405fb8
jmp 0x405545
push esi
push 0x405f60
jmp 0x405545
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40559f
and eax, 0xffff
or eax, edi
mov esi, eax
jmp 0x4022b2
push esi
push 0x405ed8
push 0x406300
push 1
call fcn.00401d67
add esp, 0x10
mov ecx, 0x40f0e8
call fcn.004088af
mov edi, dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp dword [ebp - 0x448], ebx
je 0x4055e8
cmp dword [ebp - 0x448], 0xffffffff
je 0x4055e8
push ebx
push ebx
push 0x12
push dword [ebp - 0x46c]
call edi
cmp dword [ebp - 0x440], ebx
je 0x405605
cmp dword [ebp - 0x440], 0xffffffff
je 0x405605
push ebx
push ebx
push 0x12
push dword [ebp - 0x474]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x44c], ebx
je 0x405630
cmp dword [ebp - 0x44c], 0xffffffff
je 0x405630
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp - 0x44c]
call edi
cmp dword [ebp - 0x45c], ebx
je 0x405649
cmp dword [ebp - 0x45c], 0xffffffff
je 0x405649
push dword [ebp - 0x45c]
call edi
cmp dword [ebp - 0x454], ebx
je 0x405662
cmp dword [ebp - 0x454], 0xffffffff
je 0x405662
push dword [ebp - 0x454]
call edi
cmp dword [ebp - 0x458], ebx
je 0x40567b
cmp dword [ebp - 0x458], 0xffffffff
je 0x40567b
push dword [ebp - 0x458]
call edi
cmp dword [ebp - 0x450], ebx
je 0x405694
cmp dword [ebp - 0x450], 0xffffffff
je 0x405694
push dword [ebp - 0x450]
call edi
cmp dword [ebp - 0x448], ebx
je 0x4056be
cmp dword [ebp - 0x448], 0xffffffff
je 0x4056be
push 0x1f4
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x448]
call edi
cmp dword [ebp - 0x440], ebx
je 0x4056e8
cmp dword [ebp - 0x440], 0xffffffff
je 0x4056e8
push 0x1f4
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x440]
call edi
mov ecx, 0x40f0e8
call fcn.0040a7a9
cmp dword [ebp - 0x464], ebx
je 0x405700
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x405e9c
push 0x53000002
push 1
push dword [0x40f0e0]
call fcn.0040465e
push dword [0x40f0e0]
call fcn.0040dec1
cmp esi, ebx
jl 0x405734
push 0x405e60
push 8
call fcn.00401d67
pop ecx
pop ecx
lea ecx, [ebp - 0x494]
call fcn.00402fef
mov edi, esi
jmp 0x405415
push esi
push 0x405e08
jmp 0x4055ac
push esi
push 0x405dc0
jmp 0x4055ac
cmp eax, 1
je 0x4057e8
cmp eax, 2
jne 0x405784
push 0x405d80
push 8
call fcn.00401d67
pop ecx
pop ecx
push 5
call fcn.0040cdfc
jmp 0x402365
cmp eax, 3
je 0x4057cc
cmp eax, 0xffffffff
jne 0x402365
jmp 0x4057f6
cmp eax, ebx
jne 0x40575c
push 0x405d40
push 8
call fcn.00401d67
pop ecx
pop ecx
call fcn.0040cdb3
mov esi, dword [ebp - 0x444]
jmp 0x4055bb
cmp dword [ebp - 0x4c4], 0x12
je 0x4057ef
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x402365
jmp 0x4057b6
push 0x405d04
jmp 0x40579d
push 0x405cdc
jmp 0x40579d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x405c58
push 8
call fcn.00401d67
add esp, 0xc
jmp 0x4057ab
mov esi, eax
push esi
push 0x405bf8
push 0x406300
push 1
call fcn.00401d67
add esp, 0x10
cmp esi, ebx
jle 0x4055bb
and esi, 0xffff
or esi, edi
jmp 0x4055bb
mov edi, eax
push edi
push 0x405b88
push 0x406300
push esi
call fcn.00401d67
add esp, 0x10
cmp edi, ebx
jg 0x40585b
mov esi, edi
jmp 0x4055c5
and edi, 0xffff
or edi, 0x80070000
jmp 0x405854
mov edi, eax
push edi
push 0x405b20
jmp 0x405842
mov edi, eax
push edi
push 0x405ab8
jmp 0x405842
mov esi, eax
push esi
push 0x405a60
jmp 0x4058a3
mov esi, eax
push esi
push 0x4059e8
jmp 0x4058a3
mov esi, eax
push esi
push 0x405948
jmp 0x4058a3
mov esi, eax
push esi
push 0x4058d0
push 0x406300
push 1
call fcn.00401d67
add esp, 0x10
cmp esi, ebx
jle 0x4055c5
and esi, 0xffff
or esi, 0x80070000
jmp 0x4055c5