Function at 0x1003462
Capabilities:
Accept command line arguments
Create thread
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
xor ebx, ebx
push esi
push edi
push 0x10013c8
push ebx
mov dword [ebp - 0x3c], 0x258
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.0100475e
pop ecx
pop ecx
push ebx
call sub.KERNEL32.dll_SetThreadUILanguage
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
lea eax, [eax*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10034e9
push 0xdb
jmp 0x10039d3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x38]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, 0x12e
push edi
push 0x100cff8
mov dword [0x100cfc0], eax
call fcn.0100313f
test eax, eax
je 0x1003a22
push 0x12f
push 0x100ca20
call fcn.0100313f
test eax, eax
je 0x1003a22
dec dword [ebp - 4]
add dword [ebp - 8], 4
lea eax, [ebp - 0x18]
push eax
push 0x12d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01002fc5
test eax, eax
je 0x10035e3
lea eax, [ebp - 0x3c]
push eax
push 0x131
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01003056
test eax, eax
je 0x10035e3
lea eax, [ebp - 0x28]
push eax
push 0x132
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01002f5b
test eax, eax
je 0x10035e3
lea eax, [ebp - 0x34]
push eax
push 0x133
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01002f5b
test eax, eax
je 0x10035e3
lea eax, [ebp - 0x2c]
push eax
push 0x134
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01002f5b
test eax, eax
je 0x10035e3
lea eax, [ebp - 0x1c]
push eax
push 0x135
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01002f5b
test eax, eax
je 0x10035e3
cmp dword [ebp - 4], ebx
jne 0x10035e3
xor esi, esi
inc esi
jmp 0x10035e5
xor esi, esi
cmp esi, ebx
mov dword [ebp - 0x10], ebx
je 0x100363b
cmp dword [ebp - 0x18], ebx
jne 0x10035fa
mov dword [ebp - 0x10], 3
jmp 0x100362c
push 0x12f
push dword [ebp - 0x18]
call fcn.010030f3
test eax, eax
je 0x1003614
mov dword [ebp - 0x10], 1
jmp 0x100362c
push edi
push dword [ebp - 0x18]
call fcn.010030f3
test eax, eax
je 0x100362a
mov dword [ebp - 0x10], 2
jmp 0x100362c
xor esi, esi
cmp esi, ebx
je 0x100363b
xor eax, eax
cmp dword [ebp - 0x28], ebx
setne al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0xffffffff
jne 0x1003648
or dword [ebp - 0x18], eax
jmp 0x100364b
mov dword [ebp - 0x18], eax
cmp esi, ebx
jne 0x1003659
call fcn.010031b4
jmp 0x10039d9
cmp dword [ebp - 0x2c], ebx
je 0x1003665
mov dword [ebp - 0x34], 1
cmp dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x10]
je 0x1003761
mov esi, dword [sym.imp.USERENV.dll_ForceSyncFgPolicy]
and eax, 1
mov dword [ebp - 0x28], eax
je 0x100369c
push ebx
call esi
cmp eax, ebx
je 0x100369c
push 0x100cbb0
push eax
call fcn.01003281
push eax
push 0xde
jmp 0x10039c6
mov eax, dword [ebp - 0x10]
and eax, 2
mov dword [ebp - 0x10], eax
je 0x10036fd
lea eax, [ebp - 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10036cc
push dword [ebp - 0xc]
call fcn.01002f1f
mov edi, eax
cmp edi, ebx
jne 0x10036d9
push 0x100cbb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100368b
push edi
call esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
je 0x10036f1
push 0x100cbb0
push esi
jmp 0x100368c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], ebx
xor edi, edi
inc edi
mov esi, 0xdd
push esi
call fcn.01003161
cmp dword [ebp - 0x10], ebx
pop ecx
je 0x1003730
cmp dword [ebp - 0x1c], ebx
jne 0x100386b
cmp dword [0x100cfd8], ebx
je 0x1003730
push 0xce
call fcn.01003161
pop ecx
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x28], ebx
je 0x100387f
cmp dword [ebp - 0x1c], ebx
jne 0x1003875
cmp dword [0x100cff0], ebx
je 0x100387f
push 0xcf
call fcn.01003161
pop ecx
mov dword [ebp - 0x40], edi
jmp 0x1003888
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
and eax, 1
mov dword [ebp - 0x28], eax
mov edi, 0x10032a9
je 0x10037c4
mov eax, dword [ebp - 0x20]
push ebx
push ebx
push 0x100cfdc
push edi
mov dword [0x100cfe0], eax
mov eax, dword [ebp - 0x18]
push ebx
push ebx
mov dword [0x100cfdc], 1
mov dword [0x100cfe4], eax
call esi
cmp eax, ebx
mov dword [ebp - 0x48], eax
jne 0x10037bd
push 0x100cbb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01003281
push eax
push 0xd4
jmp 0x10039c6
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x10]
and eax, 2
mov dword [ebp - 0x10], eax
je 0x10037ff
mov eax, dword [ebp - 0x20]
push ebx
push ebx
push 0x100cfc4
push edi
mov dword [0x100cfc8], eax
mov eax, dword [ebp - 0x18]
push ebx
push ebx
mov dword [0x100cfc4], ebx
mov dword [0x100cfcc], eax
call esi
cmp eax, ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x48], eax
je 0x10037a1
inc dword [ebp - 0x14]
push 0xc9
call fcn.01003161
pop ecx
push 0xffffffffffffffff
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, ebx
je 0x1003829
cmp eax, edi
jne 0x10037a1
cmp dword [ebp - 0x10], ebx
je 0x1003843
push 0x100cfc4
call fcn.010033dc
cmp dword [0x100cfd4], ebx
je 0x1003843
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x28], ebx
je 0x100385d
push 0x100cfdc
call fcn.010033dc
cmp dword [0x100cfec], ebx
je 0x100385d
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jne 0x10039d9
jmp 0x1003700
push 0xdf
jmp 0x1003727
push 0xe0
jmp 0x1003753
cmp dword [ebp - 0x30], ebx
je 0x10039d9
push esi
call fcn.01003161
cmp dword [ebp - 0x40], ebx
pop ecx
je 0x1003984
cmp dword [ebp - 0x2c], ebx
jne 0x10038ab
push edi
call fcn.010031ca
cmp eax, ebx
je 0x1003984
lea eax, [ebp - 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10038de
push 0x100cbb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01003281
push eax
push 0xd5
jmp 0x10039c6
push 2
pop esi
lea eax, [ebp - 0x54]
push eax
push 0x10013a0
push ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10038c2
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x10
lea eax, [ebp - 0x58]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10038c2
push 0xd7
call fcn.01003161
pop ecx
push ebx
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xd5
jne 0x1003953
push 0x100cbb0
call esi
push eax
call fcn.01003281
push eax
push edi
call fcn.01003161
pop ecx
jmp 0x100395d
push 0xd9
call fcn.01003161
pop ecx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10039d9
push 0x100cbb0
call esi
push eax
call fcn.01003281
push eax
push edi
jmp 0x10039c6
cmp dword [ebp - 0x30], ebx
je 0x10039d9
cmp dword [ebp - 0x34], ebx
jne 0x1003998
push ebx
call fcn.010031ca
cmp eax, ebx
je 0x10039d9
push 0xd8
call fcn.01003161
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x10039ce
push 0x100cbb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01003281
push eax
push 0xd6
call fcn.01003161
pop ecx
jmp 0x10039d8
push 0xda
call fcn.01003161
pop ecx
cmp dword [ebp - 0xc], ebx
je 0x10039e7
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x1003a06
mov edi, dword [ebp - 0x14]
lea esi, [ebp + edi*4 - 0x4c]
mov eax, dword [esi]
cmp eax, ebx
je 0x1003a00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esi, 4
dec edi
jne 0x10039f3
cmp dword [ebp - 0x38], ebx
je 0x1003a14
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], ebx
je 0x1003a22
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret