Function at 0x401000
Capabilities:
Acquire debug privileges

Disassembly:
cmp dword [esp + 4], 4
push ebx
push ebp
push esi
push edi
je 0x4010dd
cmp dword [esp + 0x14], 3
jne 0x401161
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.MSVCRT.dll__strcmpi]
push str._Check
push dword [esi + 8]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40106d
push dword [esi + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov esi, eax
call fcn.004050f3
test al, al
je 0x401276
push 1
push str.SeDebugPrivilege
call fcn.00405775
push 1
push str.SeSecurityPrivilege
call fcn.00405775
push esi
call fcn.004012b1
jmp 0x4010d5
push str._Deny
push dword [esi + 8]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40108a
push dword [esi + 4]
call fcn.0040638b
jmp 0x401275
push str._Del
push dword [esi + 8]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x401276
push dword [esi + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov esi, eax
call fcn.004050f3
test al, al
je 0x401276
push 1
push str.SeDebugPrivilege
call fcn.00405775
push 1
push str.SeSecurityPrivilege
call fcn.00405775
push esi
call fcn.00401e93
add esp, 0x14
jmp 0x401276
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 4]
push dword [esi + 8]
mov dword [esp + 0x18], eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov edi, dword [sym.imp.MSVCRT.dll__strcmpi]
push 1
pop ebp
mov dword [esp + 0x1c], eax
mov dword [esp], str._DisableClr
push dword [esi + 0xc]
call edi
pop ecx
mov ebx, str._Disablemscorsec
test eax, eax
pop ecx
je 0x401169
push ebx
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x401169
push str._Disablemscoreei
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x401169
push str._Disable
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x401169
push str._Infect
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x401169
push str._Replace
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
je 0x401169
or eax, 0xffffffff
jmp 0x401278
push ebx
push dword [esi + 0xc]
call edi
pop ecx
pop ecx
push 5
test eax, eax
pop ebx
jne 0x40117c
push 2
jmp 0x4011ca
push str._Disablemscoreei
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x401190
push 3
jmp 0x4011ca
push str._Disable
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x4011a4
push 4
jmp 0x4011ca
push str._Infect
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x4011b8
mov ebp, ebx
jmp 0x4011cb
push str._Replace
push dword [esi + 0xc]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x4011cb
push 6
pop ebp
call fcn.004050f3
test al, al
je 0x401276
push 1
push str.SeDebugPrivilege
call fcn.00405775
pop ecx
cmp bp, bx
pop ecx
je 0x401210
cmp bp, 6
je 0x401210
mov eax, dword [esp + 0x18]
test ax, ax
jbe 0x401276
cmp ax, 0xffff
ja 0x401276
push ebp
push eax
push dword [esp + 0x1c]
call fcn.004049d1
add esp, 0xc
jmp 0x401276
push 1
push str.SeSecurityPrivilege
call fcn.00405775
mov edi, dword [esp + 0x20]
pop ecx
test di, di
pop ecx
jbe 0x401252
cmp di, 0xffff
ja 0x401252
push edi
cmp bp, bx
push dword [esp + 0x18]
jne 0x40124b
call fcn.004048ec
pop ecx
test al, al
pop ecx
je 0x401276
push edi
call fcn.00401e93
jmp 0x401275
call fcn.00404807
jmp 0x401274
mov esi, dword [esi + 8]
test di, di
je 0x401265
push esi
call fcn.0040127d
test al, al
pop ecx
jne 0x401276
cmp bp, bx
jne 0x401276
push esi
push dword [esp + 0x18]
call fcn.00404083
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret