Function at 0x401bf0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
cmp eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
jle 0x401f18
cmp eax, 2
je 0x401ec8
mov dword [ebp - 0x2c], 0
mov edi, 1
mov dword [ebp - 0x28], 0
jmp 0x401c56
mov dword [0x405008], 1
add edi, 1
cmp dword [ebp - 0x20], edi
jle 0x401d27
mov eax, dword [ebp - 0x1c]
lea esi, [edi*4]
add eax, esi
mov ebx, dword [eax]
mov dword [ebp - 0x24], eax
movzx eax, word [ebx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x401e70
add ebx, 2
mov dword [esp], 0x404024
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x401c9c
test byte [0x403004], 1
jne 0x401d78
mov dword [esp + 4], ebx
mov dword [esp], 0x404028
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x401c40
mov dword [esp + 4], ebx
mov dword [esp], 0x40402c
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x401da8
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + esi + 4]
test ebx, ebx
je 0x401f31
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], 1
test eax, eax
jne 0x401f55
mov eax, dword [0x405004]
mov ecx, dword [section..data]
test eax, eax
je 0x401de0
mov edx, dword [section..bss]
cmp edx, ecx
je 0x401e20
lea ecx, [edx + 1]
add edi, 1
mov dword [eax + edx*4], ebx
add edi, 1
cmp dword [ebp - 0x20], edi
mov dword [section..bss], ecx
jg 0x401c56
mov eax, dword [0x405008]
test eax, eax
jne 0x401e60
call fcn.004015b0
mov ebx, eax
mov edx, dword [0x405004]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], str.argument_T_not_supported_n
mov dword [esp + 8], str.process_arguments
mov dword [esp + 4], 0x403004
mov dword [esp], 0
call fcn.00401500
jmp 0x401c9c
mov dword [esp + 4], ebx
mov dword [esp], 0x404032
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x401e70
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + esi + 4]
test ebx, ebx
je 0x401f31
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 1
jmp 0x401ce3
shl ecx, 2
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [0x405004], eax
test eax, eax
je 0x401e84
mov edx, dword [section..bss]
jmp 0x401d0c
lea ecx, [edx + edx]
shl edx, 3
mov dword [section..data], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x401e84
mov dword [0x405004], eax
jmp 0x401e10
call fcn.00401860
mov ebx, eax
jmp 0x401d3b
mov eax, 0x66
call fcn.00401550
mov eax, 0x65
call fcn.00401550
mov edx, dword [0x405004]
mov dword [esp + 4], 0
mov ebx, 1
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, dword [edx + 4]
movzx eax, word [edx]
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x401c21
add edx, 2
mov dword [esp], 0x404020
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x401c21
mov eax, 0x65
call fcn.00401550
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
mov eax, 0x68
call fcn.00401550
mov eax, 0x65
call fcn.00401550
jmp 0x401e84
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call fcn.004011e0
mov eax, 0x65
call fcn.00401550
jmp 0x401e84
mov eax, 0x6a
call fcn.00401550
mov eax, 0x65
call fcn.00401550
jmp 0x401e84