Function at 0x4201d7
Capabilities:
Accept command line arguments
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x112c
call fcn.00446050
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1128], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
mov dword [esp + 0x34], esi
mov edi, edx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ole32.dll_OleInitialize]
cmp edi, ebx
je 0x4203a9
cmp word [esi + 0x32], 0x18
jne 0x4203a9
push esi
lea edi, [esp + 0x64]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
call fcn.00411e1f
pop ecx
test eax, eax
js 0x4206a3
test dword [esp + 0x80], 0x100
je 0x420271
call fcn.00442f3f
test dword [esp + 0x80], 0x200
push 2
pop esi
je 0x420299
push 4
lea eax, [esp + 0x38]
push eax
push ebx
push dword [0x4507f0]
mov dword [esp + 0x44], esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.004105ea
call fcn.00440baa
test eax, eax
je 0x420309
call fcn.0040add2
test ax, ax
je 0x420309
call fcn.00439974
test ax, ax
je 0x420309
call fcn.004402b1
test ax, ax
je 0x420309
push ebx
call fcn.00439925
pop ecx
push 1
push 0x450760
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp eax, esi
jne 0x4202f2
call fcn.0040eec0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x6c]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea ecx, [esp + 0x60]
call fcn.0040b1fc
mov dword [esp + 0x18], eax
call fcn.00410641
cmp dword [esp + 0x18], 4
jne 0x420329
test byte [esp + 0x80], 4
je 0x420329
push dword [esp + 0x6c]
call fcn.00422fc1
pop ecx
cmp byte [0x450754], bl
je 0x420373
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xd0], eax
xor esi, esi
cmp esi, ebx
jne 0x42038f
lea eax, [esp + 0xc0]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4c]
push eax
push 0x409567
mov dword [esp + 0x58], 1
mov dword [esp + 0x54], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [esp + 0x4c]
cmp esi, ebx
jne 0x42039c
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x8052
push dword [esp + 0x7c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4206a3
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42039c
xor esi, esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x420340
call fcn.00440baa
test eax, eax
je 0x4206a3
lea eax, [esp + 0xd8]
push eax
call fcn.0041525d
lea eax, [esp + 0xd8]
mov dword [esp + 0x24], eax
push eax
mov eax, dword [esp + 0xdc]
mov esi, 0x44a0a0
mov dword [esp + 0x24], esi
call dword [eax + 4]
lea eax, [esp + 0x2c]
push eax
push 1
push 4
lea eax, [esp + 0x2c]
push eax
push 0x449a50
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jns 0x420426
push 0x10
push ebx
push str.register_class_object_failed
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ebx, [esp + 0xd8]
mov dword [esp + 0x20], esi
call fcn.0041565e
or eax, 0xffffffff
jmp 0x4206ad
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov esi, edi
cmp edi, ebx
je 0x420570
movzx eax, word [edi]
push 0x2f
pop ecx
cmp cx, ax
je 0x420460
push 0x22
pop ecx
cmp cx, ax
jne 0x420570
push 0x2f
pop ecx
cmp cx, word [edi + 2]
jne 0x420570
push 0x22
pop ecx
mov dword [esp + 0x28], 1
cmp cx, ax
jne 0x420488
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x28], ebx
je 0x420488
mov esi, dword [eax]
cmp esi, ebx
je 0x420570
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNW]
push 6
push 0x44b1d4
push esi
call edi
test eax, eax
jne 0x4204cf
mov eax, dword [section.Shared]
add esi, 0xc
test eax, eax
je 0x420570
mov eax, 0x4000
mov dword [esp + 0x10], 0x6000001b
mov word [esp + 0x38], ax
mov dword [esp + 0x40], esi
jmp 0x420570
push 5
push str._cmd:
push esi
call edi
test eax, eax
jne 0x420515
lea eax, [esi + 0xa]
push eax
or eax, 0xffffffff
call fcn.0040b782
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x420570
mov eax, dword [section.Shared]
test eax, eax
je 0x420511
push 3
pop eax
mov word [esp + 0x38], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x60000019
jmp 0x420542
xor eax, eax
jmp 0x42056d
push 8
push str._script:
push esi
call edi
test eax, eax
jne 0x420570
mov ecx, dword [section.Shared]
lea eax, [esi + 0x10]
test ecx, ecx
je 0x420548
mov ecx, 0x4000
mov dword [esp + 0x10], 0x6000001a
mov word [esp + 0x38], cx
mov dword [esp + 0x40], eax
jmp 0x420570
push ebx
push 0xffffffffffffffff
push eax
push 0x93ff
push 0x9000
lea ebx, [esp + 0x918]
call fcn.0040bccc
mov dword [esp + 0x30], eax
add esp, 0x14
xor eax, eax
xor ebx, ebx
mov word [esi], ax
lea eax, [esp + 0x284]
call fcn.0042ad7c
push 8
pop edi
or dword [esp + 0x2e8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x2f8], eax
lea eax, [esp + 0x360]
mov dword [esp + 0x298], eax
cmp dword [esp + 0x10], ebx
je 0x4205c7
push ebx
push ebx
push ebx
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0xec]
call fcn.00414878
add esp, 0x14
jmp 0x420663
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], 0x4404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.004105ea
test al, al
je 0x420623
lea edi, [esp + 0x360]
call fcn.00424899
test al, al
je 0x420623
mov eax, dword [esp + 0x30]
test byte [eax + 0x2c], 1
je 0x420607
movzx eax, word [eax + 0x30]
jmp 0x42060a
push 0xa
pop eax
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0xe0]
push esi
call fcn.0041f669
add esp, 0xc
mov dword [esp + 0x18], eax
lea eax, [esp + 0x107c]
call fcn.00407261
lea eax, [esp + 0x360]
call fcn.0042490f
call fcn.00410641
lea edi, [esp + 0x284]
call fcn.00415237
mov esi, edi
call fcn.0042cea5
cmp byte [esp + 0x2ff], 1
jb 0x420663
call dword [sym.imp.UxTheme.dll_BufferedPaintUnInit]
push dword [esp + 0x2c]
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x42067f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x14], ebx
je 0x42068f
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ebx, [esp + 0xd8]
mov dword [esp + 0x20], 0x44a0a0
call fcn.0041565e
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1134]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044552e
mov esp, ebp
pop ebp
ret