Function at 0x41beb9
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435560
push 0x430050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
movsx eax, byte [0x43bbd0]
push eax
push 0x5f79ffff
call fcn.00411e04
mov word [0x43bbda], ax
movsx eax, byte [0x43bbcd]
push eax
push 0xc5dffff
call fcn.00411e4a
add esp, 0x10
add dword [0x43bc04], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x41c0d6
movsx eax, byte [0x43bbd1]
push eax
push dword [0x43bc08]
call fcn.00411cd8
mov dword [0x43bbfc], eax
xor eax, eax
cmp word [0x43bbd6], bx
setne al
add word [0x43bbd8], ax
movsx eax, byte [0x43bbce]
push eax
push 0xb7e5ffff
call fcn.00411e04
add dword [0x43bbfc], eax
mov dword [ebp - 0x20], ebx
push 0x9b5ffff
movsx eax, byte [0x43bbcb]
push eax
call fcn.00411e04
add esp, 0x18
mov byte [0x43bbd0], al
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x41c0d6
push 0x117ffff
push 0xda3fffff
call fcn.00411e4a
pop ecx
pop ecx
add byte [0x43bbd1], al
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x41c0d6
mov edi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call edi
mov dword [0x43bbf8], eax
movsx eax, byte [0x43bbca]
and eax, 0x91b9ffff
add dword [0x43bbe8], eax
push 0x4e
call fcn.004163e0
pop ecx
call eax
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x41c006
push esi
call fcn.0041d302
pop ecx
mov dword [ebp - 0x1c], eax
jmp 0x41c009
mov dword [ebp - 0x1c], esi
dec byte [0x43bbc9]
push 0x40
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
call esi
test eax, eax
jne 0x41c0d6
push 0x4111ffff
push dword [0x43bc00]
call fcn.00411e04
add word [0x43bbe4], ax
movsx eax, byte [0x43bbd0]
push eax
push 0xd87dffff
call fcn.00411cac
add esp, 0x10
add byte [0x43bbce], al
mov eax, dword [ebp - 0x1c]
cmp word [eax], 0x5a4d
jne 0x41c0d6
mov dword [0x43bbec], 0x934e0001
push dword [eax + 0x3c]
push eax
call fcn.0041be6d
mov dword [ebp - 0x24], eax
push 0x2747ffff
push 0x5b15ffff
call fcn.00411d58
add esp, 0x10
mov byte [0x43bbcc], al
push 0xf8
push dword [ebp - 0x24]
call esi
test eax, eax
jne 0x41c0d6
movsx ax, byte [0x43bbcf]
and ax, word [0x43bbe4]
add word [0x43bbd2], ax
push 0xcf95ffff
movsx eax, word [0x43bbe0]
push eax
call fcn.00411c25
pop ecx
pop ecx
add dword [0x43bc04], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0x4550
je 0x41c0dd
xor eax, eax
jmp 0x41cbe9
mov al, byte [0x43bbe0]
inc al
mov byte [0x43bbcf], al
push 0xef6fffff
push 0x2d61ffff
call fcn.00411d90
mov byte [0x43bbce], al
push dword [0x43bc00]
movsx eax, byte [0x43bbc8]
push eax
call fcn.00411dc3
add word [0x43bbe0], ax
mov eax, dword [ebp - 0x24]
push dword [eax + 0x80]
push dword [ebp - 0x1c]
call fcn.0041be6d
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0xbc81ffff
push 0x2da9ffff
call fcn.00411e4a
add esp, 0x20
add word [0x43bbde], ax
cmp esi, dword [ebp - 0x1c]
je 0x41c553
push dword [0x43bc04]
push 0x62b7ffff
call fcn.00411e04
mov byte [0x43bbca], al
movsx eax, word [0x43bbde]
push eax
push 0xfa2fffff
call fcn.00411d1f
add esp, 0x10
mov word [0x43bbde], ax
cmp esi, dword [ebp - 0x24]
je 0x41c553
movsx ax, byte [0x43bbc9]
sub word [0x43bbde], ax
mov dword [ebp - 4], ebx
push dword [0x43bc00]
push 0x5619ffff
call fcn.00411d90
pop ecx
pop ecx
add dword [0x43bbe8], eax
call edi
add byte [0x43bbc8], al
cmp dword [esi + 0xc], ebx
je 0x41c2d6
push 1
pop edi
mov dword [ebp - 4], edi
push 0x7ef3ffff
push 0x4a9ffff
call fcn.00411e04
add word [0x43bbd6], ax
push dword [esi + 0xc]
push dword [ebp - 0x1c]
call fcn.0041be6d
mov dword [ebp - 0x38], eax
push 0x2bc9ffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411d58
add esp, 0x18
add word [0x43bbe4], ax
lea eax, [ebp - 0x34]
push eax
push 4
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.004163e0
pop ecx
call eax
mov dword [ebp - 0x3c], eax
dec word [0x43bbda]
mov eax, dword [0x43bbe8]
imul eax, eax, 0x8583ffff
mov dword [0x43bc00], eax
push dword [ebp + 0xc]
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41c39f
cmp byte [0x43bbcc], al
je 0x41c263
cmp byte [0x43bbd1], al
je 0x41c263
mov eax, edi
jmp 0x41c265
xor eax, eax
add dword [0x43bc0c], eax
movsx eax, byte [0x43bbcd]
push eax
push 0xee67ffff
call fcn.00411d90
add word [0x43bbd6], ax
push dword [0x43bc08]
push 0xc03dffff
call fcn.00411cac
add esp, 0x10
mov dword [0x43bbf0], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x5f
call fcn.004163e0
pop ecx
call eax
mov byte [0x43bbc9], 1
push dword [0x43bbe8]
push 0xf367ffff
call fcn.00411d90
pop ecx
pop ecx
add word [0x43bbdc], ax
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xc], ebx
je 0x41c553
push dword [esi + 0x10]
push dword [ebp - 0x1c]
call fcn.0041be6d
pop ecx
pop ecx
mov esi, eax
mov ax, word [0x43bbd8]
add word [0x43bbd4], ax
movsx eax, word [0x43bbd2]
movsx ecx, byte [0x43bbca]
imul eax, ecx
movsx ecx, byte [0x43bbd0]
add ecx, dword [0x43bc0c]
lea eax, [ecx + eax - 0x5e35ffff]
mov dword [0x43bc0c], eax
cmp dword [esi], ebx
je 0x41c553
push 0x4a27ffff
movsx eax, byte [0x43bbca]
push eax
call fcn.00411cac
mov word [0x43bbda], ax
movsx ax, byte [0x43bbcf]
sub word [0x43bbde], ax
push 0x7ae1ffff
push 0x209dffff
call fcn.00411cd8
add esp, 0x10
add byte [0x43bbca], al
mov eax, dword [esi]
cmp eax, dword [ebp - 0x28]
je 0x41c43b
add esi, 4
cmp word [0x43bbd4], bx
jne 0x41c42d
cmp word [0x43bbe2], bx
jne 0x41c42d
xor eax, eax
jmp 0x41c430
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 0x20
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], ebx
jmp 0x41c3ff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43bbf8], eax
push dword [0x43bc00]
push 0x5d1fffff
call fcn.00411d58
pop ecx
pop ecx
mov word [0x43bbe4], ax
add esi, 0x14
mov dword [ebp - 0x2c], esi
jmp 0x41c1ba
push 1
pop eax
add byte [0x43bbd1], al
jmp 0x41c329
or byte [0x43bbce], 0xff
dec word [0x43bbe2]
lea eax, [ebp - 0x40]
push eax
push 4
push 4
push esi
push 0x5f
call fcn.004163e0
pop ecx
call eax
mov edi, eax
push dword [0x43bbf4]
push 0x52b9ffff
call fcn.00411dc3
pop ecx
pop ecx
add byte [0x43bbc8], al
cmp edi, ebx
je 0x41c4ec
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
push 0x9f13ffff
movsx eax, byte [0x43bbcd]
push eax
call fcn.00411d58
pop ecx
pop ecx
mov word [0x43bbe0], ax
cmp dword [0x43bbe8], ebx
setne al
mov byte [0x43bbcb], al
movsx eax, word [0x43bbd6]
mov ecx, 0x72f3ffff
sub ecx, eax
add dword [0x43bbec], ecx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 4
push esi
push 0x5f
call fcn.004163e0
pop ecx
call eax
push 0x70c7ffff
push 0x2977ffff
call fcn.00411e04
pop ecx
pop ecx
mov word [0x43bbda], ax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
movsx eax, word [0x43bbd8]
push eax
push dword [0x43bbf0]
call fcn.00411d58
mov word [0x43bbe4], ax
mov eax, dword [0x43bc08]
inc eax
add word [0x43bbd6], ax
push 0xd65fffff
push 0x3bdfffff
call fcn.00411d58
add esp, 0x10
mov byte [0x43bbd0], al
jmp 0x41c553
cmp word [0x43bbd8], bx
jne 0x41c56c
cmp byte [0x43bbca], 0
mov word [0x43bbdc], bx
je 0x41c575
mov word [0x43bbdc], 1
push 0x28dffff
push 0x18f1ffff
call fcn.00411d1f
mov byte [0x43bbcc], al
dec byte [0x43bbcd]
mov eax, dword [0x43bbf4]
add eax, 0xaf81ffff
mov dword [0x43bc00], eax
inc dword [0x43bbf4]
push dword [0x43bbfc]
push 0x1923ffff
call fcn.00411cac
add dword [0x43bbfc], eax
mov esi, dword [ebp - 0x24]
push dword [esi + 0xe0]
push dword [ebp - 0x1c]
call fcn.0041be6d
mov edi, eax
mov dword [ebp - 0x48], edi
push 0xefb5ffff
push 0x7909ffff
call fcn.00411d90
mov word [0x43bbda], ax
mov word [0x43bbe4], 0xfffe
push dword [0x43bc08]
push dword [0x43bc0c]
call fcn.00411e4a
add esp, 0x28
add byte [0x43bbcd], al
cmp edi, dword [ebp - 0x1c]
je 0x41cbad
push 0x4ce3ffff
movsx eax, word [0x43bbde]
push eax
call fcn.00411cd8
pop ecx
pop ecx
add dword [0x43bc08], eax
mov al, byte [0x43bbd6]
or al, byte [0x43bc04]
add byte [0x43bbca], al
xor eax, eax
cmp word [0x43bbd4], ax
jne 0x41c655
cmp word [0x43bbdc], ax
mov dword [0x43bc0c], eax
je 0x41c65f
mov dword [0x43bc0c], 1
cmp edi, esi
je 0x41cbad
call dword [sym.imp.USER32.dll_GetFocus]
mov byte [0x43bbcf], al
push 2
pop esi
mov dword [ebp - 4], esi
cmp dword [edi + 4], 0
je 0x41c795
push 0x5e81ffff
push 0x7c9dffff
call fcn.00411d90
add byte [0x43bbce], al
push 0x2e27ffff
push 0xf1f1ffff
call fcn.00411dc3
add esp, 0x10
add byte [0x43bbc9], al
mov dword [ebp - 4], 3
push dword [edi + 4]
push dword [ebp - 0x1c]
call fcn.0041be6d
mov dword [ebp - 0x58], eax
push 0x703fffff
push dword [0x43bc04]
call fcn.00411e4a
add esp, 0x10
mov word [0x43bbd8], ax
lea eax, [ebp - 0x54]
push eax
push 4
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.004163e0
pop ecx
call eax
mov dword [ebp - 0x5c], eax
push dword [ebp + 0xc]
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x41c819
push 0x8625ffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411d1f
mov word [0x43bbe4], ax
push 0x83ffff
movsx eax, ax
push eax
call fcn.00411e04
mov word [0x43bbd8], ax
push 0xa005ffff
push 0x894dffff
call fcn.00411d1f
add esp, 0x18
add word [0x43bbe4], ax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.004163e0
pop ecx
call eax
movsx eax, byte [0x43bbcd]
and eax, 0xc28dffff
mov dword [0x43bbf4], eax
movsx eax, word [0x43bbda]
push eax
push 0xefc9ffff
call fcn.00411dc3
pop ecx
pop ecx
mov byte [0x43bbcd], al
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
movsx eax, word [0x43bbd2]
push eax
movsx eax, byte [0x43bbcc]
push eax
call fcn.00411d1f
mov word [0x43bbd6], ax
push 0x9d0bffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411cd8
add esp, 0x10
add byte [0x43bbd1], al
mov dword [0x43bbf4], 0xcf77ffff
cmp dword [edi + 4], 0
je 0x41cbad
movsx eax, byte [0x43bbc8]
push eax
push dword [0x43bc0c]
call fcn.00411d1f
pop ecx
pop ecx
mov dword [0x43bbec], eax
cmp dword [0x43bbe8], 0
jne 0x41c87c
cmp byte [0x43bbd0], 0
jne 0x41c87c
and word [0x43bbe2], 0
jmp 0x41c885
mov al, byte [0x43bbd8]
mov byte [0x43bbcf], al
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 0x20
lea eax, [ebp - 0x58]
push eax
push 0x5f
call fcn.004163e0
pop ecx
call eax
mov dword [ebp - 4], esi
jmp 0x41c871
add edi, 0x20
mov dword [ebp - 0x48], edi
jmp 0x41c678
mov word [0x43bbe2], 1
push dword [edi + 0x10]
push dword [ebp - 0x1c]
call fcn.0041be6d
pop ecx
pop ecx
mov esi, eax
xor ebx, ebx
cmp dword [esi], 0
je 0x41cb36
sub dword [0x43bc04], 0xc000001
push 0x4ce5ffff
push 0x9177ffff
call fcn.00411d1f
add byte [0x43bbd0], al
push 0xc101ffff
push 0x21fbffff
call fcn.00411dc3
add esp, 0x10
add byte [0x43bbcf], al
test byte [esi + 3], 0x80
je 0x41c918
push 0x536dffff
movsx eax, word [0x43bbdc]
push eax
call fcn.00411e4a
add word [0x43bbd8], ax
inc dword [0x43bc00]
push 0x42d9ffff
movsx eax, byte [0x43bbd0]
push eax
call fcn.00411e4a
add esp, 0x10
add byte [0x43bbcc], al
jmp 0x41c98a
xor eax, eax
cmp byte [0x43bbce], al
setne al
add dword [0x43bbf0], eax
mov eax, dword [esi]
movsx ecx, byte [0x43bbc8]
or ecx, 0xfd95ffff
add dword [0x43bbfc], ecx
add eax, 2
push eax
push dword [ebp - 0x1c]
call fcn.0041be6d
mov dword [ebp - 0x60], eax
mov ax, word [0x43bbda]
add word [0x43bbde], ax
movsx eax, byte [0x43bbca]
push eax
push 0x427bffff
call fcn.00411cac
mov dword [0x43bbf0], eax
inc dword [0x43bbf4]
push dword [ebp + 0x10]
push dword [ebp - 0x60]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x18
test eax, eax
je 0x41c9cd
movsx eax, word [0x43bbda]
push eax
movsx eax, byte [0x43bbca]
push eax
call fcn.00411d90
mov byte [0x43bbd0], al
or word [0x43bbe0], 0xffff
push 0x981fffff
push 0xa99fffff
call fcn.00411c63
add esp, 0x10
add dword [0x43bc04], eax
add esi, 4
inc ebx
jmp 0x41c896
push 0xe463ffff
push 0xbb61ffff
call fcn.00411dc3
mov word [0x43bbdc], ax
mov al, byte [0x43bbcf]
neg al
mov byte [0x43bbca], al
push dword [0x43bc0c]
push dword [0x43bc04]
call fcn.00411d90
add dword [0x43bbf4], eax
push dword [edi + 0xc]
push dword [ebp - 0x1c]
call fcn.0041be6d
mov esi, eax
push dword [0x43bc0c]
push 0x7ff9ffff
call fcn.00411cd8
add dword [0x43bbe8], eax
push 0xb753ffff
movsx eax, word [0x43bbd4]
push eax
call fcn.00411c63
add esp, 0x28
add word [0x43bbe0], ax
dec byte [0x43bbca]
lea esi, [esi + ebx*4]
lea eax, [ebp - 0x68]
push eax
push 4
push 4
push esi
push 0x5f
call fcn.004163e0
pop ecx
call eax
inc word [0x43bbd8]
mov dword [0x43bc08], 0xeafe0001
test eax, eax
je 0x41cb36
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
push 0x7ec9ffff
push 0x48cdffff
call fcn.00411e4a
pop ecx
pop ecx
add byte [0x43bbc8], al
mov al, byte [0x43bbd1]
shl al, 1
add al, byte [0x43bbc8]
mov byte [0x43bbd1], al
call dword [sym.imp.USER32.dll_GetInputState]
add byte [0x43bbcc], al
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x68]
push 4
push esi
push 0x5f
call fcn.004163e0
pop ecx
call eax
movsx eax, byte [0x43bbc9]
push eax
push 0x8f3ffff
call fcn.00411c25
pop ecx
pop ecx
mov dword [0x43bbe8], eax
xor eax, eax
cmp word [0x43bbe0], ax
setne al
mov word [0x43bbd4], ax
mov byte [0x43bbd0], 1
cmp dword [ebp - 0x20], 0
jne 0x41cb05
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
push dword [0x43bbfc]
push 0x36c3ffff
call fcn.00411e04
add byte [0x43bbd1], al
push 0x4229ffff
movsx eax, word [0x43bbe4]
push eax
call fcn.00411dc3
add esp, 0x10
add dword [0x43bc00], eax
push 0xcd63ffff
push 0x3405ffff
call fcn.00411e04
mov dword [0x43bbf8], eax
push 0x2cf3ffff
push 0xcf7ffff
call fcn.00411dc3
add esp, 0x10
mov dword [0x43bbf4], eax
jmp 0x41cbad
movsx eax, byte [0x43bbcc]
and eax, 0xd1edffff
add dword [0x43bbe8], eax
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov dword [0x43bbe8], eax
movsx eax, word [0x43bbd8]
push eax
push 0x399bffff
call fcn.00411c25
pop ecx
pop ecx
add dword [0x43bc04], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10