Function at 0x401380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
mov dword [esp + 0x20], 0
mov dword [0x403030], 0x401000
sbb eax, eax
neg eax
mov dword [0x403034], eax
mov eax, 0
setne al
inc eax
mov dword [0x403004], eax
call fcn.004010a0
mov dword [esp + 0x38], 0
call dword [0x403030]
mov edi, eax
test edi, edi
je 0x4013e7
push edi
call dword [0x403038]
mov ebx, eax
jmp 0x4013e9
xor ebx, ebx
cmp dword [0x403034], 0
lea eax, [esp + 0xc]
push 1
push eax
push 0
mov ecx, 0x40212c
mov dword [esp + 0x18], 0
push 0
mov eax, 0x402128
cmove eax, ecx
push eax
push edi
call dword [0x40300c]
mov esi, eax
test esi, esi
je 0x40142d
push esi
call dword [0x403038]
mov edx, eax
mov dword [esp + 0x30], eax
jmp 0x401433
xor edx, edx
mov dword [esp + 0x30], edx
test edi, edi
je 0x401476
cmp dword [0x403034], 0
je 0x40145a
cmp word [edi], 0x22
jne 0x401476
mov eax, dword [esp + 0xc]
mov ecx, dword [0x403004]
sub eax, ecx
cmp word [eax], 0x22
je 0x401470
jmp 0x401476
cmp byte [edi], 0x22
jne 0x401476
mov eax, dword [esp + 0xc]
mov ecx, dword [0x403004]
sub eax, ecx
cmp byte [eax], 0x22
jne 0x401476
add edi, ecx
mov dword [esp + 0xc], eax
test edx, edx
jne 0x401481
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0x44
push eax
call dword [0x403020]
mov eax, dword [0x403004]
lea ecx, [ebx + 1]
imul ecx, eax
push 4
push 0x1000
lea eax, [ecx + eax*4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4017e0
push edi
push eax
call dword [0x403018]
mov ebx, dword [esp + 0xc]
mov ecx, 0x40212e
sub ebx, edi
mov eax, 0x402124
cmp dword [0x403034], 0
cmove eax, ecx
push eax
mov eax, dword [esp + 0x18]
add eax, ebx
push eax
call dword [0x403018]
mov eax, dword [0x403004]
lea ecx, [eax*8]
cmp ebx, ecx
jb 0x40152b
cmp dword [0x403034], 0
mov edx, str.rundll32
mov eax, 0x402130
cmove eax, edx
push eax
mov eax, ebx
sub eax, ecx
add eax, dword [esp + 0x18]
push eax
call dword [section..data]
test eax, eax
je 0x401563
mov eax, dword [0x403004]
lea ecx, [eax + eax*2]
shl ecx, 2
cmp ebx, ecx
jb 0x4017c5
cmp dword [0x403034], 0
mov edx, str.rundll32.exe
mov eax, 0x402150
cmove eax, edx
sub ebx, ecx
add ebx, dword [esp + 0x14]
push eax
push ebx
call dword [section..data]
test eax, eax
jne 0x4017c5
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push 0
push eax
sub ebx, edi
mov ecx, 0x402184
add ebx, esi
mov eax, 0x40217c
cmp dword [0x403034], 0
push 0
push 0
cmove eax, ecx
push eax
push ebx
call dword [0x40300c]
mov ecx, eax
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4017c5
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4017c5
mov edx, dword [0x403034]
test edx, edx
je 0x4015c1
cmp word [eax], 0x2c
je 0x4015ca
jmp 0x4017c5
cmp byte [eax], 0x2c
jne 0x4017c5
push 0
lea eax, [esp + 0x30]
test edx, edx
push eax
push 0
mov edx, 0x40212c
mov eax, 0x402128
push 0
cmove eax, edx
push eax
push ecx
call dword [0x40300c]
cmp dword [0x403034], 0
mov edi, eax
mov ecx, 0x40212e
mov eax, 0x402124
cmove eax, ecx
push eax
push dword [esp + 0x28]
call dword [0x403018]
cmp dword [0x403034], 0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x9c]
mov ecx, str..dll
push eax
push 0x104
mov eax, 0x402188
cmove eax, ecx
push eax
push ebx
push 0
call dword [0x403014]
test eax, eax
je 0x4017c5
push ebx
call dword [0x403010]
mov ecx, eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x4017c5
test byte [esp + 0x7c], 1
je 0x40166f
movzx edx, word [esp + 0x80]
mov dword [esp + 0x34], edx
jmp 0x401677
mov dword [esp + 0x34], 0xa
cmp dword [0x403034], 0
mov eax, dword [esp + 0x2c]
je 0x40170d
mov ecx, dword [esp + 0x10]
xor edx, edx
push 0
push 0
sub eax, ecx
push eax
div dword [0x403004]
push ecx
push eax
sub ecx, ebx
add ecx, esi
push ecx
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
test ecx, ecx
je 0x4017bb
mov eax, dword [esp + 0x10]
add ecx, eax
push eax
push dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov word [ecx], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4016e2
mov eax, 1
jmp 0x401729
mov eax, dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0x20]
mov byte [eax], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x401727
push dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
push dword [esp + 0x20]
jmp 0x401712
push dword [esp + 0x10]
push ecx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4017bb
xor eax, eax
test edi, edi
je 0x401764
cmp dword [0x403034], eax
je 0x401764
mov eax, dword [esp + 0x30]
inc eax
mov byte [edi], 0
imul eax, dword [0x403004]
push 0
push 0
sub eax, edi
add eax, ebx
push eax
push edi
mov eax, edi
push 0xffffffffffffffff
sub eax, ebx
add eax, esi
push eax
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov dword [esp + 0x20], eax
call fcn.00401240
mov ebx, eax
test edi, edi
jne 0x401790
cmp dword [0x403034], edi
mov ecx, 0x40212e
mov edi, 0x402124
cmove edi, ecx
push dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov edx, ebx
push edi
push dword [esp + 0x28]
call fcn.00401310
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x4017b3
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x38], 1
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x8000
push 0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [esp + 0x38], 0
jne 0x40183e
nop dword [eax]
test esi, esi
je 0x40183e
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [0x40302c]
test eax, eax
jne 0x40182c
cmp dword [0x403034], 0
mov ecx, 0x40212c
push 1
push eax
push eax
push eax
mov eax, 0x402128
cmove eax, ecx
push eax
push esi
call dword [0x40300c]
mov esi, eax
jmp 0x4017e0
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x44]
call esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ExitProcess]