Function at 0x401000
Capabilities:
Accept command line arguments
Delete file
Terminate process

Disassembly:
push 0x3000
push 0x400000
call dword [sym.imp.KERNEL32.DLL_VirtualLock]
call fcn.00402a13
push 0x40000
call fcn.00401a22
test eax, eax
jne 0x40102b
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edi, eax
push 0x3fc
push edi
call fcn.00401a0a
mov eax, edi
add eax, 0x400
push 0x20000
push eax
push edi
call fcn.00401a3a
cmp eax, 0x400
jg 0x40105a
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov ebp, edi
add ebp, 0x400
inc ebp
cmp dword [ebp], 0x41414141
jne 0x401062
add ebp, 4
xor ebx, ebx
mov eax, 0x6f
xor byte [ebp + ebx], al
cmp byte [ebp + ebx], 9
je 0x40108f
add eax, 0x93
inc ebx
cmp ebx, 0x1000
jl 0x401076
mov ebx, edi
add ebx, 0x400
mov dword [0x4032f8], ebx
add ebx, 0x80
mov dword [0x4032fc], ebx
add ebx, 0x80
mov dword [0x403300], ebx
add ebx, 0x80
mov dword [0x403304], ebx
add ebx, 0x80
mov dword [0x40330c], ebx
add ebx, 0x80
mov dword [0x403310], ebx
add ebx, 0x80
mov dword [0x403314], ebx
add ebx, 0x80
mov dword [0x403318], ebx
xor ebx, ebx
mov al, byte [ebp + ebx]
cmp al, 1
jne 0x40110c
push ebp
push ebx
push dword [0x4032f8]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
cmp al, 2
jne 0x401121
push ebp
push ebx
push dword [0x4032fc]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
cmp al, 3
jne 0x401136
push ebp
push ebx
push dword [0x403300]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
cmp al, 4
jne 0x40114b
push ebp
push ebx
push dword [0x403304]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
cmp al, 5
jne 0x401192
push ebx
call fcn.004015c8
test eax, eax
jne 0x40118c
mov ebx, edi
add ebx, 0x20400
push dword [0x403300]
push dword [0x4032fc]
push dword [0x4032f8]
push 0x1fc00
push ebx
call fcn.0040220e
pop ebx
test eax, eax
jne 0x4013da
jmp 0x4012ed
pop ebx
jmp 0x4012ed
cmp al, 6
jne 0x4011aa
push ebx
push dword [ebp + ebx + 1]
call dword [sym.imp.KERNEL32.DLL_Sleep]
pop ebx
add ebx, 4
jmp 0x4012ed
cmp al, 7
jne 0x4011c0
mov edx, dword [ebp + ebx + 1]
mov dword [0x403308], edx
add ebx, 4
jmp 0x4012ed
cmp al, 8
jne 0x40121b
mov edx, dword [ebp + ebx + 1]
mov ecx, dword [ebp + ebx + 5]
add edx, edi
add edx, 0x400
push ebx
push edx
push ecx
push 0x200
push edi
call fcn.004019a2
push 0x4016dd
push edi
call fcn.00401900
pop ecx
pop edx
push 0
push 0
push ecx
push edx
push edi
call fcn.00401a8d
push 0x1b7740
push 0
push edi
call fcn.00401b23
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop ebx
add ebx, 8
jmp 0x4012ed
cmp al, 0xa
jne 0x40123b
mov edx, dword [ebp + ebx + 1]
mov dword [0x40331c], edx
mov edx, dword [ebp + ebx + 5]
mov dword [0x403320], edx
add ebx, 8
jmp 0x4012ed
cmp al, 0x14
jne 0x401253
push ebp
push ebx
push dword [0x403310]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
cmp al, 0x15
jne 0x40126b
push ebp
push ebx
push dword [0x403314]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
cmp al, 0x16
jne 0x4012a8
push ebx
call fcn.004015c8
test eax, eax
jne 0x4012a5
mov ebx, edi
add ebx, 0x20400
push dword [0x403300]
push dword [0x4032fc]
push dword [0x4032f8]
push 0x1fc00
push ebx
call fcn.0040220e
pop ebx
test eax, eax
jne 0x401302
jmp 0x4012ed
pop ebx
jmp 0x4012ed
cmp al, 0x17
jne 0x4012cd
push ebp
push ebx
push dword [0x40330c]
call fcn.00401543
mov ebx, eax
push ebx
push dword [0x40330c]
call fcn.004014a0
pop ebx
jmp 0x4010f3
cmp al, 0x18
jne 0x4012e5
push ebp
push ebx
push dword [0x403318]
call fcn.00401543
mov ebx, eax
jmp 0x4010f3
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
inc ebx
cmp ebx, 0x1000
jl 0x4010f3
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push ebx
call fcn.0040163e
mov esi, edi
add esi, 0x800
push 0x4016e9
push esi
call fcn.00401884
push dword [0x403310]
push esi
call fcn.00401900
push 0x4017af
push esi
call fcn.00401900
push dword [0x403314]
push esi
call fcn.00401900
push 0x4017cd
push esi
call fcn.00401900
push dword [0x403304]
push esi
call fcn.00401900
push 0x4017f1
push esi
call fcn.00401900
push dword [0x403304]
push esi
call fcn.00401900
push 0x4017f4
push esi
call fcn.00401900
push esi
call fcn.004014a0
push dword [0x403318]
push esi
call fcn.00401884
cmp byte [esi], 0
je 0x4013cf
push 0x401843
push esi
call fcn.00401900
push dword [0x4032f8]
push esi
call fcn.00401900
push 0x401843
push esi
call fcn.00401900
push dword [0x4032fc]
push esi
call fcn.00401900
mov eax, edi
add eax, 0x1000
push 0x200
push eax
push esi
call fcn.00401c12
call fcn.00401451
pop ebx
jmp 0x4012ed
call fcn.0040163e
push dword [0x403304]
call fcn.004014a0
mov esi, edi
add esi, 0x800
push dword [0x403318]
push esi
call fcn.00401884
cmp byte [esi], 0
je 0x401444
push 0x401843
push esi
call fcn.00401900
push dword [0x4032f8]
push esi
call fcn.00401900
push 0x401843
push esi
call fcn.00401900
push dword [0x4032fc]
push esi
call fcn.00401900
mov eax, edi
add eax, 0x1000
push 0x200
push eax
push esi
call fcn.00401c12
call fcn.00401451
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]