Function at 0x40cb60
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x58c
mov eax, dword [0x4c30e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x540]
mov dword [ebp - 0x540], 8
push eax
mov dword [ebp - 0x53c], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 1
push 0
call fcn.0045c859
add esp, 8
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea ecx, [ebp - 0x554]
call fcn.00406e50
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x554]
call fcn.00407950
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d764
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x538], eax
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d76e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x520], eax
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d778
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x534], eax
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d782
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x530], eax
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d78c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push dword [0x4c302c]
add eax, 0x10
lea ecx, [ebp - 0x514]
mov dword [ebp - 0x52c], eax
call fcn.00409140
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x554]
call fcn.00407700
mov edx, dword [ebp - 0x514]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cce8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x4c3030]
lea ecx, [ebp - 0x51c]
call fcn.00409140
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x554]
call fcn.00407700
mov edx, dword [ebp - 0x51c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x4c3028]
lea ecx, [ebp - 0x514]
call fcn.00409140
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x554]
call fcn.00407700
mov edx, dword [ebp - 0x514]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [0x4c3034]
lea ecx, [ebp - 0x51c]
call fcn.00409140
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x554]
call fcn.00407700
mov edx, dword [ebp - 0x51c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cdbd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d796
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [ebp - 0x510]
push str.sync
mov dword [ebp - 0x510], eax
call fcn.00407360
test al, al
jne 0x40ce02
push 4
push str.sync
lea ecx, [ebp - 0x510]
call fcn.004088f0
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x510]
push eax
lea ecx, [ebp - 0x554]
call fcn.00407700
mov edx, dword [ebp - 0x510]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ce38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x530]
cmp dword [edi - 0xc], 0
je 0x40d196
mov ecx, edi
lea eax, [ebp - 0x508]
mov dword [ebp - 0x50c], eax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ce60
sub ecx, edx
sar ecx, 1
push 0x80
lea eax, [ecx + 1]
lea esi, [eax*4]
mov dword [ebp - 0x514], eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x50c]
push esi
push eax
call fcn.00408f60
add esp, 0x10
push 0
push 0
push esi
push dword [ebp - 0x50c]
mov esi, dword [ebp - 0x514]
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x518], ecx
test eax, eax
jne 0x40cf31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40cf2b
push 0
push 0
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea eax, [ebp - 0x508]
push 0x80
push eax
lea eax, [ebp - 0x50c]
push esi
push eax
call fcn.00408f60
add esp, 0x10
push 0
push 0
push esi
push dword [ebp - 0x50c]
push dword [ebp - 0x514]
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
jmp 0x40cf31
mov ecx, dword [ebp - 0x518]
test ecx, ecx
jne 0x40d7a0
lea ecx, [ebp - 0x488]
call fcn.00409210
mov edx, dword [ebp - 0x50c]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cf50
sub ecx, esi
push 0
push ecx
push edx
lea ecx, [ebp - 0x488]
call fcn.0040a060
push 0x2000
call fcn.0044f189
mov edi, eax
add esp, 4
test edi, edi
je 0x40cf8d
push 0x2000
push 0
push edi
call fcn.00451e80
add esp, 0xc
jmp 0x40cf8f
xor edi, edi
push str.cmd_line
lea ecx, [ebp - 0x488]
call fcn.0040a870
test eax, eax
je 0x40cfbb
add eax, 0x3a
je 0x40cfbb
test edi, edi
je 0x40cfbb
push 0x2000
push eax
push edi
call fcn.00451380
add esp, 0xc
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00451e80
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x40
lea eax, [ebp - 0x594]
mov dword [ebp - 0x598], 0x44
push 0
push eax
call fcn.00451e80
add esp, 0xc
mov dword [ebp - 0x56c], 1
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x568], ax
movups xmmword [ebp - 0x548], xmm0
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d7bf
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov dword [ebp - 0x518], eax
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x598]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40d09e
mov eax, dword [ebp - 0x52c]
cmp dword [eax - 0xc], 0
je 0x40d092
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x40d092
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x514], 1
jmp 0x40d0be
push dword [ebp - 0x548]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x544]
call esi
mov dword [ebp - 0x514], 0
mov edx, dword [ebp - 0x518]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d0db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40d0e8
push edi
call fcn.0044f192
add esp, 4
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x42c]
push eax
push 0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00409000
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], 0
test ecx, ecx
je 0x40d16d
mov edx, dword [ebp - 0x424]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x40d145
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d7c9
push edx
push ecx
call fcn.0044ed39
add esp, 8
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x50c]
lea ecx, [ebp - 0x508]
mov dword [ebp - 4], 0xffffffff
cmp eax, ecx
je 0x40d6a7
push eax
call fcn.0045c7d1
add esp, 4
jmp 0x40d6a7
push str.RunExtention.tpi
push str.REXT.tpi
lea ecx, [ebp - 0x520]
call fcn.0040bd40
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d7ce
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [ebp - 0x510]
push str.rundll
mov dword [ebp - 0x510], eax
call fcn.00407360
test al, al
jne 0x40d1f0
push 6
push str.rundll
lea ecx, [ebp - 0x510]
call fcn.004088f0
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d7d8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x520]
add eax, 0xfffffff0
push eax
call fcn.004074a0
mov edi, dword [eax + 4]
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x51c], esi
mov dword [ebp - 0x514], esi
test edi, edi
js 0x40d7e2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x40d26a
push edi
lea ecx, [ebp - 0x514]
call fcn.004085a0
mov esi, dword [ebp - 0x514]
mov dword [ebp - 0x51c], esi
lea eax, [edi + 1]
push eax
push esi
call fcn.0045cba2
add esp, 8
cmp edi, dword [esi - 8]
jg 0x40d7e2
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, dword [ebp - 0x538]
cmp dword [eax - 0xc], 0
je 0x40d303
mov edi, dword [ebp - 0x510]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x514], ecx
lea edx, [edi - 0x10]
mov dword [ebp - 0x53c], edx
cmp ecx, edx
je 0x40d339
cmp dword [edx + 0xc], 0
lea edi, [edx + 0xc]
jl 0x40d2fd
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x40d2fd
push dword [ebp - 0x514]
call fcn.004074a0
add esp, 4
mov dword [ebp - 0x514], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40d2f8
mov edi, dword [ebp - 0x53c]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x514]
lea edi, [eax + 0x10]
jmp 0x40d339
push dword [eax - 0xc]
push eax
jmp 0x40d328
cmp dword [esi - 0xc], 0
jl 0x40d333
push str.utilityex.dll
push esi
call fcn.00451fda
add esp, 8
test eax, eax
je 0x40d333
sub eax, esi
sar eax, 1
js 0x40d333
push 5
push str.popex
lea ecx, [ebp - 0x510]
call fcn.004088f0
mov edi, dword [ebp - 0x510]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00451e80
add esp, 0xc
push dword [ebp - 0x520]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x40d3a2
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0x520]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x40d3f1
mov eax, dword [ebp - 0x520]
lea ecx, [ebp - 0x218]
mov esi, ecx
mov edx, 0x104
sub eax, esi
mov esi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40d3de
movzx eax, word [esi + ecx]
test ax, ax
je 0x40d3de
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40d3c0
mov esi, dword [ebp - 0x51c]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.00407640
mov ecx, eax
test ecx, ecx
je 0x40d7ec
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [ebp - 0x510]
mov dword [ebp - 0x510], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00407360
test al, al
jne 0x40d452
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d430
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x510]
call fcn.004088f0
mov eax, dword [ebp - 0x510]
cmp dword [eax - 0xc], 0
je 0x40d48d
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d48d
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.0040a2a0
mov eax, dword [ebp - 0x518]
add esp, 8
mov dword [ebp - 0x524], eax
jmp 0x40d493
mov eax, dword [ebp - 0x524]
push 0
push 0
push eax
push edi
lea ecx, [ebp - 0x525]
call fcn.004112f0
push 0
push dword [ebp + 8]
mov ecx, 0x4c4d40
push 0
call fcn.0040a960
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.0040bfa0
mov dword [ebp - 0x514], eax
add esp, 8
mov eax, dword [0x4c4d20]
add eax, 0x10
mov dword [ebp - 0x53c], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4c4d78]
mov dword [ebp - 0x518], eax
test eax, eax
je 0x40d548
cmp dword [eax + 4], 0
jle 0x40d510
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x4c4d78]
mov dword [ebp - 0x518], eax
test eax, eax
je 0x40d548
mov ecx, dword [eax]
test ecx, ecx
je 0x40d52f
push ecx
call fcn.0045c7d1
mov eax, dword [ebp - 0x518]
add esp, 4
mov dword [eax], 0
push 0xc
push eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.0044ed39
add esp, 8
push dword [ebp - 0x53c]
mov dword [0x4c4d78], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x4c4d74]
mov dword [ebp - 0x518], eax
test eax, eax
je 0x40d5b7
mov ecx, dword [eax]
test ecx, ecx
je 0x40d588
push ecx
call fcn.0045c7d1
mov eax, dword [ebp - 0x518]
add esp, 4
mov dword [eax], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40d5a5
push ecx
call fcn.0045c7d1
mov eax, dword [ebp - 0x518]
add esp, 4
mov dword [eax + 4], 0
push 0xc
push eax
mov dword [eax + 8], 0
call fcn.0044ed39
add esp, 8
mov eax, dword [0x4c4d6c]
test eax, eax
je 0x40d5f0
cmp dword [eax], 0
je 0x40d5f0
mov esi, eax
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40d5d4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x40d5c7
mov esi, dword [ebp - 0x51c]
mov eax, dword [0x4c3008]
mov edx, dword [0x4c300c]
mov dword [ebp - 0x518], eax
cmp eax, edx
jae 0x40d62b
mov ecx, dword [eax]
test ecx, ecx
je 0x40d61e
mov eax, dword [ecx + 0x1c]
push 0
call eax
mov edx, dword [0x4c300c]
mov eax, dword [ebp - 0x518]
add eax, 4
mov dword [ebp - 0x518], eax
cmp eax, edx
jb 0x40d605
mov ecx, 0x4c4d40
call fcn.0040c200
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x510]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d659
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d673
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x524]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d690
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40d6a7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x52c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d6c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x530]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d6e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x534]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d6fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x520]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40d71b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x538]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x40d736
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x554]
call fcn.00406f30
mov eax, dword [ebp - 0x514]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f149
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80
lea eax, [ebp - 0x508]
push eax
push dword [ebp - 0x50c]
call fcn.00408fe0
add esp, 0xc
call fcn.00409d90
push 0x80004005
call fcn.00407340
call fcn.0045bf48
push 0x80004005
call fcn.00407340
push 0x80004005
call fcn.00407340
push 0x80070057
call fcn.00407340
push 0x80004005
call fcn.00407340
int3