Function at 0x401310
Capabilities:
Accept command line arguments
Access the windows event log
Create process on windows
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push str.JB_Elevator
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
cmp dword [ebp + 8], 3
mov ebx, eax
jg 0x40138e
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffffc
push 0
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push str.Bad_command_line
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 8
mov eax, 0xfffffffc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x4013e8
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffffb
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push str.Failed_to_set_directory_to__s_:__ld
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0x10
mov eax, 0xfffffffb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
push dword [esi + 4]
call fcn.00403f56
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401441
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffffa
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [esi + 4]
push str.Failed_to_get_parent_pid_from__s
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xc]
mov esi, ecx
mov dword [esp + 0xc], ecx
lea edx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401450
sub esi, edx
sar esi, 1
jne 0x4014ae
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff9
push 0
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [esp + 0xc]
push str.Failed_to_get_descriptors_from__s
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
xor edi, edi
test esi, esi
je 0x4014d0
movzx eax, word [ecx + edi*2]
push 4
push eax
call fcn.004036b8
add esp, 8
test eax, eax
je 0x401546
mov ecx, dword [esp + 0xc]
inc edi
cmp edi, esi
jb 0x4014b4
push ecx
call fcn.00403f56
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 4
mov dword [esp + 0xc], eax
push str.__::__
call esi
push eax
call fcn.004023f1
add esp, 8
test eax, eax
jne 0x401593
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffff7
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call esi
push eax
push str.__::__
push str.Failed_to_find__s_in__s
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0x10
mov eax, 0xfffffff7
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff8
push 0
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [esp + 0xc]
push str.Bad_descriptor__s
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
mov eax, 0xfffffff8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
add eax, 0xc
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
jne 0x4015f8
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffff6
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_attach_console:__d
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00402870
add esp, 0xc
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 0x100
push 0
call fcn.00403634
mov esi, dword [sym.imp.ADVAPI32.dll_ReportEventW]
add esp, 4
test byte [esp + 0xc], 4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x401675
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0x68], eax
push 1
call fcn.00403634
add esp, 4
lea eax, [esp + 0x6c]
mov edx, 1
push ebx
push eax
push dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00401040
add esp, 0x10
test eax, eax
je 0x40172a
jmp 0x4018e2
push 4
push dword [esp + 0x14]
lea eax, [esp + 0x88]
push str..pipe_jetbrains_ld__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x80]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x401708
test eax, eax
je 0x401708
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x4016e6
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffffe
jmp 0x401714
push dword [esp + 0x14]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x4016ff
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffffd
jmp 0x401714
mov eax, dword [esp + 0x14]
jmp 0x40163e
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 1
push ebx
call esi
call edi
test eax, eax
je 0x401642
jmp 0x4018e8
push 2
call fcn.00403634
add esp, 4
lea eax, [esp + 0x70]
mov edx, 2
push ebx
push eax
push dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00401040
add esp, 0x10
test eax, eax
jne 0x4018ee
push dword [esp + 0x10]
push eax
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4018f4
mov ecx, dword [esp + 0x10]
mov edx, ebx
call fcn.004011a0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
push dword [esp + 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4017eb
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffff4
push eax
push 1
push ebx
call esi
push dword [esp + 0x18]
call edi
push eax
push str.Error_launching_process._Exit_code__ld__command_was__ls
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0x10
mov eax, 0xfffffff4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
mov dword [esp + 0x80], eax
lea eax, [esp + 0x7c]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x40185c
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff3
push 0
push 1
push ebx
call esi
call edi
push eax
push str.Error_waiting_processes:__ld
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
mov eax, 0xfffffff3
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4018ab
push eax
push eax
push eax
push eax
push eax
push 0xfffffffffffffff2
push eax
push 1
push ebx
call esi
push str.Parent_process__launcher__died_
push 2
call fcn.00403634
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 0xffffffffffffffff
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0xfffffff2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401910
mov esp, ebp
pop ebp
ret
push eax
call fcn.00403280
push eax
call fcn.00403280
push eax
call fcn.00403280
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
push 0
push 1
push ebx
call esi
call edi
push eax
call fcn.00403280
int3