Function at 0x40195e
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
call fcn.00401ca0
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call eax
mov edx, eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4019a8
mov dword [esp], str.Error_parsing_commandline_options__n
call fcn.00401560
mov eax, dword [ebp - 0x28]
cmp eax, 3
je 0x4019e9
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.Usage:__S__option..__nOptions:_n___p___pid___________pid__n___n___process_name__process_name__n___f___file__________path__n_nExamples:_n_S__p_1234_n_S__n_lsass.exe_n_S__f__S_n
call fcn.00401560
mov ebx, 0x405040
mov dword [esp], str.kernel32
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.IsWow64Process
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x40422e
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401a4e
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404234
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401a81
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_wcstoul
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.004016cc
jmp 0x401b34
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404240
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401ab9
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.__process_name
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401ad9
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0040158a
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004016cc
jmp 0x401b34
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404264
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401b11
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.__file
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401b23
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00401783
jmp 0x401b34
mov dword [esp], str.Invalid_action_specified.._n
call fcn.00401560
mov eax, 1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret