Function at 0x406bc0
Capabilities:
Accept command line arguments
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8018
call fcn.00407650
mov eax, dword [0x43a128]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x8008], eax
shl eax, 2
push edi
push eax
mov dword [ebp - 0x8010], ebx
mov dword [ebp - 0x800c], 0
call fcn.0040ab5a
xor edx, edx
add esp, 4
mov edi, eax
cmp dword [ebp - 0x8008], edx
jbe 0x406c26
mov esi, ebx
mov ecx, edi
sub esi, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
inc edx
cmp edx, dword [ebp - 0x8008]
jb 0x406c14
push ebx
lea eax, [ebp - 0x8008]
push eax
push 0x43012c
call fcn.00401e00
push ebx
lea eax, [ebp - 0x8008]
push eax
push 0x43012c
call fcn.004016f0
add esp, 0x18
test eax, eax
jne 0x406c67
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
push edi
call fcn.0040ab3f
add esp, 4
mov dword [ebp - 0x8014], 0x10
lea eax, [ebp - 0x8014]
push eax
push 0x464ec0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call fcn.00402d50
test eax, eax
jne 0x406cc1
push str.PsExec_requires_Windows_XP_or_higher._n_n
push 2
call fcn.0040af7e
add esp, 4
push eax
call fcn.00403ba0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x8008]
xor esi, esi
xor edx, edx
test edi, edi
je 0x406cfe
nop
mov ecx, dword [ebx + edx*4]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406cd6
sub ecx, ebx
sar ecx, 1
add esi, ecx
cmp esi, 0x1fff
ja 0x406d7c
mov ebx, dword [ebp - 0x8010]
inc edx
cmp edx, edi
jb 0x406cd0
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d10
sub eax, edx
sar eax, 1
cmp eax, 0x4000
ja 0x406d7c
call esi
lea edx, [ebp - 0x8004]
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x406d30
cmp word [ebp - 0x8004], 0x22
lea esi, [ebp - 0x8004]
jne 0x406d86
mov eax, dword [ebp - 0x8002]
lea esi, [ebp - 0x8002]
mov ecx, esi
test ax, ax
je 0x406d9d
movzx edx, ax
cmp dx, 0x22
je 0x406d99
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x406d66
jmp 0x406d99
push str.Arguments_too_long._n_n
jmp 0x406c9a
lea eax, [ebp - 0x8004]
push 0x20
push eax
call fcn.00408954
add esp, 8
mov ecx, eax
test ecx, ecx
je 0x406da8
cmp word [ecx], 0
je 0x406da8
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x8018]
push eax
push 0x460ec0
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [ebp - 0x8018]
test eax, eax
je 0x406dcf
xor ecx, ecx
mov word [eax], cx
push 0x43017c
push 1
push 0x42da00
call section..text
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call ebx
mov dword [0x43aad8], eax
lea eax, [ebp - 0x800c]
push eax
push dword [ebp - 0x8010]
push dword [ebp - 0x8008]
call fcn.00404d30
add esp, 0xc
test al, al
je 0x406fb4
push 0x430194
push 1
push 0x4301a8
call section..text
add esp, 8
push eax
call ebx
test eax, eax
je 0x406e48
cmp dword [ebp - 0x800c], 0
jne 0x406e48
lea ecx, [ebp - 0x800c]
push ecx
push 0x43bae0
push 0
call eax
cmp byte [0x43aadc], 0
je 0x406f2f
cmp byte [0x43aadd], 0
jne 0x406f2f
push 0x5c
push 0x43bae0
call fcn.00408954
mov edi, eax
add esp, 8
test edi, edi
je 0x406e7c
xor eax, eax
mov word [edi], ax
push 0x4301c4
push 0x43bae0
call fcn.0040aa3e
add esp, 8
test eax, eax
je 0x406f11
push 0x4301e0
push 0x43bae0
call fcn.0040aa3e
add esp, 8
test eax, eax
je 0x406f11
push str.Password:
call fcn.00401d40
push 1
call fcn.0040af7e
push eax
call fcn.00410536
add esp, 0xc
xor esi, esi
call fcn.0040ffee
movzx eax, ax
cmp eax, 0xd
je 0x406eeb
cmp eax, 3
je 0x406fbb
mov word [esi*2 + 0x460ca0], ax
inc esi
cmp esi, 0x207
jb 0x406ec4
add esi, esi
cmp esi, 0x208
jae 0x406fda
xor eax, eax
push 0x42fee8
mov word [esi + 0x460ca0], ax
call fcn.00401d40
add esp, 4
jmp 0x406f23
xor eax, eax
mov dword [ebp - 0x800c], 1
mov word [0x460ca0], ax
test edi, edi
je 0x406f2f
mov eax, 0x5c
mov word [edi], ax
push str.CreateProcessWithLogonW
push 1
push 0x42da00
call section..text
add esp, 8
push eax
call ebx
push 0x43aae0
push 0x464ec0
mov dword [0x43ff04], eax
call fcn.0040aa3e
add esp, 8
test eax, eax
jne 0x406f8f
cmp byte [0x43fef5], al
jne 0x406f8f
cmp dword [ebp - 0x800c], eax
jne 0x406f8f
cmp dword [0x43ff04], eax
je 0x406f8f
call fcn.004047a0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
push 0x4058a0
push 0x43aae0
push 1
call fcn.004029a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040760d
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.0040aea0
push 0x42e20c
push 2
call fcn.0040af7e
add esp, 4
push eax
call fcn.00403ba0
add esp, 8
push 0
call fcn.0040aea0
call fcn.0040779d
int3