Function at 0x401aa2
Capabilities:
Accept command line arguments
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x110
lea eax, [ebp - 0x61]
mov ecx, eax
call fcn.004f6f30
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x61]
mov dword [esp + 4], edx
mov dword [esp], 0x5730c4
mov ecx, eax
call fcn.0053cc10
sub esp, 8
lea eax, [ebp - 0x61]
mov ecx, eax
call fcn.004f6f60
lea eax, [ebp - 0x94]
mov ecx, eax
call fcn.0053cf70
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x98]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xc], eax
jge 0x401e2a
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], str.__dll
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401b70
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], 0x5730d6
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401b77
mov eax, 1
jmp 0x401b7c
mov eax, 0
test al, al
je 0x401bad
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov edx, dword [eax]
lea eax, [ebp - 0x94]
mov dword [esp], edx
mov ecx, eax
call fcn.0053d690
sub esp, 4
jmp 0x401e21
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], 0x5730dc
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
sete al
test al, al
je 0x401c4d
mov eax, dword [str.LocalSewashiStopSignal]
mov dword [esp + 4], eax
mov dword [esp], str.Opening_handle__s_n
call fcn.00403623
mov eax, dword [str.LocalSewashiStopSignal]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 2
mov eax, dword [sym.imp.KERNEL32.dll_OpenEventA]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401c43
mov dword [esp], str.Sending_stop_event_n
call fcn.00403623
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov ebx, 0
jmp 0x4020ac
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], str.__sessions
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401c97
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], 0x573128
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401c9e
mov eax, 1
jmp 0x401ca3
mov eax, 0
test al, al
je 0x401cd1
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov edx, dword [eax]
lea eax, [ebp - 0x7c]
mov dword [esp], edx
mov ecx, eax
call fcn.0053d690
sub esp, 4
jmp 0x401e21
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], str.__poll
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
sete al
test al, al
je 0x401d51
mov dword [ebp - 0xd8], 3
mov byte [0x5fa03c], 1
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov eax, dword [eax]
lea edx, [ebp - 0xd8]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x57313c
mov dword [esp], eax
call fcn.00401834
mov eax, dword [ebp - 0xd8]
imul eax, eax, 0x3e8
mov dword [0x56800c], eax
jmp 0x401e21
mov eax, dword [ebp - 0xc]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
add eax, edx
mov ebx, dword [eax]
lea eax, [ebp - 0x2d]
mov ecx, eax
call fcn.004f6f30
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x2d]
mov dword [esp + 4], edx
mov dword [esp], str.Invalid_switch
mov ecx, eax
call fcn.0053cc10
sub esp, 8
lea eax, [ebp - 0x60]
mov dword [esp + 8], ebx
lea edx, [ebp - 0x48]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00559a30
lea eax, [ebp - 0xf0]
mov dword [esp + 8], str._nSyntax:_nsewashi___dll__DLL____sessions__SESSIONS____poll__seconds_
lea edx, [ebp - 0x60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00559a30
lea eax, [ebp - 0x60]
mov ecx, eax
call fcn.0053d570
lea eax, [ebp - 0x48]
mov ecx, eax
call fcn.0053d570
lea eax, [ebp - 0x2d]
mov ecx, eax
call fcn.004f6f60
lea eax, [ebp - 0xf0]
mov ecx, eax
call fcn.004c0930
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], 0x5731ec
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
mov ebx, 1
lea eax, [ebp - 0xf0]
mov ecx, eax
call fcn.0053d570
jmp 0x4020ac
add dword [ebp - 0xc], 1
jmp 0x401b17
lea eax, [ebp - 0x94]
mov ecx, eax
call fcn.004c0930
mov esi, eax
mov dword [esp], 4
call fcn.0055be70
mov ebx, eax
mov dword [esp], esi
mov ecx, ebx
call fcn.0040219c
sub esp, 4
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov ecx, eax
call fcn.004ae0cc
xor eax, 1
test al, al
je 0x401e9b
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Soffid_ESSO
mov dword [esp + 4], str.Unable_to_load_HLL_API_library
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov ebx, 1
jmp 0x4020ac
lea eax, [ebp - 0x7c]
mov ecx, eax
call fcn.004c0ac0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffff
ja 0x401ebf
shl eax, 3
mov dword [esp], eax
call fcn.0055be40
jmp 0x401ec4
call fcn.0055ce18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x7c]
mov ecx, eax
call fcn.004c0ac0
cmp dword [ebp - 0x10], eax
setb al
test al, al
je 0x401f6f
mov eax, dword [ebp - 0x10]
lea edx, [eax*8]
mov eax, dword [ebp - 0x28]
add edx, eax
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.0053d770
sub esp, 4
movzx edx, word [eax]
mov eax, dword [ebp - 0x10]
lea ecx, [eax*8]
mov eax, dword [ebp - 0x28]
add eax, ecx
mov byte [eax + 4], dl
mov eax, dword [ebp - 0x10]
lea edx, [eax*8]
mov eax, dword [ebp - 0x28]
add eax, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x401861
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
add dword [ebp - 0x10], 1
jmp 0x401ece
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [esp + 4], 1
lea eax, [ebp - 0xc8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
call eax
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
lea eax, [ebp - 0xc8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
call eax
sub esp, 0x10
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd4], 0xc
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], 1
mov eax, dword [str.LocalSewashiStopSignal]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x40207e
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Soffid_HLL_Wrapper
mov dword [esp + 4], str.Unable_to_create_stop_event
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov ebx, 0
lea eax, [ebp - 0x94]
mov ecx, eax
call fcn.0053d570
lea eax, [ebp - 0x7c]
mov ecx, eax
call fcn.0053d570
mov eax, ebx
jmp 0x402154
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x10