Function at 0x401b20
Capabilities:
Accept command line arguments
Get common file path
Manipulate boot configuration

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
push 0x405b30
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], esi
jne 0x401b78
push 0x404604
call fcn.00401000
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 0x10
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x401bac
cmp eax, 3
je 0x401bac
push 0x4045ec
call fcn.00401000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x214
ret 0x10
call fcn.00401a30
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 3
jne 0x401c4c
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
lea edx, [esp + 0x128]
push 0x103
stosb byte es:[edi], al
mov eax, dword [esi + 8]
push edx
push 0xffffffffffffffff
push eax
push 0x200
push ebx
call ebp
mov esi, str._setdefault
lea eax, [esp + 0x120]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401c2b
cmp cl, bl
je 0x401c27
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401c2b
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401c07
xor eax, eax
jmp 0x401c30
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401c48
push 0x4045b8
call fcn.00401000
add esp, 4
mov byte [0x40500c], 1
mov esi, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi + 4]
push ebx
push ebx
lea eax, [esp + 0x24]
push 0x103
push eax
push 0xffffffffffffffff
push ecx
push 0x200
push ebx
call ebp
push 0x103
push 0x4049f4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x401cb4
push 0x404598
call fcn.00401000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x214
ret 0x10
call fcn.004011c0
or ecx, 0xffffffff
mov edi, 0x4049f4
xor eax, eax
mov byte [0x4049f6], 0x5c
mov byte [0x4049f7], bl
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x103
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x404af8
push 0x404d00
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.boot.ini
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x404af8
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4049f4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404bfc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ORMLdr
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x404bfc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str._bcdedit.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x404d00
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
push 0x103
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x404f08
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str.powercfg.exe
or ecx, 0xffffffff
xor eax, eax
push str.Wow64DisableWow64FsRedirection
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.kernel32.dll
mov esi, edi
mov edx, ecx
mov edi, 0x404f08
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
cmp eax, ebx
je 0x401e04
lea ecx, [esp + 0x18]
push ecx
call eax
mov esi, str._install
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401e31
cmp cl, bl
je 0x401e2d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401e31
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401e0d
xor eax, eax
jmp 0x401e36
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401e51
push 0x404514
call fcn.00401000
add esp, 4
call fcn.00401330
jmp 0x401ee3
mov esi, str._remove
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401e7e
cmp cl, bl
je 0x401e7a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401e7e
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401e5a
xor eax, eax
jmp 0x401e83
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401e9b
push 0x4044f8
call fcn.00401000
add esp, 4
call fcn.00401890
jmp 0x401ee3
mov esi, str._rmdefault
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401ec8
cmp cl, bl
je 0x401ec4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401ec8
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401ea4
xor eax, eax
jmp 0x401ecd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401ee3
push 0x4044cc
call fcn.00401000
add esp, 4
call fcn.00401780
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call ebp
cmp eax, ebx
je 0x401efd
lea ecx, [esp + 0x18]
push ecx
call eax
call fcn.00402960
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x40449c
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 0x10