Function at 0x401000
Capabilities:
Check os version
Get common file path
Get hostname
Get session user name
Identify system language via api

Disassembly:
sub esp, 0x19c
mov eax, dword [esp + 0x1a0]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1b0]
mov esi, ecx
mov ecx, dword [esp + 0x1b4]
push str.If__Command_Name__is_provided_displayes_syntax_and_description_of_that_command_otherwise_displays_all_the_avilable_commands
push str.Command_Name
xor ebp, ebp
mov dword [esi + 0x55c], ecx
push fcn.00401bc0
push str.Help
mov ecx, esi
mov dword [esi + 0x548], ebp
mov dword [esi + 0x554], 0x40cee8
mov dword [esi + 0x558], edi
mov dword [esi + 0x550], eax
mov dword [esi], ebp
call fcn.004015b0
push str.Executes_the_given_system_command__returns_immidiately_
push str.Command
push 0x402d70
push str.System
mov ecx, esi
call fcn.004015b0
push str.call_and_wait_untill_app_is_done.
push str.Exact_path_to_App__arguments
push 0x402d90
push str.SysCallAndWait
mov ecx, esi
call fcn.004015b0
push str.Defines_the_variable_if_not_defined_and_Sets_the_its_value_to_the_given_value._nIf__Value__is_not_given_it_undefines_the_given_variable
push str.Name_Value_
push 0x401970
push 0x40a6bc
mov ecx, esi
call fcn.004015b0
push str.Outputs_data_after_evaluation
push str.Data
push 0x402580
push str.Echo
mov ecx, esi
call fcn.004015b0
push str.runs_all_the_commands_in_that_section_and_returnd_and_continues_executing_commands_after_that_line
push str.Section_Name
push 0x402b40
push str.Call
mov ecx, esi
call fcn.004015b0
push str.Executes_all_the_commands_in_that_file_and_returns
push str.Path_to_an_NVU_File
push fcn.00402be0
push 0x40a5c0
mov ecx, esi
call fcn.004015b0
push str.Run_all_the_commands_in_this_file_and_delete_the_file
push str.Path_to_an_NVU_File
push fcn.00402cc0
push str.RunOnce
mov ecx, esi
call fcn.004015b0
push str.Adds_or_replaces_the_given_section_of_the_given_file_from_the_same_section_name_in_the_current_NVU_file
push str.Section_filename
push 0x401ab0
push str.ExportSection
mov ecx, esi
call fcn.004015b0
push str.Adds_or_replaces_the_given_section_of_the_current_file_from_the_same_section_name_in_the_given_NVU_file
push str.Section_filename
push 0x401b50
push str.ImportSection
mov ecx, esi
call fcn.004015b0
push str.Removes_the_given_section_from_the_current_file
push str.Section
push 0x402d20
push str.RemoveSection
mov ecx, esi
call fcn.004015b0
push str.A_dir_will_be_applied_to_the_given_path_and_for_each_file_found_it_sets_variable_current_file_to_that_file_and_calls_the_given_command.
push str.DirPath_Command
push 0x402e50
push str.DirAndApply
mov ecx, esi
call fcn.004015b0
push str.Executes_command_if_Exp1_is_the_same_as_Exp2_for__or_Exp1_has_Exp2_for__
push str.Exp1___Exp2_then_Command
push 0x4019d0
push 0x40a308
mov ecx, esi
call fcn.004015b0
push str.reEvaluates_the_given_command_and_executes_it
push str.Command
push fcn.00401e40
push str.Eval
mov ecx, esi
call fcn.004015b0
push str.Opens_the_given_log_files_ad_Logs_all_the_commands_in_the_given_file
push str.Filename
push 0x402a90
push str.StartLogging
mov ecx, esi
call fcn.004015b0
push str.Stops_logging_close_the_file
push 0x40cee8
push fcn.00402b10
push str.StopLogging
mov ecx, esi
call fcn.004015b0
push str.Waits_for_a_number_of_miliseconds_passed_before_executing_the_next_command
push str.milisconds
push 0x402fb0
push str.Sleep
mov ecx, esi
call fcn.004015b0
mov dword [esi + 0x54c], 0x40a1b0
mov dword [esi + 0x404], ebp
mov edx, dword [esi + 0x404]
mov dword [esi + edx*8 + 4], ebp
mov eax, dword [esi + 0x404]
mov dword [esi + eax*8 + 8], ebp
mov ecx, dword [esi + 0x404]
inc ecx
mov eax, ecx
mov dword [esi + 0x404], ecx
cmp eax, 0x80
jl 0x401221
push ebx
lea ecx, [esp + 0x14]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x14]
mov ecx, esi
push edx
push str.windir
call fcn.00401780
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x14]
push ecx
push str.sysdir
mov ecx, esi
call fcn.00401780
lea edx, [esp + 0x14]
push 0x104
push edx
call fcn.00402f70
add esp, 8
lea eax, [esp + 0x14]
mov ecx, esi
push eax
push str.syswow64dir
call fcn.00401780
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x14]
mov ecx, esi
push edx
push str.Currentdir
call fcn.00401780
push 1
lea eax, [esp + 0x18]
push 0x17
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x14]
push ecx
push str.commonprograms
mov ecx, esi
call fcn.00401780
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, eax
and edi, 0xffff
lea edx, [esp + 0x14]
push edi
push str.Language_Resource__d
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, esi
push eax
push str.Language_Resource
call fcn.00401780
and edi, 0x3ff
lea ecx, [esp + 0x14]
push edi
push str.Language_Resource__d
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esi
push edx
push str.Primary_Language_Resource
call fcn.00401780
push 0x40a12c
push 0x40a128
mov ecx, esi
call fcn.00401780
push 0x104
mov ecx, dword [esi + 0x550]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x14]
mov ecx, esi
push edx
push str.Current_Parser_Path
call fcn.00401780
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.00401d60
push eax
push str.Current_Parser_Name
mov ecx, esi
call fcn.00401780
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x14]
mov ecx, esi
push eax
push str.Computer_Name
call fcn.00401780
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x14]
mov ecx, esi
push eax
push str.User_Name
call fcn.00401780
lea ecx, [esp + 0x118]
mov dword [esp + 0x118], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x11c]
lea eax, [esp + 0x14]
push edx
push 0x40a0e0
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push str.OS_Major_Version
mov ecx, esi
call fcn.00401780
mov edx, dword [esp + 0x120]
lea eax, [esp + 0x14]
push edx
push 0x40a0e0
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push str.OS_Minor_Version
mov ecx, esi
call fcn.00401780
mov eax, dword [esp + 0x128]
mov dword [esi + 0x560], ebp
dec eax
pop ebx
je 0x4014c4
dec eax
jne 0x401512
push str.ControlClass
push str.DriverBaseRegPath
mov ecx, esi
call fcn.00401780
mov eax, dword [esp + 0x118]
cmp eax, 5
jne 0x4014b8
mov eax, dword [esp + 0x11c]
sub eax, ebp
je 0x4014b1
dec eax
je 0x4014aa
dec eax
mov ecx, esi
je 0x4014a3
push str.Unknown_WIN32_NT5
jmp 0x401508
push str.WinServer2003Family
jmp 0x401508
push str.WinXP
jmp 0x401506
push str.Win2K
jmp 0x401506
cmp eax, 4
jne 0x401512
push str.WinNT4
jmp 0x401506
push str.ServicesClass
push str.DriverBaseRegPath
mov ecx, esi
call fcn.00401780
mov eax, dword [esp + 0x11c]
cmp eax, ebp
je 0x401501
cmp eax, 0xa
je 0x4014fa
cmp eax, 0x5a
mov ecx, esi
je 0x4014f3
push str.Unknown_WIN32_Windows
jmp 0x401508
push str.WinME
jmp 0x401508
push str.Win98
jmp 0x401506
push str.Win95
mov ecx, esi
push 0x40a010
call fcn.00401780
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 0xc