Function at 0x401000
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check for unmoving mouse cursor
Get disk information
Get file attributes
Open clipboard
Terminate process
Write clipboard data

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, str._SbFolder_3.840
push edi
push 1
xor ebx, ebx
push 1
push ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401c4d
push 0x1d
push 0x10050511
call fcn.00403669
pop ecx
pop ecx
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
call sub.IMM32.dll_ImmDisableIME
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x40107e
push str.SetProcessDPIAware
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x401077
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x30
pop ebx
mov ebp, 0x40529c
push ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], ebp
mov dword [0x40529c], ebx
mov dword [0x4052a4], 0x401c59
mov dword [0x4052b0], eax
mov dword [0x4052bc], 3
mov dword [0x4052c4], edi
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov dword [0x405618], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
test al, al
je 0x401c4d
inc esi
cmp al, 0x2e
jne 0x4010cf
mov eax, dword [esi]
and eax, 0xdddfdfdf
cmp eax, 0x455845
jne 0x4010cf
mov al, byte [esi]
xor edi, edi
test al, al
mov dword [esp + 0x24], esi
je 0x401304
cmp al, 0x2f
jne 0x401273
mov eax, esi
and byte [eax], 0
dec eax
cmp byte [eax], 0x20
je 0x401106
and dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
inc esi
mov al, byte [esi]
cmp al, bl
jb 0x401151
cmp al, 0x39
ja 0x401151
lea edx, [esi - 1]
mov dword [esp + 0x18], edx
xor ecx, ecx
and eax, 0xf
lea ecx, [ecx + ecx*4]
inc esi
lea ecx, [eax + ecx*2]
mov al, byte [esi]
cmp al, bl
jb 0x401140
cmp al, 0x39
jbe 0x40112c
cmp byte [edx], 0x2d
jne 0x401147
neg ecx
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x30], ecx
jmp 0x401119
mov al, byte [esi]
cmp al, 0x2e
je 0x401257
cmp al, 0x2c
jne 0x401169
mov dword [esp + 0x14], 1
jmp 0x401118
cmp al, 0x27
jne 0x40117c
or byte [esp + 0x10], 0x80
mov dword [esp + 0x14], 1
jmp 0x401118
mov cx, word [esi]
cmp cx, 0x282d
jne 0x4011a9
inc esi
inc esi
mov dword [esp + 0x1c], esi
mov al, byte [esi]
test al, al
je 0x40126c
cmp al, 0x29
je 0x4011a1
and al, 0xdf
mov byte [esi], al
inc esi
jmp 0x40118c
and byte [esi], 0
jmp 0x401118
mov eax, ecx
and eax, 0xdfdf
cmp ax, 0x480d
jne 0x4011c0
or dword [esp + 0x10], 2
jmp 0x401240
cmp ax, 0x530d
jne 0x4011cd
or dword [esp + 0x10], 4
jmp 0x401240
cmp ax, 0x450b
jne 0x4011da
or dword [esp + 0x10], 0x20
jmp 0x401240
cmp ax, 0x4e0d
jne 0x4011e7
or dword [esp + 0x10], 0x40
jmp 0x401240
cmp ax, 0x4d0d
jne 0x4011f4
xor dword [esp + 0x10], 0x10
jmp 0x401240
cmp ax, 0x520d
jne 0x401201
or byte [esp + 0x11], 1
jmp 0x401240
cmp ax, 0x590d
jne 0x40120e
or byte [esp + 0x11], 2
jmp 0x401240
cmp ax, 0x4c0d
jne 0x40121b
or byte [esp + 0x11], 4
jmp 0x401240
cmp ax, 0x460b
jne 0x401228
or byte [esp + 0x11], 0x10
jmp 0x401240
cmp ax, 0x420b
jne 0x401235
or byte [esp + 0x11], 0x20
jmp 0x401240
cmp ax, 0x4656
jne 0x401246
or dword [esp + 0x10], 8
inc esi
jmp 0x401118
and cx, 0xf0ff
cmp cx, 0x302d
jne 0x401285
jmp 0x401118
lea eax, [esi + 1]
mov dword [0x4056e4], esi
cmp byte [eax], 0x2a
jne 0x401284
and byte [esi], 0
mov esi, eax
jmp 0x401284
and dword [esp + 0x1c], 0
jmp 0x401284
cmp word [esi], 0x5c5c
je 0x401282
cmp word [esi + 1], 0x5c3a
jne 0x401284
mov edi, esi
inc esi
mov al, byte [esi]
test al, al
jne 0x4010fc
test edi, edi
je 0x401304
cmp byte [edi], al
mov ecx, edi
mov dword [esp + 0x18], ecx
je 0x4012a7
inc ecx
cmp byte [ecx], 0
jne 0x40129d
mov dword [esp + 0x18], ecx
cmp byte [ecx - 1], 0x22
lea eax, [ecx - 1]
jne 0x4012b9
mov ecx, eax
and byte [ecx], 0
mov dword [esp + 0x18], ecx
mov eax, dword [ecx - 4]
and eax, 0xdfdfdfff
cmp eax, 0x5458542e
push edi
jne 0x4012e1
push 0xffffffffffffffff
call fcn.00402caa
test eax, eax
pop ecx
pop ecx
je 0x401304
or dword [esp + 0x10], 8
mov dword [esp + 0x28], edi
jmp 0x401304
push ebp
call fcn.00403887
mov edi, eax
dec edi
cmp byte [edi], 0x5c
pop ecx
pop ecx
mov dword [esp + 0x20], edi
jne 0x401304
push 0x3e
call fcn.004031e5
cmp edi, eax
pop ecx
jne 0x401304
and byte [edi], 0
mov eax, dword [esp + 0x24]
mov dword [eax], 0x6d6863
mov eax, dword [esp + 0x10]
and eax, 0x18
cmp al, 0x10
jne 0x40132f
push 0x40
call fcn.004031e5
test eax, eax
pop ecx
jne 0x40132f
xor edi, edi
mov dword [0x40529c], edi
jmp 0x401331
xor edi, edi
mov eax, dword [esp + 0x10]
test al, 1
mov dword [0x4056c8], eax
je 0x401350
mov eax, dword [0x4056e4]
neg eax
sbb eax, eax
not eax
and eax, esi
mov dword [0x4056e4], eax
mov eax, dword [esp + 0x10]
and eax, 6
push 0x8001
mov dword [0x4056e0], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x38]
push eax
push 2
push dword [esp + 0x3c]
mov dword [esp + 0x44], 0x28
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_MonitorFromPoint]
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
test eax, eax
je 0x401821
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x30], eax
jge 0x4013a8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x30], eax
jle 0x4013b6
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x34], eax
jge 0x4013c4
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x34], eax
jle 0x4013d2
mov dword [esp + 0x34], eax
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push dword [esp + 0x30]
dec eax
push edi
push edi
lea ecx, [eax + 5]
push ecx
mov dword [esp + 0x28], eax
lea eax, [eax + eax*2 + 0xa]
push eax
push dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add eax, 7
push eax
push 0x90c00000
push 0x405010
push str._SbFolder_3.840
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, edi
mov dword [0x405710], eax
je 0x401821
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x4056d0], eax
je 0x401c1d
push 0x37
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, eax
mov eax, dword [esp + 0x58]
sub eax, dword [esp + 0x50]
inc ecx
sub eax, 8
cdq
inc ecx
idiv ecx
mov dword [0x4056f4], ecx
add ecx, 0xfffffffc
shl ecx, 4
mov esi, eax
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x4c]
cdq
idiv ecx
mov ecx, 0x400
imul eax, esi
cmp eax, ecx
jle 0x40147d
mov eax, ecx
mov dword [0x4056f8], eax
mov dword [0x4056fc], esi
or dword [0x405284], 0xffffffff
test byte [esp + 0x10], 8
jne 0x4014d6
push 0x40529c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, ebx
jge 0x4014b9
cmp byte [0x40529c], 0x5c
je 0x4014b9
xor eax, eax
mov dword [0x405708], eax
jmp 0x4014e5
sar eax, 4
push 0x40
and eax, 1
pop ecx
sub ecx, eax
push ecx
call fcn.004031e5
mov dword [esp + 0x1c], eax
mov eax, dword [0x405708]
pop ecx
jmp 0x4014e5
push 1
pop eax
mov dword [0x405288], eax
mov dword [0x405708], eax
xor ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp eax, 0x1f
jae 0x40150f
cmp dword [eax*4 + 0x40564c], ebx
lea esi, [eax*4 + 0x40564c]
jne 0x40150b
lea esi, [eax*4 + 0x40564c]
call ebp
mov dword [esi], eax
mov esi, dword [esi]
jmp 0x401518
jne 0x401821
push 2
pop esi
call ebp
mov edi, eax
mov eax, dword [0x405708]
cmp eax, ebx
mov dword [eax*4 + 0x405648], edi
mov dword [0x40526c], eax
je 0x401586
cmp dword [0x405288], ebx
jg 0x401554
push dword [esp + 0x18]
push esi
push edi
call fcn.0040269f
add esp, 0xc
test eax, eax
je 0x40156f
xor eax, eax
mov dword [0x405708], eax
jmp 0x4014eb
push ebx
push edi
call fcn.00402caa
pop ecx
pop ecx
push ebx
push 0x8301
push 0x800
push edi
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0x40507d
push 0x8302
push ebx
push edi
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x4016f6
mov ebp, dword [0x40564c]
push 1
pop esi
mov dword [0x4053bc], 0x29412628
mov dword [esp + 0x20], 0x4053c1
mov dword [esp + 0x14], 0x5c3a41
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [esp + 0x24], eax
test dword [esp + 0x24], esi
je 0x401690
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 2
jl 0x401690
jne 0x4015e5
cmp byte [esp + 0x14], 0x43
jg 0x4015ef
dec esi
jmp 0x401613
cmp esi, 5
je 0x4015ef
cmp esi, 4
jne 0x4015f6
test byte [esp + 0x10], 0x10
jne 0x401613
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push 0x7f
push 0x4053c1
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x401627
and byte [0x4053c1], 0
cmp esi, 4
mov dword [esp + 0x18], 0x11
jne 0x401638
cmp byte [0x4053c1], 0
mov dword [esp + 0x18], 0x10
jne 0x40164f
lea eax, [esi + esi*2]
lea eax, [eax*4 + str.EXPLORER]
push eax
push 0x4053c1
call fcn.00403887
pop ecx
pop ecx
mov dl, byte [esp + 0x14]
cmp esi, 4
sete al
mov byte [0x4053be], dl
dec eax
and eax, 0xfffffff3
add eax, 0x2d
cmp dword [esp + 0x1c], 0
mov byte [0x4053c0], al
je 0x401683
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
test al, al
je 0x401683
cmp al, dl
je 0x401690
inc ecx
jmp 0x401676
push 0x4053bc
push ebp
push dword [esp + 0x20]
push edi
call ebx
mov ecx, dword [esp + 0x14]
and ecx, 0x1f
push 1
pop esi
shl esi, cl
inc dword [esp + 0x14]
cmp esi, dword [esp + 0x24]
jbe 0x4015b9
test byte [esp + 0x10], 0x40
jne 0x4016c8
push 0x3f
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test al, 1
je 0x4016c8
push 0x405098
push ebp
push 0x10
push edi
call ebx
test byte [esp + 0x11], 1
jne 0x4016da
push 0x4050ab
push ebp
push 0x10
push edi
call ebx
push 0
push 0x8301
push 0x800
push edi
call ebx
push 0x40506c
push ebp
push 0x10
push edi
call ebx
xor ebx, ebx
or dword [0x40570c], 0xffffffff
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [0x405700], 0x1f
call dword [sym.imp.USER32.dll_mouse_event]
push ebx
push 2
push ebx
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
push dword [0x405710]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x10]
and eax, 0x100
test byte [esp + 0x10], 0x80
mov dword [0x4056cc], eax
jne 0x40174c
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.USER32.dll_SetCursorPos]
push ebx
push dword [0x405710]
push ebx
push dword [esp + 0x40]
push dword [esp + 0x40]
push 0x110
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp dword [0x405284], ebx
mov esi, eax
jl 0x401821
push 0x1b0201
push 0x12200d10
call fcn.00403669
mov ebx, eax
cmp ebx, 0x10
pop ecx
pop ecx
jge 0x401813
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x405710]
jne 0x401813
cmp esi, 0x8301
mov dword [esp + 0x14], 5
ja 0x4017b5
test bl, 0xe
je 0x4017ca
push 0
and ebx, 0xc
or ebx, 2
push ebx
push 0x121
push 0
call fcn.00401c59
test byte [0x4056dc], 1
jne 0x401818
cmp dword [0x405704], 0x8302
jne 0x40183b
test byte [0x405284], 1
jne 0x4017ee
dec dword [0x40526c]
mov eax, dword [0x40526c]
test eax, eax
jle 0x401800
push eax
call fcn.004031e5
pop ecx
jmp 0x401807
and byte [0x40529c], 0
mov dword [0x40561c], 0x80
jmp 0x40183b
test bl, 1
je 0x401821
and dword [0x405618], 0
jmp 0x40183b
push 0x405018
push 0
push 0xc
push dword [0x405710]
call dword [sym.imp.USER32.dll_SendMessageA]
or dword [esp + 0x14], 0xffffffff
mov esi, 0x4056c4
xor edi, edi
mov eax, dword [esi]
cmp eax, edi
je 0x401851
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [esi], edi
sub esi, 4
cmp esi, 0x405648
jge 0x401842
test byte [esp + 0x11], 1
mov dword [0x405708], edi
jne 0x401882
cmp dword [esp + 0x14], edi
jl 0x401876
push edi
call fcn.00402f8e
pop ecx
push dword [0x4056cc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0xff120201
push 0x2e737271
call fcn.00403669
push 0xffffffffffffffff
push 0x970200d
call fcn.00403669
push edi
push edi
push edi
call fcn.00403713
add esp, 0x1c
cmp dword [esp + 0x14], edi
jl 0x401a4a
mov ebp, 0x4054ec
push 0xffffffffffffffff
push 0x1d1b1011
call fcn.00403669
mov eax, dword [esp + 0x1c]
shl eax, 3
mov esi, dword [eax + 0x405618]
test esi, esi
pop ecx
pop ecx
je 0x401a40
mov ecx, dword [eax + 0x40561c]
cmp ecx, 0x40
mov edi, esi
mov dword [0x4056dc], ecx
jl 0x40191f
mov eax, ecx
and eax, 0x38f
cmp eax, 1
jne 0x401a40
test cl, 0x10
je 0x401918
push 0
call fcn.004038ae
test eax, eax
pop ecx
jne 0x401a40
mov ecx, dword [0x4056dc]
mov esi, 0x405146
jmp 0x401980
cmp byte [esi], 0
je 0x401a40
test cl, 1
jne 0x401a15
mov eax, dword [esp + 0x10]
and eax, 0x20
xor ecx, eax
push esi
mov dword [0x4056dc], ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jge 0x401954
cmp byte [esi], 0x5c
jne 0x401a40
mov ecx, dword [0x4056dc]
test cl, 2
jne 0x4019e3
test cl, 1
jne 0x401a40
test al, 0x10
je 0x401990
test cl, 0x1c
jne 0x401990
cmp word [esi], 0x5c
jne 0x401980
mov esi, 0x405118
test cl, 0x20
je 0x4019fe
sub esi, 4
mov dword [esi], 0x202c452f
jmp 0x4019fe
test cl, 0x14
je 0x4019ab
cmp byte [esi], 0
je 0x401a40
push esi
call fcn.004038ae
test eax, eax
pop ecx
jne 0x401a0b
jmp 0x4019b0
test cl, 8
je 0x4019cf
push esi
push str.shell32_OpenAs_RunDLL
push ebp
mov ebx, ebp
call fcn.00403887
pop ecx
pop ecx
push eax
call fcn.00403887
pop ecx
pop ecx
mov esi, str.rundll32
jmp 0x4019d1
xor ebx, ebx
push 0x1f
push ebx
push esi
call fcn.00403713
add esp, 0xc
test eax, eax
jl 0x4019e7
jmp 0x401a0b
test al, 0x10
jne 0x401a15
lea esi, [edi - 0xc]
mov dword [esi], 0x202c4e2f
mov dword [esi + 4], 0x4c45532f
mov dword [esi + 8], 0x2c544345
push 0x1d
push esi
push 0
call fcn.00403713
add esp, 0xc
and dword [edi], 0
and dword [esp + 0x20], 0
jmp 0x401a40
mov esi, dword [0x405708]
push edi
push edi
call fcn.004034ac
test eax, eax
pop ecx
pop ecx
jne 0x401a3a
and byte [edi], al
push 0x20
mov dword [0x405708], esi
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x401a40
jl 0x401b25
dec dword [esp + 0x14]
jns 0x4018b7
mov eax, dword [0x405708]
test eax, eax
je 0x401b38
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x401b31
and byte [esi], 0
mov dword [0x40570c], esi
mov dword [esp + 0x14], 5
mov eax, dword [esp + 0x14]
shl eax, 3
mov ecx, dword [eax + 0x405618]
test ecx, ecx
mov dword [esp + 0x18], ecx
je 0x401ac9
cmp byte [ecx], 0
je 0x401ac9
mov eax, dword [eax + 0x40561c]
cmp eax, 0x40
mov dword [0x4056dc], eax
jge 0x401ac9
test al, 1
je 0x401ac9
push ecx
or eax, 0x80000000
push ecx
mov dword [0x4056dc], eax
call fcn.004034ac
test eax, eax
pop ecx
pop ecx
jle 0x401acf
dec dword [esp + 0x14]
jns 0x401a84
mov eax, dword [0x40570c]
and byte [eax - 2], 0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [esp + 0x14], 0
jge 0x401b31
cmp byte [esi], 0
je 0x401b31
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401b31
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x401b09
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x401b1d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x401b38
mov dword [0x40561c], 0x70
jmp 0x401b38
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, 0x405640
xor edi, edi
mov eax, dword [esi]
cmp eax, edi
je 0x401b51
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi], edi
sub esi, 8
cmp esi, 0x405618
jg 0x401b3f
mov eax, dword [0x40561c]
and dword [esp + 0x10], 0xfffffff7
test al, 0x40
je 0x401be5
cmp dword [esp + 0x20], edi
jne 0x401b7b
push 0x180
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x40561c]
test al, 0x80
je 0x401b8f
test al, 1
jne 0x401b93
or dword [esp + 0x10], 8
jmp 0x401be9
test al, 2
je 0x401ba7
mov eax, dword [esp + 0x28]
cmp eax, edi
jne 0x401c11
push edi
push 1
call fcn.00402caa
pop ecx
pop ecx
jmp 0x401c11
test al, 1
jne 0x401c1d
xor ecx, ecx
cmp eax, 0x70
setl cl
add ecx, 0x5203
mov eax, ecx
mov dword [esp + 0x14], eax
and eax, 1
lea eax, [eax + eax*2]
shl ecx, 4
push ecx
shl eax, 5
push str._SbFolder_3.840
add eax, 0x405170
push eax
push dword [0x405710]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401c1d
test al, 0x80
je 0x401c00
mov dword [0x405288], edi
mov dword [0x40561c], edi
mov dword [0x405274], edi
jmp 0x401488
test ah, 1
je 0x401c1d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [eax], 0x22
jne 0x401c11
inc eax
push 0x1f
push edi
push eax
call fcn.00403713
add esp, 0xc
push dword [0x405710]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x405610]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push dword [0x405614]
call esi
push dword [0x4056d0]
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]