Function at 0x404c00
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5c10
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x170
mov eax, dword [0x50e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x164], 1
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 7
mov word [ebp - 0x160], ax
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x138], eax
mov word [ebp - 0x148], ax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x170]
push eax
mov dword [ebp - 0x134], 7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x16c], eax
test eax, eax
je 0x404d9d
mov edi, 1
cmp dword [ebp - 0x170], edi
jle 0x404d96
nop word [eax + eax]
mov esi, dword [eax + edi*4]
mov ecx, str.__typeutility
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404d06
test dx, dx
je 0x404d02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404d06
add eax, 4
add ecx, 4
test dx, dx
jne 0x404ce0
xor eax, eax
jmp 0x404d0b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404d17
mov byte [ebp - 0x164], al
jmp 0x404d83
push 8
push str.__entry
push esi
call fcn.004a75c8
add esp, 0xc
test eax, eax
jne 0x404d4b
add esi, 0x10
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d33
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x148]
jmp 0x404d7d
push 7
push str.__from
push esi
call fcn.004a75c8
add esp, 0xc
test eax, eax
jne 0x404d83
add esi, 0xe
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d67
sub ecx, edx
sar ecx, 1
push ecx
lea ecx, [ebp - 0x160]
push esi
call fcn.00402870
mov eax, dword [ebp - 0x16c]
inc edi
cmp edi, dword [ebp - 0x170]
jl 0x404cd0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x80
lea eax, [ebp - 0x98]
mov byte [ebp - 0x165], 0
push 0
push eax
call fcn.004a2d80
add esp, 0xc
lea eax, [ebp - 0x98]
push 0xbb
push 0
push 0
push 6
push str._d._d._d._d
push 0xffffffffffffffff
push 0x40
push eax
call fcn.00402c00
add esp, 0x20
lea ecx, [ebp - 0xe0]
call fcn.00402f40
lea ecx, [ebp - 0x17c]
call fcn.00406080
push 0x20
xor eax, eax
mov dword [ebp - 0xb8], 0
push str.helper_2345.child_process.common
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
call fcn.00402870
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x174]
call fcn.00406090
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x404e7b
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404e71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059ea
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x164], al
je 0x40557c
push 0x13
push str.helper_2345explorer
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
call fcn.00402870
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x17c]
call fcn.00406100
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x404f2d
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404f23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059ef
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x17c], eax
je 0x404f69
cmp byte [ebp - 0x177], al
je 0x404f69
lea esi, [eax + 0x32]
jmp 0x4058bc
mov edi, dword [ebp - 0x174]
test edi, edi
je 0x404f80
cmp byte [ebp - 0x16f], 0
jne 0x40555e
lea ecx, [ebp - 0xf8]
call fcn.00402c50
push 0xa
xor eax, eax
mov dword [ebp - 0xa0], 0
push str.Statistics
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
call fcn.00402870
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.0040a200
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0xf8]
cmp eax, esi
je 0x405014
mov ecx, eax
call fcn.00402290
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xf8], xmm0
movq xmm0, qword [esi + 0x10]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
movq qword [ebp - 0xe8], xmm0
mov word [esi], ax
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x40505b
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405051
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059f4
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
mov dword [ebp - 4], 0x12
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x4050bf
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4050b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059f9
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
push eax
push 0x4ecce0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
call fcn.00402870
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x160]
push eax
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402770
lea ecx, [ebp - 0xc8]
call fcn.004049f0
add esp, 0x18
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00401990
mov ecx, eax
call fcn.00401a40
mov dword [ebp - 4], 0x16
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x40517d
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405173
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4059fe
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
mov dword [ebp - 4], 0x1a
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x4051e1
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4051d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a03
push edx
push ecx
call fcn.004a12e5
add esp, 8
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x130]
xor eax, eax
mov dword [ebp - 0x120], 0
push 0xb
mov dword [ebp - 0x11c], 7
xorps xmm0, xmm0
mov word [ebp - 0x130], ax
mov dword [ebp - 4], 0xffffffff
push 0x4e8e90
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
movlpd qword [ebp - 0x108], xmm0
mov byte [ebp - 0x100], al
call fcn.00402870
lea eax, [ebp - 0x130]
mov dword [ebp - 0x118], 0
xorps xmm0, xmm0
mov dword [ebp - 0x114], 0
push eax
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
movlpd qword [ebp - 0x108], xmm0
call fcn.00401990
mov ecx, eax
call fcn.0041c560
xor eax, eax
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4052b3
sub ecx, edx
lea eax, [ebp - 0x98]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xb0]
call fcn.00402870
push 7
xor eax, eax
mov dword [ebp - 0xb8], 0
push str.EXE_VER
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
call fcn.00402870
call fcn.00401990
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, dword [eax]
call fcn.00424cc0
mov dword [ebp - 4], 0x1f
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x405365
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40535b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a08
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
mov dword [ebp - 4], 0x23
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x4053c9
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4053bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a0d
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
lea ecx, [ebp - 0xe0]
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x165], 1
call fcn.00403230
mov esi, eax
mov dword [ebp - 0xa0], 0
push 7
xor eax, eax
mov dword [ebp - 0x9c], 7
push str.TJSJ_01
lea ecx, [ebp - 0xb0]
mov word [ebp - 0xb0], ax
call fcn.00402870
call fcn.00401990
mov ecx, dword [eax]
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00424a30
mov dword [ebp - 4], 0x27
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x40548f
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405485
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a12
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
mov dword [ebp - 4], 0x2c
mov edx, dword [ebp - 0x11c]
cmp edx, 8
jb 0x4054f3
mov ecx, dword [ebp - 0x130]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4054e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a17
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 7
mov word [ebp - 0x130], ax
mov dword [ebp - 4], 0x30
mov edx, dword [ebp - 0xe4]
cmp edx, 8
jb 0x405557
mov ecx, dword [ebp - 0xf8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40554d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1c
push edx
push ecx
call fcn.004a12e5
add esp, 8
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x405573
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x174], 0
mov word [ebp - 0x170], 0
cmp dword [ebp - 0xd0], 0
jne 0x405645
cmp byte [ebp - 0x165], 0
je 0x4057ee
push 7
xor eax, eax
mov dword [ebp - 0xa0], 0
push str.TJSJ_02
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
call fcn.00402870
call fcn.00401990
push 0
push 1
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, dword [eax]
call fcn.00424a30
mov dword [ebp - 4], 0x34
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x405623
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405619
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a21
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
jmp 0x4057b6
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
cmovae eax, dword [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x405705
cmp byte [ebp - 0x165], al
je 0x4057ee
push str.TJSJ_02
lea ecx, [ebp - 0xb0]
call fcn.00402700
call fcn.00401990
push edi
push 2
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, dword [eax]
call fcn.00424a30
mov dword [ebp - 4], 0x3c
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x4056e3
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4056d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a26
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
jmp 0x4057b6
push str.HelperMain
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x16c], eax
test eax, eax
jne 0x4057f8
cmp byte [ebp - 0x165], al
je 0x4057ee
push str.TJSJ_02
lea ecx, [ebp - 0xb0]
call fcn.00402700
call fcn.00401990
push 0
push 3
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, dword [eax]
call fcn.00424a30
mov dword [ebp - 4], 0x44
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x405799
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40578f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a2b
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
mov dword [ebp - 4], 0xffffffff
call fcn.00401990
mov ecx, eax
call fcn.004022f0
call fcn.00401990
mov esi, dword [eax]
cmp byte [esi], 0
je 0x4057ee
call fcn.0042ae50
push esi
mov ecx, eax
call fcn.0042b2e0
push 0
mov ecx, esi
call fcn.004256c0
mov byte [esi], 0
mov esi, 0x33
jmp 0x4058bc
cmp byte [ebp - 0x164], 0
je 0x405826
call fcn.00401990
mov esi, dword [eax]
cmp byte [esi], 0
je 0x405826
call fcn.0042ae50
push esi
mov ecx, eax
call fcn.0042b2e0
push 0
mov ecx, esi
call fcn.004256c0
mov byte [esi], 0
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0xb0]
call fcn.00402700
lea eax, [ebp - 0xb0]
push eax
call dword [ebp - 0x16c]
add esp, 4
mov esi, eax
mov dword [ebp - 4], 0x4c
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x405891
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405887
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a30
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
push edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x174]
call fcn.004060b0
lea ecx, [ebp - 0x17c]
call fcn.004060b0
mov dword [ebp - 4], 0x50
mov edx, dword [ebp - 0xcc]
cmp edx, 8
jb 0x405919
mov ecx, dword [ebp - 0xe0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40590f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a35
push edx
push ecx
call fcn.004a12e5
add esp, 8
xor eax, eax
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
mov dword [ebp - 4], 0x55
mov edx, dword [ebp - 0x134]
cmp edx, 8
jb 0x40597d
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405973
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a3a
push edx
push ecx
call fcn.004a12e5
add esp, 8
mov byte [ebp - 4], 0x59
mov edx, dword [ebp - 0x14c]
cmp edx, 8
jb 0x4059c1
mov ecx, dword [ebp - 0x160]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4059b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a3f
push edx
push ecx
call fcn.004a12e5
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a100a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
call fcn.004a4ce9
int3