Function at 0x4171b0
Capabilities:
Accept command line arguments
Get hostname
Get session user name
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x5b0]
sub esp, 0x5b0
push 0xfffffffffffffffe
push 0x508fe0
push 0x4b7620
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x52e144]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x5ac], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
push 0x5104d4
call fcn.00404690
push eax
push esi
call fcn.004b9929
add esp, 0xc
test eax, eax
je 0x417220
call fcn.0040f550
xor eax, eax
jmp 0x417b73
push str.x01_
push esi
call fcn.004b9929
add esp, 8
xor ebx, ebx
cmp eax, ebx
je 0x417236
mov esi, eax
mov al, byte [esi]
cmp al, 0x5c
jne 0x41729d
lea edx, [ebp + 0x480]
add esi, 2
mov al, byte [esi]
cmp al, 0x39
jg 0x417253
movsx eax, al
sub eax, 0x30
jmp 0x417262
cmp al, 0x46
movsx eax, al
jg 0x41725f
sub eax, 0x37
jmp 0x417262
sub eax, 0x57
shl eax, 4
inc esi
mov cl, byte [esi]
cmp cl, 0x39
jg 0x417275
movsx ecx, cl
sub ecx, 0x30
jmp 0x417285
cmp cl, 0x46
movsx ecx, cl
jg 0x417282
sub ecx, 0x37
jmp 0x417285
sub ecx, 0x57
add eax, ecx
inc esi
mov byte [edx], al
inc edx
cmp byte [esi], bl
jne 0x417242
mov byte [edx], bl
lea eax, [ebp + 0x480]
push eax
jmp 0x41734c
cmp al, 0x30
jne 0x41735a
push 0x100
push ebx
lea ecx, [ebp + 0x480]
push ecx
call fcn.004b6dc0
add esp, 0xc
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4172c0
sub eax, edx
push eax
push esi
lea edx, [ebp + 0x480]
push edx
call fcn.004b6e40
add esp, 0xc
xor eax, eax
mov dword [ebp + 0x5a1], eax
mov dword [ebp + 0x5a5], eax
mov word [ebp + 0x5a9], ax
mov byte [ebp + 0x5ab], al
xor esi, esi
jmp 0x417300
mov ax, word [ebp + esi*2 + 0x480]
mov word [ebp + 0x5a0], ax
push 0x10
push ebx
lea ecx, [ebp + 0x5a0]
push ecx
call fcn.004b8fb7
add esp, 0xc
mov byte [ebp + esi + 0x480], al
inc esi
cmp esi, 0xfc
jae 0x417345
cmp word [ebp + esi*2 + 0x480], bx
jne 0x417300
cmp word [ebp + esi*2 + 0x482], bx
jne 0x417300
lea edx, [ebp + 0x480]
push edx
call fcn.004045b0
lea esi, [ebp + 0x480]
add esp, 4
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x30], ebx
push 0x538350
push 0x53834c
push 0x538348
push 0x538344
lea eax, [ebp - 0x4c]
push eax
push 0x537880
push 0x53755c
lea ecx, [ebp + 0x580]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x34]
push eax
push 0x510498
call fcn.00404690
add esp, 4
push eax
push esi
call fcn.004b9078
add esp, 0x3c
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp edi, 6
jge 0x4173e5
push 0x80020100
push 0x1c9ed2a0
push 0x3a99
call fcn.0040a3f0
add esp, 0xc
xor eax, eax
jmp 0x417b73
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x5378bc]
cmp eax, ecx
je 0x417400
add ecx, 0xfff00000
cmp eax, ecx
je 0x417570
cmp dword [ebp - 0x30], 1
jne 0x417570
cmp dword [ebp - 0x20], ebx
je 0x417570
cmp dword [ebp - 0x1c], ebx
je 0x417570
push 0x510480
call fcn.004045b0
add esp, 4
push eax
push 0x510470
call fcn.004045b0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0040fed0
cmp eax, ebx
je 0x417570
lea ecx, [ebp - 0x3d]
push ecx
push ebx
push ebx
push 0x14
call eax
test eax, eax
jge 0x417570
mov dword [ebp - 0x54], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], 0
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x52ced9
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [0x537880]
push ecx
mov edx, dword [0x53755c]
push edx
lea eax, [ebp + 0x580]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 2
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0x51044c
call fcn.004045b0
add esp, 4
push eax
lea edx, [ebp + 0x400]
push edx
call fcn.004b79a8
lea eax, [ebp + 0x400]
push eax
call fcn.004041d0
add esp, 0x30
mov ebx, eax
mov dword [ebp - 0x58], ebx
lea edi, [ebp]
mov dword [ebp - 0x50], edi
lea eax, [ebp + 0x400]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4174e5
sub eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], 0
jmp 0x417500
mov ecx, dword [ebp - 0x24]
add ecx, 4
cmp dword [ebp - 0x44], ecx
jge 0x41752b
movzx eax, byte [ebx]
inc ebx
mov dword [ebp - 0x58], ebx
push eax
push str.x_02x
push edi
call fcn.004b79a8
add esp, 0xc
add edi, eax
mov dword [ebp - 0x50], edi
inc dword [ebp - 0x44]
jmp 0x417500
mov byte [edi], 0
lea edx, [ebp]
push edx
call fcn.0040fc00
add esp, 4
test eax, eax
je 0x417549
push 0x7d0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp]
push eax
call fcn.0040fa20
add esp, 4
test eax, eax
je 0x417564
push 0x3e8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xfffffffe
mov edi, dword [ebp - 0x2c]
xor ebx, ebx
push 0xc350
push ebx
push ebx
push 0x510434
call fcn.00404690
add esp, 4
push eax
mov ecx, 0x527e20
call fcn.00409a00
push 0x50d930
call fcn.00404690
add esp, 4
push str.Tue_Sep__8_17:51:58_2015
push 0xd05
push 0x50d930
call fcn.00404690
add esp, 4
push eax
push 0x5103f8
call fcn.004045b0
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x14
lea ecx, [ebp + 0x480]
cmp esi, ecx
jne 0x4175f5
push esi
push 0x5103ec
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
push esi
push edi
push 0x5103d4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x5378bc]
cmp eax, ecx
je 0x417680
lea edx, [ecx - 0x100000]
cmp eax, edx
je 0x417680
push ecx
push eax
push 0x5103bc
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x80020100
push 0x1c9ef9b0
push 0x3a99
call fcn.0040a3f0
add esp, 0x1c
xor eax, eax
jmp 0x417b73
mov ecx, 0x539708
call fcn.0040a6a0
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x5378bc]
cmp eax, ecx
je 0x4176a1
add ecx, 0xfff00000
cmp eax, ecx
je 0x4176d0
cmp dword [ebp - 0x30], 2
jne 0x4176d0
cmp dword [ebp - 0x20], ebx
je 0x4176d0
cmp dword [ebp - 0x1c], ebx
je 0x4176d0
push 0x5103b0
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
mov byte [0x537552], 1
push 0x510480
call fcn.004045b0
add esp, 4
push eax
push 0x510470
call fcn.004045b0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0040fed0
mov esi, eax
cmp esi, ebx
je 0x417736
lea eax, [ebp - 0x25]
push eax
push ebx
push ebx
push 0x14
call esi
test eax, eax
jl 0x41771e
lea ecx, [ebp - 0x25]
push ecx
push ebx
push 1
push 0x14
call esi
push 0x51038c
jmp 0x417723
push 0x510370
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp dword [ebp - 0x20], ebx
je 0x417994
cmp dword [ebp - 0x1c], ebx
je 0x417994
mov dword [ebp - 0x2c], ebx
lea edx, [ebp - 0x2c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x52ced9
cmp byte [0x537552], 0
je 0x41776b
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
jne 0x41779f
push 0x40000411
push 0x1c9f20c0
push 0x36b3
call fcn.0040a3f0
add esp, 0xc
xor eax, eax
jmp 0x417b73
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
je 0x417859
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], ecx
push 2
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov eax, dword [ebp - 0x20]
push eax
push esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call edi
mov ebx, eax
test ebx, ebx
je 0x4177dd
cmp dword [ebp - 0x20], 0
jne 0x417808
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push ebx
push 0x51033c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x18
push 2
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x41782c
cmp dword [ebp - 0x1c], 0
jne 0x41785f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x24]
push eax
push ebx
push 0x510308
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x18
jmp 0x41785f
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 2
push 0
push 0
push 0x53755c
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
push eax
mov ecx, dword [0x53755c]
push ecx
push esi
call edi
push 2
push 0
push 0
push 0x537880
call ebx
push eax
mov edx, dword [0x537880]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
je 0x41792a
push ecx
push eax
mov ecx, dword [0x53970c]
call fcn.00405c40
mov esi, eax
test esi, esi
jne 0x4178fe
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
push eax
push 0x5102e8
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x40000411
push 0x1c9f47d0
push 0x2710
call fcn.0040a3f0
add esp, 0x18
xor eax, eax
jmp 0x417b73
push esi
mov eax, dword [0x53970c]
mov ecx, dword [eax]
push ecx
push 0x5102cc
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
mov dword [0x537898], esi
jmp 0x4179d1
mov dword [0x537c58], 1
push 0x5102bc
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x417959
cmp dword [ebp - 0x1c], 0
jne 0x4179d4
mov edx, dword [ebp - 0x1c]
push edx
push eax
push 0x5102a4
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
push 0x40000411
push 0x1c9f47d0
push 0x2710
call fcn.0040a3f0
add esp, 0x1c
xor eax, eax
jmp 0x417b73
cmp byte [0x537552], 0
jne 0x4179d4
mov ecx, dword [0x53970c]
call fcn.00405c00
cmp eax, ebx
je 0x4178bd
push eax
mov eax, dword [0x53970c]
mov ecx, dword [eax]
push ecx
push 0x5102cc
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
xor esi, esi
mov dword [ebp - 0x30], esi
mov edx, dword [ebp - 0x3c]
push edx
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x539720], eax
mov ecx, dword [ebp - 0x30]
mov dword [0x539724], ecx
mov dword [0x539728], esi
mov edx, dword [ebp - 0x3c]
mov dword [0x539714], edx
lea ecx, [ebp - 0x48]
push ecx
push esi
push eax
call 0x52ced9
mov edx, dword [ebp - 0x48]
mov dword [0x539718], edx
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax + 0x580]
mov byte [eax + 0x53972c], cl
inc eax
test cl, cl
jne 0x417a20
push esi
lea eax, [ebp + 0x580]
push eax
call fcn.0040aa50
add esp, 8
mov ecx, dword [0x53970c]
mov dword [ecx + 0x2c], esi
mov byte [0x539708], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x537894], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x510288
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
push 2
mov edx, dword [0x53970c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x51027c
call fcn.00404690
push eax
push 0x53972c
call fcn.004b9a67
add esp, 0xc
test eax, eax
je 0x417b6e
push 0x510270
call fcn.00404690
push eax
push 0x53972c
call fcn.004b9a67
add esp, 0xc
test eax, eax
je 0x417b6e
push 0x510260
call fcn.00404690
push eax
push 0x53972c
call fcn.004b9a67
add esp, 0xc
test eax, eax
je 0x417b6e
push 0x510250
call fcn.00404690
push eax
push 0x53972c
call fcn.004b9a67
add esp, 0xc
test eax, eax
je 0x417b6e
push 0x510240
call fcn.00404690
push eax
push 0x53972c
call fcn.004b9a67
add esp, 0xc
test eax, eax
je 0x417b6e
push 0x51022c
call fcn.00404690
push eax
push 0x53972c
call fcn.004b9a67
add esp, 0xc
test eax, eax
je 0x417b6e
mov esi, 0x20
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x24]
push ecx
push 0x52b5f4
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0x24], esi
lea edx, [ebp - 0x24]
push edx
push str.undef
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5ac]
xor ecx, ebp
call fcn.004b6da3
add ebp, 0x5b0
mov esp, ebp
pop ebp
ret