Function at 0x401b50
Capabilities:
Accept command line arguments
Get common file path
Manipulate boot configuration

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
push 0x405740
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], esi
jne 0x401ba8
push 0x404670
call fcn.00401000
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 0x10
mov eax, dword [esp + 0x10]
cmp eax, 2
je 0x401bdc
cmp eax, 3
je 0x401bdc
push 0x404658
call fcn.00401000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x214
ret 0x10
call fcn.00401a60
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 3
jne 0x401c7c
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
lea edx, [esp + 0x128]
push 0x103
stosb byte es:[edi], al
mov eax, dword [esi + 8]
push edx
push 0xffffffffffffffff
push eax
push 0x200
push ebx
call ebp
mov esi, str._setdefault
lea eax, [esp + 0x120]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401c5b
cmp cl, bl
je 0x401c57
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401c5b
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401c37
xor eax, eax
jmp 0x401c60
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401c78
push 0x404624
call fcn.00401000
add esp, 4
mov byte [0x405338], 1
mov esi, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi + 4]
push ebx
push ebx
lea eax, [esp + 0x24]
push 0x103
push eax
push 0xffffffffffffffff
push ecx
push 0x200
push ebx
call ebp
push 0x103
push 0x404a14
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x401ce4
push 0x404604
call fcn.00401000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x214
ret 0x10
call fcn.004011c0
or ecx, 0xffffffff
mov edi, 0x404a14
xor eax, eax
mov byte [0x404a16], 0x5c
mov byte [0x404a17], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x404b18
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.boot.ini
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x404b18
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x404a14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404c1c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ORMLdr
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x404c1c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x404a14
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404d20
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x4045e8
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, edi
mov edx, ecx
mov edi, 0x404d20
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x103
and ecx, 3
push 0x40502c
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str._bcdedit.exe
or ecx, 0xffffffff
xor eax, eax
push 0x103
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x405234
mov esi, edi
mov edx, ecx
mov edi, 0x40502c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str.powercfg.exe
or ecx, 0xffffffff
xor eax, eax
push str.Wow64DisableWow64FsRedirection
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.kernel32.dll
mov esi, edi
mov edx, ecx
mov edi, 0x405234
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
cmp eax, ebx
je 0x401e84
lea ecx, [esp + 0x18]
push ecx
call eax
mov esi, str._install
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401eb1
cmp cl, bl
je 0x401ead
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401eb1
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401e8d
xor eax, eax
jmp 0x401eb6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401ed1
push 0x404578
call fcn.00401000
add esp, 4
call fcn.00401230
jmp 0x401f63
mov esi, str._remove
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401efe
cmp cl, bl
je 0x401efa
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401efe
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401eda
xor eax, eax
jmp 0x401f03
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401f1b
push 0x40455c
call fcn.00401000
add esp, 4
call fcn.00401890
jmp 0x401f63
mov esi, str._rmdefault
lea eax, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401f48
cmp cl, bl
je 0x401f44
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401f48
add eax, 2
add esi, 2
cmp cl, bl
jne 0x401f24
xor eax, eax
jmp 0x401f4d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401f63
push 0x404530
call fcn.00401000
add esp, 4
call fcn.00401790
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call ebp
cmp eax, ebx
je 0x401f7d
lea ecx, [esp + 0x18]
push ecx
call eax
call fcn.00402720
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x404500
call fcn.00401000
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 0x10