Function at 0x4140e0
Capabilities:
Accept command line arguments
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f070
mov eax, dword fs:[0]
push eax
sub esp, 0x8bc
mov eax, dword [0x476458]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x8a8]
xor ebx, ebx
push eax
mov dword [ebp - 0x8a8], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x8a4], eax
cmp eax, ebx
je 0x4144ab
mov dword [ebp - 0x8a0], ebx
cmp dword [ebp - 0x8a8], ebx
jle 0x4144ab
lea ebx, [ebx]
mov ecx, dword [ebp - 0x8a4]
mov edx, dword [ebp - 0x8a0]
mov eax, dword [ecx + edx*4]
xor edi, edi
cmp eax, edi
jne 0x41416a
mov eax, 0x464c78
xor ecx, ecx
mov word [ebp - 0x82c], cx
mov ecx, eax
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], edi
lea esi, [ecx + 2]
jmp 0x414190
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x414190
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x82c]
call fcn.00408f90
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x81c]
cmp eax, edi
je 0x414454
test eax, eax
je 0x41451b
mov edx, dword [ebp - 0x818]
mov ecx, dword [ebp - 0x82c]
mov eax, ecx
cmp edx, 8
jae 0x4141d9
mov eax, esi
cmp word [eax], 0x2d
je 0x4141f6
mov eax, ecx
cmp edx, 8
jae 0x4141ec
lea eax, [ebp - 0x82c]
cmp word [eax], 0x2f
jne 0x414454
mov eax, 1
xor ecx, ecx
lea esi, [ebp - 0x82c]
call fcn.00403110
call fcn.0043f5a4
mov esi, eax
mov dword [ebp - 0x8c0], esi
call fcn.0043f363
push 0
lea ecx, [ebp - 0x8b8]
mov edi, eax
call fcn.0043f698
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x414235
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x8b8]
call fcn.0043f6c0
push ecx
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x8ac], esp
push 0
lea ecx, [ebp - 0x8c8]
mov dword [eax], esi
call fcn.0043f698
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x414268
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x8c8]
call fcn.0043f6c0
lea edx, [ebp - 0x82c]
push edx
call fcn.00414800
add esp, 8
push 0
lea ecx, [ebp - 0x8c4]
mov bl, al
mov byte [ebp - 4], 0
call fcn.0043f698
mov eax, dword [esi + 4]
test eax, eax
je 0x4142a5
cmp eax, 0xffffffff
jae 0x4142a5
dec eax
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x8c4]
not edi
call fcn.0043f6c0
and edi, esi
je 0x4142c7
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
test bl, bl
je 0x41438d
mov eax, dword [ebp - 0x8a4]
mov ecx, dword [ebp - 0x8a0]
mov eax, dword [eax + ecx*4 + 4]
test eax, eax
jne 0x4142e8
mov eax, 0x464c78
xor edi, edi
mov ebx, 7
xor edx, edx
mov ecx, eax
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x838], edi
mov word [ebp - 0x848], dx
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x414310
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x848]
call fcn.00408f90
mov eax, dword [ebp - 0x848]
mov esi, 8
cmp dword [ebp - 0x834], esi
jae 0x414344
lea eax, [ebp - 0x848]
push eax
call fcn.00441e3b
add esp, 4
cmp eax, edi
je 0x414356
mov dword [0x47b0a0], eax
inc dword [ebp - 0x8a0]
cmp dword [ebp - 0x834], esi
jb 0x414373
mov eax, dword [ebp - 0x848]
push eax
call fcn.004410cb
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x838], edi
mov word [ebp - 0x848], cx
jmp 0x414454
call fcn.0043f5a4
mov esi, eax
mov dword [ebp - 0x8ac], esi
call fcn.0043f363
push 0
lea ecx, [ebp - 0x8bc]
mov edi, eax
call fcn.0043f698
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4143ba
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x8bc]
call fcn.0043f6c0
push ecx
mov byte [ebp - 4], 2
mov eax, esp
mov dword [ebp - 0x8c0], esp
push 0
lea ecx, [ebp - 0x8b4]
mov dword [eax], esi
call fcn.0043f698
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x4143ed
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x8b4]
call fcn.0043f6c0
lea edx, [ebp - 0x82c]
push edx
call fcn.00414980
add esp, 8
push 0
lea ecx, [ebp - 0x8b0]
mov bl, al
mov byte [ebp - 4], 0
call fcn.0043f698
mov eax, dword [esi + 4]
test eax, eax
je 0x41442a
cmp eax, 0xffffffff
jae 0x41442a
dec eax
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x8b0]
not edi
call fcn.0043f6c0
and edi, esi
je 0x41444c
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
test bl, bl
jne 0x414525
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x818], 8
jb 0x414473
mov eax, dword [ebp - 0x82c]
push eax
call fcn.004410cb
add esp, 4
mov eax, dword [ebp - 0x8a0]
inc eax
xor ecx, ecx
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], 0
mov word [ebp - 0x82c], cx
mov dword [ebp - 0x8a0], eax
cmp eax, dword [ebp - 0x8a8]
jl 0x414150
xor ebx, ebx
mov esi, dword [0x47b000]
cmp esi, ebx
jne 0x4146ef
lea ecx, [ebp - 0x8a4]
push ecx
lea edx, [ebp - 0x810]
xor eax, eax
push edx
mov word [ebp - 0x810], ax
mov dword [ebp - 0x8a4], 0x400
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4144eb
mov word [ebp - 0x810], ax
mov eax, dword [0x47aff8]
cmp eax, ebx
jne 0x414551
push 0x28c
call fcn.00441178
add esp, 4
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 4], 3
cmp eax, ebx
je 0x414543
mov esi, eax
call fcn.004028b0
jmp 0x414545
push str.invalid_string_position
call fcn.0043f2a7
call fcn.00413920
cmp dword [ebp - 0x818], 8
jb 0x4147aa
mov edx, dword [ebp - 0x82c]
push edx
jmp 0x4147a2
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x47aff8], eax
add eax, 8
mov edi, 0x10
cmp dword [eax + 0x14], edi
jb 0x414560
mov eax, dword [eax]
mov edx, eax
cmp eax, ebx
jne 0x41456b
mov edx, 0x4649e4
mov eax, edx
mov dword [ebp - 0x888], 0xf
mov dword [ebp - 0x88c], ebx
mov byte [ebp - 0x89c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414587
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x89c]
call fcn.00402d60
lea ecx, [ebp - 0x89c]
push ecx
lea esi, [ebp - 0x880]
mov dword [ebp - 4], 4
call fcn.0042a0c0
cmp dword [ebp - 0x888], edi
jb 0x4145cd
mov edx, dword [ebp - 0x89c]
push edx
call fcn.004410cb
add esp, 4
xor eax, eax
mov dword [ebp - 0x850], 7
mov dword [ebp - 0x854], ebx
mov word [ebp - 0x864], ax
lea ecx, [ebp - 0x8a0]
push ecx
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [ebp - 0x880]
mov edi, 8
cmp dword [ebp - 0x86c], edi
jae 0x414617
lea eax, [ebp - 0x880]
mov edx, dword [ebp - 0x8a0]
push eax
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x864]
push str.Local_s_d9977d49f_0bfb_4008_9530_49c1880ba852_s
push ecx
call fcn.0042a210
push edi
call fcn.00441178
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x414670
mov eax, dword [ebp - 0x864]
cmp dword [ebp - 0x850], edi
jae 0x41465a
lea eax, [ebp - 0x864]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x414672
xor esi, esi
mov dword [0x47b000], esi
cmp dword [ebp - 0x850], edi
jb 0x414695
mov edx, dword [ebp - 0x864]
push edx
call fcn.004410cb
mov esi, dword [0x47b000]
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x850], 7
mov dword [ebp - 0x854], ebx
mov word [ebp - 0x864], ax
cmp dword [ebp - 0x86c], edi
jb 0x4146d2
mov ecx, dword [ebp - 0x880]
push ecx
call fcn.004410cb
mov esi, dword [0x47b000]
add esp, 4
xor edx, edx
mov dword [ebp - 0x86c], 7
mov dword [ebp - 0x870], ebx
mov word [ebp - 0x880], dx
cmp esi, ebx
je 0x414701
cmp dword [esi], 0xb7
jne 0x414701
call fcn.004147d0
jmp 0x4147aa
push 1
push 0x414090
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.004196e0
sub esp, 0x14
mov eax, esp
mov edi, 0x4196b0
mov dword [eax], edi
mov ebx, 0x47b030
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
xor edx, edx
mov dword [eax + 0xc], edx
xor esi, esi
mov dword [eax + 0x10], esi
mov eax, dword [0x47b03c]
push eax
call fcn.00419b00
cmp byte [0x47affc], 0
jne 0x41475d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
cmp byte [0x47affc], 0
je 0x414750
mov ecx, 0x47b030
call fcn.004098d0
xor eax, eax
push 0x7d0
lea ecx, [eax + 1]
mov edx, 0x47b030
call fcn.00419830
call fcn.004197c0
mov eax, dword [0x47b000]
test eax, eax
je 0x4147aa
lea esi, [eax + 4]
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4147a1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push edi
call fcn.004410cb
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440ba3
mov esp, ebp
pop ebp
ret