Function at 0x404a30
Capabilities:
Accept command line arguments
Get hostname
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x42a130]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
xor bl, bl
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x28e], 0
mov byte [ebp - 0x28d], bl
mov byte [ebp - 0x2a0], bl
mov byte [ebp - 0x29f], bl
mov byte [ebp - 0x299], bl
mov byte [ebp - 0x29c], bl
mov byte [ebp - 0x29b], bl
mov byte [ebp - 0x29a], bl
mov byte [ebp - 0x29e], bl
mov byte [ebp - 0x2a1], bl
mov byte [ebp - 0x29d], bl
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x298], edi
cmp ecx, 1
jg 0x404abe
push dword [edi]
call fcn.004063e0
add esp, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
mov dword [eax], 0
xor eax, eax
mov word [0x4518a0], ax
mov eax, 1
mov dword [ebp - 0x294], eax
push esi
cmp ecx, eax
jle 0x405389
mov ecx, dword [edi + eax*4]
lea ebx, [edi + eax*4]
mov dword [ebp - 0x2a8], ebx
movzx edx, word [ecx]
mov eax, edx
sub eax, 0x2d
je 0x404b3c
sub eax, 2
je 0x404b3c
sub eax, 0x11
mov al, byte [ebp - 0x28d]
jne 0x40513f
test al, al
jne 0x40513f
mov edx, 0x42b380
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x404b17
mov eax, dword [ebp - 0x294]
mov cl, 1
mov byte [ebp - 0x28e], cl
jmp 0x405348
mov al, byte [ebp - 0x28d]
test al, al
jne 0x40513f
lea eax, [ecx + 2]
push 0x422c14
push eax
call fcn.00406e6e
add esp, 8
test eax, eax
je 0x404bfe
mov eax, dword [ebx]
add eax, 2
push str.nobanner
push eax
call fcn.00406e6e
add esp, 8
test eax, eax
je 0x404bfe
cmp dword [0x430798], 0
jne 0x404be0
xor ebx, ebx
mov esi, 0x4290e0
xor edi, edi
mov eax, dword [ebp - 0x2a8]
push esi
mov eax, dword [eax]
add eax, 2
push eax
call fcn.00406e6e
add esp, 8
test eax, eax
je 0x404bc5
add edi, 0x204
inc ebx
add esi, 0x204
cmp edi, 0xe1c
jb 0x404b90
mov eax, dword [0x430798]
jmp 0x404bd6
imul eax, ebx, 0x204
mov eax, dword [eax + 0x4292e0]
mov dword [0x430798], eax
test eax, eax
jne 0x404bfe
mov ebx, dword [ebp - 0x2a8]
mov eax, dword [ebx]
add eax, 2
push 0x422c40
push eax
call fcn.00406e6e
add esp, 8
test eax, eax
jne 0x404c09
mov byte [0x430797], 1
mov eax, dword [ebp - 0x294]
jmp 0x405342
mov eax, dword [ebx]
mov esi, 1
mov dword [ebp - 0x2a8], esi
cmp word [eax + 2], 0
je 0x404bfe
mov ecx, 2
movzx eax, word [ecx + eax]
push eax
call fcn.0040972c
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x17
ja case.0x404c3b.66
jmp dword [eax*4 + 0x4054c4]
cmp byte [ebp - 0x2a0], 0
jne case.0x404c3b.66
mov byte [0x42b37e], 1
mov byte [ebp - 0x2a0], 1
jmp 0x404e2d
cmp byte [ebp - 0x29f], 0
jne case.0x404c3b.66
mov byte [0x42b37f], 1
mov byte [ebp - 0x29f], 1
jmp 0x404e2d
cmp byte [ebp - 0x29d], 0
jne case.0x404c3b.66
mov byte [0x430795], 1
mov byte [ebp - 0x29d], 1
jmp 0x404e2d
cmp byte [ebp - 0x29a], 0
jne case.0x404c3b.66
mov byte [0x430794], 1
mov byte [ebp - 0x29a], 1
jmp 0x404e2d
cmp byte [ebp - 0x29c], 0
jne case.0x404c3b.66
mov byte [0x430791], 1
mov byte [ebp - 0x29c], 1
jmp 0x404e2d
cmp byte [0x42a10a], 0
je case.0x404c3b.66
mov byte [0x42a10a], 0
jmp 0x404e2d
cmp byte [ebp - 0x29b], 0
jne case.0x404c3b.66
mov eax, dword [ebp - 0x294]
inc eax
mov byte [0x430792], 1
mov byte [ebp - 0x29b], 1
cmp eax, dword [ebp + 8]
jge 0x404e2d
mov edx, dword [ebx + 4]
movzx eax, word [edx]
cmp eax, 0x2d
je 0x404e2d
cmp eax, 0x2f
je 0x404e2d
mov ecx, edx
mov esi, 1
lea edi, [ecx + 2]
jmp 0x404d50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d50
sub ecx, edi
sar ecx, 1
cmp ecx, 1
jle 0x404d93
movzx eax, word [edx + esi*2]
push 4
push eax
call fcn.00409758
add esp, 8
test eax, eax
je 0x404d93
mov edx, dword [ebx + 4]
inc esi
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404d80
sub eax, edi
sar eax, 1
cmp esi, eax
jl 0x404d64
mov ecx, dword [ebx + 4]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404da0
sub ecx, edx
sar ecx, 1
cmp esi, ecx
je 0x404e4f
mov esi, dword [ebp - 0x2a8]
jmp 0x404e2d
cmp byte [ebp - 0x2a1], 0
jne case.0x404c3b.66
cmp dword [0x42b378], 0
je 0x405365
mov byte [0x430796], 1
mov byte [ebp - 0x2a1], 1
jmp 0x404e2d
cmp byte [0x430793], 0
jne case.0x404c3b.66
mov byte [0x430793], 1
mov byte [0x430792], 1
jmp 0x404e21
cmp byte [ebp - 0x299], 0
jne case.0x404c3b.66
mov byte [0x430790], 1
mov byte [ebp - 0x299], 1
mov eax, dword [ebp - 0x2ac]
mov dword [eax], 1
mov eax, dword [ebx]
inc esi
mov dword [ebp - 0x2a8], esi
lea ecx, [esi + esi]
cmp word [ecx + eax], 0
jne 0x404c22
mov eax, dword [ebp - 0x294]
jmp 0x405342
push 0x429efc
push 0x422d0c
push dword [ebx + 4]
call fcn.00409a41
add esp, 0xc
test eax, eax
je case.0x404c3b.66
mov ecx, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x294]
mov byte [0x42a108], 0
inc eax
mov dword [ecx], 1
jmp 0x405342
cmp dword [0x43079c], 0
jne case.0x404c3b.66
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebx]
push str.__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d
lea eax, [eax + esi*2]
add eax, 4
push eax
call fcn.00409a41
add esp, 0x88
xor esi, esi
test eax, eax
jle 0x404fbb
mov edi, dword [0x43079c]
lea ecx, [ecx]
mov ecx, dword [ebp + esi*4 - 0x28c]
mov edx, 1
shl edx, cl
inc esi
or edi, edx
cmp esi, eax
jl 0x404fa0
mov dword [0x43079c], edi
mov eax, dword [ebp - 0x294]
inc eax
jmp 0x405342
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp eax, dword [ebp + 8]
jg case.0x404c3b.66
cmp dword [0x42a10c], 0xffffffff
jne case.0x404c3b.66
push 0x42a10c
push 0x422d0c
push dword [ebx + 4]
call fcn.00409a41
add esp, 0xc
test eax, eax
je case.0x404c3b.66
mov eax, dword [ebp - 0x294]
jmp 0x405342
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp eax, dword [ebp + 8]
jge case.0x404c3b.66
cmp byte [0x42b37d], 0
jne case.0x404c3b.66
mov ecx, dword [ebx + 4]
mov edx, 0x4518a0
lea ecx, [ecx]
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x405040
mov eax, dword [ebp - 0x294]
mov byte [0x42b37d], 1
jmp 0x405342
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp eax, dword [ebp + 8]
jge case.0x404c3b.66
cmp byte [0x42b37c], 0
jne case.0x404c3b.66
mov ecx, dword [ebx + 4]
mov edx, 0x42c380
nop
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x405090
mov eax, dword [ebp - 0x294]
mov byte [0x42b37c], 1
jmp 0x405342
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp eax, dword [ebp + 8]
jge case.0x404c3b.66
cmp byte [ebp - 0x29e], 0
jne case.0x404c3b.66
mov ecx, dword [ebx + 4]
mov edx, 0x430588
nop
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x4050e0
mov eax, dword [ebp - 0x294]
mov byte [ebp - 0x29e], 1
jmp 0x405342
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp eax, dword [ebp + 8]
jge case.0x404c3b.66
mov ecx, dword [ebx + 4]
mov edx, str.PSEXESVC
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x405122
mov eax, dword [ebp - 0x294]
jmp 0x405342
cmp edx, 0x5c
jne 0x405185
cmp word [ecx + 2], dx
jne 0x405185
cmp byte [ebp - 0x28e], 0
jne 0x405185
add ecx, 4
mov edx, 0x42b380
jmp 0x405160
movzx eax, word [ecx]
lea edx, [edx + 2]
add ecx, 2
mov word [edx - 2], ax
test ax, ax
jne 0x405160
mov eax, dword [ebp - 0x294]
mov cl, 1
mov byte [ebp - 0x28e], cl
jmp 0x405348
test al, al
jne 0x4052c0
cmp edx, 0x22
jne 0x4051c2
cmp word [ecx + 2], 0
je 0x4051b7
lea esp, [esp]
movzx eax, word [ecx + 2]
cmp eax, 0x22
je 0x4051b7
mov word [ebp - 0x20c], ax
cmp word [ecx + 2], 0
jne 0x4051a0
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x4051e0
lea edx, [ebp - 0x20c]
sub edx, ecx
lea ebx, [ebx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x4051d0
cmp byte [0x42b37e], 0
je 0x405289
push 0
push 0
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
lea ecx, [esi + esi]
push ecx
call fcn.00407316
add esp, 4
mov edi, eax
push esi
push edi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x451680
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00404850
add esp, 0x10
test al, al
jne 0x4052a7
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x405240
mov eax, dword [str..exe]
mov dword [ecx], eax
mov eax, dword [0x422da4]
mov dword [ecx + 4], eax
mov ax, word [0x422da8]
push 0x451680
push esi
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00404850
add esp, 0x10
test al, al
jne 0x4052a7
push str.The_specified_application_is_not_on_the_path._n_n
jmp 0x4053f9
xor ecx, ecx
jmp 0x405290
movzx eax, word [ebp + ecx - 0x20c]
mov word [ecx + 0x451680], ax
add ecx, 2
test ax, ax
jne 0x405290
mov eax, dword [ebp - 0x294]
mov bl, 1
mov cl, byte [ebp - 0x28e]
mov byte [ebp - 0x28d], bl
jmp 0x40534e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [ebp - 0x294]
xor esi, esi
mov ecx, eax
test ebx, ebx
jle 0x40530d
push dword [edi + esi*4]
push ecx
call fcn.004097ae
mov edx, eax
add esp, 8
test edx, edx
je 0x405311
mov ecx, dword [edi + esi*4]
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4052f0
sub ecx, edi
inc esi
mov edi, dword [ebp - 0x298]
sar ecx, 1
lea ecx, [edx + ecx*2]
cmp esi, ebx
jl 0x4052d4
test ecx, ecx
jne 0x405315
mov ecx, dword [edi + esi*4 - 4]
cmp word [ecx], 0x22
jne 0x40531e
add ecx, 2
cmp word [ecx], 0x20
jne 0x405327
add ecx, 2
mov edx, 0x42c588
sub edx, ecx
mov edi, edi
movzx eax, word [ecx]
mov word [ecx + edx], ax
add ecx, 2
test ax, ax
jne 0x405330
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x28e]
mov bl, byte [ebp - 0x28d]
inc eax
mov dword [ebp - 0x294], eax
cmp eax, dword [ebp + 8]
jge 0x405385
mov edi, dword [ebp - 0x298]
jmp 0x404ae0
push str.Limited_user_is_only_supported_on_Windows_2000_and_higher._n_n
call fcn.0040746c
add esp, 4
xor al, al
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
test cl, cl
jne 0x4053e2
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x2b0], 0x1000
push eax
push 0x42b380
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp byte [ebp - 0x29b], 0
je 0x4053e2
cmp dword [0x429efc], 0xffffffff
jne 0x4053e2
push str.ProcessIdToSessionId
push 0x422df4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4053e2
push 0x429efc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
cmp byte [0x430796], 0
je 0x40541d
cmp byte [0x430795], 0
je 0x40541d
push str.Run_elevated_and_limited_user_options_are_not_compatible._n_n
call fcn.00407f6a
add eax, 0x40
push eax
call fcn.00408b5b
add esp, 8
xor al, al
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
test bl, bl
je case.0x404c3b.66
cmp byte [0x42b37d], 0
je 0x405433
cmp byte [0x42b37c], 0
je case.0x404c3b.66
cmp byte [ebp - 0x29a], 0
je 0x405466
cmp byte [0x42b37f], 0
je 0x40546f
mov eax, dword [ebp - 0x298]
push dword [eax]
call fcn.004063e0
add esp, 4
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
cmp byte [0x42b37f], 0
je 0x405478
cmp byte [0x42b37e], 0
je case.0x404c3b.66
push 0x42b380
push 0x455ac0
call fcn.00406e6e
add esp, 8
test eax, eax
je 0x405497
cmp byte [0x430793], 0
jne case.0x404c3b.66
movzx eax, byte [0x42a10a]
xor ecx, ecx
cmp byte [ebp - 0x299], cl
pop esi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
pop edi
mov byte [0x42a10a], al
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004077dc
mov esp, ebp
pop ebp
ret