Function at 0x401040
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x688]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x4012be
cmp dword [ebp - 0x62c], 2
jne 0x4012a8
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0x105
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4012a8
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x4010d2
mov eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d8
mov esp, ebp
pop ebp
ret 0x10
push 0x105
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4012be
push str.System32PnPutil.exe
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x628]
push eax
call esi
test eax, eax
jne 0x401128
mov eax, 0xfffffffc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d8
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebp - 0x210]
test eax, eax
je 0x401162
nop
dec eax
lea edx, [eax + eax]
movzx ecx, word [ebp + edx - 0x210]
cmp ecx, 0x5c
je 0x401273
cmp ecx, 0x2f
je 0x401273
test eax, eax
jne 0x401140
push esi
lea eax, [ebp - 0x628]
push eax
push str.__s___i__a___s_
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00401010
add esp, 0x14
mov dword [ebp - 0x674], 0x44
lea eax, [ebp - 0x684]
xorps xmm0, xmm0
movlpd qword [ebp - 0x670], xmm0
movlpd qword [ebp - 0x668], xmm0
push eax
lea eax, [ebp - 0x674]
movlpd qword [ebp - 0x660], xmm0
push eax
lea eax, [ebp - 0x210]
movlpd qword [ebp - 0x658], xmm0
push eax
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
movlpd qword [ebp - 0x650], xmm0
push eax
push 0
movlpd qword [ebp - 0x648], xmm0
movlpd qword [ebp - 0x640], xmm0
movlpd qword [ebp - 0x638], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401292
push dword [ebp - 0x680]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401292
lea eax, [ebp - 0x630]
push eax
push dword [ebp - 0x684]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401292
push dword [ebp - 0x684]
call esi
mov ecx, dword [ebp - 0x630]
xor eax, eax
test ecx, ecx
je 0x4012c1
cmp ecx, 0x103
mov edx, 0xfffffffa
pop esi
cmovne eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d8
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 0x20a
jae 0x4012d2
xor eax, eax
lea esi, [ebp - 0x20e]
mov word [ebp + edx - 0x210], ax
add esi, edx
jmp 0x401162
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d8
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0xfffffffe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012d8
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004012d8
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401408
int3