Function at 0x402130
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38c
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x388], eax
push ebx
push esi
push edi
sub esp, 8
call fcn.00402e10
test byte [0x407500], 1
je 0x402168
sub esp, 8
call fcn.00404e8c
push 0x4074d0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [0x407014]
mov dword [esp + 0x10], 1
push 0x407028
push 0x407010
mov eax, dword [ecx - 0x10]
mov dword [esp + 0xe0], eax
mov eax, dword [ecx - 0xc]
mov dword [esp + 0xe4], eax
mov eax, dword [ecx - 8]
mov dword [esp + 0xe8], eax
mov eax, dword [ecx - 4]
mov dword [esp + 0xec], eax
lea eax, [esp + 0xe0]
push 0x403590
push eax
mov byte [esp + 0x27], 0
mov dword [0x407030], 0
mov dword [0x407034], 0
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_EventRegister]
test eax, eax
jne 0x402260
mov ebx, dword [0x407014]
lea eax, [esp + 0x18]
push eax
push 0x401260
push 0
movzx esi, word [ebx]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x402218
lea eax, [esp + 0x18]
push eax
push 0x4012a8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x402260
push 0x4012bc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x402256
mov ecx, esi
mov esi, esp
push ecx
push ebx
push 2
push dword [0x40702c]
mov ecx, edi
push dword [0x407028]
call dword [0x408190]
call edi
cmp esi, esp
je 0x402256
mov ecx, 4
int 0x29
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.iertutil.dll_Ordinal_798]
test eax, eax
js 0x402d58
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.api_ms_win_downlevel_ole32_l1_1_0.dll_CoCreateGuid]
test eax, eax
jns 0x4022a6
mov esi, dword [0x40171c]
mov edi, dword [0x401720]
mov ebx, dword [0x401724]
mov eax, dword [0x401728]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
jmp 0x4022b6
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], eax
call dword [sym.imp.iertutil.dll_Ordinal_840]
mov ecx, dword [esp + 0xc]
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
call dword [sym.imp.iertutil.dll_Ordinal_840]
mov byte [eax + 0x10], 1
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [esp + 0x40], eax
lea edx, [esp + 0x54]
lea eax, [esp + 0x40]
mov dword [esp + 0x54], 0x401c
push eax
sub esp, 8
mov dword [esp + 0x28], 0x2800
lea ecx, [esp + 0x28]
call fcn.004044c0
push 1
push 0x4013d8
call dword [sym.imp.iertutil.dll_Ordinal_797]
test eax, eax
js 0x402b1c
push 0
push 0
push 4
lea eax, [esp + 0x2c]
push eax
push 1
push 0
push dword [0x4016f0]
call dword [sym.imp.iertutil.dll_Ordinal_650]
test eax, eax
js 0x402343
cmp dword [esp + 0x20], 0
jne 0x40234b
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
cmp byte [0x40742c], 0
jne 0x402370
push 0x407430
mov dword [0x407430], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov byte [0x40742c], 1
cmp dword [0x407440], 2
jne 0x4023db
cmp dword [0x407434], 6
jne 0x4023db
cmp dword [0x407438], 1
jne 0x4023db
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.msvcrt.dll_rand_s]
add esp, 4
test eax, eax
jne 0x4023db
movzx eax, byte [esp + 0xc]
mov esi, 0
add eax, 1
mov dword [esp + 0xc], eax
je 0x4023db
jmp 0x4023c0
push 1
push 0x2000
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
inc esi
cmp esi, dword [esp + 0xc]
jb 0x4023c0
mov eax, dword [0x407048]
test eax, eax
je 0x402406
push eax
call dword [sym.imp.iertutil.dll_Ordinal_701]
test eax, eax
js 0x402454
xor ecx, ecx
test eax, eax
sete cl
mov dword [0x40704c], ecx
mov dword [0x407048], 0
cmp dword [0x40704c], 0
je 0x402454
push 0x401388
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402449
push 0x4013a4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x402449
mov esi, esp
mov ecx, edi
push 1
call dword [0x408190]
call edi
cmp esi, esp
je 0x402449
mov ecx, 4
int 0x29
push 0x4010ec
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x27
push esi
push 0x401310
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x402483
mov dword [esp + 0xc], 0
jmp 0x40248e
mov dword [esp + 0xc], 1
add esi, 0x4e
movzx eax, word [esi]
cmp eax, 0x22
jne 0x4024b7
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x4024ac
cmp eax, 0x22
jne 0x402496
add esi, 2
jmp 0x4024c9
cmp word [esi], 0x22
jne 0x4024c9
add esi, 2
jmp 0x4024c9
cmp eax, 0x20
jbe 0x4024c9
lea esp, [esp]
add esi, 2
cmp word [esi], 0x20
ja 0x4024c0
movzx eax, word [esi]
test ax, ax
je 0x4024e3
cmp ax, 0x20
ja 0x4024e3
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x4024d1
mov ebx, esi
lea ecx, [ebx + 2]
jmp 0x4024f0
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4024f0
sub ebx, ecx
sar ebx, 1
inc ebx
lea eax, [ebx + ebx]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x4025e2
xor eax, eax
test ebx, ebx
je 0x402524
cmp ebx, 0x7fffffff
jbe 0x402529
mov eax, 0x80070057
test eax, eax
js 0x402599
mov dword [esp + 0x1c], 0
mov edx, ebx
mov ecx, edi
test ebx, ebx
je 0x40257f
mov eax, 0x7ffffffe
sub eax, ebx
sub esi, edi
mov dword [esp + 0x20], eax
lea ebx, [ebx]
add eax, edx
je 0x40257b
movzx eax, word [ecx + esi]
test ax, ax
je 0x40257b
mov word [ecx], ax
add ecx, 2
mov eax, dword [esp + 0x20]
sub edx, 1
jne 0x402550
sub ecx, 2
mov eax, 0x8007007a
xor edx, edx
mov word [ecx], dx
jmp 0x4025a2
test edx, edx
jne 0x40258e
sub ecx, 2
mov eax, 0x8007007a
xor edx, edx
mov word [ecx], dx
jmp 0x4025a2
mov eax, dword [esp + 0x1c]
xor edx, edx
mov word [ecx], dx
jmp 0x4025a2
test ebx, ebx
je 0x4025a2
xor ecx, ecx
mov word [edi], cx
test eax, eax
js 0x4025e2
push 1
push 0x401360
mov edx, ebx
mov ecx, edi
call fcn.00403430
test al, al
jne 0x4025a6
push 1
push 0x40136c
mov edx, ebx
mov ecx, edi
call fcn.00403430
test al, al
jne 0x4025a6
push 1
push 0x401378
mov edx, ebx
mov ecx, edi
call fcn.00403430
test al, al
jne 0x4025a6
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, dword [ebp + 8]
push 0x10000031
mov dword [0x407418], eax
call dword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
mov edx, 0x4011d0
mov ecx, 0x401218
cmovne ecx, edx
push ecx
call dword [sym.imp.api_ms_win_downlevel_shell32_l1_1_0.dll_SetCurrentProcessExplicitAppUserModelID]
mov edx, edi
lea ecx, [edx + 2]
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402620
sub edx, ecx
mov ecx, edi
sar edx, 1
push 1
push 0x4013fc
inc edx
call fcn.00403430
test al, al
je 0x40265a
call fcn.00402090
call dword [sym.imp.IEFRAME.dll_Ordinal_212]
mov dword [esp + 0x10], 0
jmp 0x402b08
push 0x4012f0
push edi
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
test eax, eax
je 0x4026f7
movzx ecx, word [eax + 0xe]
test cx, cx
je 0x40267c
cmp ecx, 0x20
jne 0x4026f7
cmp eax, edi
je 0x402687
cmp word [eax - 2], 0x20
jne 0x4026f7
xor esi, esi
mov ebx, 0x80004005
mov edi, edi
push 0
push 0x401300
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x4026cb
lea eax, [esp + 0x50]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov ecx, esi
call fcn.004047f2
mov ebx, eax
test ebx, ebx
js 0x402690
jmp 0x4026cf
test ebx, ebx
js 0x4026f7
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4026d4
sub edx, ecx
mov ecx, edi
sar edx, 1
push 1
push 0x4012f0
inc edx
call fcn.00403430
jmp 0x402b08
push 7
push 0x4012d0
push edi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x40290f
movzx eax, word [edi + 0xe]
lea esi, [edi + 0xe]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
add esp, 4
test eax, eax
jne 0x402740
cmp word [esi], 0
je 0x402740
movzx eax, word [esi + 2]
add esi, 2
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
add esp, 4
test eax, eax
je 0x402725
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
add esp, 4
test eax, eax
je 0x402766
movzx eax, word [esi + 2]
add esi, 2
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
add esp, 4
test eax, eax
jne 0x402751
push 7
push 0x4012e0
push esi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x40290f
cmp dword [esp + 0xc], eax
jne 0x402902
cmp dword [0x407010], 5
mov esi, dword fs:[0x2c]
mov esi, dword [esi]
mov byte [esi + 1], 1
jbe 0x4028ee
sub esp, 8
call fcn.00403050
test al, al
je 0x4028ee
push 0x10000003
call dword [sym.imp.iertutil.dll_Ordinal_796]
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0x10
mov dword [esp + 0x114], 0
call dword [sym.imp.iertutil.dll_Ordinal_840]
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], 0
mov dword [esp + 0x120], 0x10
mov dword [esp + 0x124], 0
mov al, byte [0x4018fb]
mov ecx, 0x401828
movzx eax, word [0x401829]
sub ecx, 0x401758
mov dword [esp + 0x64], eax
or ecx, 0xb000000
mov eax, dword [0x407014]
xor ebx, ebx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0x4000
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], 0
movzx eax, word [eax]
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], 2
mov dword [esp + 0xf8], 0x401833
mov dword [esp + 0xfc], 0
mov dword [esp + 0x100], 0x32
mov dword [esp + 0x104], 1
cmp byte [esi + 1], bl
je 0x4028ad
mov byte [esi + 1], bl
jmp 0x4028c4
call fcn.00402fa0
test al, al
jne 0x4028bf
call fcn.00402f40
test al, al
je 0x4028c4
mov ebx, 2
lea eax, [esp + 0xe8]
push eax
push 4
push 0
push 0
push ebx
push 0
push 0
lea eax, [esp + 0x7c]
push eax
push dword [0x40702c]
push dword [0x407028]
call dword [sym.imp.ADVAPI32.dll_EventWriteEx]
push dword [ebp + 0x14]
mov byte [esp + 0x1b], 1
push edi
call dword [sym.imp.IEFRAME.dll_Ordinal_251]
jmp 0x402b04
mov dword [esp + 0x10], 5
jmp 0x402b08
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x402a8a
cmp dword [esp + 0x48], 0
je 0x402a8a
call fcn.004045c2
sub esp, 8
lea ecx, [esp + 0x190]
call fcn.004050d1
test al, al
je 0x402b08
push 0x40
lea eax, [esp + 0x98]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, 1
mov dword [esp + 0x9c], 0x44
lea ecx, [esp + 0x194]
mov dword [esp + 0xc8], 1
add esp, 0xc
mov word [esp + 0xc0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402991
sub ecx, edx
sar ecx, 1
add ecx, 3
test edi, edi
je 0x4029c1
mov edx, edi
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4029b0
sub edx, esi
sar edx, 1
jmp 0x4029c3
xor edx, edx
lea ebx, [edx + 1]
mov edx, 2
add ebx, ecx
xor ecx, ecx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040369f
mov esi, eax
add esp, 4
test esi, esi
je 0x402b08
push 0x401a00
mov edx, ebx
mov ecx, esi
call fcn.0040488a
test eax, eax
js 0x402a7c
lea eax, [esp + 0x188]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00404842
test eax, eax
js 0x402a7c
push 0x401a04
mov edx, ebx
mov ecx, esi
call fcn.00404842
test eax, eax
js 0x402a7c
push edi
mov edx, ebx
mov ecx, esi
call fcn.00404842
test eax, eax
js 0x402a7c
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x94]
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push esi
lea eax, [esp + 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402a7c
push 0xea60
push dword [esp + 0x84]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push esi
call fcn.004036af
add esp, 4
jmp 0x402b08
push 0x401428
push edi
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
test eax, eax
je 0x402af4
movzx ecx, word [eax + 0x14]
test cx, cx
je 0x402aa8
cmp ecx, 0x20
jne 0x402af4
cmp eax, edi
je 0x402ab3
cmp word [eax - 2], 0x20
jne 0x402af4
mov edx, edi
lea ecx, [edx + 2]
jmp 0x402ac0
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402ac0
sub edx, ecx
mov ecx, edi
sar edx, 1
push 0
push 0x401a0c
inc edx
call fcn.00403430
test al, al
je 0x402af4
push dword [esp + 0xc]
push 1
push dword [ebp + 0x14]
push edi
call dword [sym.imp.IEFRAME.dll_Ordinal_258]
jmp 0x402b04
push dword [esp + 0xc]
push 1
push dword [ebp + 0x14]
push edi
call dword [sym.imp.IEFRAME.dll_Ordinal_255]
mov dword [esp + 0x10], eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [esp + 0x17], 0
jne 0x402d60
jmp 0x402b24
mov dword [esp + 0x10], 0
push 0
push 0
push 4
lea eax, [esp + 0x50]
push eax
push 1
push 1
push dword [0x4016f4]
call dword [sym.imp.iertutil.dll_Ordinal_650]
push 0
push 0
push 4
lea eax, [esp + 0x48]
push eax
push 1
push 1
push dword [0x4016f8]
call dword [sym.imp.iertutil.dll_Ordinal_650]
mov ecx, dword [esp + 0x3c]
xor eax, eax
or eax, dword [esp + 0x44]
cmp dword [0x407010], 5
mov dword [esp + 0x58], eax
mov eax, dword fs:[0x2c]
mov dword [esp + 0x5c], ecx
mov esi, dword [eax]
mov byte [esi + 1], 1
jbe 0x402d60
mov ecx, dword [0x40701c]
xor eax, eax
and ecx, 0x4000
or eax, ecx
je 0x402d60
mov ecx, dword [0x407024]
xor edx, edx
mov eax, ecx
and eax, 0x4000
cmp edx, dword [0x407020]
jne 0x402d60
cmp eax, ecx
jne 0x402d60
push 0x10000003
call dword [sym.imp.iertutil.dll_Ordinal_796]
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], 0
mov dword [esp + 0x150], 0x10
mov dword [esp + 0x154], 0
call dword [sym.imp.iertutil.dll_Ordinal_840]
mov dword [esp + 0x158], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x168], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x15c], 0
mov dword [esp + 0x160], 0x10
mov dword [esp + 0x164], 0
mov dword [esp + 0x16c], 0
mov dword [esp + 0x170], 4
mov dword [esp + 0x174], 0
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], 0
mov dword [esp + 0x180], 8
mov dword [esp + 0x184], 0
mov al, byte [0x4018fb]
mov ecx, 0x401866
movzx eax, word [0x401867]
sub ecx, 0x401758
mov dword [esp + 0x74], eax
or ecx, 0xb000000
mov eax, dword [0x407014]
xor edi, edi
cmp byte [esi + 1], 0
mov dword [esp + 0x70], ecx
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0x4000
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], 0
movzx eax, word [eax]
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], 2
mov dword [esp + 0x138], 0x401871
mov dword [esp + 0x13c], 0
mov dword [esp + 0x140], 0x46
mov dword [esp + 0x144], 1
je 0x402d12
mov byte [esi + 1], 0
jmp 0x402d29
call fcn.00402fa0
test al, al
jne 0x402d24
call fcn.00402f40
test al, al
je 0x402d29
mov edi, 2
lea eax, [esp + 0x128]
push eax
push 6
push 0
push 0
push edi
push 0
push 0
lea eax, [esp + 0x8c]
push eax
push dword [0x40702c]
push dword [0x407028]
call dword [sym.imp.ADVAPI32.dll_EventWriteEx]
jmp 0x402d60
mov dword [esp + 0x10], 0
push 0x4074d0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.00403010
push dword [0x40702c]
push dword [0x407028]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_EventUnregister]
lea eax, [esp + 0x4c]
mov dword [0x407028], 0
push eax
lea eax, [esp + 0x28]
mov dword [0x40702c], 0
push eax
push 0
push 0x10
push 0x401440
push 0x401468
push 0x80000002
mov dword [0x407010], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x68], 4
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
cmp dword [esp + 0x24], 0
je 0x402deb
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x394]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403a60
mov esp, ebp
pop ebp
ret 0x10