Function at 0x428160
Capabilities:
Accept command line arguments
Get token membership
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 1
call fcn.0042bd12
add esp, 4
push eax
push 0x44dab4
push 0x44dab8
call fcn.0042d306
call fcn.00413b20
add esp, 0xc
push eax
push str.MsiTool__u_n
call fcn.00428ca0
push str.PAUSE
call fcn.0042d1e9
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x4574c4], eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
push eax
mov word [esp + 0x3c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [0x45603c], eax
test eax, eax
je 0x428234
push 0x45603c
push dword [esp + 0xc]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 8]
neg eax
sbb eax, eax
and dword [0x45603c], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [0x45603c]
push 0x4574c0
push dword [0x4574c4]
mov dword [0x4574d4], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [0x4574c8], eax
test eax, eax
jne 0x4282b5
mov eax, dword [0x45765c]
test eax, eax
je 0x42828a
push 0x7d0
push 0
push 0x10
push str.Error
push str.Unable_to_parse_command_line
push 0
call eax
mov eax, 0xa
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Error
push str.Unable_to_parse_command_line
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xa
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4574c0], 1
jne 0x42831a
mov ecx, dword [0x4574c8]
xor dl, dl
mov ecx, dword [ecx]
call fcn.00405960
mov eax, dword [0x45765c]
test eax, eax
je 0x4282ef
push 0x7d0
push 0
push 0x40
push str.Error
push str.Please_drop_files_to_this_script_to_run_it_
push 0
call eax
jmp 0x42829e
push 0x40
push str.Error
push str.Please_drop_files_to_this_script_to_run_it_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xa
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 1
cmp dword [0x4574c0], ecx
jle 0x428377
nop word [eax + eax]
mov eax, dword [0x4574c8]
mov eax, dword [eax + ecx*4]
cmp word [eax], 0x2f
jne 0x42836e
movzx edx, word [eax + 2]
cmp edx, 0x41
je 0x42834c
cmp edx, 0x61
jne 0x42836e
movzx edx, word [eax + 4]
cmp edx, 0x52
je 0x42835a
cmp edx, 0x72
jne 0x42836e
cmp word [eax + 6], 0
jne 0x42836e
cmp dword [0x4574d4], 0
je 0x42886b
inc ecx
cmp ecx, dword [0x4574c0]
jl 0x428330
mov esi, 1
cmp dword [0x4574c0], esi
jle 0x428846
nop dword [eax + eax]
mov eax, dword [0x4574c8]
mov eax, dword [eax + esi*4]
cmp word [eax], 0x2f
jne 0x428839
movzx ecx, word [eax + 2]
cmp ecx, 0x41
je 0x4283b0
cmp ecx, 0x61
jne 0x4283d2
movzx edx, word [eax + 4]
cmp edx, 0x52
je 0x4283be
cmp edx, 0x72
jne 0x4283d2
cmp word [eax + 6], 0
jne 0x4283d2
cmp dword [0x4574d4], 0
je 0x42886b
cmp ecx, 0x47
je 0x4283dc
cmp ecx, 0x67
jne 0x42844f
movzx edx, word [eax + 4]
cmp edx, 0x4f
je 0x4283ea
cmp edx, 0x6f
jne 0x42844f
movzx edx, word [eax + 6]
cmp edx, 0x53
je 0x4283f8
cmp edx, 0x73
jne 0x42844f
movzx edx, word [eax + 8]
cmp edx, 0x43
je 0x428406
cmp edx, 0x63
jne 0x42844f
movzx edx, word [eax + 0xa]
cmp edx, 0x44
je 0x428414
cmp edx, 0x64
jne 0x42844f
movzx edx, word [eax + 0xc]
cmp edx, 0x49
je 0x428422
cmp edx, 0x69
jne 0x42844f
movzx edx, word [eax + 0xe]
cmp edx, 0x4d
je 0x428430
cmp edx, 0x6d
jne 0x42844f
movzx edx, word [eax + 0x10]
cmp edx, 0x47
je 0x42843e
cmp edx, 0x67
jne 0x42844f
cmp word [eax + 0x12], 0
jne 0x42844f
call fcn.0041de70
jmp 0x428839
cmp ecx, 0x52
je 0x428459
cmp ecx, 0x72
jne 0x42848b
movzx edx, word [eax + 4]
cmp edx, 0x54
je 0x428467
cmp edx, 0x74
jne 0x42848b
movzx edx, word [eax + 6]
cmp edx, 0x49
je 0x428475
cmp edx, 0x69
jne 0x42848b
cmp word [eax + 8], 0
jne 0x42848b
push 0
call fcn.00419850
add esp, 4
jmp 0x428839
cmp ecx, 0x52
je 0x428495
cmp ecx, 0x72
jne 0x4284c0
movzx edx, word [eax + 4]
cmp edx, 0x54
je 0x4284a3
cmp edx, 0x74
jne 0x4284c0
cmp word [eax + 6], 0x41
jne 0x4284c0
cmp word [eax + 8], 0
jne 0x4284c0
push 1
call fcn.00419850
add esp, 4
jmp 0x428839
cmp ecx, 0x49
je 0x4284ca
cmp ecx, 0x69
jne 0x428504
movzx edx, word [eax + 4]
cmp edx, 0x54
je 0x4284d8
cmp edx, 0x74
jne 0x428504
movzx edx, word [eax + 6]
cmp edx, 0x52
je 0x4284e6
cmp edx, 0x72
jne 0x428504
cmp word [eax + 8], 0
jne 0x428504
cmp dword [0x4574d4], 0
je 0x42886b
call fcn.00424c70
jmp 0x428839
cmp ecx, 0x43
je 0x42850e
cmp ecx, 0x63
jne 0x42852d
movzx edx, word [eax + 4]
cmp edx, 0x54
je 0x42851c
cmp edx, 0x74
jne 0x42852d
cmp word [eax + 6], 0
jne 0x42852d
call fcn.00409b20
jmp 0x428839
cmp ecx, 0x4d
je 0x428537
cmp ecx, 0x6d
jne 0x428562
movzx edx, word [eax + 4]
cmp edx, 0x44
je 0x428545
cmp edx, 0x64
jne 0x428562
cmp word [eax + 6], 0x35
jne 0x428562
cmp word [eax + 8], 0
jne 0x428562
push 0
call fcn.0041ab90
add esp, 4
jmp 0x428839
cmp ecx, 0x53
je 0x42856c
cmp ecx, 0x73
jne 0x4285a5
movzx edx, word [eax + 4]
cmp edx, 0x48
je 0x42857a
cmp edx, 0x68
jne 0x4285a5
movzx edx, word [eax + 6]
cmp edx, 0x41
je 0x428588
cmp edx, 0x61
jne 0x4285a5
cmp word [eax + 8], 0x31
jne 0x4285a5
cmp word [eax + 0xa], 0
jne 0x4285a5
push 1
call fcn.0041ab90
add esp, 4
jmp 0x428839
cmp ecx, 0x53
je 0x4285af
cmp ecx, 0x73
jne 0x4285f7
movzx edx, word [eax + 4]
cmp edx, 0x41
je 0x4285bd
cmp edx, 0x61
jne 0x4285f7
movzx edx, word [eax + 6]
cmp edx, 0x4f
je 0x4285cb
cmp edx, 0x6f
jne 0x4285f7
movzx edx, word [eax + 8]
cmp edx, 0x44
je 0x4285d9
cmp edx, 0x64
jne 0x4285f7
cmp word [eax + 0xa], 0
jne 0x4285f7
cmp dword [0x4574d4], 0
je 0x42886b
call fcn.0041c2d0
jmp 0x428839
cmp ecx, 0x44
jne 0x428636
movzx edx, word [eax + 4]
cmp edx, 0x52
je 0x42860a
cmp edx, 0x72
jne 0x42863b
movzx edx, word [eax + 6]
cmp edx, 0x45
je 0x428618
cmp edx, 0x65
jne 0x42863b
cmp word [eax + 8], 0
jne 0x42863b
cmp dword [0x4574d4], 0
je 0x42886b
call fcn.004237d0
jmp 0x428839
cmp ecx, 0x47
je 0x428640
cmp ecx, 0x67
jne 0x42867b
movzx edx, word [eax + 4]
cmp edx, 0x55
je 0x42864e
cmp edx, 0x75
jne 0x42867b
movzx edx, word [eax + 6]
cmp edx, 0x50
je 0x42865c
cmp edx, 0x70
jne 0x42867b
movzx edx, word [eax + 8]
cmp edx, 0x58
je 0x42866a
cmp edx, 0x78
jne 0x42867b
cmp word [eax + 0xa], 0
jne 0x42867b
call fcn.0041fe70
jmp 0x428839
cmp ecx, 0x37
jne 0x428705
movzx edx, word [eax + 4]
cmp edx, 0x5a
je 0x428696
cmp edx, 0x7a
jne 0x4287a5
movzx edx, word [eax + 6]
cmp edx, 0x53
je 0x4286a8
cmp edx, 0x73
jne 0x4287a5
movzx edx, word [eax + 8]
cmp edx, 0x50
je 0x4286ba
cmp edx, 0x70
jne 0x4287a5
movzx edx, word [eax + 0xa]
cmp edx, 0x4c
je 0x4286cc
cmp edx, 0x6c
jne 0x4287a5
movzx edx, word [eax + 0xc]
cmp edx, 0x49
je 0x4286de
cmp edx, 0x69
jne 0x4287a5
movzx edx, word [eax + 0xe]
cmp edx, 0x54
je 0x4286f0
cmp edx, 0x74
jne 0x4287a5
cmp word [eax + 0x10], 0
jne 0x4287a5
call fcn.00421c70
jmp 0x428839
cmp ecx, 0x4d
je 0x42870f
cmp ecx, 0x6d
jne 0x42874a
movzx edx, word [eax + 4]
cmp edx, 0x53
je 0x42871d
cmp edx, 0x73
jne 0x42874a
movzx edx, word [eax + 6]
cmp edx, 0x55
je 0x42872b
cmp edx, 0x75
jne 0x42874a
movzx edx, word [eax + 8]
cmp edx, 0x45
je 0x428739
cmp edx, 0x65
jne 0x42874a
cmp word [eax + 0xa], 0
jne 0x42874a
call fcn.00426c30
jmp 0x428839
cmp ecx, 0x52
je 0x428754
cmp ecx, 0x72
jne 0x4287a5
movzx edx, word [eax + 4]
cmp edx, 0x45
je 0x428762
cmp edx, 0x65
jne 0x4287a5
movzx edx, word [eax + 6]
cmp edx, 0x4d
je 0x428770
cmp edx, 0x6d
jne 0x4287a5
movzx edx, word [eax + 8]
cmp edx, 0x4f
je 0x42877e
cmp edx, 0x6f
jne 0x4287a5
movzx edx, word [eax + 0xa]
cmp edx, 0x56
je 0x42878c
cmp edx, 0x76
jne 0x4287a5
movzx edx, word [eax + 0xc]
cmp edx, 0x45
je 0x42879a
cmp edx, 0x65
jne 0x4287a5
cmp word [eax + 0xe], 0
je 0x42882a
cmp ecx, 0x55
je 0x4287b3
cmp ecx, 0x75
jne 0x428839
movzx ecx, word [eax + 4]
cmp ecx, 0x4e
je 0x4287c1
cmp ecx, 0x6e
jne 0x428839
movzx ecx, word [eax + 6]
cmp ecx, 0x49
je 0x4287cf
cmp ecx, 0x69
jne 0x428839
movzx ecx, word [eax + 8]
cmp ecx, 0x4e
je 0x4287dd
cmp ecx, 0x6e
jne 0x428839
movzx ecx, word [eax + 0xa]
cmp ecx, 0x53
je 0x4287eb
cmp ecx, 0x73
jne 0x428839
movzx ecx, word [eax + 0xc]
cmp ecx, 0x54
je 0x4287f9
cmp ecx, 0x74
jne 0x428839
movzx ecx, word [eax + 0xe]
cmp ecx, 0x41
je 0x428807
cmp ecx, 0x61
jne 0x428839
movzx ecx, word [eax + 0x10]
cmp ecx, 0x4c
je 0x428815
cmp ecx, 0x6c
jne 0x428839
movzx ecx, word [eax + 0x12]
cmp ecx, 0x4c
je 0x428823
cmp ecx, 0x6c
jne 0x428839
cmp word [eax + 0x14], 0
jne 0x428839
mov ecx, dword [0x4574c8]
mov dl, 1
mov ecx, dword [ecx]
call fcn.00405960
inc esi
cmp esi, dword [0x4574c0]
jl 0x428390
push dword [0x4574c8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004280a0
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret 0x10
sub esp, 0xc
xor edx, edx
xor ecx, ecx
call fcn.00403910
int3