Function at 0x40288c
Capabilities:
Accept command line arguments

Disassembly:
push 0x2a4
mov eax, 0x427d12
call fcn.00426200
xor ebx, ebx
mov dword [ebp - 4], ebx
push ecx
push ecx
lea ecx, [ebp - 0x128]
call fcn.00407a00
mov byte [ebp - 4], 1
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00413820
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1cc]
call fcn.004139b0
test al, al
je 0x402ba5
push ecx
call fcn.004038fb
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403918
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push str.When_run_without_specifying_a_user_or_domain__changes_the_password_of_the
mov ecx, esi
call fcn.00403930
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.current_user._Otherwise__the_Windows_password_of_the_specified_user_is_changed.
mov ecx, esi
call fcn.00403946
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.0040395c
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403974
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.Windows_password._Administrators_can_use_the_net_user_command_to_change_any
mov ecx, esi
call fcn.0040398c
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.users_password_without_having_to_know_the_current_password._To_learn_more_
mov ecx, esi
call fcn.004039a2
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.004039b8
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push str.The_caller_must_have_the_Change_password_control_access_right__which_is
mov ecx, esi
call fcn.00403930
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.granted_to_all_users_and_types_of_logon_by_default._If_the_caller_is_not_a
mov ecx, esi
call fcn.004039d0
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.member_of_the_Administrators_group__the_SE_CHANGE_NOTIFY_NAME_privilege_may
mov ecx, esi
call fcn.004039a2
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.also_be_required__in_Security_Policy__Bypass_traverse_checking_._This_right
mov ecx, esi
call fcn.0040398c
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str.is_also_granted_to_all_users_by_default__see_also_MS_KB_article_823659_for_a
mov ecx, esi
call fcn.004039e6
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.004039fc
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403a14
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403a2c
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403a44
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str._________If_not_specified__will_change_the_password_of_the_current_user.
mov ecx, esi
call fcn.00403a5c
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str._domain__The_DNS_or_NetBIOS_name_of_a_remote_server_or_domain_on_which_the
mov ecx, esi
call fcn.004039d0
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str._________operation_is_to_execute._On_NT__this_string_may_need_to_begin_with_.
mov ecx, esi
call fcn.00403946
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403a72
mov esi, eax
mov ecx, esi
call fcn.00408f20
push str._oldpw___The_existing_password._If_not_specified__bvPwd_will_prompt_for_it.
mov ecx, esi
call fcn.004039a2
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403a8a
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push str.bvPwd_will_return_0_if_successful__or_with_one_of_the_following_error_codes:
mov ecx, esi
call fcn.004039e6
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403aa2
push ecx
push ecx
push 2
mov ecx, eax
call fcn.00408d50
push ecx
mov ecx, eax
call fcn.00403aba
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403aa2
push ecx
push ecx
push 1
mov ecx, eax
call fcn.00408d50
push ecx
mov ecx, eax
call fcn.00403ad2
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403aa2
push ecx
push ecx
push 3
mov ecx, eax
call fcn.00408d50
push str.___unrecognized_exception
mov ecx, eax
call fcn.00403aea
mov esi, eax
mov ecx, esi
call fcn.00408f20
mov ecx, esi
call fcn.00408f20
push str.If_not_all_of_the_above_help_text_is_visible__enlarge_the_window_or_run:
mov ecx, esi
call fcn.00403a5c
mov esi, eax
mov ecx, esi
call fcn.00408f20
push ecx
mov ecx, esi
call fcn.00403b00
mov ecx, eax
call fcn.00408f20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1cc]
call fcn.0040205d
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x128]
call fcn.00407ae0
push 2
pop eax
jmp 0x403154
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
push ecx
lea ecx, [ebp - 0x16c]
call fcn.00403209
mov byte [ebp - 4], 7
push ecx
lea ecx, [ebp - 0x108]
call fcn.00403209
mov byte [ebp - 4], 8
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 4], 9
mov eax, str.user
mov dword [ebp - 0x58], eax
push 4
pop ecx
mov dword [ebp - 0x54], ecx
push ecx
push eax
lea ecx, [ebp - 0x88]
call fcn.00405930
mov byte [ebp - 4], 0xa
sub esp, 0xc
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.004148a0
mov byte [ebp - 0x15], al
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x88]
call fcn.0040346d
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 4], 0xc
mov eax, str.domain
mov dword [ebp - 0xbc], eax
push 6
pop ecx
mov dword [ebp - 0xb8], ecx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.00405930
mov byte [ebp - 4], 0xd
sub esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.004148a0
mov byte [ebp - 0x16], al
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x98]
call fcn.0040346d
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0xc]
lea esi, [ebp - 0x16c]
add esi, eax
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 4], 0xf
mov eax, str.oldpw
mov dword [ebp - 0xc4], eax
push 5
pop edi
mov dword [ebp - 0xc0], edi
push edi
push eax
lea ecx, [ebp - 0xa8]
call fcn.00405930
mov byte [ebp - 4], 0x10
push ecx
push ecx
push esi
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.004145a0
mov bh, al
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa8]
call fcn.0040346d
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0xc]
lea esi, [ebp - 0x108]
add esi, eax
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 0x12
mov eax, str.newpw
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
push edi
push eax
lea ecx, [ebp - 0x50]
call fcn.00405930
mov byte [ebp - 4], 0x13
push ecx
push ecx
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.004145a0
mov bl, al
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x50]
call fcn.0040346d
push ecx
lea ecx, [ebp - 0x1cc]
call fcn.004140b0
test bh, bh
je 0x402db1
test bl, bl
jne 0x402dc7
push str.Press_ESC_to_abort_password_change._Run_with__h_parameter_for_info_and_help.
mov ecx, 0x4457e0
call fcn.004039e6
mov ecx, eax
call fcn.00408f20
test bh, bh
jne 0x402df0
push str.Enter_existing_password:
mov ecx, 0x4457e0
call fcn.00403aea
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x16c]
add ecx, eax
call fcn.0040266d
test bl, bl
jne 0x402eb8
push ecx
call fcn.00403b18
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x108]
add ecx, eax
call fcn.0040266d
push ecx
lea ecx, [ebp - 0x210]
call fcn.00403209
mov byte [ebp - 4], 0x15
push ecx
call fcn.00403b35
mov eax, dword [ebp - 0x210]
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x210]
add ecx, eax
call fcn.0040266d
mov eax, dword [ebp - 0x210]
mov eax, dword [eax + 0xc]
lea edx, [ebp - 0x210]
add edx, eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x108]
add ecx, eax
push ecx
push ecx
mov eax, esp
mov dword [eax], str.wmain::_lambda_be8290f0d3b8706401f794742226fb8d_::operator___
mov dword [eax + 4], 0x3d
call fcn.00403b52
pop ecx
pop ecx
test al, al
jne 0x402ea9
push ecx
push ecx
mov ecx, esp
push str.Passwords_do_not_match
call fcn.00403c0c
push ecx
lea ecx, [ebp - 0x24c]
call fcn.0040254e
push 0x441228
lea eax, [ebp - 0x24c]
push eax
call fcn.0041c750
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x210]
call fcn.0040315a
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x19
mov esi, 0x433124
push ebx
push esi
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x16c]
call fcn.00403c21
push ebx
push esi
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x108]
call fcn.00403c21
add esp, 0x10
mov eax, 0x445274
mov edx, eax
cmp dword [ebp - 0x60], ebx
cmovne edx, dword [ebp - 0x64]
mov esi, eax
cmp dword [ebp - 0x70], ebx
cmovne esi, dword [ebp - 0x74]
cmp byte [ebp - 0x15], bl
je 0x402f31
mov ecx, eax
cmp dword [ebp - 0x38], ebx
cmovne ecx, dword [ebp - 0x3c]
jmp 0x402f33
mov ecx, ebx
cmp byte [ebp - 0x16], 0
je 0x402f43
cmp dword [ebp - 0x28], 0
cmovne eax, dword [ebp - 0x2c]
jmp 0x402f45
mov eax, ebx
push edx
push esi
push ecx
push eax
call dword [sym.imp.NETAPI32.dll_NetUserChangePassword]
mov esi, eax
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x68]
call fcn.0040346d
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x78]
call fcn.0040346d
push ecx
test esi, esi
jne 0x402fe4
call fcn.00403c8b
mov ecx, eax
call fcn.00408f20
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x108]
call fcn.0040315a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x16c]
call fcn.0040315a
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
call fcn.0040346d
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.0040346d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1cc]
call fcn.0040205d
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x128]
call fcn.00407ae0
xor eax, eax
jmp 0x403154
push ebx
push esi
lea ecx, [ebp - 0x2b0]
call fcn.004023c8
mov edi, eax
mov byte [ebp - 4], 0x1e
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
push ecx
mov esi, dword [eax]
mov ecx, esi
call dword [0x42c1c8]
mov ecx, edi
call esi
push dword [eax + 4]
push dword [eax]
call fcn.004019dc
mov ecx, eax
call fcn.00408f20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2b0]
call fcn.00402460
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x108]
call fcn.0040315a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x16c]
call fcn.0040315a
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
call fcn.0040346d
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.0040346d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1cc]
call fcn.0040205d
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x128]
call fcn.00407ae0
jmp 0x403151
xor eax, eax
inc eax
call fcn.0042614d
ret