Function at 0x405580
Capabilities:
Accept command line arguments
Check if file exists
Get comspec environment variable
Get file attributes
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4240
call fcn.00430be0
mov eax, dword [0x43a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push pe_nt_image_headers32
push 0
push 0x44a0a4
mov dword [ebp - 0x4240], 0
mov dword [ebp - 0x423c], 1
call fcn.0041e550
add esp, 0xc
mov dword [0x44a0a0], 0x114
push 0x44a0a0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x4234]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40567e
lea eax, [ebp - 0x4230]
mov dword [ebp - 0x4230], 0x64
push eax
push 0x43bbf8
lea eax, [ebp - 0x4238]
push eax
push 0
push str.ProductName
push dword [ebp - 0x4234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x405641
cmp dword [ebp - 0x4238], 1
jne 0x405641
mov ecx, dword [ebp - 0x4230]
jmp 0x40564f
mov ecx, 2
mov dword [ebp - 0x4230], ecx
lea esi, [ecx + 0x55]
shr ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x64
jae 0x405e61
push dword [ebp - 0x4234]
xor eax, eax
mov word [ecx + 0x43bbf8], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40573c
mov eax, dword [0x44a0b0]
sub eax, 1
je 0x4056ad
sub eax, 1
jne 0x40573c
mov eax, dword [0x437d7c]
movups xmm0, xmmword [str.Windows_NT]
mov dword [0x43bc08], eax
mov ax, word [0x437d80]
jmp 0x40572f
cmp dword [0x44a0a4], 4
jne 0x40573c
mov eax, dword [0x44a0a8]
test eax, eax
jne 0x4056dc
mov eax, dword [0x437d1c]
movups xmm0, xmmword [str.Windows_95]
mov dword [0x43bc08], eax
mov ax, word [0x437d20]
jmp 0x40572f
cmp eax, 1
jne 0x4056fa
mov eax, dword [0x437d34]
movups xmm0, xmmword [str.Windows_98]
mov dword [0x43bc08], eax
mov ax, word [0x437d38]
jmp 0x40572f
cmp eax, 9
jne 0x405718
mov eax, dword [0x437d4c]
movups xmm0, xmmword [str.Windows_ME]
mov dword [0x43bc08], eax
mov ax, word [0x437d50]
jmp 0x40572f
mov eax, dword [0x437d64]
movups xmm0, xmmword [str.Windows_9x]
mov dword [0x43bc08], eax
mov ax, word [0x437d68]
movups xmmword [0x43bbf8], xmm0
mov word [0x43bc0c], ax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x40576d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push edi
call esi
push str.NtReadVirtualMemory
push edi
mov dword [0x43bc5c], eax
call esi
mov dword [0x43be74], eax
mov ecx, 0x80000002
call fcn.00405200
mov ecx, 0x80000001
call fcn.00405200
call fcn.00411500
push 2
lea eax, [ebp - 0x4238]
push eax
push str.PROMPT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x4057b0
push 0x43b040
push str.PROMPT
call esi
mov dword [0x4418a0], 0
mov dword [0x4418a4], 0
mov dword [0x4418a8], 0
call fcn.00410080
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4057ff
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
push str.COMSPEC
call esi
push 1
push 0x405140
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov esi, dword [0x44a080]
mov ebx, dword [0x44a000]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push esi
call edi
push 3
push esi
call edi
push 7
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x422c], eax
movzx ecx, word [eax]
test cx, cx
je 0x405a7f
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [eax + eax]
cmp cx, 0x2f
jne 0x405a62
mov eax, dword [ebp - 0x422c]
movzx eax, word [eax + 2]
push eax
call fcn.004216bb
movzx esi, ax
add esp, 4
mov ecx, esi
cmp esi, 0x3f
je 0x405b9d
cmp esi, 0x50
jne 0x405942
push str._autoexec.bat
call ebx
cmp eax, 0xffffffff
je 0x40591c
test al, 0x10
jne 0x40591c
mov ecx, str._autoexec.bat
call fcn.00415300
mov edi, eax
test edi, edi
je 0x405933
mov ecx, edi
call fcn.00403b90
mov ecx, dword [edi]
test ecx, ecx
je 0x4058c2
call fcn.00415e00
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4058ce
call fcn.00415e00
mov eax, dword [edi + 8]
test eax, eax
je 0x4058e6
mov esi, dword [eax]
push eax
call fcn.0041f3e5
add esp, 4
mov eax, esi
test esi, esi
jne 0x4058d5
mov al, byte [edi + 0xc]
cmp al, 7
je 0x4058f1
cmp al, 8
jne 0x405904
push dword [edi + 0x14]
call fcn.0041f3e5
push dword [edi + 0x18]
call fcn.0041f3e5
add esp, 8
push edi
call fcn.0041f3e5
add esp, 4
mov dword [0x43a94c], 0
jmp 0x405a62
push 0x436be8
call fcn.004096d0
push 0x436be8
call fcn.0041ae50
add esp, 8
mov dword [0x43a94c], 0
jmp 0x405a62
cmp esi, 0x41
jne 0x405956
mov dword [0x43a944], 1
jmp 0x405a62
cmp esi, 0x43
je 0x405b84
cmp esi, 0x4b
je 0x405b84
cmp esi, 0x52
je 0x405b84
cmp esi, 0x44
jne 0x405985
mov dword [ebp - 0x423c], 0
jmp 0x405a62
cmp esi, 0x51
jne 0x405999
mov dword [0x43bbe0], 1
jmp 0x405a62
cmp esi, 0x53
jne 0x4059ad
mov dword [ebp - 0x4240], 1
jmp 0x405a62
push 3
push 0x436ef0
push dword [ebp - 0x422c]
call fcn.0041fe38
add esp, 0xc
test eax, eax
jne 0x4059e9
push 0x10
lea eax, [ebp - 0x422c]
push eax
mov eax, dword [ebp - 0x422c]
add eax, 6
push eax
call fcn.00420062
add esp, 0xc
mov word [0x43bbec], ax
jmp 0x405a62
cmp esi, 0x55
jne 0x4059fa
mov dword [0x43a944], 3
jmp 0x405a62
cmp esi, 0x56
jne 0x405a1f
mov eax, dword [ebp - 0x422c]
push 4
add eax, 4
push str.:OFF
push eax
call fcn.0041fe38
add esp, 0xc
mov dword [0x43bbf0], eax
jmp 0x405a62
cmp esi, 0x45
jne 0x405a3f
mov eax, dword [ebp - 0x422c]
push 4
add eax, 4
push str.:OFF
push eax
call fcn.0041fe38
add esp, 0xc
jmp 0x405a5d
cmp esi, 0x58
jne 0x405a50
mov dword [0x43a948], 1
jmp 0x405a62
mov eax, dword [0x43a948]
xor ecx, ecx
cmp esi, 0x59
cmove eax, ecx
mov dword [0x43a948], eax
mov eax, dword [ebp - 0x422c]
add eax, 2
mov dword [ebp - 0x422c], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x405850
cmp word [0x43bbec], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
jne 0x405ae5
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str.CONOUT_
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405adb
lea eax, [ebp - 0x4228]
push eax
push esi
call edi
movzx edx, word [0x43bbec]
test eax, eax
movzx ecx, word [ebp - 0x4220]
cmovne edx, ecx
push esi
mov word [0x43bbec], dx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x43bbec], 0
je 0x405b4d
movzx ebx, word [0x43bbec]
mov ecx, dword [0x44a080]
mov eax, ebx
shr al, 4
xor al, bl
mov dword [ebp - 0x4238], ecx
test al, 0xf
je 0x405b4d
lea eax, [ebp - 0x4228]
push eax
push ecx
call edi
movsx ecx, word [ebp - 0x4226]
xor eax, eax
mov edi, dword [ebp - 0x4238]
mov dword [ebp - 0x4234], eax
lea eax, [ebp - 0x4230]
push eax
movsx eax, word [ebp - 0x4228]
push dword [ebp - 0x4234]
imul ecx, eax
movzx esi, bl
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, dword [0x43a944]
cmp ecx, 4
jg 0x405c26
mov esi, dword [0x44a1d0]
or edx, 0xffffffff
mov dword [0x44a088], ecx
mov edi, 0xfde9
cmp ecx, 1
jne 0x405bfa
mov dword [0x44a08c], esi
jmp 0x405c07
xor eax, eax
cmp ecx, 0x4b
sete al
lea eax, [eax*2 + 1]
mov dword [0x43be70], eax
jmp 0x405a7f
push 0
lea eax, [ebp - 0x4234]
mov dword [ebp - 0x4234], 0
push eax
push ecx
mov edx, 0x267
call fcn.0041d0b0
mov ecx, dword [ebp - 0x4234]
test ecx, ecx
je 0x405bd5
test eax, eax
je 0x405bd5
push eax
push ecx
push 1
call fcn.0041ce60
add esp, 0xc
pop edi
pop esi
mov dword [0x43bbd4], 1
mov dword [0x43bbd8], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d22b
mov esp, ebp
pop ebp
ret
cmp ecx, 4
mov eax, edx
cmove eax, edi
mov dword [0x44a08c], eax
mov dword [0x44a048], ecx
cmp ecx, 1
jne 0x405c1a
mov dword [0x44a04c], esi
jmp 0x405c26
cmp ecx, 4
cmove edx, edi
mov dword [0x44a04c], edx
mov eax, dword [ebp - 0x422c]
cmp word [eax], 0
jne 0x405c4f
push 1
lea eax, [ebp - 0x4238]
mov dword [ebp - 0x4238], 0xa
push eax
push 0x44a060
call fcn.0041c900
cmp dword [ebp - 0x423c], 0
je 0x405c6c
mov ecx, 0x80000002
call fcn.00405460
mov ecx, 0x80000001
call fcn.00405460
mov eax, dword [ebp - 0x422c]
cmp word [eax], 0
je 0x405e50
lea esi, [eax + 4]
movzx eax, word [esi]
push 8
push eax
call fcn.0041f340
add esp, 8
test eax, eax
je 0x405ca7
movzx eax, word [esi + 2]
add esi, 2
push 8
push eax
call fcn.0041f340
add esp, 8
test eax, eax
jne 0x405c91
cmp word [esi], 0x22
mov edi, esi
jne 0x405da5
add esi, 2
push 0x22
push esi
call fcn.0041df18
mov edx, eax
add esp, 8
mov dword [ebp - 0x4230], edx
test edx, edx
je 0x405da5
xor eax, eax
lea ebx, [edi + 4]
mov word [edx], ax
cmp ebx, edx
jae 0x405d68
movzx eax, word [ebx]
push 8
push eax
call fcn.0041f340
add esp, 8
test eax, eax
jne 0x405d02
mov edx, dword [ebp - 0x4230]
add ebx, 2
cmp ebx, edx
jb 0x405ce1
jmp 0x405d68
cmp dword [ebp - 0x4240], 0
jne 0x405d62
push str.____
push esi
lfence
call fcn.004200af
add esp, 8
test eax, eax
jne 0x405d62
lea edx, [ebp - 0x4210]
mov ecx, esi
lfence
call fcn.0041c710
test eax, eax
je 0x405d62
mov eax, dword [ebp - 0x4230]
mov ecx, 0x22
mov word [eax], cx
lea ecx, [ebp - 0x4210]
sub ecx, edi
nop word [eax + eax]
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x405d50
jmp 0x405dc0
mov edx, dword [ebp - 0x4230]
lea edi, [ebp - 0x4210]
mov ecx, esi
sub edi, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x405d72
lea ecx, [edx + 2]
sub edx, esi
and edx, 0xfffffffe
sub edx, ecx
lea edx, [ebp + edx - 0x4210]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x405d93
jmp 0x405dc0
lea ecx, [ebp - 0x4210]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x405db0
lea ecx, [ebp - 0x4210]
call fcn.00415300
mov edi, eax
test edi, edi
je 0x405e2e
mov ecx, edi
call fcn.00403b90
mov ecx, dword [edi]
test ecx, ecx
je 0x405de3
call fcn.00415e00
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x405def
call fcn.00415e00
mov eax, dword [edi + 8]
test eax, eax
je 0x405e07
mov esi, dword [eax]
push eax
call fcn.0041f3e5
add esp, 4
mov eax, esi
test esi, esi
jne 0x405df6
mov al, byte [edi + 0xc]
cmp al, 7
je 0x405e12
cmp al, 8
jne 0x405e25
push dword [edi + 0x14]
call fcn.0041f3e5
push dword [edi + 0x18]
call fcn.0041f3e5
add esp, 8
push edi
call fcn.0041f3e5
add esp, 4
mov eax, dword [0x43bbd8]
mov ecx, 1
cmp dword [0x43be70], ecx
mov dword [0x43be70], 0
cmove eax, ecx
mov dword [0x43bbd8], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d22b
mov esp, ebp
pop ebp
ret
call fcn.0041d35b
int3