Function at 0x40ee23
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
xor ebx, ebx
call fcn.0040ebb4
cmp eax, 1
jne 0x40f012
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [eax + esi - 2]
add eax, esi
cmp cl, 0x2d
je 0x40ee63
cmp cl, 0x5c
jne 0x40ee71
mov al, byte [eax - 1]
cmp al, 0x73
je 0x40ee6e
cmp al, 0x53
jne 0x40ee71
push 1
pop ebx
push str.WinObjEx_123
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, edi
jne 0x40ef9e
call fcn.0040dcb9
test eax, eax
je 0x40ef8a
call fcn.0040ddb5
test eax, eax
je 0x40eec0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x41ff34
push eax
mov dword [ebp - 0x18], 0x40df2b
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x40f025
cmp ebx, edi
je 0x40efaa
push 1
call fcn.0040df8a
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40ef6d
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.WinObjEx_456
push edi
push 1
push edi
call esi
push str.WinObjEx_789
push edi
push 1
mov dword [ebp - 0x14], eax
pop ebx
push ebx
push edi
call esi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
je 0x40ef60
cmp eax, edi
je 0x40ef60
push 0x41ff34
call fcn.0040e02e
cmp eax, ebx
jne 0x40ef46
push 0x1388
lea eax, [ebp - 0x14]
push edi
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, edi
je 0x40ef38
cmp eax, 0x102
je 0x40ef38
mov dword [ebp - 4], ebx
jmp 0x40ef46
push edi
push edi
push str.Unable_to_run_as_LocalSystem_account._nContinue_as_usual.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x14], edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40ef56
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x10], edi
je 0x40ef60
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 8], ebx
jne 0x40ef7b
push edi
call fcn.0040df8a
jmp 0x40ef7b
push edi
push edi
push str.Unable_to_run_as_LocalSystem_account_nbecause_interactive_services_disabled._nContinue_as_usual.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 4], 1
jne 0x40efa5
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ebx, edi
je 0x40efaa
push edi
push edi
push str.Administrative_privileges_required_to_run_as_LocalSystem_account._nContinue_as_usual.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40efa5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], edi
jne 0x40f025
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x40edd1
mov dword [0x424d68], eax
call esi
push str.SeTakeOwnershipPrivilege
mov ebx, eax
call fcn.0040ebc4
push str.SeTcbPrivilege
call fcn.0040ebc4
push str.SeLoadDriverPrivilege
call fcn.0040ebc4
call fcn.0040ed19
call fcn.0040ed2b
push 0xa
push dword [ebp - 0xc]
push edi
push dword [0x424d68]
call fcn.0040f037
call fcn.0040ed7c
call fcn.00404e95
call fcn.00404d86
push ebx
call esi
jmp 0x40f025
push 0x10
push 0x41ff34
push str.This_application_requires_features_present_in_Windows_NT
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]