Function at 0x4080e0
Capabilities:
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x2f
je 0x408100
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x2d
jne 0x4088e0
push str.REALTIME
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408124
mov edx, dword [ebp + 0x14]
mov dword [edx], 0x100
jmp 0x4088d9
push str.HIGH
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408148
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0x80
jmp 0x4088d9
push str.ABOVENORMAL
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40816c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x8000
jmp 0x4088d9
push str.NORMAL
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408190
mov edx, dword [ebp + 0x14]
mov dword [edx], 0x20
jmp 0x4088d9
push str.BELOWNORMAL
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4081b4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0x4000
jmp 0x4088d9
push str.IDLE
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4081d8
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x40
jmp 0x4088d9
push str.NOCONSOLE
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408230
push str.NOWINDOW
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408230
push str.HIDE
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408230
push str.HIDDEN
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408244
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
or eax, 0x8000000
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x4088d9
push str.TEST
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40826c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 2
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x4088d9
push str.SILENT
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408294
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push str.WAIT
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4082bc
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x4088d9
push str.WAITINPUT
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4082e8
push str.WAITIDLE
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4082fa
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x20
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push str.SHELL
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408322
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x40
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x4088d9
push 0x410fec
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40834d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 0x200
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x4088d9
push str.UAC2
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408378
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x400
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push str.RUNAS
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4083ba
push str.ELEVATE
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4083ba
push str.ELEVATED
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4083cf
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x100
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push str.NONELEVATED
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408411
push str.NOELEVATE
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408411
push str.NOELEVATED
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408426
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x1000
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push str.NOUAC
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408450
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x2000
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x4088d9
push str.UACTASK
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40847b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 0x4000
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x4088d9
push str.REGTASK
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4084a6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x8000
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push str.UNREGTASK
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4084d0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x10000
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x4088d9
push 0x4110b4
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4084fc
push str.NOQUOTES
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40850e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 8
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push 0x4110d0
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408550
push 0x4110d4
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x408550
push 0x4110e0
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408562
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x4088d9
push 6
push 0x4110e4
push 6
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4085db
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x30
jl 0x4085ce
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x39
jg 0x4085ce
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0xa
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x30]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
jmp 0x408594
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
jmp 0x4088d9
push 2
push 0x4110f4
push 2
mov eax, dword [ebp + 8]
add eax, 2
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x40865d
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 6]
cmp edx, 0x22
jne 0x408641
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x22
jne 0x408634
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov word [eax + edx*2], cx
mov ecx, dword [ebp + 8]
add ecx, 8
mov edx, dword [ebp + 0x1c]
mov dword [edx], ecx
jmp 0x40864c
mov eax, dword [ebp + 8]
add eax, 6
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x4088d9
push 4
push str.MSG
push 4
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4086d4
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0xa]
cmp eax, 0x22
jne 0x4086c4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x22
jne 0x4086b6
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 8]
add edx, 0xc
mov dword [0x4148b4], edx
jmp 0x4086cf
mov eax, dword [ebp + 8]
add eax, 0xa
mov dword [0x4148b4], eax
jmp 0x4088d9
push 6
push str.TITLE
push 6
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x40874b
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0xe]
cmp eax, 0x22
jne 0x40873b
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x22
jne 0x40872d
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 8]
add edx, 0x10
mov dword [0x4148b8], edx
jmp 0x408746
mov eax, dword [ebp + 8]
add eax, 0xe
mov dword [0x4148b8], eax
jmp 0x4088d9
push 4
push str.ERR
push 4
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4087c2
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0xa]
cmp eax, 0x22
jne 0x4087b2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x22
jne 0x4087a4
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 8]
add edx, 0xc
mov dword [0x4148bc], edx
jmp 0x4087bd
mov eax, dword [ebp + 8]
add eax, 0xa
mov dword [0x4148bc], eax
jmp 0x4088d9
push 7
push str.ERRMSG
push 7
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x408839
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x10]
cmp eax, 0x22
jne 0x408829
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x22
jne 0x40881b
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 8]
add edx, 0x12
mov dword [0x4148bc], edx
jmp 0x408834
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [0x4148bc], eax
jmp 0x4088d9
push 9
push str.ERRTITLE
push 9
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4088ad
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x14]
cmp eax, 0x22
jne 0x4088a0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x22
jne 0x408892
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 8]
add edx, 0x16
mov dword [0x4148c0], edx
jmp 0x4088ab
mov eax, dword [ebp + 8]
add eax, 0x14
mov dword [0x4148c0], eax
jmp 0x4088d9
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
and edx, 4
jne 0x4088d9
mov eax, dword [0x4148ac]
or eax, 0x10
push eax
push str.Unknown_parameter___Hstart
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
jmp 0x4088e2
xor eax, eax
mov esp, ebp
pop ebp
ret