Function at 0x404d30
Capabilities:
Accept command line arguments
Get hostname
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x43a128]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
xor al, al
cmp dword [ebp + 8], 1
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x2ac], ecx
mov byte [ebp - 0x28e], 0
mov byte [ebp - 0x28d], al
mov byte [ebp - 0x29c], al
mov byte [ebp - 0x29d], al
mov byte [ebp - 0x28f], al
mov byte [ebp - 0x29f], al
mov byte [ebp - 0x29a], al
mov byte [ebp - 0x299], al
mov byte [ebp - 0x2a1], al
mov byte [ebp - 0x2a0], al
mov byte [ebp - 0x29e], al
jg 0x404dba
push dword [edi]
call fcn.00406930
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
push ebx
xor eax, eax
mov dword [ecx], 0
mov ebx, 1
mov word [0x460ca0], ax
mov dword [ebp - 0x298], ebx
push esi
nop word [eax + eax]
mov ecx, dword [edi + ebx*4]
lea ebx, [edi + ebx*4]
mov dword [ebp - 0x2a8], ebx
movzx edx, word [ecx]
mov eax, edx
sub eax, 0x2d
je 0x404e35
sub eax, 2
je 0x404e35
sub eax, 0x11
mov al, byte [ebp - 0x28d]
jne 0x405446
test al, al
jne 0x405446
mov edx, 0x43aae0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x404e17
mov dl, 1
mov byte [ebp - 0x28e], dl
jmp 0x40564f
mov al, byte [ebp - 0x28d]
test al, al
jne 0x405446
lea eax, [ecx + 2]
push 0x42feec
push eax
call fcn.0040aa3e
add esp, 8
test eax, eax
je 0x405649
mov eax, dword [ebx]
add eax, 2
push str.nobanner
push eax
call fcn.0040aa3e
add esp, 8
test eax, eax
je 0x405649
cmp dword [0x43fef8], 0
jne 0x404ee4
xor ebx, ebx
mov esi, 0x4390e0
xor edi, edi
nop dword [eax]
mov eax, dword [ebp - 0x2a8]
push esi
mov eax, dword [eax]
add eax, 2
push eax
call fcn.0040aa3e
add esp, 8
test eax, eax
je 0x404ec5
add edi, 0x204
inc ebx
add esi, 0x204
cmp edi, 0xe1c
jb 0x404e90
mov eax, dword [0x43fef8]
jmp 0x404ed6
imul eax, ebx, 0x204
mov eax, dword [eax + 0x4392e0]
mov dword [0x43fef8], eax
test eax, eax
jne 0x405649
mov ebx, dword [ebp - 0x2a8]
mov eax, dword [ebx]
add eax, 2
push 0x42ff18
push eax
call fcn.0040aa3e
add esp, 8
test eax, eax
jne 0x404f07
mov byte [0x43fef7], 1
jmp 0x405649
mov eax, dword [ebx]
mov esi, 1
mov dword [ebp - 0x2a8], esi
cmp word [eax + 2], 0
je 0x405649
mov ecx, 2
movzx eax, word [eax + ecx]
push eax
call fcn.004116f7
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x17
ja case.0x404f3d.66
jmp dword [eax*4 + 0x405834]
cmp byte [ebp - 0x29c], 0
jne case.0x404f3d.66
mov byte [0x43aade], 1
mov byte [ebp - 0x29c], 1
jmp 0x40512d
cmp byte [ebp - 0x29d], 0
jne case.0x404f3d.66
mov byte [0x43aadf], 1
mov byte [ebp - 0x29d], 1
jmp 0x40512d
cmp byte [ebp - 0x29e], 0
jne case.0x404f3d.66
mov byte [0x43fef5], 1
mov byte [ebp - 0x29e], 1
jmp 0x40512d
cmp byte [ebp - 0x299], 0
jne case.0x404f3d.66
mov byte [0x43fef4], 1
mov byte [ebp - 0x299], 1
jmp 0x40512d
cmp byte [ebp - 0x29f], 0
jne case.0x404f3d.66
mov byte [0x43fef1], 1
mov byte [ebp - 0x29f], 1
jmp 0x40512d
cmp byte [0x43a10a], 0
je case.0x404f3d.66
mov byte [0x43a10a], 0
jmp 0x40512d
cmp byte [ebp - 0x29a], 0
jne case.0x404f3d.66
mov eax, dword [ebp - 0x298]
inc eax
mov byte [0x43fef2], 1
mov byte [ebp - 0x29a], 1
mov dword [ebp - 0x2b0], eax
cmp eax, dword [ebp + 8]
jge 0x40512d
mov edx, dword [ebx + 4]
movzx eax, word [edx]
cmp eax, 0x2d
je 0x40512d
cmp eax, 0x2f
je 0x40512d
mov ecx, edx
mov esi, 1
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405050
sub ecx, edi
sar ecx, 1
cmp ecx, 1
jle 0x405093
movzx eax, word [edx + esi*2]
push 4
push eax
call fcn.00411590
add esp, 8
test eax, eax
je 0x405093
mov edx, dword [ebx + 4]
inc esi
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405080
sub eax, edi
sar eax, 1
cmp esi, eax
jl 0x405064
mov edx, dword [ebx + 4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4050a0
sub ecx, edi
sar ecx, 1
cmp esi, ecx
je 0x405149
mov esi, dword [ebp - 0x2a8]
jmp 0x40512d
cmp byte [ebp - 0x2a0], 0
jne case.0x404f3d.66
cmp dword [0x43aad8], 0
je 0x405688
mov byte [0x43fef6], 1
mov byte [ebp - 0x2a0], 1
jmp 0x40512d
cmp byte [0x43fef3], 0
jne case.0x404f3d.66
mov byte [0x43fef3], 1
mov byte [0x43fef2], 1
jmp 0x405121
cmp byte [ebp - 0x28f], 0
jne case.0x404f3d.66
mov byte [0x43fef0], 1
mov byte [ebp - 0x28f], 1
mov eax, dword [ebp - 0x2ac]
mov dword [eax], 1
mov eax, dword [ebx]
inc esi
mov dword [ebp - 0x2a8], esi
lea ecx, [esi + esi]
cmp word [eax + ecx], 0
jne 0x404f24
jmp 0x405649
push 0x439efc
push 0x42ffec
push edx
call fcn.00406b90
add esp, 0xc
test eax, eax
je case.0x404f3d.66
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x2ac]
mov byte [0x43a108], 0
mov dword [eax], 1
jmp 0x405649
cmp dword [0x43fefc], 0
jne case.0x404f3d.66
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebx]
push str.__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d
lea eax, [eax + esi*2]
add eax, 4
push eax
call fcn.00406b90
mov esi, eax
add esp, 0x88
xor edx, edx
test esi, esi
jle 0x4052b5
mov ecx, dword [0x43fefc]
nop dword [eax]
mov eax, dword [ebp + edx*4 - 0x28c]
inc edx
bts ecx, eax
cmp edx, esi
jl 0x4052a0
mov dword [0x43fefc], ecx
inc dword [ebp - 0x298]
jmp 0x405649
mov eax, 0xffff
cmp word [0x43a10c], ax
jne case.0x404f3d.66
push 0x43a10c
push 0x42ffe4
push dword [ebx + 4]
call fcn.00406b90
add esp, 0xc
test eax, eax
je case.0x404f3d.66
inc dword [ebp - 0x298]
jmp 0x405649
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x298], eax
jge case.0x404f3d.66
cmp dword [0x43a110], 0xffffffff
jne case.0x404f3d.66
push 0x43a110
push 0x42ffec
jmp 0x4052dc
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x404f3d.66
cmp byte [0x43aadd], 0
jne case.0x404f3d.66
mov ecx, dword [ebx + 4]
mov edx, 0x460ca0
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x405350
mov byte [0x43aadd], 1
jmp 0x405649
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x404f3d.66
cmp byte [0x43aadc], 0
jne case.0x404f3d.66
mov ecx, dword [ebx + 4]
mov edx, 0x43bae0
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4053a0
mov byte [0x43aadc], 1
jmp 0x405649
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x404f3d.66
cmp byte [ebp - 0x2a1], 0
jne case.0x404f3d.66
mov ecx, dword [ebx + 4]
mov edx, 0x43fce8
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4053f0
mov byte [ebp - 0x2a1], 1
jmp 0x405649
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x404f3d.66
mov ecx, dword [ebx + 4]
mov edx, str.PSEXESVC
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x405430
jmp 0x405649
cmp edx, 0x5c
jne 0x405480
cmp word [ecx + 2], dx
jne 0x405480
cmp byte [ebp - 0x28e], 0
jne 0x405480
add ecx, 4
mov edx, 0x43aae0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x405462
mov dl, 1
mov byte [ebp - 0x28e], dl
jmp 0x40564f
test al, al
jne 0x4055aa
cmp edx, 0x22
jne 0x4054bb
movzx eax, word [ecx + 2]
test ax, ax
je 0x4054b0
mov edx, eax
cmp dx, 0x22
je 0x4054b0
mov word [ebp - 0x20c], dx
movzx eax, word [ecx + 2]
mov edx, eax
test ax, ax
jne 0x405498
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x4054d3
lea edx, [ebp - 0x20c]
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4054c3
cmp byte [0x43aade], 0
je 0x405579
push 0
push 0
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
lea ecx, [esi + esi]
push ecx
call fcn.0040ab5a
add esp, 4
mov edi, eax
push esi
push edi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x460a80
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00404b50
add esp, 0x10
test al, al
jne 0x405597
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x405530
mov eax, dword [str..exe]
mov dword [ecx], eax
mov eax, dword [0x430084]
mov dword [ecx + 4], eax
mov ax, word [0x430088]
push 0x460a80
push esi
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00404b50
add esp, 0x10
test al, al
jne 0x405597
push str.The_specified_application_is_not_on_the_path._n_n
jmp 0x40575e
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ebp + ecx - 0x20c]
lea ecx, [ecx + 2]
mov word [ecx + 0x460a7e], ax
test ax, ax
jne 0x405580
mov dl, byte [ebp - 0x28e]
mov al, 1
mov byte [ebp - 0x28d], al
jmp 0x405655
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [ebp - 0x298]
xor esi, esi
mov edx, eax
test ebx, ebx
jle 0x4055fd
nop
push dword [edi + esi*4]
push edx
call fcn.00408c4e
mov edx, eax
add esp, 8
test edx, edx
je 0x405601
mov ecx, dword [edi + esi*4]
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4055e0
sub ecx, edi
inc esi
mov edi, dword [ebp - 0x294]
sar ecx, 1
lea edx, [edx + ecx*2]
cmp esi, ebx
jl 0x4055c0
test edx, edx
jne 0x405605
mov edx, dword [edi + esi*4 - 4]
movzx eax, word [edx]
mov esi, eax
cmp eax, 0x22
jne 0x405616
movzx esi, word [edx + 2]
add edx, 2
lea ecx, [edx + 2]
cmp si, 0x20
cmovne ecx, edx
mov edx, 0x43bce8
sub edx, ecx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x405630
mov eax, dword [ebp + 8]
mov dword [ebp - 0x298], eax
mov dl, byte [ebp - 0x28e]
mov al, byte [ebp - 0x28d]
mov cl, byte [ebp - 0x299]
mov bh, byte [ebp - 0x28f]
mov bl, cl
mov byte [ebp - 0x29b], al
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge 0x4056a8
mov edi, dword [ebp - 0x294]
mov ebx, eax
jmp 0x404de0
push str.Limited_user_is_only_supported_on_Windows_2000_and_higher._n_n
call fcn.00401da0
add esp, 4
xor al, al
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
test dl, dl
jne 0x40573b
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0x1000
push eax
push 0x43aae0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp byte [ebp - 0x29a], 0
mov cl, bl
mov al, byte [ebp - 0x29b]
mov ah, al
mov byte [ebp - 0x28f], bh
je 0x405741
cmp dword [0x439efc], 0xffffffff
mov byte [ebp - 0x28f], bh
jne 0x405741
push str.ProcessIdToSessionId
push 1
push 0x4300d4
call section..text
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov byte [ebp - 0x28f], bh
mov ah, byte [ebp - 0x29b]
mov cl, bl
test esi, esi
je 0x405741
push 0x439efc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
mov ah, byte [ebp - 0x29b]
mov cl, bl
jmp 0x405747
mov ah, byte [ebp - 0x28d]
mov bh, byte [ebp - 0x28f]
cmp byte [0x43fef6], 0
je 0x405784
cmp byte [0x43fef5], 0
je 0x405784
push str.Run_elevated_and_limited_user_options_are_not_compatible._n_n
push 2
call fcn.0040af7e
add esp, 4
push eax
call fcn.00403ba0
add esp, 8
xor al, al
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
test ah, ah
je case.0x404f3d.66
cmp byte [0x43aadd], 0
je 0x40579a
cmp byte [0x43aadc], 0
je case.0x404f3d.66
test cl, cl
je 0x4057c8
cmp byte [0x43aadf], 0
je 0x4057d1
mov eax, dword [ebp - 0x294]
push dword [eax]
call fcn.00406930
add esp, 4
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040760d
mov esp, ebp
pop ebp
ret
cmp byte [0x43aadf], 0
je 0x4057da
cmp byte [0x43aade], 0
je case.0x404f3d.66
push 0x43aae0
push 0x464ec0
call fcn.0040aa3e
add esp, 8
test eax, eax
je 0x4057f9
cmp byte [0x43fef3], 0
jne case.0x404f3d.66
test bh, bh
je 0x405821
mov al, byte [0x43fef2]
mov byte [0x43a10a], 0
test al, al
je 0x405821
xor ecx, ecx
movzx eax, al
cmp dword [0x439efc], 0xffffffff
cmove eax, ecx
mov byte [0x43fef2], al
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0040760d
mov esp, ebp
pop ebp
ret