Function at 0x104b354
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x10831cb
call fcn.01068a88
sub esp, 0x150
mov eax, dword [0x1097470]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push dword [0x1096e18]
xor ebx, ebx
push ebx
push 0x1f0003
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xf4], esi
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, ebx
mov dword [ebp - 0xe8], eax
je 0x104b3f1
push 0x31
pop ecx
xor eax, eax
mov word [ebp - 0xe4], bx
lea edi, [ebp - 0xe2]
rep stosd dword es:[edi], eax
push 0x63
stosw word es:[edi], ax
lea eax, [ebp - 0xe4]
push eax
push 2
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x104b3de
lea eax, [ebp - 0xe4]
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x104b3de
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0xe8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x104b72c
push dword [0x1096e18]
xor edi, edi
inc edi
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xe8], eax
mov dword [0x10987f0], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x1008054
push 0x13
push esi
push 0x10967e0
mov ecx, 0x1098540
mov dword [ebp - 0xf0], eax
call fcn.01048a39
mov dword [0x10987e8], edi
mov esi, 0x1008578
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xf0]
movsw word es:[edi], word [esi]
jmp 0x104b493
push 0x1008560
push esi
call fcn.01068d06
test eax, eax
pop ecx
pop ecx
je 0x104b58e
push 0x100854c
push esi
call fcn.01068d06
test eax, eax
pop ecx
pop ecx
je 0x104b59d
push 0x100853c
push esi
call fcn.01068d06
test eax, eax
pop ecx
pop ecx
je 0x104b5a0
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.01046dc0
mov esi, eax
cmp esi, ebx
jne 0x104b44f
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
xor edi, edi
inc edi
cmp dword [ebp - 0xec], edi
mov byte [ebp - 4], 2
jle 0x104b5fd
push dword [esi + edi*4]
lea ecx, [ebp - 0x13c]
call fcn.01012a13
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 3
call fcn.0101292a
push 1
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 2
call fcn.0101260e
push ebx
push 0x1008534
lea ecx, [ebp - 0x124]
call fcn.01018cc8
test eax, eax
jne 0x104b5b3
inc edi
cmp edi, dword [ebp - 0xec]
jge 0x104b5f0
push dword [esi + edi*4]
lea ecx, [ebp - 0x15c]
call fcn.01012a13
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 4
call fcn.0101292a
lea ecx, [ebp - 0x15c]
jmp 0x104b5e5
mov ecx, 0x1098540
call fcn.01049f0d
jmp 0x104b72c
push ebx
jmp 0x104b5a2
push 1
push 1
mov ecx, 0x1098540
call fcn.010499fb
jmp 0x104b72c
cmp edi, 1
jne 0x104b5f0
push dword [esi + 4]
lea ecx, [ebp - 0x14c]
call fcn.01012a13
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 5
call fcn.0101292a
lea ecx, [ebp - 0x14c]
push 1
mov byte [ebp - 4], 2
call fcn.0101260e
inc edi
cmp edi, dword [ebp - 0xec]
jl 0x104b505
push dword [ebp - 0xf4]
call fcn.0107c762
push 2
pop esi
mov dword [ebp - 4], esi
call sub.SHELL32.dll_Ordinal_258
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 8
mov dword [ebp - 0x128], 0x280
call fcn.01048c5d
call fcn.01046178
call fcn.01045e5f
mov dword [eax + 0x130], ebx
call fcn.01032678
cmp dword [ebp - 0x10c], ebx
je 0x104b663
lea eax, [ebp - 0x114]
push eax
call fcn.01045e5f
mov ecx, eax
call fcn.0104b246
cmp dword [ebp - 0xfc], ebx
je 0x104b685
call fcn.01045e5f
push 0xffffffffffffffff
lea ecx, [eax + 0x90]
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.0101292a
mov byte [ebp - 4], 8
call fcn.0104b971
mov ecx, 0x1098540
mov dword [ebp - 4], esi
mov dword [0x10987e8], ebx
call fcn.0104b300
call fcn.0104b9b6
call fcn.0103486a
call fcn.01045e5f
cmp dword [eax + 0x130], ebx
je 0x104b6c9
call fcn.01045e5f
push dword [eax + 0x130]
call dword [sym.imp.GDI32.dll_DeleteObject]
call fcn.01046227
push dword [ebp - 0xf4]
call sub.SHELL32.dll_Ordinal_259
cmp dword [ebp - 0xe8], ebx
je 0x104b6ed
push dword [ebp - 0xe8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [0x10987ec]
jmp 0x104b703
push 1
lea ecx, [ebp - 0x124]
call fcn.0101260e
push 1
lea ecx, [ebp - 0x104]
call fcn.0101260e
push 1
lea ecx, [ebp - 0x114]
call fcn.0101260e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.01067393
pop edi
pop esi
pop ebx
leave
ret 0x10