Function at 0x405e20
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b1c4
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x48b378]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov esi, 0x48e3e0
mov ebx, dword [eax]
mov eax, dword [0x48e3dc]
cmp eax, dword [ebx + 4]
jle 0x405ecb
push 0x48e3dc
call fcn.0044e9e8
add esp, 4
cmp dword [0x48e3dc], 0xffffffff
jne 0x405ecb
mov dword [ebp - 4], 0
mov ecx, esi
push 8
push str.14231324
mov dword [0x48e3f4], 0xf
mov dword [0x48e3f0], 0
mov byte [0x48e3e0], 0
call fcn.00407700
push 0x46d7a0
call fcn.0044ed3f
push 0x48e3dc
mov dword [ebp - 4], 0xffffffff
call fcn.0044e9a9
add esp, 8
mov eax, dword [0x48e3f8]
cmp eax, dword [ebx + 4]
jle 0x405f20
push 0x48e3f8
call fcn.0044e9e8
add esp, 4
cmp dword [0x48e3f8], 0xffffffff
jne 0x405f20
push 0x46d790
mov dword [0x48e410], 0xf
mov dword [0x48e40c], 0
mov byte [0x48e3fc], 0
call fcn.0044ed3f
push 0x48e3f8
call fcn.0044e9a9
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [ebp - 0x44], eax
sub ecx, dword [0x48e0f8]
cmp ecx, 0x7d0
ja 0x405f49
mov ecx, dword [0x48e3f0]
add ecx, ecx
cmp dword [0x48e40c], ecx
jbe 0x405f69
cmp dword [0x48e410], 0x10
mov eax, 0x48e3fc
mov dword [0x48e40c], 0
cmovae eax, dword [0x48e3fc]
mov byte [eax], 0
lea eax, [ebp - 0x38]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x34]
movsx edx, ax
shr eax, 0x10
movsx ecx, ax
mov eax, dword [ebp - 0x38]
add eax, 0x32
mov dword [ebp - 0x3c], eax
cmp edx, eax
jge 0x405f9d
lea eax, [ebx + 0x32]
cmp ecx, eax
jge 0x405f9d
push 0x31
jmp 0x405fd6
mov eax, dword [ebp - 0x30]
add eax, 0xffffffce
mov dword [ebp - 0x40], eax
cmp edx, eax
jle 0x405fb5
lea eax, [ebx + 0x32]
cmp ecx, eax
jge 0x405fb5
push 0x32
jmp 0x405fd6
mov ebx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x3c]
jge 0x405fc8
lea eax, [ebx - 0x32]
cmp ecx, eax
jle 0x405fc8
push 0x33
jmp 0x405fd6
cmp edx, dword [ebp - 0x40]
jle 0x405fdb
lea eax, [ebx - 0x32]
cmp ecx, eax
jle 0x405fdb
push 0x34
call fcn.00406990
push dword [0x48e3f0]
cmp dword [0x48e3f4], 0x10
mov eax, dword [ebp - 0x44]
cmovae esi, dword [0x48e3e0]
push ecx
push esi
mov dword [0x48e0f8], eax
call fcn.00406a20
cmp eax, 0xffffffff
je 0x406144
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp byte [edi + 0x528], al
je 0x40607a
push 0x5b
push str.______________________________HACK_CODE_MATCHED________________________________r_n_r_n
call fcn.00402500
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
cmp word [edx], 0
jne 0x40604b
xor ecx, ecx
jmp 0x40605f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406050
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00404e20
push 0xa
push 0x481a40
lea ecx, [ebp - 0x28]
call fcn.00404e20
jmp 0x406086
push 0x1d
push 0x481a58
call fcn.00402500
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 4
cmovae eax, dword [ebp - 0x28]
push str.:_6R
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40612f
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x1594
push dword [edi + 4]
mov dword [edi + 0x53c], 1
call esi
push 0x1593
push dword [edi + 4]
call esi
push 0x1595
push dword [edi + 4]
call esi
push 1
push 0
mov ecx, edi
call fcn.00415ee7
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 5
push str.cmd.exe
call esi
call fcn.00401440
push 1
call fcn.00401a60
push ecx
push 1
call fcn.00401440
mov ecx, eax
call fcn.00401c70
push 5
push 0x481aa8
call esi
push 5
push str.taskmgr.exe
call esi
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x406144
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00402430
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e878
mov esp, ebp
pop ebp
ret 8