Function at 0x40194f
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
call fcn.00401c90
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call eax
mov edx, eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40198f
mov dword [esp], str.Error_parsing_commandline_options__n
call fcn.00401530
mov eax, dword [ebp - 0x28]
cmp eax, 3
je 0x4019d0
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.Usage:__S__option..__nOptions:_n___p___pid___________pid__n___n___process_name__process_name__n___f___file__________path__n_nExamples:_n_S__p_1234_n_S__n_lsass.exe_n_S__f__S_n
call fcn.00401530
mov dword [esp], str.kernel32
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov ebx, 0x405020
mov dword [esp + 4], str.IsWow64Process
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404222
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401a35
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404228
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401a68
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_wcstoul
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.004016b4
jmp 0x401b1b
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404234
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401aa0
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.__process_name
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401ac0
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0040155a
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004016b4
jmp 0x401b1b
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404258
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401af8
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.__file
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401b0a
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0040176a
jmp 0x401b1b
mov dword [esp], str.Invalid_action_specified.._n
call fcn.00401530
mov eax, 1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret