Function at 0x401320
Capabilities:
Accept command line arguments
Create thread
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x46aab0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
mov ebx, 1
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x4017da
mov edi, 2
cmp dword [esp + 0x1c], edi
jl 0x4017da
mov edx, dword [esi]
push str.install
push edx
call fcn.0044b912
add esp, 8
or ebp, 0xffffffff
test eax, eax
jne 0x401617
call fcn.00409a60
test eax, eax
je 0x4015a2
push 0x11
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x40], esp
call fcn.00401860
sub esp, 0x1c
mov dword [esp + 0x6c], 0
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x60], esp
call fcn.00401860
mov dword [esp + 0x6c], ebp
call fcn.00404e50
mov eax, dword [esi + 4]
add esp, 0x3c
push str.protect
push eax
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4014a2
call fcn.0041e600
test eax, eax
jne 0x401473
call fcn.00406350
test eax, eax
jne 0x40144f
call fcn.004339e0
test eax, eax
jne 0x40144f
push edi
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.00401860
mov dword [esp + 0x50], ebx
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x5c], esp
call fcn.00401860
mov dword [esp + 0x6c], ebp
call fcn.00404e50
add esp, 0x3c
mov edi, 0xe
jmp 0x4014c8
call fcn.00421860
test eax, eax
jne 0x401473
push 0xa
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.00401860
mov dword [esp + 0x50], edi
jmp 0x401429
call fcn.004336f0
test eax, eax
jne 0x40149b
push 6
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.00401860
mov dword [esp + 0x50], 3
jmp 0x401429
mov edi, 0xd
jmp 0x4014c8
mov ecx, dword [esi + 4]
push str.hookport
push ecx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4015c5
call fcn.004339e0
neg eax
sbb eax, eax
add eax, edi
mov edi, eax
push edi
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
push 0xa
mov ebx, 7
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], 0
push str.installret
mov word [esi + 4], dx
call fcn.004018a0
sub esp, 0x1c
mov dword [esp + 0x6c], ebx
mov esi, esp
mov dword [esp + 0x5c], esp
push 0xa
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], 0
push str.installret
mov word [esi + 4], ax
call fcn.004018a0
mov dword [esp + 0x6c], ebp
call fcn.00404e50
add esp, 0x3c
cmp edi, 0xd
jne 0x40159e
cmp dword [esp + 0x1c], 3
jne 0x40159e
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 8]
push 0x47420c
push edx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x40159e
call section..text
test eax, eax
je 0x401638
push 0
call fcn.0042d670
add esp, 4
push 1
call fcn.0040a620
add esp, 4
cmp dword [0x4e0b08], 0
jne 0x40159e
push 0
push 0
push 0x4e0b0c
push 0x42d530
push 0
push 0
mov dword [0x4e0b0c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e0b08], eax
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4015ad
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov edx, dword [esi + 4]
push str.service
push edx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4015eb
call fcn.004336f0
neg eax
sbb eax, eax
add eax, 6
jmp 0x4014c6
mov eax, dword [esi + 4]
push str.360bprot
push eax
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4017da
call fcn.00421860
mov edi, eax
neg edi
sbb edi, edi
add edi, 0xa
jmp 0x4014c8
mov ecx, dword [esi]
push str.uninstall
push ecx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x401799
call section..text
test eax, eax
jne 0x40164e
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov edx, dword [esi + 4]
push str.protect
push edx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x401725
call fcn.004217e0
test eax, eax
jne 0x4016b6
push 0xc
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.00401860
mov dword [esp + 0x50], 4
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x5c], esp
call fcn.00401860
mov dword [esp + 0x6c], ebp
call fcn.00404e50
add esp, 0x3c
mov edi, 0x10
jmp 0x4014c8
call fcn.00406350
test eax, eax
jne 0x4016f0
call fcn.0041e600
test eax, eax
jne 0x4016f0
call fcn.00432b00
test eax, eax
jne 0x4016f0
push 4
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.00401860
mov dword [esp + 0x50], 5
jmp 0x40168d
call fcn.00432c20
test eax, eax
jne 0x40171b
push 8
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.00401860
mov dword [esp + 0x50], 6
jmp 0x40168d
mov edi, 0xf
jmp 0x4014c8
mov eax, dword [esi + 4]
push str.hookport
push eax
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x40174b
call fcn.00432b00
neg eax
sbb eax, eax
add eax, 4
jmp 0x4014c6
mov ecx, dword [esi + 4]
push str.service
push ecx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x401771
call fcn.00432c20
neg eax
sbb eax, eax
add eax, 8
jmp 0x4014c6
mov edx, dword [esi + 4]
push str.360bprot
push edx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4017da
call fcn.004217e0
mov edi, eax
neg edi
sbb edi, edi
add edi, 0xc
jmp 0x4014c8
mov eax, dword [esi]
push str.restart
push eax
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4017da
mov ecx, dword [esi + 4]
push str.service
push ecx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x4017da
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004329c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x18], 0
jmp 0x4015a2