Function at 0x61e000
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push esi
pushf
push ecx
lea ecx, [ebp + esi*2 + 0x2f]
sub ecx, 0x2f
lea ecx, [ecx + edx*2 + 0xe]
lea ecx, [ecx + edx - 0xe]
sub ecx, edx
sub ecx, edx
lea ecx, [esp + 0xb]
sub ecx, 0xb
lea ecx, [ecx + ebx + 6]
sub ecx, ebx
push eax
lea eax, [ecx + edx + 0x412450]
lea eax, [ebp + 0x482930]
sub eax, ebp
mov dword [ecx], eax
pop eax
pop ecx
popf
call fcn.0061f290
mov edi, 0x424df2
mov edi, 0x4941ea
push eax
pushf
push ecx
or ecx, 0xf84d6cfe
lea ecx, [ebp + esi + 0x486d88]
sub ecx, esi
lea ecx, [esp + 0x31]
lea ecx, [ecx - 0x31]
lea ecx, [eax + ecx + 6]
sub ecx, eax
mov dword [ecx], 0x94
pop ecx
popf
sub edi, edi
pop edi
sbb eax, edi
lea eax, [eax + edi + 0x3a06dfea]
push ebp
push edx
push ecx
lea edx, [esi + 0x2b3b8da7]
sub edx, esi
push edx
lea ecx, [eax + edi - 0x38]
push edx
lea edx, [ecx + ebp - 0x5e5278e]
sub edx, ecx
sub edx, ebp
sub edx, 0x7593f47b
sub edx, 0xffffffb2
inc edx
xor edx, 0x7b791b8b
neg edx
add ecx, edx
pop edx
pop ecx
sub ecx, 0x29
push ecx
ror edx, 0xc5
mov edx, 0x462e02
pop edx
xor edx, 0x4f23b5ab
mov ebp, 0x4908a6
add ebp, dword [esp + 0x38]
mov ebp, edx
add ebp, 0xd5a3eb99
push ebp
add edx, dword [esp + 0x38]
add edx, 0x52
pop edx
sub eax, edx
pop ecx
pop edx
pop ebp
or eax, ebp
lea eax, [ecx + edi + 0x44]
sub eax, ecx
lea eax, [eax - 0x44]
call fcn.00447580
mov dword [ebp - 0x18], esp
mov esi, 0x411062
xor esi, dword [esp + 0x28]
add esi, dword [esp + 0x18]
add esi, 0xffffff96
xor esi, ebp
lea esi, [esp + ecx + 9]
sub esi, ecx
lea esi, [ecx + esi - 0x25]
push ebx
push eax
push edi
mov eax, dword [esp + 0x10]
sbb eax, ebp
sbb eax, ebp
add eax, dword [esp + 0x18]
sub eax, 0xffffffcf
lea eax, [ecx + edx - 0x24fd54c7]
sub eax, edx
sub eax, ecx
xchg edi, eax
add edi, 0xffffff9f
add eax, dword [esp + 0x18]
mov eax, 0x45923e
mov eax, edi
xor eax, 0x72
inc eax
or ebx, 0x1c854f8
and ebx, edi
lea ebx, [eax + 0x2a]
sub ebx, 0x2a
xor ebx, 0xdb02aab7
or eax, 9
add eax, dword [esp + 0x18]
mov eax, ebx
lea esi, [esi + eax*2 + 0x1b]
lea esi, [ecx + esi - 0x1b]
sub esi, ecx
sub esi, eax
or edi, 0x2b6e9535
pop edi
xor eax, 0x2ec978c8
pop eax
add ebx, dword [esp + 0x38]
mov ebx, 0x436e76
pop ebx
sub esi, ecx
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4e5cf8], ecx
mov eax, dword [esi + 4]
mov dword [0x4e5d04], eax
mov edx, dword [esi + 8]
mov dword [0x4e5d08], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4e5cfc], esi
cmp ecx, 2
je 0x61e1cc
or esi, 0x8000
mov dword [0x4e5cfc], esi
shl eax, 8
lea eax, [eax + edx*2 + 0x6f]
lea eax, [eax + ebp - 0x6f]
sub eax, ebp
sub eax, edx
mov dword [0x4e5d00], eax
xor esi, esi
push esi
mov edi, 0x41c35a
ror edi, 0x69
xor edi, dword [esp + 8]
mov edi, 0x48243a
add edi, 0x9a82bf2e
lea edi, [eax + ecx + sym.imp.kernel32.dll_GetModuleHandleA]
sub edi, ecx
sub edi, eax
push dword [edi]
add edi, dword [esp + 0x18]
xor edi, dword [esp + 0x28]
pop edi
call edi
cmp word [eax], 0x5a4d
jne 0x61e252
mov ecx, dword [eax + 0x3c]
lea ecx, [ecx + eax*2 + 0x66]
lea ecx, [ecx + edx - 0x66]
sub ecx, edx
sub ecx, eax
cmp dword [ecx], 0x4550
jne 0x61e252
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x61f450
cmp eax, 0x20b
je 0x61f42c
mov dword [ebp - 0x1c], esi
push 1
call fcn.0044c864
pop ecx
test eax, eax
jne 0x61e26d
push 0x1c
call fcn.0061f2f8
pop ecx
call fcn.0044e294
test eax, eax
jne 0x61e282
push 0x10
call fcn.0061f2f8
pop ecx
call fcn.0061f228
mov dword [ebp - 4], esi
call fcn.0044f591
test eax, eax
jge 0x61e29f
push 0x1b
call fcn.0061e4d4
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4e6590], eax
call fcn.0061ef98
mov dword [0x4e5ce4], eax
call fcn.0061ed60
test eax, eax
jge 0x61e2c9
push 8
call fcn.0061e4d4
pop ecx
call fcn.00452acd
test eax, eax
jge 0x61e2de
push 9
call fcn.0061e4d4
pop ecx
push 1
call fcn.0061eba4
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x61e2f8
push eax
call fcn.0061e4d4
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call fcn.0061e3ac
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x61e3a0
movzx eax, word [ebp - 0x40]
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004582ae
sub edi, 0x21
xor edi, dword [esp + 0x28]
push eax
adc edi, eax
pop edi
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x61e346
push edi
call fcn.0061e38c
call fcn.0061e37c
or dword [ebp - 4], 0xffffffff
lea eax, [ecx + edx - 0x41]
sub eax, edx
push edi
lea eax, [ebp + esi + 0x2a]
sub eax, 0x2a
pop eax
lea esp, [ebp - 0x7c]
call fcn.0061e368
ret
push 0xa
pop eax
jmp 0x61e31b
cmp dword [ecx + 0x84], 0xe
jbe 0x61e252
xor eax, eax
cmp dword [ecx + 0xf8], esi
setne al
mov dword [ebp - 0x1c], eax
jmp 0x61e255
cmp dword [ecx + 0x74], 0xe
jbe 0x61e252
xor eax, eax
cmp dword [ecx + 0xe8], esi
jmp 0x61f441