Function at 0x408330
Capabilities:
Accept command line arguments
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8018
call fcn.00409410
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x8008], eax
shl eax, 2
push edi
push eax
mov dword [ebp - 0x8010], ebx
mov dword [ebp - 0x800c], 0
call fcn.004139ef
xor edx, edx
add esp, 4
mov edi, eax
cmp dword [ebp - 0x8008], edx
jbe 0x408396
mov esi, ebx
mov ecx, edi
sub esi, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
inc edx
cmp edx, dword [ebp - 0x8008]
jb 0x408384
push ebx
lea eax, [ebp - 0x8008]
push eax
push 0x45e18c
call fcn.004021e0
push ebx
lea eax, [ebp - 0x8008]
push eax
push 0x45e18c
call fcn.00401950
add esp, 0x18
test eax, eax
jne 0x4083d7
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
push edi
call fcn.004139ea
add esp, 4
mov dword [ebp - 0x8014], 0x10
lea eax, [ebp - 0x8014]
push eax
push 0x4956a0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
call fcn.00403b10
test eax, eax
jne 0x408431
push str.PsExec_requires_Windows_XP_or_higher._n_n
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.00405060
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x8008]
xor esi, esi
xor edx, edx
test edi, edi
je 0x40846e
nop
mov ecx, dword [ebx + edx*4]
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408446
sub ecx, ebx
sar ecx, 1
add esi, ecx
cmp esi, 0x1fff
ja 0x4084ec
mov ebx, dword [ebp - 0x8010]
inc edx
cmp edx, edi
jb 0x408440
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408480
sub eax, edx
sar eax, 1
cmp eax, 0x4000
ja 0x4084ec
call esi
lea edx, [ebp - 0x8004]
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4084a0
cmp word [ebp - 0x8004], 0x22
lea esi, [ebp - 0x8004]
jne 0x4084f6
mov eax, dword [ebp - 0x8002]
lea esi, [ebp - 0x8002]
mov ecx, esi
test ax, ax
je 0x40850d
movzx edx, ax
cmp dx, 0x22
je 0x408509
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4084d6
jmp 0x408509
push str.Arguments_too_long._n_n
jmp 0x40840a
lea eax, [ebp - 0x8004]
push 0x20
push eax
call fcn.0040aa74
add esp, 8
mov ecx, eax
test ecx, ecx
je 0x408518
cmp word [ecx], 0
je 0x408518
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x8018]
push eax
push 0x4916a0
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [ebp - 0x8018]
test eax, eax
je 0x40853f
xor ecx, ecx
mov word [eax], cx
push 0x45e1dc
push 1
push 0x45ba50
call section..text
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call ebx
mov dword [0x46aba8], eax
lea eax, [ebp - 0x800c]
push eax
push dword [ebp - 0x8010]
push dword [ebp - 0x8008]
call fcn.004064d0
add esp, 0xc
test al, al
je 0x408724
push 0x45e1f4
push 1
push 0x45e208
call section..text
add esp, 8
push eax
call ebx
test eax, eax
je 0x4085b8
cmp dword [ebp - 0x800c], 0
jne 0x4085b8
lea ecx, [ebp - 0x800c]
push ecx
push 0x46bbb0
push 0
call eax
cmp byte [0x46abac], 0
je 0x40869f
cmp byte [0x46abad], 0
jne 0x40869f
push 0x5c
push 0x46bbb0
call fcn.0040aa74
mov edi, eax
add esp, 8
test edi, edi
je 0x4085ec
xor eax, eax
mov word [edi], ax
push 0x45e224
push 0x46bbb0
call fcn.00413875
add esp, 8
test eax, eax
je 0x408681
push 0x45e240
push 0x46bbb0
call fcn.00413875
add esp, 8
test eax, eax
je 0x408681
push 0x45e258
call fcn.00402100
push 1
call fcn.00413ed7
push eax
call fcn.00425beb
add esp, 0xc
xor esi, esi
call fcn.0042555d
movzx eax, ax
cmp eax, 0xd
je 0x40865b
cmp eax, 3
je 0x40872b
mov word [esi*2 + 0x491480], ax
inc esi
cmp esi, 0x207
jb 0x408634
add esi, esi
cmp esi, 0x208
jae 0x40874a
xor eax, eax
push 0x45df50
mov word [esi + 0x491480], ax
call fcn.00402100
add esp, 4
jmp 0x408693
xor eax, eax
mov dword [ebp - 0x800c], 1
mov word [0x491480], ax
test edi, edi
je 0x40869f
mov eax, 0x5c
mov word [edi], ax
push str.CreateProcessWithLogonW
push 1
push 0x45ba50
call section..text
add esp, 8
push eax
call ebx
push 0x46abb0
push 0x4956a0
mov dword [0x46ffd4], eax
call fcn.00413875
add esp, 8
test eax, eax
jne 0x4086ff
cmp byte [0x46ffc5], al
jne 0x4086ff
cmp dword [ebp - 0x800c], eax
jne 0x4086ff
cmp dword [0x46ffd4], eax
je 0x4086ff
call fcn.00405fb0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
push 0x407030
push 0x46abb0
push 1
call fcn.004034a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004093c1
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00413d84
push 0x45c364
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.00405060
add esp, 8
push 0
call fcn.00413d84
call fcn.0040955e
int3