Function at 0x40d164
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x424210]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push ecx
push ecx
push 1
mov ecx, 0x425f28
mov dword [esp + 0x1c], esi
call fcn.0040e72c
mov eax, dword fs:[0x30]
lea edi, [esp + 0x14]
push 7
mov cl, byte [eax + 3]
mov eax, dword fs:[0x30]
or cl, 0x80
mov byte [eax + 3], cl
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x42599c
mov edi, eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateGuid]
xor ebx, ebx
mov ecx, 0x424108
mov dword [0x4259b0], ebx
mov dword [0x4259b4], ebx
call fcn.004060bb
call fcn.0041e5e9
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 2
push ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
js 0x40d3a3
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.00420eaa
mov ebx, esi
test eax, eax
js 0x40d215
mov ebx, dword [esp + 0xc]
mov ecx, edi
call fcn.0040d0b1
push dword [ebp + 0x14]
mov edx, ebx
mov ecx, esi
push eax
call fcn.004124bb
test eax, eax
je 0x40d364
call fcn.0040d110
mov ecx, eax
call fcn.0041e640
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x40d510
push esi
mov eax, 0x800b
push eax
push eax
call dword [sym.imp.USER32.dll_SetWinEventHook]
mov dword [esp + 0xc], eax
jmp 0x40d2e0
cmp dword [esp + 0x18], 0x50
jne 0x40d27b
push esi
push esi
push 0x8001
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esp + 0x14]
push eax
push dword [0x424ec8]
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40d2e0
mov eax, dword [0x425e00]
test eax, eax
je 0x40d2af
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40d2e0
lea eax, [esp + 0x14]
push eax
push dword [0x424ec4]
push dword [0x425e0c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40d2e0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x40d261
mov esi, dword [0x425bfc]
lea eax, [esp + 0x30]
mov edi, dword [0x425bf0]
push eax
push 0
push dword [0x425970]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
mov ecx, 0x424e00
push esi
sbb eax, eax
and eax, dword [esp + 0x54]
push edi
mov edx, eax
call fcn.0041e907
mov ecx, dword [0x425e14]
test ecx, ecx
je 0x40d34c
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x426478]
call esi
and dword [0x425e14], 0
call fcn.0040ae2d
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40d360
push eax
call dword [sym.imp.USER32.dll_UnhookWinEvent]
mov esi, dword [esp + 0x10]
mov ecx, dword [0x4259c0]
mov eax, ecx
mov edx, dword [0x4259c4]
or eax, edx
je 0x40d38b
push edx
push ecx
call fcn.00420131
and dword [0x4259c0], 0
and dword [0x4259c4], 0
call fcn.0040ae5c
cmp ebx, esi
je 0x40d39b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
xor ebx, ebx
mov eax, dword [0x424124]
mov ecx, dword [0x424120]
push eax
push ecx
mov dword [0x424108], ebx
mov dword [0x424120], ebx
mov dword [0x424124], ebx
call dword [sym.imp.ADVAPI32.dll_EventUnregister]
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421870
mov esp, ebp
pop ebp
ret 0x10