Function at 0x409b40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
je 0x409eda
mov edi, dword [esp + 0x3c]
mov ebp, eax
cmp edi, 1
je 0x409ece
mov ebx, 1
mov dword [esp + 0x24], 0
jg 0x409bef
jmp 0x409c90
cmp cx, 0x2d
je 0x409c20
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towupper]
cmp ax, 0x3f
je 0x409d18
lea ecx, [eax - 0x43]
cmp cx, 0x13
ja 0x409cf0
mov eax, 1
shl eax, cl
test eax, 0x98601
jne 0x409be8
cmp cx, 1
je 0x409d30
cmp cx, 2
jne 0x409cf0
mov dword [esp + 0x24], 1
lea esi, [esi]
add ebx, 1
cmp ebx, edi
jge 0x409c20
mov esi, dword [ebp + ebx*4]
movzx ecx, word [esi]
mov eax, ecx
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x409c20
movzx eax, word [esi + 2]
test ax, ax
je 0x409b90
movzx ecx, word [esi + 4]
test cx, cx
je 0x409b9a
cmp cx, 0x3a
je 0x409b9a
lea esi, [esi]
cmp edi, ebx
je 0x409e70
cmp ebx, edi
jge 0x409c90
cmp dword [esp + 0x24], 1
je 0x409cb0
mov eax, dword [esp + 0x24]
cmp eax, 2
je 0x409d58
test eax, eax
jne 0x409d40
mov esi, dword [ebp + ebx*4]
mov dword [esp + 4], 0x411b52
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x409d70
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], eax
call fcn.0040c0a0
lea esi, [esi]
add ebx, 1
cmp ebx, dword [esp + 0x3c]
jl 0x409c33
lea esi, [esi]
mov dword [esp], ebp
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, 1
sub esp, 4
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + ebx*4 + 4]
mov edx, dword [ebp + ebx*4]
test eax, eax
je 0x409cc6
cmp word [eax], 0
jne 0x409ea0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], edx
call fcn.0040c350
add ebx, 2
cmp ebx, dword [esp + 0x3c]
jl 0x409cb0
jmp 0x409c90
mov dword [esp + 4], esi
mov dword [esp], 0xbba
call fcn.004099a0
mov dword [esp], 0xbbb
call fcn.00409a70
mov edi, dword [esp + 0x3c]
jmp 0x409be8
mov dword [esp], 0xbb9
call fcn.00409a70
mov edi, dword [esp + 0x3c]
jmp 0x409be8
mov dword [esp + 0x24], 2
jmp 0x409be8
mov dword [esp], 0xbc0
call fcn.00409a70
jmp 0x409c80
mov eax, dword [ebp + ebx*4]
mov dword [esp], eax
call fcn.0040c220
jmp 0x409c80
mov eax, dword [sym.imp.kernel32.dll_SearchPathW]
mov dword [esp + 0x14], 0
xor edi, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
mov dword [esp + 0x28], eax
call eax
sub esp, 0x18
test eax, eax
mov edx, eax
jg 0x409e00
test edx, edx
je 0x409e4c
mov dword [esp + 4], 0x411b56
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wfopen]
test eax, eax
je 0x409ee1
mov dword [esp], eax
mov esi, eax
call fcn.0040c0a0
test edi, edi
je 0x409c80
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fclose]
jmp 0x409c80
lea eax, [eax + eax]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov edi, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp], 0
call eax
mov edx, eax
sub esp, 0x18
test edx, edx
jne 0x409db9
mov dword [esp + 4], esi
mov dword [esp], 0xbbe
call fcn.004099a0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x409c80
mov eax, dword [esp + 0x24]
cmp eax, 1
jbe 0x409ec0
cmp eax, 2
jne 0x409e8a
mov dword [esp], 0xbbd
call fcn.004099a0
mov dword [esp], 0xbbb
call fcn.00409a70
mov edi, dword [esp + 0x3c]
jmp 0x409c28
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0040c350
jmp 0x409cde
mov dword [esp], 0xbbc
call fcn.004099a0
jmp 0x409e8a
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
xor eax, eax
jmp 0x409ca1
mov dword [esp], 0x411b5c
call dword [sym.imp.ucrtbase.dll__wperror]
mov dword [esp + 4], esi
mov dword [esp], 0xbbf
call fcn.004099a0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x409c80