Function at 0x401040
Capabilities:
Accept command line arguments
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x41b004]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
push 0
call fcn.0040640c
push eax
call fcn.004063fa
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4010f1
lea eax, [esp + 0x10]
push eax
push 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4010ea
lea eax, [esp + 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4010ea
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0x10
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x24]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4010ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x401126
mov ecx, dword [esp + 0x18]
cmp ecx, 1
jne 0x40113f
push 0x40
push str.Helper32.exe
push str.This_is_a_commandline_utility_used_by_TestConsole.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp ecx, 2
jne 0x401218
push str._config
push dword [esi + 4]
call edi
test eax, eax
jne 0x4011e4
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWARE_77config
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401126
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 1
push str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x4011c4
push dword [esp + 0x14]
push 4
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x18]
cmp ecx, 2
jne 0x401218
push str._list
push dword [esi + 4]
call edi
test eax, eax
jne 0x401214
call fcn.00401360
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x18]
cmp ecx, 4
jne 0x40128d
push str._inject
push dword [esi + 4]
call edi
test eax, eax
jne 0x401289
push str._all
push dword [esi + 8]
call edi
test eax, eax
jne 0x401258
mov edx, dword [esi + 0xc]
or ecx, 0xffffffff
call fcn.00401770
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10
push dword [esi + 8]
call fcn.004063d7
add esp, 4
test eax, eax
je 0x401126
mov edx, dword [esi + 0xc]
mov ecx, eax
call fcn.00401770
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x18]
cmp ecx, 3
jne 0x401126
push str._detach
push dword [esi + 4]
call edi
test eax, eax
jne 0x401126
push str._all
push dword [esi + 8]
call edi
test eax, eax
jne 0x401329
push 0x3e80
call fcn.00402821
add esp, 4
mov dword [esp + 0x10], 0x3e8
mov ebx, eax
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.004020c0
test eax, eax
je 0x40130a
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40130a
mov esi, ebx
mov eax, 0x7277
nop dword [eax + eax]
cmp word [esi + 4], ax
jne 0x401302
mov ecx, esi
call fcn.00402300
mov eax, 0x7277
add esi, 0x10
sub edi, 1
jne 0x4012f0
push ebx
call fcn.0040282a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10
push dword [esi + 8]
call fcn.004063d7
add esp, 4
test eax, eax
je 0x401126
mov ecx, eax
call fcn.004018b0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004026f1
mov esp, ebp
pop ebp
ret 0x10