Function at 0x40a998
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
or dword [esp + 8], 0xffffffff
xor eax, eax
push ebx
push esi
push edi
push 0xfffffffffffffffe
pop ebx
push ecx
mov ecx, 0x45d4a0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], eax
mov byte [esp + 0x17], al
call fcn.00415594
push 2
xor esi, esi
pop edi
test al, al
je 0x40aa15
xorps xmm0, xmm0
mov dword [esp + 0x4c], esi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], 0x43575c
movups xmmword [esp + 0x3c], xmm0
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], ebx
call fcn.004150ab
push 5
push ecx
push edi
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 1
mov ecx, 0x45d4a0
call fcn.00415687
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [esp + 0x2c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
xor eax, eax
mov dword [esp + 0x20], edi
mov word [esp + 0x38], ax
mov edx, 0x851
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], str.Param
push eax
push 0x434584
push ecx
push 0x64
pop eax
push eax
mov ecx, 0x170b043
mov dword [esp + 0x44], edi
call fcn.00401f81
test edi, edi
je 0x40aa6c
mov edx, str..exe
mov ecx, edi
call fcn.0040bb85
jmp 0x40aa6e
mov eax, esi
push 0x22
pop edx
test eax, eax
je 0x40aa7a
lea edi, [eax + 8]
jmp 0x40aad7
test edi, edi
je 0x40aa8f
mov edx, str.msohtmed
mov ecx, edi
call fcn.0040bb85
push 0x22
pop edx
jmp 0x40aa91
mov eax, esi
test eax, eax
je 0x40aa9a
lea edi, [eax + 0x10]
jmp 0x40aad7
cmp word [edi], dx
jne 0x40aac0
lea ecx, [edi + 2]
call fcn.0040b897
test eax, eax
je 0x40aac0
push 0x20
lea ecx, [eax + 2]
pop edx
call fcn.0040b897
mov edi, eax
test edi, edi
jne 0x40aad4
mov edi, dword [esp + 0x20]
push 0x20
pop edx
mov ecx, edi
call fcn.0040b897
mov edi, eax
test edi, edi
je 0x40ad0e
add edi, 2
movzx eax, word [edi]
push 0x22
pop edx
mov ecx, eax
cmp ax, dx
jne 0x40aaf1
add edi, 2
movzx eax, word [edi]
cmp ax, dx
je 0x40aae4
mov ecx, eax
push 0x20
pop eax
cmp cx, ax
jne 0x40ab01
add edi, 2
cmp word [edi], ax
je 0x40aaf9
mov edx, edi
mov ecx, str._regserver
call fcn.0040b9a2
test eax, eax
jne 0x40ab31
mov edx, edi
mov ecx, str._regserverfp
call fcn.0040b9a2
test eax, eax
jne 0x40ab31
mov edx, edi
mov ecx, str._unregserver
call fcn.0040b9a2
test eax, eax
je 0x40abad
push str.MSOHTMED_REG
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40ad0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40acff
mov edx, edi
mov ecx, str._regserverfp
call fcn.0040b9a2
test eax, eax
je 0x40ab82
xor edx, edx
inc edx
call fcn.00405ed2
neg eax
sbb eax, eax
and eax, 2
add ebx, eax
jmp 0x40acff
mov edx, edi
mov ecx, str._regserver
call fcn.0040b9a2
test eax, eax
je 0x40ab96
xor edx, edx
jmp 0x40ab6f
mov edx, edi
mov ecx, str._unregserver
call fcn.0040b9a2
test eax, eax
je 0x40abad
call fcn.00407fe5
jmp 0x40ab74
mov edx, edi
mov ecx, 0x434618
call fcn.0040b9a2
test eax, eax
je 0x40abfc
movzx ecx, word [edi + 4]
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x40acff
cmp word [edi + 6], si
jne 0x40acff
push 0xa
mov word [esp + 0x18], cx
xor eax, eax
pop edx
lea ecx, [esp + 0x14]
mov word [esp + 0x16], ax
call fcn.0040bd13
mov ecx, eax
call fcn.004097bb
jmp 0x40ab74
mov edx, edi
mov ecx, 0x433a08
call fcn.0040b9a2
test eax, eax
mov dword [esp + 0x24], eax
lea esi, [edi + 6]
mov ecx, 0x434620
cmove esi, edi
mov edx, esi
call fcn.0040b9a2
test eax, eax
mov dword [esp + 0x20], eax
lea edi, [esi + 6]
mov ecx, 0x434628
cmove edi, esi
mov edx, edi
call fcn.0040b9a2
test eax, eax
je 0x40ac98
movzx ecx, word [edi + 4]
call fcn.0040bbef
push 0x64
pop edx
push 0x20
cmp ax, dx
pop eax
jne 0x40ac5d
cmp word [edi + 6], ax
jne 0x40ac5d
mov byte [esp + 0x13], 1
jmp 0x40ac95
cmp ecx, 0x30
jb 0x40acff
cmp ecx, 0x39
ja 0x40acff
cmp word [edi + 6], ax
jne 0x40acff
push 0xa
mov word [esp + 0x18], cx
xor eax, eax
pop edx
lea ecx, [esp + 0x14]
mov word [esp + 0x16], ax
call fcn.0040bd13
mov dword [esp + 0x14], eax
add edi, 8
movzx ecx, word [edi]
push 0x22
pop eax
mov edx, ecx
cmp cx, ax
jne 0x40acdc
mov ecx, edi
call fcn.0040b82d
mov esi, eax
push 0x22
pop eax
cmp word [edi + esi*2 - 2], ax
jne 0x40ad58
lea ecx, [edi + 2]
xor edx, edx
call fcn.0040baeb
mov dword [esp + 0x18], eax
test eax, eax
je 0x40acff
xor ecx, ecx
mov word [eax + esi*2 - 4], cx
mov esi, eax
movzx edx, word [eax]
jmp 0x40acde
mov esi, edi
test dx, dx
jne 0x40ad5a
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40acf4
call fcn.00402061
test esi, esi
je 0x40acff
mov ecx, esi
call fcn.004022dd
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40ad0e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [0x45cd00], 0
je 0x40ad1d
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x432850
push eax
push str.Param
lea ecx, [esp + 0x34]
call fcn.00401f30
push eax
push str.WinMain__EXIT_
push 0x64
pop eax
push eax
mov edx, 0x851
mov ecx, 0x170b049
call fcn.00401f6b
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, edi
xor eax, eax
mov dword [esp + 0x2c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [esp + 0x38], ax
mov edx, 0x851
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], str.Param
push eax
push str.WinMain:_Before_PHevCreateFileInfo
push ecx
push 0x64
pop eax
push eax
mov ecx, 0x170b046
mov dword [esp + 0x44], edi
call fcn.00401f81
xor edx, edx
mov ecx, esi
call fcn.00402120
mov esi, eax
test esi, esi
je 0x40ace7
xor eax, eax
mov dword [esp + 0x2c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [esp + 0x38], ax
mov edx, 0x851
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], str.Param
push eax
push str.WinMain:_Before_WHevParseFile
push ecx
push 0x64
pop eax
push eax
mov ecx, 0x170b047
mov dword [esp + 0x44], edi
call fcn.00401f81
cmp dword [esp + 0x14], 0xffffffff
jne 0x40adfa
cmp byte [esp + 0x13], 0
jne 0x40adfa
mov ecx, esi
call fcn.0040ae66
mov dword [esp + 0x14], eax
jmp 0x40ae01
mov ecx, esi
call fcn.0040ae66
xor eax, eax
mov dword [esp + 0x2c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [esp + 0x38], ax
mov edx, 0x851
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], str.Param
push eax
push str.WinMain:_Before_FHevActivateApp
push ecx
push 0x64
pop eax
push eax
mov ecx, 0x170b048
mov dword [esp + 0x44], edi
call fcn.00401f81
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x14]
jne 0x40ae5f
cmp ecx, ebx
je 0x40ae5f
xor eax, eax
mov edx, esi
cmp dword [esp + 0x24], eax
setne al
push eax
call fcn.00402529
jmp 0x40ace7
mov ebx, ecx
jmp 0x40ace7