Function at 0x401150
Capabilities:
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x2f
je 0x401170
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x2d
jne 0x40172e
push str.REALTIME
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401194
mov edx, dword [ebp + 0x14]
mov dword [edx], 0x100
jmp 0x401727
push str.HIGH
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4011b8
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0x80
jmp 0x401727
push str.ABOVENORMAL
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4011dc
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x8000
jmp 0x401727
push str.NORMAL
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401200
mov edx, dword [ebp + 0x14]
mov dword [edx], 0x20
jmp 0x401727
push str.BELOWNORMAL
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401224
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0x4000
jmp 0x401727
push str.IDLE
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401248
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x40
jmp 0x401727
push str.NOCONSOLE
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4012a0
push str.NOWINDOW
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4012a0
push str.HIDE
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4012a0
push str.HIDDEN
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4012b4
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
or eax, 0x8000000
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x401727
push str.TEST
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4012dc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 2
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x401727
push str.SILENT
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401304
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x401727
push str.WAIT
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40132c
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401727
push str.WAITINPUT
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401358
push str.WAITIDLE
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40136a
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x20
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x401727
push str.SHELL
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401392
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x40
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401727
push 0x4039c0
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4013bd
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, 0x200
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x401727
push str.UAC2
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4013e8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 0x400
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x401727
push str.RUNAS
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401412
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
or eax, 0x100
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401727
push 0x4039e0
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40143e
push str.NOQUOTES
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401450
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 8
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x401727
push 0x4039fc
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401492
push 0x403a00
mov edx, dword [ebp + 8]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x401492
push 0x403a0c
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4014a4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x401727
push 2
push 0x403a10
push 2
mov ecx, dword [ebp + 8]
add ecx, 2
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x401526
mov edx, dword [ebp + 8]
movzx eax, word [edx + 6]
cmp eax, 0x22
jne 0x40150a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x22
jne 0x4014fd
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 8]
add edx, 8
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x401515
mov ecx, dword [ebp + 8]
add ecx, 6
mov edx, dword [ebp + 0x18]
mov dword [edx], ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x401727
push 4
push str.MSG
push 4
mov edx, dword [ebp + 8]
add edx, 2
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x40159d
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xa]
cmp ecx, 0x22
jne 0x40158c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0x22
jne 0x40157f
xor eax, eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp + 8]
add eax, 0xc
mov dword [0x404334], eax
jmp 0x401598
mov ecx, dword [ebp + 8]
add ecx, 0xa
mov dword [0x404334], ecx
jmp 0x401727
push 6
push str.TITLE
push 6
mov edx, dword [ebp + 8]
add edx, 2
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x401614
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0xe]
cmp ecx, 0x22
jne 0x401603
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0x22
jne 0x4015f6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [0x404338], eax
jmp 0x40160f
mov ecx, dword [ebp + 8]
add ecx, 0xe
mov dword [0x404338], ecx
jmp 0x401727
push 7
push str.ERRMSG
push 7
mov edx, dword [ebp + 8]
add edx, 2
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x40168b
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x10]
cmp ecx, 0x22
jne 0x40167a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0x22
jne 0x40166d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp + 8]
add eax, 0x12
mov dword [0x40433c], eax
jmp 0x401686
mov ecx, dword [ebp + 8]
add ecx, 0x10
mov dword [0x40433c], ecx
jmp 0x401727
push 9
push str.ERRTITLE
push 9
mov edx, dword [ebp + 8]
add edx, 2
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x4016ff
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
cmp ecx, 0x22
jne 0x4016f1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
sub eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0x22
jne 0x4016e4
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp + 8]
add eax, 0x16
mov dword [0x404340], eax
jmp 0x4016fd
mov ecx, dword [ebp + 8]
add ecx, 0x14
mov dword [0x404340], ecx
jmp 0x401727
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
and eax, 4
jne 0x401727
push 0x1010
push str.Unknown_parameter___Hstart
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
jmp 0x401730
xor eax, eax
mov esp, ebp
pop ebp
ret