Function at 0x401980
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
call fcn.00402570
mov eax, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call eax
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4019be
mov dword [esp], str.Error_parsing_commandline_options__n
call fcn.00401560
mov eax, dword [ebp - 0x28]
cmp eax, 3
je 0x4019ff
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.Usage:__S__option..__nOptions:_n___p___pid___________pid__n___n___process_name__process_name__n___f___file__________path__n_nExamples:_n_S__p_1234_n_S__n_lsass.exe_n_S__f__S_n
call fcn.00401560
mov ebx, 0x405020
mov dword [esp], str.kernel32
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.IsWow64Process
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404246
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401a64
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x40424c
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401a97
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_wcstoul
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.004016e4
jmp 0x401b4a
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x404258
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401acf
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.__process_name
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401aef
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0040158a
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call fcn.004016e4
jmp 0x401b4a
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0x40427c
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x401b27
mov eax, dword [ebp - 0x1c]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.__file
mov dword [esp], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x401b39
mov eax, dword [ebp - 0x1c]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0040179b
jmp 0x401b4a
mov dword [esp], str.Invalid_action_specified.._n
call fcn.00401560
mov eax, 1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret