Function at 0x41bec0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4b7108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x54], esi
jle 0x41bfaa
nop dword [eax + eax]
mov edx, dword [eax + esi*4]
xor eax, eax
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
cmp word [edx], ax
jne 0x41bf20
xor ecx, ecx
jmp 0x41bf34
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bf25
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402060
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.004012d0
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x41bf9c
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x41c2b0
add eax, eax
cmp eax, 0x1000
jb 0x41bf93
test cl, 0x1f
jne 0x41c2b0
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41c2b0
sub ecx, eax
cmp ecx, 4
jb 0x41c2b0
cmp ecx, 0x23
ja 0x41c2b0
mov ecx, eax
push ecx
call fcn.0044ee3c
add esp, 4
inc esi
cmp esi, dword [ebp - 0x54]
jge 0x41bfaa
mov eax, dword [ebp - 0x50]
jmp 0x41bf00
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x64], edi
cmp esi, edi
je 0x41c29a
nop dword [eax]
xor eax, eax
mov dword [ebp - 0x38], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], ax
call fcn.00401cd0
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
lea ebx, [ebp - 0x4c]
cmp edx, 8
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x60], 0
cmovae ecx, dword [ebp - 0x4c]
cmovae ebx, dword [ebp - 0x4c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x4c]
mov edx, eax
cmovae ecx, dword [ebp - 0x4c]
sub edx, ecx
inc edx
shr edx, 1
cmp ecx, eax
cmova edx, dword [ebp - 0x58]
mov dword [ebp - 0x58], edx
test edx, edx
je 0x41c04f
mov edi, dword [ebp - 0x60]
mov esi, ecx
sub esi, ebx
nop word [eax + eax]
movzx eax, word [ebx + esi]
push eax
call fcn.004749fd
inc edi
mov word [ebx], ax
add esp, 4
lea ebx, [ebx + 2]
cmp edi, dword [ebp - 0x58]
jne 0x41c030
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x64]
push 0x4aadf8
lea ecx, [ebp - 0x4c]
call fcn.00401390
test eax, eax
je 0x41c202
push 0x4aae30
lea ecx, [ebp - 0x4c]
call fcn.00401390
test eax, eax
je 0x41c1bf
push str._weixin
lea ecx, [ebp - 0x4c]
call fcn.00401390
test eax, eax
je 0x41c0b2
mov eax, dword [ebp - 0x38]
cmp eax, 8
jb 0x41c09f
inc eax
lea ecx, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
call fcn.004021c0
add esi, 0x18
mov dword [ebp - 0x50], esi
cmp esi, edi
jne 0x41bfc0
jmp 0x41c29a
push 5
xor eax, eax
mov dword [ebp - 0x20], 7
push str.kantu
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
call fcn.00402060
xor eax, eax
mov dword [ebp - 8], 7
push 0x13
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
push str.capturescreen_alta
lea ecx, [ebp - 0x1c]
call fcn.00402060
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.00425160
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x41c156
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x41c2b0
add eax, eax
cmp eax, 0x1000
jb 0x41c14d
test cl, 0x1f
jne 0x41c2b5
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41c2ba
sub ecx, eax
cmp ecx, 4
jb 0x41c2bf
cmp ecx, 0x23
ja 0x41c2c4
mov ecx, eax
push ecx
call fcn.0044ee3c
add esp, 4
xor eax, eax
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], 0
cmp eax, 8
jb 0x41c25b
mov ecx, dword [ebp - 0x34]
inc eax
cmp eax, 0x7fffffff
ja 0x41c2c9
add eax, eax
cmp eax, 0x1000
jb 0x41c252
test cl, 0x1f
jne 0x41c2ce
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41c2d3
sub ecx, eax
cmp ecx, 4
jb 0x41c2d8
cmp ecx, 0x23
jbe 0x41c250
jmp 0x41c2dd
push 5
xor eax, eax
mov dword [ebp - 0x20], 7
push str.kantu
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
call fcn.00402060
xor eax, eax
mov dword [ebp - 8], 7
push 0x17
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
push str.capturescreen_ctlalta
jmp 0x41c0f0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
xor eax, eax
mov dword [ebp - 0x20], 7
push str.kantu
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
call fcn.00402060
xor eax, eax
mov dword [ebp - 8], 7
push 0x15
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
push str.capturescreen_youjian
jmp 0x41c0f0
mov ecx, eax
push ecx
call fcn.0044ee3c
add esp, 4
mov eax, dword [ebp - 0x38]
cmp eax, 8
jb 0x41c29a
mov ecx, dword [ebp - 0x4c]
inc eax
cmp eax, 0x7fffffff
ja 0x41c2b0
add eax, eax
cmp eax, 0x1000
jb 0x41c291
test cl, 0x1f
jne 0x41c2b0
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41c2b0
sub ecx, eax
cmp ecx, 4
jb 0x41c2b0
cmp ecx, 0x23
ja 0x41c2b0
mov ecx, eax
push ecx
call fcn.0044ee3c
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044ee41
mov esp, ebp
pop ebp
ret
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
call fcn.0046e037
int3