Function at 0x4064d0
Capabilities:
Accept command line arguments
Get hostname
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
xor al, al
cmp dword [ebp + 8], 1
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x2ac], ecx
mov byte [ebp - 0x28e], 0
mov byte [ebp - 0x28d], al
mov byte [ebp - 0x29c], al
mov byte [ebp - 0x29d], al
mov byte [ebp - 0x28f], al
mov byte [ebp - 0x29f], al
mov byte [ebp - 0x29a], al
mov byte [ebp - 0x299], al
mov byte [ebp - 0x2a1], al
mov byte [ebp - 0x2a0], al
mov byte [ebp - 0x29e], al
jg 0x40655a
push dword [edi]
call fcn.004080b0
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
push ebx
xor eax, eax
mov dword [ecx], 0
mov ebx, 1
mov word [0x491480], ax
mov dword [ebp - 0x298], ebx
push esi
nop word [eax + eax]
mov ecx, dword [edi + ebx*4]
lea ebx, [edi + ebx*4]
mov dword [ebp - 0x2a8], ebx
movzx edx, word [ecx]
mov eax, edx
sub eax, 0x2d
je 0x4065d5
sub eax, 2
je 0x4065d5
sub eax, 0x11
mov al, byte [ebp - 0x28d]
jne 0x406bc6
test al, al
jne 0x406bc6
mov edx, 0x46abb0
movzx eax, word [ecx]
add ecx, 2
mov word [edx], ax
add edx, 2
test ax, ax
jne 0x4065b7
mov dl, 1
mov byte [ebp - 0x28e], dl
jmp 0x406dce
mov al, byte [ebp - 0x28d]
test al, al
jne 0x406bc6
lea eax, [ecx + 2]
push 0x45df54
push eax
call fcn.00413875
add esp, 8
test eax, eax
je 0x406dc8
mov eax, dword [ebx]
add eax, 2
push str.nobanner
push eax
call fcn.00413875
add esp, 8
test eax, eax
je 0x406dc8
cmp dword [0x46ffc8], 0
jne 0x406684
xor ebx, ebx
mov esi, 0x4690e0
xor edi, edi
nop dword [eax]
mov eax, dword [ebp - 0x2a8]
push esi
mov eax, dword [eax]
add eax, 2
push eax
call fcn.00413875
add esp, 8
test eax, eax
je 0x406665
add edi, 0x204
inc ebx
add esi, 0x204
cmp edi, 0xe1c
jb 0x406630
mov eax, dword [0x46ffc8]
jmp 0x406676
imul eax, ebx, 0x204
mov eax, dword [eax + 0x4692e0]
mov dword [0x46ffc8], eax
test eax, eax
jne 0x406dc8
mov ebx, dword [ebp - 0x2a8]
mov eax, dword [ebx]
add eax, 2
push 0x45df80
push eax
call fcn.00413875
add esp, 8
test eax, eax
jne 0x4066a7
mov byte [0x46ffc7], 1
jmp 0x406dc8
mov eax, dword [ebx]
mov esi, 1
mov dword [ebp - 0x2a8], esi
cmp word [eax + 2], 0
je 0x406dc8
mov ecx, 2
movzx eax, word [ecx + eax]
push eax
call fcn.004275fb
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x17
ja case.0x4066dd.66
jmp dword [eax*4 + 0x406fb4]
cmp byte [ebp - 0x29c], 0
jne case.0x4066dd.66
mov byte [0x46abae], 1
mov byte [ebp - 0x29c], 1
jmp 0x4068cd
cmp byte [ebp - 0x29d], 0
jne case.0x4066dd.66
mov byte [0x46abaf], 1
mov byte [ebp - 0x29d], 1
jmp 0x4068cd
cmp byte [ebp - 0x29e], 0
jne case.0x4066dd.66
mov byte [0x46ffc5], 1
mov byte [ebp - 0x29e], 1
jmp 0x4068cd
cmp byte [ebp - 0x299], 0
jne case.0x4066dd.66
mov byte [0x46ffc4], 1
mov byte [ebp - 0x299], 1
jmp 0x4068cd
cmp byte [ebp - 0x29f], 0
jne case.0x4066dd.66
mov byte [0x46ffc1], 1
mov byte [ebp - 0x29f], 1
jmp 0x4068cd
cmp byte [0x46a10a], 0
je case.0x4066dd.66
mov byte [0x46a10a], 0
jmp 0x4068cd
cmp byte [ebp - 0x29a], 0
jne case.0x4066dd.66
mov eax, dword [ebp - 0x298]
inc eax
mov byte [0x46ffc2], 1
mov byte [ebp - 0x29a], 1
mov dword [ebp - 0x2b0], eax
cmp eax, dword [ebp + 8]
jge 0x4068cd
mov edx, dword [ebx + 4]
movzx eax, word [edx]
cmp eax, 0x2d
je 0x4068cd
cmp eax, 0x2f
je 0x4068cd
mov ecx, edx
mov esi, 1
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4067f0
sub ecx, edi
sar ecx, 1
cmp ecx, 1
jle 0x406833
movzx eax, word [edx + esi*2]
push 4
push eax
call fcn.004271b5
add esp, 8
test eax, eax
je 0x406833
mov edx, dword [ebx + 4]
inc esi
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406820
sub eax, edi
sar eax, 1
cmp esi, eax
jl 0x406804
mov edx, dword [ebx + 4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406840
sub ecx, edi
sar ecx, 1
cmp esi, ecx
je 0x4068e9
mov esi, dword [ebp - 0x2a8]
jmp 0x4068cd
cmp byte [ebp - 0x2a0], 0
jne case.0x4066dd.66
cmp dword [0x46aba8], 0
je 0x406e07
mov byte [0x46ffc6], 1
mov byte [ebp - 0x2a0], 1
jmp 0x4068cd
cmp byte [0x46ffc3], 0
jne case.0x4066dd.66
mov byte [0x46ffc3], 1
mov byte [0x46ffc2], 1
jmp 0x4068c1
cmp byte [ebp - 0x28f], 0
jne case.0x4066dd.66
mov byte [0x46ffc0], 1
mov byte [ebp - 0x28f], 1
mov eax, dword [ebp - 0x2ac]
mov dword [eax], 1
mov eax, dword [ebx]
inc esi
mov dword [ebp - 0x2a8], esi
lea ecx, [esi + esi]
cmp word [ecx + eax], 0
jne 0x4066c4
jmp 0x406dc8
push 0x469efc
push 0x45e04c
push edx
call fcn.00408300
add esp, 0xc
test eax, eax
je case.0x4066dd.66
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x2ac]
mov byte [0x46a108], 0
mov dword [eax], 1
jmp 0x406dc8
cmp dword [0x46ffcc], 0
jne case.0x4066dd.66
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebx]
push str.__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d__d
lea eax, [eax + esi*2]
add eax, 4
push eax
call fcn.00408300
mov esi, eax
add esp, 0x88
xor edx, edx
test esi, esi
jle 0x406a55
mov ecx, dword [0x46ffcc]
nop dword [eax]
mov eax, dword [ebp + edx*4 - 0x28c]
inc edx
bts ecx, eax
cmp edx, esi
jl 0x406a40
mov dword [0x46ffcc], ecx
inc dword [ebp - 0x298]
jmp 0x406dc8
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x298], eax
jge case.0x4066dd.66
cmp dword [0x46a10c], 0xffffffff
jne case.0x4066dd.66
push 0x46a10c
push 0x45e04c
push dword [ebx + 4]
call fcn.00408300
add esp, 0xc
test eax, eax
je case.0x4066dd.66
inc dword [ebp - 0x298]
jmp 0x406dc8
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x4066dd.66
cmp byte [0x46abad], 0
jne case.0x4066dd.66
mov ecx, dword [ebx + 4]
mov edx, 0x491480
nop
movzx eax, word [ecx]
add ecx, 2
mov word [edx], ax
add edx, 2
test ax, ax
jne 0x406ad0
mov byte [0x46abad], 1
jmp 0x406dc8
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x4066dd.66
cmp byte [0x46abac], 0
jne case.0x4066dd.66
mov ecx, dword [ebx + 4]
mov edx, 0x46bbb0
nop dword [eax + eax]
movzx eax, word [ecx]
add ecx, 2
mov word [edx], ax
add edx, 2
test ax, ax
jne 0x406b20
mov byte [0x46abac], 1
jmp 0x406dc8
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x4066dd.66
cmp byte [ebp - 0x2a1], 0
jne case.0x4066dd.66
mov ecx, dword [ebx + 4]
mov edx, 0x46fdb8
nop dword [eax + eax]
movzx eax, word [ecx]
add ecx, 2
mov word [edx], ax
add edx, 2
test ax, ax
jne 0x406b70
mov byte [ebp - 0x2a1], 1
jmp 0x406dc8
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge case.0x4066dd.66
mov ecx, dword [ebx + 4]
mov edx, 0x469f00
nop dword [eax + eax]
movzx eax, word [ecx]
add ecx, 2
mov word [edx], ax
add edx, 2
test ax, ax
jne 0x406bb0
jmp 0x406dc8
cmp edx, 0x5c
jne 0x406c00
cmp word [ecx + 2], dx
jne 0x406c00
cmp byte [ebp - 0x28e], 0
jne 0x406c00
add ecx, 4
mov edx, 0x46abb0
movzx eax, word [ecx]
add ecx, 2
mov word [edx], ax
add edx, 2
test ax, ax
jne 0x406be2
mov dl, 1
mov byte [ebp - 0x28e], dl
jmp 0x406dce
test al, al
jne 0x406d2a
cmp edx, 0x22
jne 0x406c3b
movzx eax, word [ecx + 2]
test ax, ax
je 0x406c30
mov edx, eax
cmp dx, 0x22
je 0x406c30
mov word [ebp - 0x20c], dx
movzx eax, word [ecx + 2]
mov edx, eax
test ax, ax
jne 0x406c18
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x406c53
lea edx, [ebp - 0x20c]
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x406c43
cmp byte [0x46abae], 0
je 0x406cf9
push 0
push 0
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
lea ecx, [esi + esi]
push ecx
call fcn.004139ef
add esp, 4
mov edi, eax
push esi
push edi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x491260
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004062f0
add esp, 0x10
test al, al
jne 0x406d17
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x406cb0
mov eax, dword [str..exe]
mov dword [ecx], eax
mov eax, dword [0x45e0e4]
mov dword [ecx + 4], eax
mov ax, word [0x45e0e8]
push 0x491260
push esi
mov word [ecx + 8], ax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004062f0
add esp, 0x10
test al, al
jne 0x406d17
push str.The_specified_application_is_not_on_the_path._n_n
jmp 0x406edd
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ebp + ecx - 0x20c]
mov word [ecx + 0x491260], ax
add ecx, 2
test ax, ax
jne 0x406d00
mov dl, byte [ebp - 0x28e]
mov al, 1
mov byte [ebp - 0x28d], al
jmp 0x406dd4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [ebp - 0x298]
xor esi, esi
mov ecx, eax
test ebx, ebx
jle 0x406d7d
nop
push dword [edi + esi*4]
push ecx
call fcn.0040ad77
mov edx, eax
add esp, 8
test edx, edx
je 0x406d81
mov ecx, dword [edi + esi*4]
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406d60
sub ecx, edi
inc esi
mov edi, dword [ebp - 0x294]
sar ecx, 1
lea ecx, [edx + ecx*2]
cmp esi, ebx
jl 0x406d40
test ecx, ecx
jne 0x406d85
mov ecx, dword [edi + esi*4 - 4]
movzx eax, word [ecx]
mov esi, eax
mov edx, eax
cmp eax, 0x22
jne 0x406d95
movzx edx, word [ecx + 2]
cmp esi, 0x22
lea eax, [ecx + 2]
cmovne eax, ecx
cmp dx, 0x20
mov edx, 0x46bdb8
lea ecx, [eax + 2]
cmovne ecx, eax
sub edx, ecx
nop
movzx eax, word [ecx]
mov word [ecx + edx], ax
add ecx, 2
test ax, ax
jne 0x406db0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x298], eax
mov dl, byte [ebp - 0x28e]
mov al, byte [ebp - 0x28d]
mov cl, byte [ebp - 0x299]
mov bh, byte [ebp - 0x28f]
mov bl, cl
mov byte [ebp - 0x29b], al
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp eax, dword [ebp + 8]
jge 0x406e27
mov edi, dword [ebp - 0x294]
mov ebx, eax
jmp 0x406580
push str.Limited_user_is_only_supported_on_Windows_2000_and_higher._n_n
call fcn.00402130
add esp, 4
xor al, al
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
test dl, dl
jne 0x406eba
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x2b4], 0x1000
push eax
push 0x46abb0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp byte [ebp - 0x29a], 0
mov cl, bl
mov al, byte [ebp - 0x29b]
mov ah, al
mov byte [ebp - 0x28f], bh
je 0x406ec0
cmp dword [0x469efc], 0xffffffff
mov byte [ebp - 0x28f], bh
jne 0x406ec0
push str.ProcessIdToSessionId
push 1
push 0x45e134
call section..text
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov byte [ebp - 0x28f], bh
mov ah, byte [ebp - 0x29b]
mov cl, bl
test esi, esi
je 0x406ec0
push 0x469efc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call esi
mov ah, byte [ebp - 0x29b]
mov cl, bl
jmp 0x406ec6
mov ah, byte [ebp - 0x28d]
mov bh, byte [ebp - 0x28f]
cmp byte [0x46ffc6], 0
je 0x406f03
cmp byte [0x46ffc5], 0
je 0x406f03
push str.Run_elevated_and_limited_user_options_are_not_compatible._n_n
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.00405060
add esp, 8
xor al, al
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
test ah, ah
je case.0x4066dd.66
cmp byte [0x46abad], 0
je 0x406f19
cmp byte [0x46abac], 0
je case.0x4066dd.66
test cl, cl
je 0x406f47
cmp byte [0x46abaf], 0
je 0x406f50
mov eax, dword [ebp - 0x294]
push dword [eax]
call fcn.004080b0
add esp, 4
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
cmp byte [0x46abaf], 0
je 0x406f59
cmp byte [0x46abae], 0
je case.0x4066dd.66
push 0x46abb0
push 0x4956a0
call fcn.00413875
add esp, 8
test eax, eax
je 0x406f78
cmp byte [0x46ffc3], 0
jne case.0x4066dd.66
test bh, bh
je 0x406fa0
mov al, byte [0x46ffc2]
mov byte [0x46a10a], 0
test al, al
je 0x406fa0
xor ecx, ecx
movzx eax, al
cmp dword [0x469efc], 0xffffffff
cmove eax, ecx
mov byte [0x46ffc2], al
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.004093c1
mov esp, ebp
pop ebp
ret