Function at 0x4066c2
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa3c]
sub esp, 0xabc
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0xa38], eax
mov eax, dword [ebp + 0xa44]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x5b2]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x6c], esi
call fcn.00421bc0
add esp, 0xc
push 0x104
lea eax, [ebp + 0x5b0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x7ba]
push esi
push eax
call fcn.00421bc0
push HeapFree
lea edi, [ebp + 0x7b8]
lea esi, [ebp + 0x5b0]
call fcn.0040dfbe
add esp, 0x10
test eax, eax
je 0x406c1a
push 4
pop esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x435e94
push 0x435ea8
xor edi, edi
push 0x80000002
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40678f
cmp dword [ebp - 0x78], esi
je 0x406792
mov dword [ebp - 0x70], edi
mov eax, 0x7fff
cmp dword [ebp - 0x70], eax
jbe 0x40679f
mov dword [ebp - 0x70], eax
xor eax, eax
push 0x40e
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
call fcn.00404c45
mov eax, dword [eax + 8]
push 0x7e
push edi
cmp eax, 2
jne 0x406954
xor eax, eax
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x9ba]
push eax
call fcn.00421bc0
lea eax, [ebx + 0x90]
add esp, 0xc
cmp word [eax], di
je 0x406807
push eax
push 0x435dc0
lea eax, [ebp + 0x9b8]
push HeapFree
push eax
call fcn.0041fb89
add esp, 0x10
jmp 0x406813
lea eax, [ebp + 0x9b8]
push eax
call fcn.00407de3
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x93a]
push edi
push eax
call fcn.00421bc0
xor esi, esi
lea eax, [ebx + 0x110]
add esp, 0xc
inc esi
cmp word [eax], di
je 0x406855
push eax
push 0x435dc0
lea eax, [ebp + 0x938]
push HeapFree
push eax
call fcn.0041fb89
add esp, 0x10
jmp 0x406883
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x938]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x435f2c
push 0x435d48
push 0x80000001
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x6c], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x8ba]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x8b8]
push eax
call fcn.004083a1
xor eax, eax
push 0x206
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x3aa]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x3a8]
push eax
push 0x435d08
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edi, 0x103
call fcn.0040fa78
add esp, 0xc
push dword [ebp - 0x70]
lea eax, [ebp + 0x3a8]
push eax
lea eax, [ebp + 0x8b8]
push eax
call fcn.00408316
movzx eax, al
push eax
call fcn.00408006
movzx eax, al
push eax
call fcn.004081f8
movzx eax, al
push eax
push dword [ebx + 0xc]
push dword [ebx + 8]
call fcn.00406d22
push eax
lea eax, [ebp + 0x938]
push eax
lea eax, [ebp + 0x9b8]
push eax
add ebx, 0x10
push ebx
lea eax, [ebp + 0x7b8]
push eax
push reloc.KERNEL32.dll_SetHandleCount
lea eax, [ebp - 0x68]
push 0x207
push eax
call fcn.0041fb89
add esp, 0x40
jmp 0x406bf9
cmp eax, 3
jne 0x406aa5
xor eax, eax
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x9ba]
push eax
call fcn.00421bc0
add esp, 0xc
push HeapFree
lea eax, [ebp + 0x9b8]
push eax
call fcn.00407f15
test eax, eax
jne 0x4069b4
call fcn.00408e37
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x40699a
mov eax, dword [eax + 4]
jmp 0x40699d
add eax, 4
push eax
push 0x435dc0
lea eax, [ebp + 0x9b8]
push HeapFree
push eax
call fcn.0041fb89
add esp, 0x10
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x83a]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x838]
push eax
call fcn.00407de3
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x93a]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x938]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x435f2c
xor esi, esi
push 0x435d48
inc esi
push 0x80000001
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x8ba]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x8b8]
push eax
call fcn.004083a1
push dword [ebp - 0x70]
lea eax, [ebp + 0x8b8]
push eax
call fcn.00408316
movzx eax, al
push eax
call fcn.00408006
movzx eax, al
push eax
call fcn.004081f8
movzx eax, al
push eax
push dword [ebx + 0xc]
push dword [ebx + 8]
call fcn.00406d22
push eax
lea eax, [ebp + 0x938]
push eax
lea eax, [ebp + 0x838]
push eax
lea eax, [ebp + 0x9b8]
push eax
lea eax, [ebp + 0x7b8]
push eax
push reloc.KERNEL32.dll_SetHandleCount
jmp 0x406be8
xor eax, eax
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x9ba]
push eax
call fcn.00421bc0
add esp, 0xc
push HeapFree
lea eax, [ebp + 0x9b8]
push eax
call fcn.00407f15
test eax, eax
jne 0x406afc
call fcn.00408e37
add eax, 0x38
cmp dword [eax + 0x18], 8
jb 0x406ae2
mov eax, dword [eax + 4]
jmp 0x406ae5
add eax, 4
push eax
push 0x435dc0
lea eax, [ebp + 0x9b8]
push HeapFree
push eax
call fcn.0041fb89
add esp, 0x10
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x93a]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x938]
push eax
call fcn.00407de3
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x8ba]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x8b8]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x435f2c
xor esi, esi
push 0x435d48
inc esi
push 0x80000001
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x83a]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x838]
push eax
call fcn.004083a1
push dword [ebp - 0x70]
lea eax, [ebp + 0x838]
push eax
call fcn.00408316
movzx eax, al
push eax
call fcn.00408006
movzx eax, al
push eax
call fcn.004081f8
movzx eax, al
push eax
push dword [ebx + 0xc]
push dword [ebx + 8]
call fcn.00406d22
push eax
lea eax, [ebp + 0x8b8]
push eax
lea eax, [ebp + 0x938]
push eax
lea eax, [ebp + 0x9b8]
push eax
lea eax, [ebp + 0x7b8]
push eax
push reloc.KERNEL32.dll_SetHandleCount
lea eax, [ebp - 0x68]
push 0x207
push eax
call fcn.0041fb89
add esp, 0x3c
lea eax, [ebp - 0x68]
push eax
push 0x4361d8
push 0x436218
push 0x823
push dword [ebp - 0x80]
call fcn.0041fb89
add esp, 0x14
mov dword [ebp - 0x6c], esi
mov ecx, dword [ebp + 0xa38]
mov eax, dword [ebp - 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0xa3c
leave
ret 4