Function at 0x401360
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Create process suspended
Delete file
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value
Resume thread
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x444
mov eax, dword [0x40d07c]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x40b1a4
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4013b2
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x4013b2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x44], ebx
je 0x401568
push 0x104
lea edx, [esp + 0x244]
push edx
xor ecx, ecx
push ebx
mov dword [esp + 0x110], 7
mov dword [esp + 0x10c], ebx
mov word [esp + 0xfc], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x240]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4013f6
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x244]
lea ecx, [esp + 0xf4]
call fcn.00401fe0
mov esi, dword [esp + 0x100]
cmp esi, 1
jbe 0x401446
mov ebx, 1
lea edi, [esp + 0xf0]
call fcn.00401e70
lea ecx, [eax + 1]
mov eax, esi
sub eax, ecx
mov esi, edi
call fcn.00401d40
xor ebx, ebx
push 0xf
mov eax, 0x40b528
lea ecx, [esp + 0xf4]
call fcn.00401f00
mov eax, dword [esp + 0xf0]
mov edi, 8
cmp dword [esp + 0x104], edi
jae 0x401475
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40149f
mov eax, dword [esp + 0xf0]
cmp dword [esp + 0x104], edi
jae 0x401498
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0xf0]
cmp dword [esp + 0x104], edi
jae 0x4014b6
lea esi, [esp + 0xf0]
push 0xa
push 0x6e
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x4014ce
push esi
call fcn.004011e0
add esp, 4
push 0x40
lea eax, [esp + 0xb0]
push ebx
push eax
call fcn.004056b0
mov esi, dword [esp + 0xfc]
xor eax, eax
add esp, 0xc
mov dword [esp + 0xa8], 0x44
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
cmp dword [esp + 0x104], edi
jae 0x401515
lea esi, [esp + 0xf0]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0xac]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [esp + 0x104], edi
jb 0x40154f
mov eax, dword [esp + 0xf0]
push eax
call fcn.00402cab
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.004024a9
mov esp, ebp
pop ebp
ret 0x10
push 0x110
lea ecx, [esp + 0x130]
push ebx
push ecx
call fcn.004056b0
add esp, 0xc
lea edx, [esp + 0x128]
push edx
mov dword [esp + 0x12c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4015b1
mov eax, dword [esp + 0x12c]
shl eax, 0x10
add eax, dword [esp + 0x130]
mov dword [0x40dbbc], eax
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x38], 2
jge 0x4015e6
push 0x40
push 0x40b4c8
push 0x40b1c0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401cc0
mov esi, dword [eax + 4]
push 0x40b548
push esi
call fcn.00402642
add esp, 8
test eax, eax
jne 0x401602
mov esi, 0x40b560
jmp 0x40164f
push 0x40b5b0
push esi
call fcn.00402642
add esp, 8
test eax, eax
jne 0x40161b
mov esi, 0x40b5c8
jmp 0x40164f
push 0x40b618
push esi
call fcn.00402642
add esp, 8
test eax, eax
jne 0x401634
mov esi, 0x40b630
jmp 0x40164f
push 0x40b680
push esi
call fcn.00402642
add esp, 8
test eax, eax
jne 0x401cbb
mov esi, 0x40b690
xor edx, edx
push 0x40b560
push esi
mov dword [esp + 0x128], 7
mov dword [esp + 0x124], ebx
mov word [esp + 0x114], dx
call fcn.00402642
add esp, 8
mov edi, 0x60000
test eax, eax
jne 0x4016df
cmp dword [0x40dbbc], edi
jae 0x4016df
push 0x104
lea eax, [esp + 0x244]
push eax
push 0x40b6e0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x240]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4016b0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x244]
lea ecx, [esp + 0x110]
call fcn.00401fe0
push 0xb
mov eax, 0x40b724
jmp 0x4017f2
push 0x40b690
push esi
call fcn.00402642
add esp, 8
push 0x104
test eax, eax
jne 0x401782
lea ecx, [esp + 0x244]
push ecx
cmp dword [0x40dbbc], edi
jae 0x401740
push 0x40b6e0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0x244]
call fcn.00401ce0
lea eax, [esp + 0x10c]
push eax
mov eax, 0x40b73c
call fcn.00401d10
jmp 0x4017fe
push 0x40b758
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0x244]
call fcn.00401ce0
lea eax, [esp + 0x10c]
push eax
mov eax, 0x40b78c
call fcn.00401d10
lea ecx, [esp + 0x10c]
push ecx
mov eax, esi
call fcn.00401d10
jmp 0x4017fe
lea edx, [esp + 0x244]
push edx
push 0x40b758
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x240]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4017a0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x244]
lea ecx, [esp + 0x110]
call fcn.00401fe0
push 0x60
mov eax, 0x40b7b8
lea ecx, [esp + 0x110]
call fcn.00401f00
mov eax, esi
lea edx, [eax + 2]
jmp 0x4017e0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4017e0
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [esp + 0x110]
call fcn.00401f00
push 0x40
xor esi, esi
lea eax, [esp + 0x68]
push esi
push eax
call fcn.004056b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0xc
push esi
lea ecx, [esp + 0x24]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
xor eax, eax
push 0x40b880
push 0x80000001
mov dword [esp + 0x84], 0x44
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], esi
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4018a3
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x40]
push eax
push 0
push 0
push 0x40b8f8
push ecx
mov dword [esp + 0x34], 4
call esi
mov eax, dword [esp + 0x20]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push 0x40b8f8
push eax
mov dword [esp + 0x28], 0
call edi
xor eax, eax
push eax
lea ecx, [esp + 0x18]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push 0x40b908
push 0x80000001
mov dword [esp + 0x64], eax
mov dword [esp + 0x58], eax
call ebx
test eax, eax
jne 0x401946
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x40b984
push ecx
mov dword [esp + 0x24], 4
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0x40b998
push ecx
mov dword [esp + 0x24], 4
call esi
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push 0x40b984
push eax
mov dword [esp + 0x28], 1
call edi
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push 0x40b998
push edx
call edi
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push 0x40b9c0
push 0x80000001
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], eax
call ebx
test eax, eax
jne 0x4019e2
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0x40ba38
mov ebx, 4
push ecx
mov dword [esp + 0x24], ebx
call esi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x40ba54
push ecx
mov dword [esp + 0x24], ebx
call esi
mov eax, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x14]
push edx
push ebx
push 0
push 0x40ba38
push eax
mov dword [esp + 0x28], 1
call edi
mov edx, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0
push 0x40ba54
push edx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ebx, ebx
cmp dword [0x40dbbc], 0x60001
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], ebx
jb 0x401b05
push 0x40e8e8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 0x40e8e8
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401a20
sub eax, edx
sar eax, 1
push eax
mov eax, 0x40e8e8
mov ecx, 0x40dbc0
call fcn.00401fe0
push 0x12
mov eax, str.cpalaunchmod32.dll
mov ecx, 0x40dbc0
call fcn.00401f00
cmp dword [0x40dbd4], 8
mov ebx, dword [0x40dbc0]
jae 0x401a64
mov ebx, 0x40dbc0
push 0xa
push 0x6c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x401a7d
push ebx
call fcn.004011e0
add esp, 4
push 0x104
lea eax, [esp + 0x244]
push eax
push 0x40baa8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x64]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [esp + 0x260]
push eax
push 0
call esi
cmp eax, 1
jne 0x401b05
cmp dword [0x40dbd4], 8
mov eax, dword [0x40dbc0]
jae 0x401acf
mov eax, 0x40dbc0
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
push eax
push ecx
call fcn.00401280
mov edx, dword [esp + 0x30]
add esp, 8
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp dword [esp + 0x120], 8
mov eax, dword [esp + 0x10c]
jae 0x401b1d
lea eax, [esp + 0x10c]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x64]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call esi
mov ebx, dword [sym.imp.USER32.dll_EnumChildWindows]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp eax, 1
jne 0x401b94
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp dword [0x40dbbc], 0x60001
jb 0x401b6a
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], 6
mov edx, dword [esp + 0x2c]
push edx
push 0x4010a0
call esi
push eax
call ebx
push 0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_SleepEx]
dec dword [esp + 0x10]
jne 0x401b72
cmp dword [0x40dbbc], 0x60000
jae 0x401bad
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x50]
push ecx
push 4
push 0
push 0x40ba38
push edx
call edi
mov ecx, dword [esp + 0x18]
push 4
lea eax, [esp + 0x4c]
push eax
push 4
push 0
push 0x40ba54
push ecx
call edi
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x44]
push edx
push 4
push 0
push 0x40b984
push eax
call edi
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
push 0
push 0x40b998
push edx
call edi
mov ecx, dword [esp + 0x20]
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push 0x40b8f8
push ecx
call edi
cmp dword [0x40dbbc], 0x60001
jb 0x401c84
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
mov edx, dword [esp + 0xc]
push edx
push 0x4011b0
mov dword [0x40eaf0], 0
call esi
push eax
call ebx
push 0
push 0xc8
call edi
cmp dword [0x40eaf0], 3
ja 0x401c32
mov eax, dword [esp + 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x40dbd4], 8
mov eax, dword [0x40dbc0]
jae 0x401c7d
mov eax, 0x40dbc0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x120], 8
jb 0x40154f
mov ecx, dword [esp + 0x10c]
push ecx
call fcn.00402cab
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.004024a9
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401340
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004024a9
mov esp, ebp
pop ebp
ret 0x10