Function at 0x408ca0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47777d
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x492afc]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x492afc]
xor eax, esp
push eax
lea eax, [esp + 0x274]
mov dword fs:[0], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x1c]
push eax
push str.SOFTWAREICBCEbankToolsSettings
xor ebp, ebp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebp
call esi
test eax, eax
je 0x408d11
lea ecx, [esp + 0x1c]
push ecx
push str.SOFTWAREICBCEbankToolsSettings
push SysReAllocStringLen
call esi
test eax, eax
jne 0x408d48
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x38]
push ecx
push ebp
push str.Parameters
push edx
mov dword [esp + 0x4c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
je 0x408d4f
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40916b
cmp dword [esp + 0x30], 1
jne 0x408d48
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
cmp word [esp + 0x68], bp
je 0x408d79
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x20], eax
call fcn.00425694
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x408d93
push 0x80004005
call fcn.00402bd0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push fcn.004028c0
push fcn.004028e0
push 4
push 4
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x290], ebp
call fcn.00442bdc
push fcn.004028c0
push fcn.004028e0
push 4
push 4
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0x290], 1
call fcn.00442bdc
xor eax, eax
mov byte [esp + 0x27c], 2
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov edi, 0x494ba4
xor ebx, ebx
mov edx, dword [edi - 8]
cmp edx, ebp
jne 0x408e0e
xor eax, eax
jmp 0x408e22
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x408e13
sub eax, esi
sar eax, 1
push eax
lea esi, [esp + ebx + 0x4c]
push edx
mov ecx, esi
call fcn.00401f70
push 3
push 0x482298
mov ecx, esi
call fcn.00401f70
mov ecx, dword [edi]
cmp ecx, ebp
jne 0x408e47
xor eax, eax
jmp 0x408e5f
mov eax, ecx
lea ebp, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x408e50
sub eax, ebp
sar eax, 1
push eax
push ecx
mov ecx, esi
call fcn.00401f70
push 4
push 0x4822cc
mov ecx, esi
call fcn.00401f70
mov ecx, dword [edi + 4]
xor ebp, ebp
cmp ecx, ebp
jne 0x408e83
xor eax, eax
jmp 0x408e9f
mov eax, ecx
lea esi, [eax + 2]
jmp 0x408e90
mov dx, word [eax]
add eax, 2
cmp dx, bp
jne 0x408e90
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + ebx + 0x40]
call fcn.00402590
add edi, 0xd0
add ebx, 4
cmp edi, 0x494ee4
jl 0x408e03
mov eax, dword [esp + 0x24]
mov byte [esp + 0x17], 0
cmp eax, ebp
je 0x4090d7
xor ebx, ebx
cmp eax, ebp
jle 0x40903e
call fcn.00425694
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x408d89
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x27c], 3
call fcn.00425694
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x408d89
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
mov byte [esp + 0x280], 4
mov ecx, dword [eax + ebx*4]
push edx
push ecx
call fcn.004089c0
mov ebp, dword [esp + 0x38]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x408f5e
mov eax, dword [ebp - 0xc]
push eax
push ebp
jmp 0x408fc2
cmp dword [esp + esi*4 + 0x58], 0
lea edi, [esp + esi*4 + 0x58]
jne 0x408f8d
lea edx, [esp + 0x2c]
lea ecx, [esp + esi*4 + 0x48]
push edx
call fcn.0040a7d0
lea eax, [esp + 0x28]
lea ecx, [esp + esi*4 + 0x38]
push eax
call fcn.0040a7d0
mov dword [edi], 1
jmp 0x408fe0
push 5
push 0x4822e0
lea ecx, [esp + 0x20]
call fcn.00401f70
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + ebx*4]
test edx, edx
jne 0x408fac
xor eax, eax
jmp 0x408fc0
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408fb1
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x20]
call fcn.00401f70
push 2
push 0x4822d8
lea ecx, [esp + 0x20]
call fcn.00401f70
mov byte [esp + 0x17], 1
mov byte [esp + 0x27c], 3
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
inc ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409009
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x27c], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40902d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebx, dword [esp + 0x24]
jl 0x408eda
cmp byte [esp + 0x17], 0
jne 0x409081
lea edi, [esp + 0x284]
xor esi, esi
mov eax, dword [esp + esi + 0x48]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00401f70
push 3
push 0x482304
lea ecx, [esp + 0x20]
call fcn.00401f70
mov ecx, dword [edi + 4]
lea edx, [esp + esi + 0x38]
add edi, 4
push edx
call fcn.0040a7d0
add esi, 4
cmp esi, 0x10
jl 0x409047
mov edx, dword [esp + 0x284]
mov eax, dword [esp + 0x18]
mov esi, dword [edx]
lea edi, [eax - 0x10]
sub esi, 0x10
cmp edi, esi
je 0x4090f8
cmp dword [esi + 0xc], 0
lea ebp, [esi + 0xc]
jl 0x4090ec
mov ecx, dword [edi]
cmp ecx, dword [esi]
jne 0x4090ec
push edi
call fcn.0040a760
add esp, 4
mov ebx, eax
or edx, 0xffffffff
lock xadd dword [ebp], edx
dec edx
test edx, edx
jg 0x4090c9
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [esp + 0x284]
add ebx, 0x10
mov dword [eax], ebx
jmp 0x4090f8
push 0xb
push 0x4822ec
lea ecx, [esp + 0x20]
call fcn.00402590
jmp 0x40903e
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, edx
call fcn.00402590
mov eax, dword [esp + 0x20]
test eax, eax
je 0x409107
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [esp + 0x17], 0
push fcn.004028c0
push 4
push 4
lea ecx, [esp + 0x44]
push ecx
sete bl
mov byte [esp + 0x28c], 1
call fcn.00442900
push fcn.004028c0
push 4
push 4
lea edx, [esp + 0x54]
push edx
mov byte [esp + 0x28c], 0
call fcn.00442900
mov dword [esp + 0x27c], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409169
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov al, bl
mov ecx, dword [esp + 0x274]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.004424e7
add esp, 0x26c
ret