Function at 0x404ac0
Capabilities:
Accept command line arguments
Check if file exists
Delete file
Delete registry value
Query or enumerate registry value
Read .ini file
Terminate process

Disassembly:
sub esp, 0x218
mov eax, 4
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x10], 1
ja 0x404b31
pop edi
xor eax, eax
pop esi
add esp, 0x218
ret
mov eax, dword [eax + 4]
push 0x441ac0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x404b4d
pop edi
pop esi
add esp, 0x218
ret
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.00402c90
add esp, 8
mov ecx, 0x104
lea eax, [esp + 0x18]
cmp byte [eax], 0
je 0x404b73
inc eax
dec ecx
jne 0x404b68
jmp 0x404bb7
test ecx, ecx
je 0x404bb7
lea eax, [esp + 0xc]
test eax, eax
je 0x404b88
mov eax, 0x104
sub eax, ecx
jmp 0x404b8c
mov eax, dword [esp + 0xc]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x18]
je 0x404bb7
mov esi, 0x4411b4
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x404baf
mov byte [eax], cl
inc eax
dec edx
jne 0x404ba0
jmp 0x404bb3
test edx, edx
jne 0x404bb4
dec eax
mov byte [eax], 0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x404cde
call fcn.00404760
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 8]
push edx
push 0x4419a8
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x404bfb
pop edi
xor eax, eax
pop esi
add esp, 0x218
ret
mov eax, dword [esp + 8]
push 0x441828
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 8]
push ecx
call edi
lea edx, [esp + 8]
push edx
push 0x441a18
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x404c32
pop edi
xor eax, eax
pop esi
add esp, 0x218
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0x441a10
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404c69
mov ecx, dword [esp + 8]
push ecx
call edi
pop edi
xor eax, eax
pop esi
add esp, 0x218
ret
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
push 0x104
push eax
push 0
push 0x4419f0
push 0x441a64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
mov esi, dword [esp + 0x14]
add esp, 4
xor edx, edx
mov dword [esp + 0xc], eax
cmp esi, eax
lea eax, [esp + 0x18]
sete dl
push eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
jne 0x404ce0
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 8]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x218
ret
xor esi, esi
mov ecx, dword [esp + 8]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x218
ret