Function at 0x10021570
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ab55
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x101555ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x43c], ecx
mov dword [0x1015ce04], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 8
push eax
mov dword [ebp - 0x430], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.100318e0
push 0x1011b230
push 0
call fcn.100c0845
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x1011b234
call fcn.10025d10
add esp, 8
lea ecx, [ebp - 0x440]
call fcn.10006ab0
mov dword [ebp - 4], 0
call fcn.10020b10
mov ecx, eax
call fcn.10060290
mov eax, dword [0x1015cea4]
test al, 1
jne 0x10021665
or eax, 1
mov dword [0x1015cea4], eax
mov ecx, 0x1015cea0
mov byte [ebp - 4], 1
call fcn.1002cf50
push 0x10115610
call fcn.10063b24
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x1015cea0
call fcn.1002cfa0
push ebx
call fcn.1001ad60
mov ecx, eax
call fcn.10016240
push ebx
push str.lpstrCmdLine_s
call fcn.10025d10
add esp, 8
call fcn.100318e0
lea ecx, [ebp - 0x420]
mov edi, eax
push ecx
push str.DLL_NETUL
push 0xcc
push dword [0x1015ce04]
mov eax, dword [edi]
push edi
call dword [eax + 8]
test eax, eax
jne 0x100216c4
push str.InitCloudConfig_failed.
call fcn.10025d10
add esp, 4
jmp 0x10021759
push str.InitCloudConfig_success.
call fcn.10025d10
mov esi, esp
mov dword [ebp - 0x424], esp
mov dword [ebp - 0x430], esi
call fcn.10004f30
mov ecx, eax
test ecx, ecx
je 0x10021e85
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.10004300
test al, al
jne 0x10021732
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10021714
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.100056f0
mov byte [ebp - 4], 3
call fcn.1001ad60
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.10016160
mov esi, dword [edi]
call fcn.1001ad60
mov ecx, eax
call fcn.10018aa0
push eax
push edi
call dword [esi + 0x54]
call fcn.1001ad60
mov ecx, eax
call fcn.10018aa0
push eax
call fcn.1002c970
mov ecx, dword [0x1015a468]
xor bl, bl
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ecx, ecx
jne 0x100217d8
push 0x10152d84
call edi
cmp dword [0x1015a468], 0
jne 0x100217c7
push 0x98
call fcn.1002d980
add esp, 4
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x100217b1
mov ecx, eax
call fcn.100126c0
jmp 0x100217b3
xor eax, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x1015a468], eax
push 0x10152d84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x1015a468]
call fcn.10018120
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
je 0x10021889
lea eax, [ebp - 0x428]
mov dword [ebp - 0x430], 4
push eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], 0x104
push eax
lea eax, [ebp - 0x430]
push eax
push str.em_lds
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [ebp - 0x424], 1
je 0x10021889
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x430], 1
push 0
push eax
mov dword [ebp - 0x424], 0x104
call fcn.10092350
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x430]
push eax
push str.Setup_Path
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x10021889
mov bl, 1
jmp 0x1002199b
mov ecx, dword [0x1015a468]
test ecx, ecx
jne 0x100218ee
push 0x10152d84
call edi
cmp dword [0x1015a468], 0
jne 0x100218dd
push 0x98
call fcn.1002d980
add esp, 4
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x100218c7
mov ecx, eax
call fcn.100126c0
jmp 0x100218c9
xor eax, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x1015a468], eax
push 0x10152d84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x1015a468]
call fcn.10018120
test al, al
jne 0x1002199b
lea eax, [ebp - 0x424]
mov dword [ebp - 0x430], 4
push eax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x424], 0x104
push eax
lea eax, [ebp - 0x430]
push eax
push str.em_lds
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [ebp - 0x428], 1
jne 0x1002199b
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x430], 1
push 0
push eax
mov dword [ebp - 0x424], 0x104
call fcn.10092350
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x430]
push eax
push str.Setup_Path
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x430], 1
push 0
push eax
mov dword [ebp - 0x424], 0x104
call fcn.10092350
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x430]
push eax
push str.Setup_Path
push str.SOFTWARESmartWriter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x10021a67
mov ecx, dword [0x1015a468]
test ecx, ecx
jne 0x10021a5a
push 0x10152d84
call edi
cmp dword [0x1015a468], 0
jne 0x10021a49
push 0x98
call fcn.1002d980
add esp, 4
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x10021a33
mov ecx, eax
call fcn.100126c0
jmp 0x10021a35
xor eax, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x1015a468], eax
push 0x10152d84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x1015a468]
call fcn.100182d0
test al, al
jne 0x10021df8
call fcn.10004f30
mov ecx, eax
test ecx, ecx
je 0x10021e8f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 7
push eax
call fcn.100201b0
add esp, 4
test eax, eax
jle 0x10021ce0
test bl, bl
jne 0x10021ce0
call fcn.1001ad60
mov ecx, eax
call fcn.10015e10
push eax
call fcn.10020ba0
mov ecx, eax
call fcn.10009380
push str.installpkg
call fcn.10020ba0
mov ecx, eax
call fcn.10009390
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10092350
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x1015ce04]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.10020ba0
mov ecx, eax
call fcn.100092f0
call fcn.1001ad60
mov ecx, eax
call fcn.10018120
or edi, 0xffffffff
test al, al
je 0x10021ba4
call fcn.10004f30
mov ecx, eax
test ecx, ecx
je 0x10021e99
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x428], eax
push str.in_write
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 9
call fcn.10004300
test al, al
jne 0x10021b6c
push 8
push str.in_write
lea ecx, [ebp - 0x428]
call fcn.100056f0
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 0xa
push eax
call fcn.10020ba0
mov ecx, eax
call fcn.100092e0
mov edx, dword [ebp - 0x428]
mov eax, edi
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10021ba4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x424], esp
mov dword [eax + 0x24], 0
mov ecx, dword [0x1015ce9c]
mov byte [ebp - 4], 0xb
test ecx, ecx
jne 0x10021c20
push 0x1015314c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1015ce9c], 0
jne 0x10021c0f
push 0x20
call fcn.1002d980
add esp, 4
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x10021bf9
mov ecx, eax
call fcn.10007930
jmp 0x10021bfb
xor eax, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x424]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x1015ce9c], eax
push 0x1015314c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x1015ce9c]
push 0
push 0
push 0x1011b2f0
mov byte [ebp - 4], 7
call fcn.10008fd0
call fcn.10020f10
mov ebx, eax
test ebx, ebx
je 0x10021c6c
push 0xbb8
call esi
mov edx, dword [ebp - 0x42c]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10021dfa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10021dfa
call fcn.10021180
test eax, eax
jne 0x10021c9f
mov edx, dword [ebp - 0x42c]
lea ebx, [eax + 0xe]
mov byte [ebp - 4], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10021dfa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10021dfa
push dword [ebp + 0x14]
push dword [ebp - 0x43c]
push dword [ebp - 0x438]
call fcn.100234c0
mov edx, dword [ebp - 0x42c]
add esp, 0xc
mov ebx, eax
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10021dfa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10021dfa
or edi, 0xffffffff
test eax, eax
jns 0x10021cfa
push 0
push 0x1011b27c
push 0
call fcn.1002c980
jmp 0x10021dd2
lea eax, [ebp - 0x428]
push eax
call fcn.1001ad60
mov ecx, eax
call fcn.10015e30
mov byte [ebp - 4], 8
call fcn.100318e0
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
call fcn.100318e0
push ecx
mov ecx, esp
mov esi, eax
push 0x1011b298
lea eax, [ebp - 0x42c]
push eax
push ecx
call fcn.1001f740
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
call dword [eax + 0x5c]
mov eax, dword [ebp - 0x428]
cmp dword [eax - 4], 1
jle 0x10021d6a
push dword [eax - 0xc]
lea ecx, [ebp - 0x428]
call fcn.10004e80
mov eax, dword [ebp - 0x428]
push eax
push str.RunApp_cmdLine:__s
call fcn.10025d10
add esp, 8
call fcn.100318e0
mov ecx, dword [ebp - 0x428]
mov esi, eax
cmp dword [ecx - 4], 1
jle 0x10021d9f
push dword [ecx - 0xc]
lea ecx, [ebp - 0x428]
call fcn.10004e80
mov ecx, dword [ebp - 0x428]
mov eax, dword [esi]
push ecx
push str.SmartWriter.exe
push esi
call dword [eax + 0x3c]
mov edx, dword [ebp - 0x428]
mov eax, edi
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10021dcc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x42c]
mov ebx, 0x10
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10021dfa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10021dfa
xor ebx, ebx
mov eax, dword [0x1015cea4]
test al, 1
jne 0x10021e2a
or eax, 1
mov dword [0x1015cea4], eax
mov ecx, 0x1015cea0
mov byte [ebp - 4], 0xd
call fcn.1002cf50
push 0x10115610
call fcn.10063b24
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x1015cea0
call fcn.1002d410
call fcn.10020b10
mov ecx, eax
call fcn.10060400
call fcn.100321a0
mov ecx, 0x1015ce70
call fcn.10007800
push 0x5dc
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x440]
call fcn.10006af0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10063718
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100042e0
push 0x80004005
call fcn.100042e0
push 0x80004005
call fcn.100042e0
int3