Function at 0x421ee0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e1d0
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x55b524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x43c], ecx
mov dword [0x562ed4], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 8
push eax
mov dword [ebp - 0x42c], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00433440
push 0x51f37c
push 0
call fcn.004bff65
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x51f380
call fcn.00426b80
add esp, 8
mov ecx, 0x562f04
push 0
push dword [0x562ed4]
push 0
call fcn.0041d060
lea ecx, [ebp - 0x440]
call fcn.00406f20
mov dword [ebp - 4], 0
call fcn.00421490
mov ecx, eax
call fcn.0045f7b0
mov eax, dword [0x562f74]
test al, 1
jne 0x421fe9
or eax, 1
mov dword [0x562f74], eax
mov ecx, 0x562f70
mov byte [ebp - 4], 1
call fcn.0042db40
push 0x519080
call fcn.00463047
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x562f70
call fcn.0042db90
push ebx
call fcn.0041b720
mov ecx, eax
call fcn.004174a0
push ebx
push str.lpstrCmdLine_s
call fcn.00426b80
add esp, 8
call fcn.00433440
mov edi, eax
lea eax, [ebp - 0x420]
push eax
push str.DLL_NETUL
push 0xcc
push dword [0x562ed4]
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
test eax, eax
jne 0x422048
push str.InitCloudConfig_failed.
call fcn.00426b80
add esp, 4
jmp 0x4220e5
push str.InitCloudConfig_success.
call fcn.00426b80
mov esi, esp
mov dword [ebp - 0x42c], esp
mov dword [ebp - 0x428], esi
call fcn.004053a0
mov ecx, eax
test ecx, ecx
je 0x4228a6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00404770
test al, al
jne 0x4220be
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4220a0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00405b60
mov byte [ebp - 4], 3
call fcn.0041b720
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.004173c0
mov esi, dword [edi]
call fcn.0041b720
mov ecx, eax
call fcn.00419520
push eax
push edi
call dword [esi + 0x54]
call fcn.0041b720
mov ecx, eax
call fcn.00419520
push eax
call fcn.0042d560
mov ecx, dword [0x560538]
xor bl, bl
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ecx, ecx
jne 0x422164
push 0x559d84
call edi
cmp dword [0x560538], 0
jne 0x422153
push 0x90
call fcn.0042e580
add esp, 4
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x42213d
mov ecx, eax
call fcn.00413ab0
jmp 0x42213f
xor eax, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x42c]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x560538], eax
push 0x559d84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x560538]
call fcn.004190f0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
je 0x422215
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], 4
push eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x424], 0x104
push eax
lea eax, [ebp - 0x428]
push eax
push str.em_lds
push str.SOFTWAREBiscuitZip
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [ebp - 0x42c], 1
je 0x422215
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x428], 1
push 0
push eax
mov dword [ebp - 0x42c], 0x104
call fcn.00491810
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push str.Setup_Path
push str.SOFTWAREBiscuitZip
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x422215
mov bl, 1
jmp 0x422327
mov ecx, dword [0x560538]
test ecx, ecx
jne 0x42227a
push 0x559d84
call edi
cmp dword [0x560538], 0
jne 0x422269
push 0x90
call fcn.0042e580
add esp, 4
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x422253
mov ecx, eax
call fcn.00413ab0
jmp 0x422255
xor eax, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x42c]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x560538], eax
push 0x559d84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x560538]
call fcn.004190f0
test al, al
jne 0x422327
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x428], 4
push eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x42c], 0x104
push eax
lea eax, [ebp - 0x428]
push eax
push str.em_lds
push str.SOFTWAREBiscuitZip
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [ebp - 0x424], 1
jne 0x422327
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x428], 1
push 0
push eax
mov dword [ebp - 0x42c], 0x104
call fcn.00491810
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push str.Setup_Path
push str.SOFTWAREBiscuitZip
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call fcn.004053a0
mov ecx, eax
test ecx, ecx
je 0x4228b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 6
push eax
call fcn.00420b30
add esp, 4
test eax, eax
jle 0x4225a6
test bl, bl
jne 0x4225a6
call fcn.0041b720
mov ecx, eax
call fcn.004171b0
push eax
call fcn.00421520
mov ecx, eax
call fcn.00409840
push str.installpkg
call fcn.00421520
mov ecx, eax
call fcn.00409850
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00491810
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x562ed4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.00421520
mov ecx, eax
call fcn.004097b0
call fcn.0041b720
mov ecx, eax
call fcn.004190f0
or edi, 0xffffffff
test al, al
je 0x422464
call fcn.004053a0
mov ecx, eax
test ecx, ecx
je 0x4228ba
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push str.in_dzip
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 8
call fcn.00404770
test al, al
jne 0x42242c
push 7
push str.in_dzip
lea ecx, [ebp - 0x424]
call fcn.00405b60
lea eax, [ebp - 0x424]
mov byte [ebp - 4], 9
push eax
call fcn.00421520
mov ecx, eax
call fcn.004097a0
mov edx, dword [ebp - 0x424]
mov eax, edi
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x422464
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x42c], esp
mov dword [eax + 0x24], 0
mov ecx, dword [0x562f6c]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xa
test ecx, ecx
jne 0x4224e2
push 0x55a10c
call esi
cmp dword [0x562f6c], 0
jne 0x4224d1
push 0x20
call fcn.0042e580
add esp, 4
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 0xb
test eax, eax
je 0x4224bb
mov ecx, eax
call fcn.00407da0
jmp 0x4224bd
xor eax, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x42c]
xor edx, edx
lock or dword [ecx], edx
mov dword [0x562f6c], eax
push 0x55a10c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x562f6c]
push 0
push 0
push 0x51f45c
mov byte [ebp - 4], 6
call fcn.00409490
call fcn.00421880
mov ebx, eax
test ebx, ebx
je 0x422532
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x434]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4226fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4226fa
call fcn.00421af0
test eax, eax
jne 0x422565
mov edx, dword [ebp - 0x434]
lea ebx, [eax + 0xe]
mov byte [ebp - 4], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4226fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4226fa
push dword [ebp + 0x14]
push dword [ebp - 0x43c]
push dword [ebp - 0x438]
call fcn.00423e60
mov edx, dword [ebp - 0x434]
add esp, 0xc
mov ebx, eax
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4226fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4226fa
or edi, 0xffffffff
test eax, eax
jns 0x4225c0
push 0
push 0x51f3c8
push 0
call fcn.0042d570
jmp 0x4226d0
lea eax, [ebp - 0x424]
push eax
call fcn.0041b720
mov ecx, eax
call fcn.004171d0
mov byte [ebp - 4], 7
call fcn.00433440
lea ecx, [ebp - 0x434]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
call fcn.00433440
push ecx
mov ecx, esp
mov esi, eax
push 0x51f3e4
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.004200c0
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
call dword [eax + 0x5c]
mov eax, dword [ebp - 0x424]
cmp dword [eax - 4], 1
jle 0x422630
push dword [eax - 0xc]
lea ecx, [ebp - 0x424]
call fcn.004052f0
mov eax, dword [ebp - 0x424]
push eax
push str.RunApp_cmdLine:__s
call fcn.00426b80
add esp, 8
call fcn.00433440
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
test eax, eax
je 0x42267c
call fcn.00433440
mov ecx, dword [ebp - 0x424]
mov esi, eax
cmp dword [ecx - 4], 1
jle 0x422674
push dword [ecx - 0xc]
lea ecx, [ebp - 0x424]
call fcn.004052f0
mov ecx, dword [ebp - 0x424]
push ecx
push str.BiscuitZip64.exe
jmp 0x4226a9
call fcn.00433440
mov ecx, dword [ebp - 0x424]
mov esi, eax
cmp dword [ecx - 4], 1
jle 0x4226a3
push dword [ecx - 0xc]
lea ecx, [ebp - 0x424]
call fcn.004052f0
mov ecx, dword [ebp - 0x424]
push ecx
push str.BiscuitZip.exe
mov eax, dword [esi]
push esi
call dword [eax + 0x3c]
mov edx, dword [ebp - 0x424]
mov eax, edi
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4226d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x434]
mov ebx, 0x10
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4226f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x562f74]
test al, 1
jne 0x42272a
or eax, 1
mov dword [0x562f74], eax
mov ecx, 0x562f70
mov byte [ebp - 4], 0xc
call fcn.0042db40
push 0x519080
call fcn.00463047
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x562f70
call fcn.0042dfe0
call fcn.00421490
mov ecx, eax
call fcn.0045f920
call fcn.00433d70
mov ecx, 0x562f40
call fcn.00407c70
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x562ed0]
add edi, 0x10
push edi
call esi
mov esi, dword [0x562f3c]
test esi, esi
je 0x4227b8
cmp dword [esi + 4], 0
jle 0x422786
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x562f3c]
test esi, esi
je 0x4227b8
mov eax, dword [esi]
test eax, eax
je 0x42279f
push eax
call fcn.004bbd56
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00462c49
add esp, 8
push edi
mov dword [0x562f3c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x562f38]
test esi, esi
je 0x422811
mov eax, dword [esi]
test eax, eax
je 0x4227e8
push eax
call fcn.004bbd56
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4227ff
push eax
call fcn.004bbd56
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.00462c49
add esp, 8
mov esi, dword [0x562f30]
test esi, esi
je 0x422843
cmp dword [esi], 0
je 0x422843
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x42282d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x422820
mov esi, dword [0x559fb0]
mov ecx, dword [0x559fb4]
cmp esi, ecx
jae 0x42286d
mov eax, dword [esi]
test eax, eax
je 0x422866
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x559fb4]
add esi, 4
cmp esi, ecx
jb 0x422853
mov ecx, 0x562f04
call fcn.004243f0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x440]
call fcn.00406f60
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462c38
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404750
push 0x80004005
call fcn.00404750
push 0x80004005
call fcn.00404750
int3