Function at 0x401210
Capabilities:
Accept command line arguments
Create process on windows
Get installed programs
Print debug messages
Query or enumerate registry value

Disassembly:
mov eax, 0x1c34
call fcn.00420570
mov eax, dword [0x429130]
xor eax, esp
mov dword [esp + 0x1c30], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xc]
push ecx
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x1c], esi
lea edi, [ebx + 1]
je 0x401296
cmp dword [esp + 0xc], edi
jle 0x401296
mov eax, dword [esi + 4]
mov ecx, str.schedule
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401286
cmp dx, bx
je 0x401282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401286
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401260
xor eax, eax
jmp 0x40128b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401296
mov eax, edi
jmp 0x40168e
push 0x7fe
lea edx, [esp + 0x442]
push ebx
push edx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov word [esp + 0x448], bx
call fcn.00405050
push 0x7fe
lea eax, [esp + 0x144e]
push ebx
push eax
mov word [esp + 0x1454], bx
call fcn.00405050
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAOMEI_Backupper
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401318
cmp dword [esp + 0x38], 8
jb 0x40168c
mov edx, dword [esp + 0x24]
push edx
jmp 0x401684
push 0x3ff
lea eax, [esp + 0x41]
push ebx
push eax
mov byte [esp + 0x48], bl
call fcn.00405050
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x40]
push edx
push ebx
push ebx
push str.UninstallString
push eax
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401678
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x401383
cmp dword [esp + 0x38], 8
jb 0x40168c
mov eax, dword [esp + 0x24]
push eax
jmp 0x401684
add eax, 0xffffffff
cmp eax, ebx
jl 0x401678
mov cl, 0x5c
cmp byte [esp + eax + 0x3c], cl
je 0x40139f
sub eax, edi
jns 0x401390
jmp 0x401678
push 0x7fe
lea edx, [esp + 0xc42]
push ebx
push edx
mov byte [esp + eax + 0x48], bl
mov word [esp + 0xc48], bx
call fcn.00405050
add esp, 0xc
xor eax, eax
jmp 0x4013d0
movzx ecx, word [esp + eax + 0x3c]
mov word [esp + eax + 0xc3c], cx
add eax, 2
cmp cx, bx
jne 0x4013d0
cmp esi, ebx
push ebp
je 0x401621
cmp dword [esp + 0x10], edi
jle 0x401621
mov edx, dword [esi + 4]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401400
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x2c]
call fcn.00401920
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x401429
lea eax, [esp + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call ebp
push 0x4269d0
call ebp
cmp dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
jle 0x40165f
jmp 0x401450
mov eax, dword [esp + 0x20]
mov esi, dword [eax + edi*4]
mov ecx, 0x4269d4
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401486
cmp dx, bx
je 0x401482
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401486
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401460
xor eax, eax
jmp 0x40148b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4014bd
push str.ABCore.exe_n
call ebp
lea ecx, [esp + 0xc40]
push ecx
push str._sABCore.exe
lea edx, [esp + 0x448]
push 0x400
push edx
call fcn.004031b7
add esp, 0x10
jmp 0x40160e
mov ecx, str._laucherType:2
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4014ea
cmp dx, bx
je 0x4014e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4014ea
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4014c4
xor eax, eax
jmp 0x4014ef
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401521
push str.Backupper.exe_n
call ebp
lea eax, [esp + 0xc40]
push eax
push str._sBackupper.exe
lea ecx, [esp + 0x448]
push 0x400
push ecx
call fcn.004031b7
add esp, 0x10
jmp 0x40160e
mov ecx, str._laucherType:3
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40154e
cmp dx, bx
je 0x40154a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40154e
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401528
xor eax, eax
jmp 0x401553
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401585
push str.ShortcutTaskAgent.exe_n
call ebp
lea edx, [esp + 0xc40]
push edx
push str._sShortcutTaskAgent.exe
lea eax, [esp + 0x448]
push 0x400
push eax
call fcn.004031b7
add esp, 0x10
jmp 0x40160e
push str.Backupper.exe_n
call ebp
lea ecx, [esp + 0xc40]
push ecx
push str._sBackupper.exe
lea edx, [esp + 0x448]
push 0x400
push edx
call fcn.004031b7
mov eax, dword [esp + 0x30]
mov eax, dword [eax + edi*4]
add esp, 0x10
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4015b7
lea edi, [esp + 0x1440]
sub eax, edx
add edi, 0xfffffffe
mov edi, edi
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4015d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1440]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4015f6
mov ecx, dword [0x426b10]
mov dword [edi], ecx
mov edi, dword [esp + 0x18]
add edi, 1
cmp edi, dword [esp + 0x10]
mov dword [esp + 0x18], edi
jl 0x401450
jmp 0x401643
lea edx, [esp + 0xc40]
push edx
push str._sBackupper.exe
lea eax, [esp + 0x448]
push 0x400
push eax
call fcn.004031b7
add esp, 0x10
cmp dword [esp + 0x10], 1
jle 0x40165f
push 1
push ebx
lea ecx, [esp + 0x1448]
push ecx
lea edx, [esp + 0x44c]
push edx
jmp 0x40166b
push 1
push ebx
push ebx
lea eax, [esp + 0x44c]
push eax
push 0x426b14
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
cmp dword [esp + 0x38], 8
jb 0x40168c
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00402990
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1c3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402981
add esp, 0x1c34
ret 0x10