Function at 0x44ac7e
Capabilities:
Accept command line arguments
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov dword [0x4b3850], eax
call fcn.004611dc
mov dword [esp], 0x498cfc
call fcn.004614d5
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
mov dword [ebp + 0x10], eax
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, 0x498cf8
lea edi, [ebp - 4]
lea eax, [ebp - 4]
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call fcn.0044a9e6
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x44ad07
mov esi, eax
mov al, byte [esi]
cmp al, 0x6d
je 0x44acf4
cmp al, 0x4d
je 0x44acf4
push 6
push 0x498cf0
push esi
call fcn.004691d4
add esp, 0xc
test eax, eax
jne 0x44ad07
push esi
call fcn.0044aa27
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x44b489
push dword [ebp + 8]
mov esi, 0x4b3858
mov dword [0x4b38c8], 0x4989a0
mov dword [0x4b3b00], esi
push 0x498830
push esi
mov dword [0x4b3858], 0x84
mov dword [0x4b38bc], 0x300
call fcn.0044b9cc
mov edi, 0x47f570
mov eax, edi
test eax, eax
je 0x44ad59
push 0x10
push edi
push 0x49f728
call fcn.00468320
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 8], ebx
mov dword [0x4b38dc], eax
mov dword [ebp - 0x10], ebx
je 0x44ae10
push 0x498ce4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x44ae5b
push 0x498cd8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x44af1b
mov eax, dword [ebp - 8]
mov cl, byte [eax]
cmp cl, 0x73
je 0x44adab
cmp cl, 0x53
jne 0x44adc4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x4b38f0
call fcn.0044a9be
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov cl, byte [eax]
cmp cl, 0x64
je 0x44add0
cmp cl, 0x44
jne 0x44add7
mov byte [0x4b39f4], 1
mov al, byte [eax]
cmp al, 0x75
je 0x44ade1
cmp al, 0x55
jne 0x44adf7
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x4b39f8
call fcn.0044a9be
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.0044a9e6
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x44ad70
mov ecx, esi
call fcn.0044a973
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x64
push eax
push dword [ebp + 0x10]
call fcn.0044a9e6
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x44b25d
push 8
push 0x498ccc
push eax
call fcn.004691d4
add esp, 0xc
test eax, eax
jne 0x44b25d
mov dword [ebp + 0x10], 1
jmp 0x44b262
push esi
call fcn.0044bb20
push dword [ebp + 8]
mov dword [0x4b38c8], 0x4989a0
mov dword [0x4b3b00], esi
mov dword [0x4b3858], 0x84
push 0x4988a0
push esi
mov dword [0x4b38bc], 0x300
call fcn.0044b9cc
mov eax, edi
test eax, eax
je 0x44aea9
push 0x10
push edi
push 0x49f728
call fcn.00468320
add esp, 0xc
push ebx
push 1
push esi
call fcn.0044bd49
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push 0xf003f
push ebx
push 0x498cc4
push SysReAllocString
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44aee7
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498c9c
lea ecx, [ebp + 0x10]
call fcn.004292a9
push 0x498c90
lea ecx, [ebp + 0x10]
call fcn.004292a9
push 0x498c68
lea ecx, [ebp + 0x10]
call fcn.004292a9
lea ecx, [ebp + 0x10]
call fcn.00403677
jmp 0x44b466
push esi
call fcn.0044bb20
push dword [ebp + 8]
mov dword [0x4b38c8], 0x4989a0
mov dword [0x4b3b00], esi
mov dword [0x4b3858], 0x84
push 0x4988a0
push esi
mov dword [0x4b38bc], 0x300
call fcn.0044b9cc
mov eax, edi
test eax, eax
je 0x44af69
push 0x10
push edi
push 0x49f728
call fcn.00468320
add esp, 0xc
push ebx
push 1
push esi
call fcn.0044bbd0
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push 0xf003f
push ebx
push 0x498c38
push SysReAllocString
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44afa7
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x498c9c
push edi
call esi
inc eax
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push 0x498cc4
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44afdc
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x498c0c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b012
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498bf0
call esi
inc eax
push eax
push 0x498bf0
push 1
push ebx
push ebx
push dword [ebp + 0x10]
call edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x44b04a
cmp al, 4
jne 0x44b04a
push 0x498be8
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x44b065
push 0x498bd4
call esi
inc eax
push eax
push 0x498bd4
push 1
push ebx
push 0x498be8
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b076
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x498ba4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b0ac
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498c68
call esi
inc eax
push eax
push 0x498c68
push 1
push ebx
push 0x498cc4
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b0d8
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x498b90
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b10e
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498c68
call esi
inc eax
push eax
push 0x498c68
push 1
push ebx
push 0x498cc4
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b13a
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x498b60
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b170
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498bf0
call esi
inc eax
push eax
push 0x498bf0
push 1
push ebx
push ebx
push dword [ebp + 0x10]
call edi
push 0x498be8
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0x10], ebx
je 0x44b1a6
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x498c0c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b1dc
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498bf0
call esi
inc eax
push eax
push 0x498bf0
push 1
push ebx
push ebx
push dword [ebp + 0x10]
call edi
lea eax, [ebp - 0x24]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x498b4c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x44b229
lea ecx, [ebp + 0x10]
call fcn.00403677
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], eax
push 0x498c9c
call esi
inc eax
push eax
push 0x498c9c
push 1
push ebx
push 0x498cc4
push dword [ebp + 0x10]
call edi
cmp dword [ebp + 0x10], ebx
je 0x44b255
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x10], ebx
lea ecx, [ebp + 0x10]
jmp 0x44af11
mov dword [ebp + 0x10], ebx
jmp 0x44b2b0
push esi
call fcn.0044bb20
push dword [ebp + 8]
mov dword [0x4b38c8], 0x4989a0
mov dword [0x4b3b00], esi
mov dword [0x4b3858], 0x84
push 0x498930
push esi
mov dword [0x4b38bc], 0x300
call fcn.0044b9cc
mov eax, edi
test eax, eax
je 0x44b2b0
push 0x10
push edi
push 0x49f728
call fcn.00468320
add esp, 0xc
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
je 0x44b2d4
push ebx
push 4
push esi
call fcn.0044ba4f
push 0x12c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jl 0x44b2b0
cmp dword [ebp + 0x10], ebx
je 0x44b490
lea eax, [ebp - 0x14]
push eax
call fcn.0044dea4
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 4]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
je 0x44b300
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [ebp - 0xc], 0x64
mov edi, 0x80004005
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
je 0x44b400
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
push 0xffffffffffffffff
mov dword [ebp + 0x10], ebx
lea esi, [eax + 8]
push esi
call fcn.0040dfb6
pop ecx
mov dword [ebp - 0x1c], eax
pop ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
push 0x495d0c
call dword [sym.imp.ole32.dll_CreateItemMoniker]
push dword [ebp - 0x1c]
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp edi, ebx
jge 0x44b36e
push edi
push esi
push 0x498b1c
call fcn.0044abfa
add esp, 0xc
jmp 0x44b39c
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x44b37e
mov dword [ebp + 8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.ole32.dll_GetRunningObjectTable]
mov edi, eax
cmp edi, ebx
jge 0x44b3b2
push edi
push 0x498af8
call fcn.0044abfa
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x44b30f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x44b30f
mov esi, dword [0x480b1c]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov ecx, dword [eax]
push edx
mov edx, dword [ebp - 0x14]
push dword [ebp + 0x10]
add esi, edx
push esi
push ebx
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jge 0x44b3dd
push edi
push 0x498ad4
jmp 0x44b395
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x44b3ee
mov ecx, dword [eax]
push eax
xor esi, esi
call dword [ecx + 8]
jmp 0x44b3f1
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x44b403
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x44b403
mov esi, dword [ebp - 0x18]
cmp edi, ebx
jl 0x44b439
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call edi
test eax, eax
je 0x44b42d
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
jmp 0x44b414
mov eax, dword [ebp + 8]
push dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x44b446
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
je 0x44b450
mov eax, dword [esi]
push esi
call dword [eax + 8]
push 0x4b3858
call fcn.0044bae4
push dword [0x4b38ec]
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4b3858
call fcn.0044bb20
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x498ab8
call fcn.004614d5
pop ecx
call fcn.004614ae
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
call esi
test eax, eax
je 0x44b450
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x40]
push ebx
push eax
jmp 0x44b49d