Function at 0x408e73
Capabilities:
Accept command line arguments
Check if file exists
Create thread
Get common file path
Query or enumerate registry value
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1d10]
mov eax, 0x1d90
call fcn.0042d800
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x1d0c], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x80], esi
call fcn.0040de57
mov dword [ebx + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x70], eax
cmp eax, esi
je 0x409015
xor eax, eax
push 0x206
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a86]
push esi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x103
lea eax, [ebp + 0x1a84]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1a84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x74], eax
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1c8e]
push esi
push eax
call fcn.00421bc0
lea eax, [ebp + 0x1c8c]
push eax
push 0x436f28
push dword [ebp - 0x70]
push HeapFree
pop edi
call fcn.0040fa78
add esp, 0x18
test eax, eax
je 0x408f38
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], si
jne 0x408f54
mov ecx, dword [ebp - 0x74]
lea eax, [ebp + 0x1c8c]
push eax
call fcn.0040a9d7
test eax, eax
je 0x408f62
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], si
je 0x408f62
lea ecx, [ebx + 0x38]
lea eax, [ebp + 0x1c8c]
call fcn.00405e78
mov dword [ebp - 0x6c], esi
mov esi, dword [ebp - 0x70]
lea ebx, [ebp - 0x6c]
mov ecx, 0x436f34
call fcn.0040fb7a
test eax, eax
jne 0x408f93
mov ebx, dword [ebp - 0x74]
test ebx, ebx
je 0x408f8d
lea eax, [ebp - 0x6c]
push eax
push 1
call fcn.0040ab29
jmp 0x408f8f
xor eax, eax
test eax, eax
je 0x408fa1
mov ecx, dword [ebp - 0x68]
xor eax, eax
cmp dword [ebp - 0x6c], eax
setne al
mov dword [ecx + 0x24], eax
lea ebx, [ebp - 0x6c]
mov ecx, 0x436f40
call fcn.0040fb7a
test eax, eax
jne 0x408fcc
mov ebx, dword [ebp - 0x74]
test ebx, ebx
je 0x408fc6
lea eax, [ebp - 0x6c]
push eax
push 2
call fcn.0040ab29
jmp 0x408fc8
xor eax, eax
test eax, eax
je 0x408fda
mov ecx, dword [ebp - 0x68]
xor eax, eax
cmp dword [ebp - 0x6c], eax
setne al
mov dword [ecx + 0x28], eax
lea ebx, [ebp - 0x6c]
mov ecx, 0x436f4c
call fcn.0040fb7a
test eax, eax
jne 0x409005
mov ebx, dword [ebp - 0x74]
test ebx, ebx
je 0x408fff
lea eax, [ebp - 0x6c]
push eax
push 3
call fcn.0040ab29
jmp 0x409001
xor eax, eax
test eax, eax
je 0x409013
mov ecx, dword [ebp - 0x68]
xor eax, eax
cmp dword [ebp - 0x6c], eax
setne al
mov dword [ecx + 0x2c], eax
xor esi, esi
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a06]
push esi
push eax
call fcn.00421bc0
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x5b6]
push esi
push eax
call fcn.00421bc0
add esp, 0x18
push 0x103
lea eax, [ebp + 0x5b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push reloc.KERNEL32.dll_HeapFree
lea edi, [ebp + 0x1a04]
lea esi, [ebp + 0x5b4]
call fcn.0040dfbe
pop ecx
test eax, eax
je 0x40967d
mov esi, dword [ebp - 0x68]
lea ecx, [esi + 0x54]
mov eax, edi
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
xor edi, edi
lea eax, [ebp + 0x11e6]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push 2
lea eax, [ebp + 0x11e4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
lea ecx, [esi + 0x188]
lea eax, [ebp + 0x11e4]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0xfde]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x436f58
lea eax, [ebp + 0x11e4]
push eax
lea eax, [ebp + 0xfdc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esi + 0x1a4]
lea eax, [ebp + 0xfdc]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x13ee]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push 0x17
lea eax, [ebp + 0x13ec]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
lea ecx, [esi + 0x1f8]
lea eax, [ebp + 0x13ec]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0xdd6]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x436f58
lea eax, [ebp + 0x13ec]
push eax
lea eax, [ebp + 0xdd4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esi + 0x214]
lea eax, [ebp + 0xdd4]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x7be]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push 0xb
lea eax, [ebp + 0x7bc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
lea ecx, [esi + 0x1c0]
lea eax, [ebp + 0x7bc]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x3ae]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push 0x16
lea eax, [ebp + 0x3ac]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
lea ecx, [esi + 0x230]
lea eax, [ebp + 0x3ac]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push reloc.KERNEL32.dll_LoadLibraryW
lea eax, [ebp - 0x64]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
lea ecx, [esi + 0x1dc]
lea eax, [ebp - 0x64]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a6]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push 0x19
lea eax, [ebp + 0x1a4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
lea ecx, [esi + 0x24c]
lea eax, [ebp + 0x1a4]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x9c6]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp + 0x9c4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40967d
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0xbce]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x436f68
lea eax, [ebp + 0x9c4]
push eax
lea eax, [ebp + 0xbcc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esi + 0x16c]
lea eax, [ebp + 0xbcc]
call fcn.00405e78
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x17fe]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x17fc]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x436a28
push 0x436fc0
push 0x80000001
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x409372
lea eax, [ebp + 0x17fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4093bb
cmp dword [esi + 0x14], 8
jge 0x4093bb
push 0x208
lea eax, [ebp + 0x17fc]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x17fc]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x436a28
push 0x436fc0
push 0x80000002
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp + 0x17fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebx
push edi
test eax, eax
je 0x409498
xor eax, eax
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a86]
push eax
call fcn.00421bc0
add esp, 0xc
push 0x435690
lea eax, [ebp + 0x17fc]
push eax
lea eax, [ebp + 0x1a84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
push 0x7e
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1c8e]
push edi
push eax
call fcn.00421bc0
push reloc.KERNEL32.dll_HeapFree
lea edi, [ebp + 0x1c8c]
lea esi, [ebp + 0x1a84]
call fcn.0040dfbe
add esp, 0x10
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], 0
je 0x409470
mov eax, dword [ebp - 0x68]
add eax, 0x54
cmp dword [eax + 0x18], 8
jb 0x40944c
mov eax, dword [eax + 4]
jmp 0x40944f
add eax, 4
push eax
lea eax, [ebp + 0x1c8c]
push eax
call fcn.0040e0a0
pop ecx
pop ecx
test eax, eax
jge 0x40946e
mov eax, dword [ebp - 0x68]
mov dword [eax + 0x18], 1
jmp 0x409486
jne 0x40947c
mov eax, dword [ebp - 0x68]
mov dword [eax + 0x18], 2
jmp 0x409486
mov eax, dword [ebp - 0x68]
mov dword [eax + 0x18], 3
mov edi, dword [ebp - 0x68]
lea ecx, [ebp + 0x17fc]
call fcn.0040a70c
mov esi, edi
jmp 0x409507
xor eax, eax
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a86]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x1a84]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x437044
push 0x435d48
push 0x80000001
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x74], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x409509
lea eax, [ebp + 0x1a84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409509
lea ecx, [ebp + 0x1a84]
mov edi, esi
mov dword [esi + 0x18], 4
call fcn.0040a70c
xor edi, edi
cmp dword [esi + 0xbc], edi
jne 0x409624
mov dword [esi + 0x18], edi
cmp dword [ebp - 0x70], edi
je 0x4095ad
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a86]
push edi
push eax
call fcn.00421bc0
lea eax, [ebp + 0x1a84]
push eax
push 0x437060
push dword [ebp - 0x70]
mov edi, 0x103
call fcn.0040fa78
add esp, 0x18
test eax, eax
je 0x4095ab
cmp word [ebp + reloc.ADVAPI32.dll_RegCloseKey], 0
je 0x4095ab
xor eax, eax
push ebx
push eax
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x15f6]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x15f4]
push eax
lea ecx, [ebp + 0x1a84]
call fcn.0040a8fd
test eax, eax
je 0x4095ab
push 0
push esi
lea esi, [ebp + 0x15f4]
call fcn.0040a61a
mov esi, dword [ebp - 0x68]
xor edi, edi
test eax, eax
je 0x409624
jmp 0x4095ad
xor edi, edi
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x1a86]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
cmp dword [esi + 0x14], 8
push edi
lea eax, [ebp + 0x1a84]
jge 0x4095d8
push 0x26
jmp 0x4095da
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
push ebx
mov word [ebp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp + 0x15f6]
push edi
push eax
call fcn.00421bc0
add esp, 0xc
push 0x435dc8
lea eax, [ebp + 0x1a84]
push eax
lea eax, [ebp + 0x15f4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp + 0x15f4]
mov edi, esi
call fcn.0040a70c
xor edi, edi
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x409698
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x70], eax
cmp eax, edi
je 0x40967d
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push dword [ebp - 0x70]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x3e8
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x70]
mov dword [esi + 0xc], edi
call ebx
mov dword [ebp - 0x80], 1
mov ecx, dword [ebp + 0x1d0c]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0x1d10
leave
ret