Function at 0x430327
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xab4
mov eax, dword [0x46700c]
xor eax, esp
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
xor edi, edi
push edi
mov dword [esp + 0x14], eax
call esi
push edi
mov ebx, eax
call esi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 0x20ff
call fcn.0042cb30
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edi, dword [esp + 0x10]
push edi
push 0x402abc
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
test ebx, ebx
jns 0x4303c0
mov eax, ebx
jmp 0x43050b
push 0x100
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push reloc.KERNEL32.dll_InitializeCriticalSection
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x4303e4
xor esi, esi
jmp 0x4307f3
push 0x402ae0
call dword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
push 0x402b20
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x43041a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x430522
test edi, edi
je 0x430484
push 0x402b40
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x430522
push 0x402b54
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x430522
push 0x401c04
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4304f1
push 0x402b68
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4304f1
push 0x401af0
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4304f1
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xac
push dword [0x4683ec]
call edi
test eax, eax
je 0x4304f1
push 0x100
lea eax, [esp + 0x94]
push eax
push 0xad
push dword [0x4683ec]
call edi
test eax, eax
je 0x4304f1
movzx eax, byte [0x468a66]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x10
push eax
lea eax, [esp + 0x94]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
test ebx, ebx
je 0x430503
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004655f1
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
test eax, eax
jns 0x43053a
push 0x402b88
push 2
call fcn.004400fc
mov eax, dword [esp + 0x14]
mov dword [0x4683ec], eax
test edi, edi
je 0x43057d
push 0x4029ec
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x430565
call fcn.00430149
mov esi, eax
jmp 0x4307f3
push 0x402bcc
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x43057d
mov dword [reloc.ole32.dll_CoCreateInstance], esi
call fcn.0042e7f0
xor eax, eax
mov dword [reloc.ole32.dll_CoCreateInstance], 1
call fcn.0042e2cd
test edi, edi
je 0x4307a9
push 0x401af0
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
neg eax
sbb eax, eax
neg eax
push 0x402be8
push edi
mov dword [0x4683f0], eax
call dword [sym.imp.msvcrt.dll_wcsstr]
add esp, 0x10
test eax, eax
je 0x4305d7
mov dword [0x4683b4], 1
mov dword [reloc.ole32.dll_CoCreateInstance], esi
jmp 0x4305dc
call fcn.0042e8c2
cmp dword [0x4683f0], esi
je 0x4305ea
mov dword [reloc.ole32.dll_CoCreateInstance], esi
push 0x105
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xdb
push dword [0x4683ec]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x430683
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x402bfc
push eax
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x430637
mov dword [esp + 0x10], esi
jmp 0x43063d
mov dword [reloc.ole32.dll_CoCreateInstance], esi
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x402a50
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x430683
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push 0x402c00
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x402a2c
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x43069b
push edi
call fcn.0043027c
push 0x401c04
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x430715
push 0x402c18
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x430715
lea eax, [esp + 0x48]
call fcn.0044fc76
push eax
mov dword [esp + 0x84], esi
call fcn.004523df
push esi
lea eax, [esp + 0x4c]
call fcn.004511a6
test eax, eax
je 0x4306ee
lea esi, [esp + 0x48]
call fcn.00452c2a
xor esi, esi
lea ebx, [esp + 0x48]
call fcn.0044fcb3
call fcn.0042e847
test eax, eax
je 0x430711
push 0x402c3c
push 2
call fcn.004400fc
jmp 0x4307f3
mov ebx, dword [esp + 0x1c]
push 0x402c64
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
neg eax
sbb eax, eax
neg eax
push 0x401c04
push edi
mov dword [0x4683e0], eax
call dword [sym.imp.msvcrt.dll_wcsstr]
add esp, 0x10
test eax, eax
je 0x430785
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
mov dword [0x4683f0], esi
call fcn.0043b33a
call fcn.0043a0c3
push 0x105
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.004417d5
test eax, eax
je 0x430781
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.00441bda
push 3
jmp 0x430799
push 0x402c70
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x430800
push 4
pop eax
call fcn.0042e2cd
mov dword [reloc.ole32.dll_CoCreateInstance], 5
cmp dword [0x4683f0], 0
je 0x4307b6
mov dword [esp + 0x20], esi
call fcn.0042cd12
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [esp + 0x24]
push dword [esp + 0x1c]
call fcn.00430dfa
mov dword [esp + 0x10], eax
test eax, eax
jne 0x430bdc
test ebx, ebx
je 0x4307ee
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042cd42
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
jmp 0x43050b
push 0x402c94
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x430852
push edi
lea eax, [esp + 0x94]
call fcn.0042eed8
test eax, eax
js 0x4307f3
push 0x402ca4
push edi
mov ebx, esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x43083a
xor ebx, ebx
inc ebx
push ebx
push 1
lea ecx, [esp + 0x98]
call fcn.0042f61b
test eax, eax
jns 0x4307f3
jmp 0x43055e
push 0x402ccc
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x430b58
push 0x402ce0
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x430b58
push 0x402b40
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x430aa4
push 0x402cfc
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4308bc
push 0x402d14
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x4307a9
push 0x402d30
push 4
call fcn.004400fc
push esi
push 6
xor ecx, ecx
pop ebx
call fcn.0044100b
test eax, eax
jne 0x4307f3
mov ebx, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x402d14
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x430913
push 0x100
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x81
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x4307f3
call fcn.0043a0c3
test eax, eax
je 0x43096c
push 0x105
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x127
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x43096c
movzx eax, byte [0x468a66]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x30
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4307f3
call fcn.0042e7d1
test eax, eax
jne 0x430985
push esi
push 0x401bcc
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4309a5
push 0x105
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x128
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x43093c
push 0x402d14
push edi
call ebx
pop ecx
pop ecx
test eax, eax
push 0x105
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
je 0x4309d1
mov dword [0x468434], 1
push 0x117
jmp 0x4309d6
push 0x110
push dword [0x4683ec]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x4307f3
movzx eax, byte [0x468a66]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x131
push eax
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4307f3
push 2
pop eax
call fcn.0042e2cd
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [esp + 0x24]
mov dword [reloc.ole32.dll_CoCreateInstance], 3
push dword [esp + 0x1c]
call fcn.00430dfa
mov ebx, eax
test ebx, ebx
jne 0x430a66
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4307f3
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
jmp 0x430b36
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x430a94
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x430a94
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
jne 0x430a6e
jmp 0x430a4d
call fcn.00444f58
test eax, eax
jne 0x430b41
cmp dword [0x4683f0], eax
jne 0x430b26
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0xba
push dword [0x4683ec]
call edi
test eax, eax
je 0x430b26
push 0x100
lea eax, [esp + 0x94]
push eax
push 0xad
push dword [0x4683ec]
call edi
test eax, eax
je 0x430b26
movzx eax, byte [0x468a66]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x10
push eax
lea eax, [esp + 0x94]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
test ebx, ebx
je 0x4307f3
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4307f3
xor eax, eax
inc eax
call fcn.0042e2cd
mov dword [reloc.ole32.dll_CoCreateInstance], 2
jmp 0x4307a9
mov ebx, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x402ccc
push edi
mov dword [esp + 0x18], 1
call ebx
pop ecx
pop ecx
test eax, eax
je 0x430b78
mov dword [esp + 0x10], esi
push 0x402ca4
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x430b8b
xor ebx, ebx
inc ebx
jmp 0x430b8d
mov ebx, esi
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042eed8
test eax, eax
js 0x4307f3
push ebx
push dword [esp + 0x14]
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042f61b
mov esi, eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x401448
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4307f3
call fcn.00445092
jmp 0x4307f3
push esi
push esi
push esi
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x430c2e
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x430c18
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x430bf2
mov ebx, dword [esp + 0x1c]
cmp dword [0x4691d8], 0
je 0x430c45
push 2
mov dword [0x4691d8], esi
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
test edi, edi
je 0x430c7a
push 0x401c04
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x430c63
push esi
call fcn.0043b738
jmp 0x430c7a
push 0x402d50
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x430c7a
call fcn.0042e914
call fcn.0042cd42
mov edi, dword [0x4683b0]
test edi, edi
je 0x430c9c
call fcn.0043de7c
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
mov dword [0x4683b0], esi
mov eax, dword [0x4683dc]
test eax, eax
je 0x430cb4
mov esi, eax
call fcn.00430d93
xor esi, esi
mov dword [0x4683dc], esi
mov eax, dword [0x46843c]
test eax, eax
je 0x430ccc
mov esi, eax
call fcn.00430d93
xor esi, esi
mov dword [0x46843c], esi
mov eax, dword [0x4683d8]
test eax, eax
je 0x430ce4
mov esi, eax
call fcn.00430d93
xor esi, esi
mov dword [0x4683d8], esi
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
test ebx, ebx
je 0x430d00
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4683c8], 0
je 0x430d74
cmp dword [reloc.ole32.dll_CoCreateInstance], 0
je 0x430d74
cmp dword [0x4683e4], 0
jne 0x430d74
push esi
lea eax, [esp + 0x94]
push eax
call fcn.00441544
test eax, eax
je 0x430d74
lea eax, [esp + 0x90]
test eax, eax
je 0x430d3f
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x402d60
mov eax, 0x104
lea edi, [esp + 0x94]
call fcn.0042c8f1
test eax, eax
js 0x430d74
mov eax, edi
push eax
call fcn.00440bc3
test eax, eax
je 0x430d74
push reloc.ole32.dll_CoRegisterClassObject
push esi
push esi
mov eax, edi
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.004401e7
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
call edi
mov esi, dword [0x4683bc]
call edi
jmp 0x4307f9