Function at 0x406fd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
test eax, eax
je 0x406fbc
mov edi, eax
mov eax, dword [ebp - 0x1c]
xor esi, esi
cmp eax, 1
je 0x4071f6
mov dword [ebp - 0x10], edi
jle 0x40704b
mov esi, 1
xor ebx, ebx
jmp 0x406fd8
xor esi, esi
jmp 0x4071fd
mov ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
inc esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jge 0x407056
mov edi, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + esi*4]
movzx ebx, word [edx]
mov ecx, ebx
or ecx, 2
cmp ecx, 0x2f
jne 0x407054
movzx ecx, word [edx + 2]
test cx, cx
je 0x407010
movzx edx, word [edx + 4]
cmp edx, 0x3a
je 0x407016
test edx, edx
je 0x407016
jmp 0x407054
cmp bx, 0x2d
je 0x407054
movzx eax, cx
push eax
call dword [sym.imp.ucrtbase.dll_towupper]
add esp, 4
movzx eax, ax
add eax, 0xffffffc1
cmp eax, 0x17
ja case.0x407034.64
mov ebx, edi
jmp dword [eax*4 + 0x40db78]
mov ebx, 1
jmp case.0x407034.67
mov byte [0x41117c], 1
jmp case.0x407034.67
xor ebx, ebx
mov esi, 1
jmp 0x407056
mov ebx, edi
cmp esi, eax
mov edi, dword [ebp - 0x10]
jne 0x40706c
cmp ebx, 2
jb 0x407207
je 0x407236
cmp esi, eax
jge 0x4071f1
mov dword [ebp - 0x14], ebx
jmp 0x407095
push dword [edi + esi*4]
call sym._delete_registry_key
add esp, 4
inc esi
cmp esi, dword [ebp - 0x1c]
jge 0x4071f1
cmp ebx, 2
je 0x407080
test ebx, ebx
jne 0x407150
mov ebx, dword [edi + esi*4]
push 0x40dc46
push ebx
call dword [sym.imp.kernel32.dll_lstrcmpW]
test eax, eax
je 0x407182
push 0
push 0
push 0
push 0
push ebx
push 0
mov eax, dword [sym.imp.kernel32.dll_SearchPathW]
call eax
mov edi, eax
test eax, eax
jle 0x40719e
mov eax, edi
add eax, edi
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
push 0
mov dword [ebp - 0x18], eax
push eax
push edi
push 0
push ebx
push 0
call dword [sym.imp.kernel32.dll_SearchPathW]
mov edi, eax
test edi, edi
je 0x4071ad
push 0x40d5d2
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.ucrtbase.dll__wfopen]
add esp, 8
test eax, eax
je 0x4071c0
mov ebx, eax
push eax
call sym._import_registry_file
add esp, 4
test edi, edi
je 0x4071e6
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push ebx
call dword [sym.imp.ucrtbase.dll_fclose]
jmp 0x4071e3
mov eax, dword [edi + esi*4]
mov ecx, dword [edi + esi*4 + 4]
inc esi
test ecx, ecx
je 0x407170
cmp word [ecx], 0
je 0x407170
push 1
push ecx
jmp 0x407174
push 1
push 0
push eax
call sym._export_registry_key
add esp, 0xc
jmp 0x40708b
push 0
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 4
push eax
call sym._import_registry_file
add esp, 4
mov ebx, dword [ebp - 0x14]
jmp 0x40708b
mov dword [ebp - 0x18], 0
test edi, edi
jne 0x4070ff
push ebx
push 0xbbe
call sym._output_message
add esp, 8
push dword [ebp - 0x18]
jmp 0x4071dd
push 0x40d582
call dword [sym.imp.ucrtbase.dll__wperror]
add esp, 4
push ebx
push 0xbbf
call sym._output_message
add esp, 8
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
jmp 0x40708b
mov esi, 1
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xbbc
call sym._usage
push 0xbb9
call sym._output_message
add esp, 4
push 0
call dword [sym.imp.ucrtbase.dll_exit]
mov eax, dword [ebp - 0x10]
push dword [eax + esi*4]
push 0xbba
call sym._usage
push 0xbbd
call sym._usage