Function at 0x44bf60
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x5cac4c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x258], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 8
push eax
mov dword [ebp - 0x260], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
push eax
push str.Start_run__cmd___s
call fcn.0044ca10
push edi
push str.lpstrCmdLine_s
call fcn.0044ca10
add esp, 0x10
mov ecx, 0x5d1af0
push 0
push dword [ebp + 8]
push 0
call fcn.00448330
lea ecx, [ebp - 0x284]
call fcn.00414070
mov eax, dword [0x5d1380]
test eax, eax
jne 0x44c01a
push 0x10
call fcn.004aa859
add esp, 4
test eax, eax
je 0x44c013
mov ecx, eax
call fcn.00413b70
jmp 0x44c015
xor eax, eax
mov dword [0x5d1380], eax
mov ecx, eax
call fcn.00413f00
push 1
call fcn.0046cd10
push edi
call fcn.00444480
mov ecx, eax
call fcn.0043def0
lea ecx, [ebp - 0x27c]
call fcn.00451200
call fcn.00444480
mov ecx, eax
call fcn.0043db60
push eax
lea ecx, [ebp - 0x27c]
call fcn.00451250
call fcn.00444480
mov ecx, eax
call fcn.0043f860
push dword [eax]
call fcn.0046cd40
mov ecx, 0x5d1b2c
call fcn.004164f0
test eax, eax
jne 0x44c0b8
push str.CheckSingleInstance_failed__exit
call fcn.0044ca10
add esp, 4
push 1
push 0
push 0
push 0
push 0x5815f4
push 0
call fcn.0046cd60
push 1
lea ecx, [ebp - 0x27c]
mov dword [0x5d1aec], 1
call fcn.00451260
xor edi, edi
jmp 0x44c9d8
call fcn.00444480
mov ecx, eax
call fcn.0043dd80
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430df0
call fcn.00444480
mov ecx, eax
call fcn.0043db90
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430de0
call fcn.00444480
mov ecx, eax
call fcn.0043dd90
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430e00
call fcn.00444480
mov ecx, eax
call fcn.0043ddc0
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430e70
call fcn.004345f0
mov ecx, eax
call fcn.0042edc0
push str.instnew
call fcn.004345f0
mov ecx, eax
call fcn.00430e20
call fcn.00444480
cmp dword [eax + 0x44], 0
je 0x44c155
push str.lite_pack
call fcn.004345f0
mov ecx, eax
call fcn.00430e20
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00507970
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430d40
call fcn.0046f720
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
neg eax
sbb eax, eax
inc eax
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430dd0
call fcn.0040cd20
mov ecx, eax
test ecx, ecx
je 0x44ca03
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
call esi
push eax
lea ecx, [ebp - 0x26c]
call fcn.0040e030
push str.NtQueryInformationProcess
push str.NTDLL.DLL
mov dword [ebp - 0x25c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44c234
lea eax, [ebp - 0x25c]
push eax
push 0x18
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x44c234
cmp dword [ebp - 0x25c], 0x18
jne 0x44c234
mov eax, dword [ebp - 0x210]
jmp 0x44c237
or eax, 0xffffffff
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x44c287
push str.Failed_to_open_process.
call fcn.0044ca10
add esp, 4
mov dword [ebp - 0x244], esi
xor eax, eax
mov dword [ebp - 0x240], 7
lea ecx, [ebp - 0x254]
mov word [ebp - 0x254], ax
push eax
push 0x57ba4c
call fcn.00412940
jmp 0x44c330
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
xor eax, eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c2c1
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.00412940
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x23c]
xor eax, eax
lea ecx, [ebp - 0x23c]
mov word [ebp - 0x23c], ax
movups xmmword [ebp - 0x254], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
call fcn.004109e0
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x268]
cmovae eax, dword [ebp - 0x254]
push eax
call fcn.0040e030
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00473f60
mov esi, eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00473f60
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x270]
push str.ex_ary_pro__sex_ary_param__s
push eax
call fcn.0040b090
mov edx, dword [ebp - 0x280]
or ebx, 0xffffffff
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c3b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c3cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x268]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c3ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x254]
call fcn.004109e0
mov edx, dword [ebp - 0x26c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c412
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x270]
push esi
push str.run_ex__s
call fcn.0044ca10
add esp, 8
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x447e00
push 0x5802f8
mov dword [eax + 0x24], eax
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
sub esp, 0x28
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x447e00
push 0x5802f8
mov dword [eax + 0x24], eax
call fcn.004345f0
mov ecx, eax
call fcn.004303a0
call fcn.00444480
mov ecx, eax
call fcn.0043dd70
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430de0
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.setup_pid
mov dword [eax + 0x24], 0
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
lea eax, [ebp - 0x260]
push eax
call fcn.00444480
mov ecx, eax
call fcn.0043dcd0
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430de0
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c4f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.res_pid
mov dword [eax + 0x24], 0
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
call fcn.00444480
mov ecx, eax
call fcn.0043db90
push eax
call fcn.004345f0
mov ecx, eax
call fcn.00430de0
cmp dword [0x5ca400], 0
je 0x44c5f3
push str.ntdll.dll
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x270], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x44c5e3
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44c5b3
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
call eax
movzx eax, word [ebp - 0x25c]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x270], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x270], 0
je 0x44c5e3
cmp dword [ebp - 0x26c], 6
jne 0x44c5d7
cmp dword [ebp - 0x268], 1
jae 0x44c5d9
jmp 0x44c5e3
jbe 0x44c5e3
mov dword [0x5d1b68], 1
mov edi, dword [ebp - 0x258]
mov dword [0x5ca400], 0
cmp dword [0x5d1b68], 0
jne 0x44c67b
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_os_fail
mov dword [eax + 0x24], 0
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
push 1
push 0
push 0x580af4
push 0
push str.S_MRHr_g
push 0
call fcn.0046cd60
cmp eax, 1
jne 0x44c652
push eax
push 0
push 0
push str.https:__cdn_file_ssl.ludashi.com_pc_appstore_ludashi_ludashisetup.exe
push 0x57c9ac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
lea ecx, [ebp - 0x27c]
call fcn.00451260
mov ecx, 0x5d1b2c
call fcn.00416c80
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x44c9c3
call fcn.00448450
test eax, eax
jne 0x44c6bd
push dword [0x5d1aec]
lea ecx, [ebp - 0x27c]
call fcn.00451260
call fcn.00444510
mov ecx, eax
call fcn.00441dd0
mov ecx, 0x5d1b2c
call fcn.00416c80
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x44c9c3
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_init_packinfo
mov dword [eax + 0x24], 0
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
call fcn.00449040
push 0
sub esp, 0x28
test eax, eax
mov eax, esp
push 0
mov dword [eax + 0x24], 0
push 0
jne 0x44c710
push str.install_file_fail
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
push 5
jmp 0x44c72c
push str.install_version_cmp
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
call fcn.004465e0
test eax, eax
jne 0x44c76c
push 6
lea ecx, [ebp - 0x27c]
call fcn.00451260
mov ecx, 0x5d1b2c
call fcn.00416c80
call fcn.0046f720
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.00444510
mov ecx, eax
call fcn.00441dd0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x44c9c3
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_check_se_sf
mov dword [eax + 0x24], 0
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
call fcn.004472f0
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_will_msgloop
mov dword [eax + 0x24], 0
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
call fcn.00444480
cmp dword [eax + 0x98], 0
je 0x44c7f1
push 4
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 1
push eax
push 4
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x44c806
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [ebp + 0x14]
push edi
call fcn.0044aa60
add esp, 8
mov dword [ebp - 0x260], eax
lea ecx, [ebp - 0x25c]
call fcn.0040ab30
push dword [0x5d1b78]
lea eax, [ebp - 0x25c]
push str.ex_ary_result_result__d
push eax
call fcn.0040b090
add esp, 0xc
push 0
sub esp, 0x28
mov eax, esp
push 1
push dword [ebp - 0x25c]
mov dword [eax + 0x24], 0
push str.install_result
call fcn.004345f0
mov ecx, eax
call fcn.004307a0
call fcn.00444510
mov ecx, eax
call fcn.00441dd0
push dword [0x5d1b78]
lea ecx, [ebp - 0x27c]
call fcn.00451270
mov eax, dword [0x5d1adc]
add eax, 0x10
push eax
mov dword [ebp - 0x258], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x5d1b28]
test edi, edi
je 0x44c8e8
cmp dword [edi + 4], 0
jle 0x44c8b6
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [0x5d1b28]
test edi, edi
je 0x44c8e8
mov eax, dword [edi]
test eax, eax
je 0x44c8cf
push eax
call fcn.00524f28
add esp, 4
mov dword [edi], 0
push 0xc
push edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.004aa2ce
add esp, 8
push dword [ebp - 0x258]
mov dword [0x5d1b28], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x5d1b24]
test edi, edi
je 0x44c946
mov eax, dword [edi]
test eax, eax
je 0x44c91d
push eax
call fcn.00524f28
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x44c934
push eax
call fcn.00524f28
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
mov dword [edi + 8], 0
call fcn.004aa2ce
add esp, 8
mov edi, dword [0x5d1b1c]
test edi, edi
je 0x44c978
cmp dword [edi], 0
je 0x44c978
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x44c962
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [edi + 0x20]
push 0
mov dword [edi + 0x10], 0
call eax
add edi, 0x24
cmp dword [edi], 0
jne 0x44c955
mov edi, dword [0x5ca3e0]
mov ecx, dword [0x5ca3e4]
cmp edi, ecx
jae 0x44c9a2
mov eax, dword [edi]
test eax, eax
je 0x44c99b
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x5ca3e4]
add edi, 4
cmp edi, ecx
jb 0x44c988
mov ecx, 0x5d1af0
call fcn.0044b1c0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x25c]
call fcn.0040ac10
mov edi, dword [ebp - 0x260]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44c9d8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x27c]
call fcn.00451220
lea ecx, [ebp - 0x284]
call fcn.004140b0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa2b8
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0040ad60
int3