Function at 0x406c60
Capabilities:
Create shortcut via ishelllink
Query environment variable
Query or enumerate registry value
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4081a7
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x40c004]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
push esi
push edi
mov eax, dword [0x40c004]
xor eax, esp
push eax
lea eax, [esp + 0x2e8]
mov dword fs:[0], eax
mov dword [esp + 0x40], ecx
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], 0
mov dword [esp + 0x14], 0
test edi, edi
je 0x406cdb
test dword [esp + 0x70], 0x800
jne 0x4073f1
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, 0xffffffff
jne 0x408eed
mov esi, 0x4014f8
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x10000006
push esi
push 0x401360
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x406dde
mov eax, dword [esp + 0x2c]
xor ecx, ecx
shr eax, 1
mov edx, 2
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll____U_YAPAXI_Z]
mov ecx, dword [esp + 0x30]
add esp, 4
add ecx, 2
mov ebx, eax
mov dword [esp + 0x38], ebx
push ecx
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push ebx
push 0
push 0x10000006
push esi
push 0x401360
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x408f1e
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x408fb5
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x406dc9
push 0x64
push edi
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x408f9f
mov esi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
call dword [sym.imp.msvcrt.dll_free]
mov edi, dword [esp + 0x20]
add esp, 4
mov ebx, SysReAllocString
test edi, edi
je 0x406dfc
mov ecx, ebx
mov eax, edi
jmp 0x406df0
cmp word [eax], 0
je 0x406e00
add eax, 2
dec ecx
jne 0x406df0
xor edx, edx
jmp 0x406e08
test ecx, ecx
je 0x406dfc
mov edx, ebx
sub edx, ecx
inc edx
je 0x408fd4
cmp edx, 0x7fffffff
ja 0x408fd4
mov esi, ebx
mov ecx, 0x40c438
sub esi, edx
sub edi, ecx
lea eax, [esi + edx]
test eax, eax
je 0x406e44
movzx eax, word [edi + ecx]
test ax, ax
je 0x406e44
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x406e26
sub ecx, 2
jmp 0x406e48
test edx, edx
je 0x406e3f
mov edi, dword [esp + 0x1c]
xor eax, eax
mov word [ecx], ax
cmp dword [esp + 0x14], 0
je 0x408fe9
mov dword [esp + 0x34], 0
mov dword [esp + 0x2f0], 0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
mov byte [esp + 0x2f0], 1
push eax
push 0x401600
push 1
push 0
push 0x4010e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x407388
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
push 0x401120
push eax
mov esi, dword [eax]
mov esi, dword [esi]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
test edi, edi
js 0x407388
mov eax, dword [esp + 0x34]
push 2
push 0x40c438
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov dword [esp + 0x3c], 0
test eax, eax
jns 0x40900e
mov ecx, SysReAllocString
mov eax, 0x401530
mov edi, edi
cmp word [eax], 0
je 0x406f10
add eax, 2
dec ecx
jne 0x406f00
xor ebx, ebx
jmp 0x406f16
test ecx, ecx
je 0x406f0c
sub ebx, ecx
lea edx, [ebx + 1]
test edx, edx
je 0x406f67
cmp edx, 0x7fffffff
ja 0x409040
mov esi, SysReAllocString
mov ecx, 0x40c438
mov edi, 0x401530
sub esi, edx
sub edi, ecx
lea esp, [esp]
lea eax, [esi + edx]
test eax, eax
je 0x406f5e
movzx eax, word [edi + ecx]
test ax, ax
je 0x406f5e
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x406f40
sub ecx, 2
jmp 0x406f62
test edx, edx
je 0x406f59
xor eax, eax
mov word [ecx], ax
mov dword [esp + 0x24], 0
lea eax, [esp + 0x24]
push eax
push 0x4015b0
push 3
push 0
push 0x401100
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x407368
mov dword [esp + 0x18], 0
xor esi, esi
mov byte [esp + 0x2f0], 3
push esi
xor ebx, ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40906d
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x406fec
push 0x64
push edi
push 0x76
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x409055
mov ebx, edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x409099
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x407033
push 0x64
push edi
push 0x77
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x40908f
mov esi, edi
mov dword [esp + 0x14], esi
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push ecx
push 1
push dword [esp + 0x48]
mov ecx, ebx
push 0x40c438
sub esp, 8
call fcn.00407400
push dword [esp + 0x38]
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push ebx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
js 0x407348
mov eax, dword [esp + 0x24]
push dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
test edi, edi
js 0x407348
push 0x20a
xor edi, edi
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x4072db
push 0x104
push esi
push 0x4012e0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4070f5
cmp eax, 0x104
ja 0x4070f5
lea eax, [esp + 0x8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4070f5
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
je 0x4072db
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x4090bc
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x407145
push 0x64
push esi
push 0x7a
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x4090a4
mov ebx, esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x4090e8
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x407185
push 0x64
push esi
push 0x7b
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x4090de
mov dword [esp + 0x14], esi
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ATL.DLL_AtlComPtrAssign]
lea eax, [esp + 0x18]
mov edx, 0x4012e0
push eax
push ecx
push 1
push 0
push 0x4012e0
sub esp, 8
mov ecx, ebx
call fcn.00407400
push ebx
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
js 0x407348
mov eax, dword [esp + 0x24]
push dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
test edi, edi
js 0x407348
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x40910b
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x407231
push 0x64
push esi
push 0x65
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x4090f3
mov ebx, esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x409137
push 0xca
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x407271
push 0x64
push esi
push 0x6f
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
dec eax
cmp eax, 0x62
ja 0x40912d
mov dword [esp + 0x14], esi
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ATL.DLL_AtlComPtrAssign]
lea eax, [esp + 0x18]
mov edx, 0x4012e0
push eax
push ecx
push 0
push 0
push 0x4012e0
sub esp, 8
mov ecx, ebx
call fcn.00407400
push ebx
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
js 0x407348
mov eax, dword [esp + 0x24]
push dword [esp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
test edi, edi
js 0x407348
mov dword [esp + 0x30], 0
mov byte [esp + 0x2f0], 4
lea ecx, [esp + 0x30]
mov eax, dword [esp + 0x24]
push ecx
push 0x4015a0
push eax
mov esi, dword [eax]
mov esi, dword [esi]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
test edi, edi
js 0x407328
mov ecx, dword [esp + 0x40]
push dword [esp + 0x30]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
mov byte [esp + 0x2f0], 3
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x407348
mov edx, dword [ecx]
push ecx
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov byte [esp + 0x2f0], 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x407368
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov byte [esp + 0x2f0], 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x407388
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov byte [esp + 0x2f0], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4073a8
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov dword [esp + 0x2f0], 0xffffffff
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4073cb
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov eax, edi
mov ecx, dword [esp + 0x2e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d0]
xor ecx, esp
call fcn.00407980
mov esp, ebp
pop ebp
ret
mov ebx, SysReAllocString
jmp 0x408fe9
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x406cf2
cmp dword [esp + 0x20], 0
mov esi, 0x401810
jne 0x406cf7
jmp 0x406cf2
call fcn.00409978
test eax, eax
je 0x408f63
mov ecx, 0x401850
call fcn.004098db
test al, al
je 0x408f43
mov edx, 0x401850
mov dword [esp + 0x1c], edx
jmp 0x406d82
mov ecx, 0x401920
call fcn.004098db
test al, al
je 0x406d8a
mov edx, 0x401920
mov dword [esp + 0x1c], edx
jmp 0x406d82
mov ecx, 0x401a00
call fcn.004098db
test al, al
je 0x408f7f
mov edx, 0x401a00
mov dword [esp + 0x1c], edx
jmp 0x406d82
mov ecx, 0x401ab0
call fcn.004098db
test al, al
je 0x406d8a
mov edx, 0x401ab0
mov dword [esp + 0x1c], edx
jmp 0x406d82
push edi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x408fbf
jmp 0x408fc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x408fc9
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x4073cd
jmp 0x406dc9
test edx, edx
je 0x406e51
xor eax, eax
mov word [0x40c438], ax
jmp 0x406e51
lea eax, [esp + 0x20]
mov edx, ebx
push eax
mov ecx, edi
call fcn.0040a1f7
mov edx, dword [esp + 0x20]
mov ecx, 0x40c438
push edi
lea edx, [edx + 1]
call fcn.0040a1c6
jmp 0x406e5c
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x3c]
push ecx
push 0x104
push 0x40c438
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x40]
mov ecx, esi
call dword [0x40d1c0]
call esi
mov edi, eax
test edi, edi
jns 0x406f67
jmp 0x407388
test edx, edx
je 0x406f67
xor eax, eax
mov word [0x40c438], ax
jmp 0x406f67
push edi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jg 0x409079
jmp 0x409084
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x409084
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x407348
jmp 0x406fec
push edi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407033
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jg 0x4090c8
jmp 0x4090d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4090d3
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x407348
jmp 0x407145
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407185
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jg 0x409117
jmp 0x409122
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x409122
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x407348
jmp 0x407231
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x407271