Function at 0x1027a35
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
xor esi, esi
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call ebx
cmp dword [ebp + 0xc], esi
jne 0x1027a6c
push 0x100574c
push 2
call fcn.0102ae4b
push 2
call ebx
xor eax, eax
jmp 0x1027dce
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
push 0x1005734
call edi
push eax
push 0x1005734
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x1027ac3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, esi
je 0x1027ac3
push 0x100571c
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x1027ac3
push 0x10056e0
push 5
call fcn.0102ae4b
push esi
call ebx
xor eax, eax
inc eax
jmp 0x1027dcd
cmp dword [ebp + 8], esi
je 0x1027af1
push dword [ebp + 8]
call fcn.010257cb
test eax, eax
jne 0x1027af1
push dword [ebp + 8]
push 0x1005698
push 2
call fcn.0102ae85
add esp, 0xc
push 2
call ebx
xor eax, eax
jmp 0x1027dcd
push dword [ebp + 0xc]
call edi
mov edi, eax
add edi, 5
lea eax, [edi + edi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
jne 0x1027b11
push 8
jmp 0x1027ae8
push edi
push eax
push dword [ebp + 0xc]
call fcn.01027336
xor eax, eax
cmp word [ebp + 0x14], 0xffff
push esi
setne al
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x64], esi
mov word [ebp - 0x36], si
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x3c], eax
mov ax, word [ebp + 0x14]
inc ax
neg ax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
sbb eax, eax
and eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], esi
mov word [ebp - 0x38], ax
lea eax, [ebp - 4]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001750
push 0x80000001
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.0101bbbd
test eax, eax
jne 0x1027bb5
push 0x100565c
push dword [ebp - 4]
call fcn.0101be65
push 0x1005628
push dword [ebp - 4]
call fcn.0101be65
push 0x10055f4
push dword [ebp - 4]
call fcn.0101be65
push dword [ebp + 0xc]
push 0x10055d8
push 5
call fcn.0102ae85
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0101d6e6
test eax, eax
jne 0x1027c48
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
call edi
cmp eax, esi
jne 0x1027bfe
push 0x57
pop eax
cmp eax, esi
jg 0x1027c0b
call edi
cmp eax, esi
jne 0x1027c1e
push 0x57
pop eax
jmp 0x1027c1e
call edi
cmp eax, esi
jne 0x1027c14
push 0x57
pop eax
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp + 0xc]
push 0x10055a8
push 2
call fcn.0102ae85
add esp, 0x10
cmp dword [ebp - 4], esi
je 0x1027aea
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1027aea
cmp dword [ebp - 0x20], esi
je 0x1027c59
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x10], esi
je 0x1027d76
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp + 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], 4
mov dword [ebp + 8], esi
mov dword [ebp + 0x14], esi
mov edi, 0xfa
jmp 0x1027d0b
cmp dword [ebp + 0x10], esi
jne 0x1027ccc
cmp dword [ebp - 4], esi
jne 0x1027c98
mov dword [ebp + 0x10], 1
jmp 0x1027cfe
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x100565c
push dword [ebp - 4]
mov dword [ebp + 8], 4
call fcn.0101c24b
test eax, eax
jne 0x1027ccc
push dword [ebp + 0x14]
mov dword [ebp + 0x10], 1
call fcn.0102a8df
cmp dword [ebp - 4], esi
je 0x1027cfe
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x1005628
push dword [ebp - 4]
mov dword [ebp + 8], 4
call fcn.0101c24b
test eax, eax
jne 0x1027cfe
push dword [ebp + 0x14]
call fcn.0102a8a8
mov eax, 0x2932e0
cmp dword [ebp - 0xc], eax
ja 0x1027d22
add dword [ebp - 0xc], edi
push edi
push esi
lea eax, [ebp - 0x24]
push eax
push 1
call ebx
cmp eax, 0x102
je 0x1027c85
jmp 0x1027d57
push eax
push dword [ebp + 0xc]
xor ecx, ecx
inc ecx
push 0x1005568
push ecx
mov dword [ebp - 8], ecx
call fcn.0102ae85
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1027d4c
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 8], esi
jne 0x1027d76
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1027d76
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
cmp dword [ebp - 0x24], esi
pop ecx
je 0x1027d90
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], esi
cmp dword [ebp - 4], esi
je 0x1027dc5
push 0x100565c
push dword [ebp - 4]
call fcn.0101be65
push 0x1005628
push dword [ebp - 4]
call fcn.0101be65
push 0x10055f4
push dword [ebp - 4]
call fcn.0101be65
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], esi
sete al
pop edi
pop esi
pop ebx
leave
ret 0x10