Function at 0x402360
Capabilities:
Accept command line arguments
Delete registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414d56
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x144]
xor ebx, ebx
push esi
push 0x41b020
push 0x41b0c8
mov edi, eax
mov dword [0x41b0c8], 0x64
mov dword [0x41b12c], ebx
call fcn.004131f0
push 0x100
push 0x41b138
mov ebp, 1
push 0xfa1
push esi
mov dword [0x41b25c], ebp
call dword [sym.imp.USER32.dll_LoadStringA]
push str.netapi32.dll
mov dword [0x41b238], ebx
mov dword [0x41b23c], 0x10
mov dword [0x41b240], ebp
mov dword [0x41b244], ebp
mov dword [0x41b248], ebx
mov dword [0x41b24c], ebx
mov dword [0x41b250], ebx
mov dword [0x41b254], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x41b130], eax
je 0x40242a
push str.NetWkstaUserGetInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41b134], eax
mov ecx, 0x41b0c8
mov dword [0x41b25c], ebp
mov dword [0x41b260], ebx
call fcn.00401a00
mov ax, word [0x416520]
mov cl, byte [0x416522]
lea edx, [esp + 0x14]
mov word [esp + 0x14], ax
push edx
push edi
mov byte [esp + 0x1e], cl
call fcn.004010a0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4024b5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnregServer
push esi
call edi
test eax, eax
je 0x4025c3
push str.RegServer
push esi
call edi
test eax, eax
je 0x40264a
push str.Embedding
push esi
call edi
test eax, eax
jne 0x4024a1
mov dword [0x41b260], ebp
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004010a0
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40246f
mov dword [0x41b25c], ebx
mov dword [esp + 0x18], ebx
push 0xf003f
push str.AppID
push SysReAllocStringLen
lea ecx, [esp + 0x24]
mov dword [esp + 0x148], ebx
call fcn.004115c0
cmp eax, ebx
jne 0x402544
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
push 0xf003f
push str.9209B1A6_964A_11D0_9372_00A0C9034910
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x148], 1
call fcn.004115c0
cmp eax, ebx
jne 0x402534
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x30]
push ecx
push str.LocalService
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0x104
call fcn.00411640
cmp eax, ebx
jne 0x402534
mov dword [0x41b25c], ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x13c], bl
call fcn.00411540
mov eax, dword [0x41b25c]
mov dword [esp + 0x20], 0x41b138
cmp eax, ebx
mov dword [esp + 0x24], 0x401540
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
je 0x402582
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x40257a
mov dword [0x41b25c], ebx
cmp dword [0x41b25c], ebx
jne 0x40258c
mov ecx, 0x41b0c8
call fcn.00401770
mov esi, dword [0x41b248]
lea ecx, [esp + 0x18]
mov dword [esp + 0x13c], 0xffffffff
call fcn.00411540
mov eax, esi
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x130
ret 0x10
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x4025a8
push ebx
push ebx
push 0x64
push 0x41b0c8
call fcn.00410e20
mov ecx, 0x41b0c8
call fcn.00402b30
push ebx
push 0x41b0c8
call fcn.004134d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push str.SOFTWAREMicrosoftJava_VM
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x402629
push str.MSDEBUG
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0040d7a0
add esp, 4
mov ecx, 0x41b0c8
push ebx
call fcn.00401320
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x4025a8
push ebx
push ebx
mov ecx, 0x41b0c8
call fcn.00402660
jmp 0x4025a8