Function at 0x406010
Capabilities:
Accept command line arguments
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], 0x63
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x403930
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
je 0x406068
push 0x404cc0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x406068
push edi
push edi
push 1
push edi
call eax
cmp dword [esp + 0x10], 1
jle 0x406602
call fcn.00405f40
push 0x6c
call fcn.004206e2
mov esi, dword [ebp + 8]
add esp, 4
cmp eax, edi
je 0x406096
mov edx, esi
call fcn.0041a280
mov dword [esp + 0x18], eax
jmp 0x40609a
mov dword [esp + 0x18], edi
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 4]
mov ecx, ebx
mov eax, 0x403358
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4060ce
cmp dx, di
je 0x4060ca
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4060ce
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4060a8
xor eax, eax
jmp 0x4060d3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4060e9
mov eax, dword [esp + 0x18]
call fcn.0041a4a0
mov dword [esp + 0xc], eax
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403378
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406116
cmp dx, di
je 0x406112
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406116
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4060f0
xor eax, eax
jmp 0x40611b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406131
mov eax, dword [esp + 0x18]
call fcn.0041a5d0
mov dword [esp + 0xc], eax
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x40338c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40615e
cmp dx, di
je 0x40615a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40615e
add eax, 4
add ecx, 4
cmp dx, di
jne 0x406138
xor eax, eax
jmp 0x406163
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406179
mov eax, dword [esp + 0x18]
call fcn.0041a7a0
mov dword [esp + 0xc], eax
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x4033a4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4061a6
cmp dx, di
je 0x4061a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4061a6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x406180
xor eax, eax
jmp 0x4061ab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4061c1
mov eax, dword [esp + 0x18]
call fcn.0041a910
mov dword [esp + 0xc], eax
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x4033cc
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4061ee
cmp dx, di
je 0x4061ea
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4061ee
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4061c8
xor eax, eax
jmp 0x4061f3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406205
call fcn.0041a9d0
mov dword [esp + 0xc], eax
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403404
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406236
cmp dx, di
je 0x406232
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406236
add eax, 4
add ecx, 4
cmp dx, di
jne 0x406210
xor eax, eax
jmp 0x40623b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406252
mov eax, dword [esp + 0x18]
push eax
call fcn.0041aa80
mov dword [esp + 0xc], eax
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403438
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406286
cmp dx, di
je 0x406282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406286
add eax, 4
add ecx, 4
cmp dx, di
jne 0x406260
xor eax, eax
jmp 0x40628b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4062c9
xor eax, eax
cmp dword [esp + 0x10], 3
mov dword [0x436344], esi
mov dword [0x436348], edi
jne 0x4062b0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
call fcn.00419fa0
push edi
call fcn.0040b610
xor edx, edx
test eax, eax
setns dl
add edx, 0x63
mov dword [esp + 0xc], edx
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403450
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4062f6
cmp dx, di
je 0x4062f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4062f6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4062d0
xor eax, eax
jmp 0x4062fb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x40633a
xor eax, eax
cmp dword [esp + 0x10], 3
mov dword [0x436344], esi
mov dword [0x436348], edi
jne 0x406320
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 8]
call fcn.00419fa0
push 1
call fcn.0040b610
xor ecx, ecx
test eax, eax
setns cl
add ecx, 0x63
mov dword [esp + 0xc], ecx
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x40347c
mov esi, 4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40636a
cmp dx, di
je 0x406366
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40636a
add eax, esi
add ecx, esi
cmp dx, di
jne 0x406346
xor eax, eax
jmp 0x40636f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4063db
call fcn.00418f10
test eax, eax
je 0x4065f0
lea edx, [esp + 0x1c]
push edx
push 0x202
push edi
push 0x4034a0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4065f0
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4065f0
push 0x4034e0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4063cb
mov dword [esp + 0xc], 0x64
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403504
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406406
cmp dx, di
je 0x406402
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406406
add eax, esi
add ecx, esi
cmp dx, di
jne 0x4063e2
xor eax, eax
jmp 0x40640b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406458
cmp dword [esp + 0x10], 3
jne 0x40642c
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 8]
push edi
push edx
call fcn.00417050
test eax, eax
js 0x4065e8
cmp dword [esp + 0x10], esi
jne 0x40644b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push ecx
push edx
call fcn.00417050
test eax, eax
js 0x4065e8
mov dword [esp + 0xc], 0x64
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403520
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406484
cmp dx, di
je 0x406480
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406484
add eax, esi
add ecx, esi
cmp dx, di
jne 0x406460
xor eax, eax
jmp 0x406489
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4064b9
cmp dword [esp + 0x10], 3
jl 0x4065e8
mov eax, dword [esp + 0x14]
mov ebx, dword [eax + 8]
call fcn.004172b0
test eax, eax
js 0x4065e8
mov dword [esp + 0xc], 0x64
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403540
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4064e4
cmp dx, di
je 0x4064e0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4064e4
add eax, esi
add ecx, esi
cmp dx, di
jne 0x4064c0
xor eax, eax
jmp 0x4064e9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406519
cmp dword [esp + 0x10], 3
jl 0x4065e8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
call fcn.00417340
test eax, eax
js 0x4065e8
mov dword [esp + 0xc], 0x64
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x40355c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406544
cmp dx, di
je 0x406540
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406544
add eax, esi
add ecx, esi
cmp dx, di
jne 0x406520
xor eax, eax
jmp 0x406549
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x406579
cmp dword [esp + 0x10], 3
jl 0x4065e8
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + 8]
call fcn.004173b0
test eax, eax
js 0x4065e8
mov dword [esp + 0xc], 0x64
jmp 0x4065f0
mov ecx, ebx
mov eax, 0x403574
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4065a4
cmp dx, di
je 0x4065a0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4065a4
add eax, esi
add ecx, esi
cmp dx, di
jne 0x406580
xor eax, eax
jmp 0x4065a9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4065f0
cmp dword [esp + 0x10], esi
jl 0x4065e8
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0xc]
push ecx
call fcn.00419fa0
add esp, 4
push eax
mov eax, dword [esi + 8]
call fcn.00417b90
test eax, eax
js 0x4065e8
xor ecx, ecx
cmp dword [esp + 0x1c], edi
sete cl
lea ecx, [ecx + ecx + 0x62]
mov dword [esp + 0xc], ecx
jmp 0x4065f0
mov dword [esp + 0xc], 0x63
mov ecx, dword [esp + 0x18]
cmp ecx, edi
je 0x40660e
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
jmp 0x40660e
mov ecx, dword [ebp + 8]
call fcn.00406780
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x40661d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10