Function at 0x409b00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1c]
push ebx
sub esp, 0x4c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
je 0x409e38
mov edi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
cmp eax, 1
je 0x409e42
mov dword [ebp - 0x30], 0
mov ebx, 1
jle 0x409cb0
lea esi, [esi]
mov esi, dword [edi + ebx*4]
movzx ecx, word [esi]
mov eax, ecx
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x409c40
movzx eax, word [esi + 2]
test ax, ax
jne 0x409c20
cmp cx, 0x2d
je 0x409c40
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towupper]
sub eax, 0x3f
cmp ax, 0x17
ja case.0x409b91.1
movzx eax, ax
jmp dword [eax*4 + 0x411aac]
mov dword [esp + 4], esi
mov dword [esp], 0xbba
call sym._output_message
mov dword [esp], 0xbbb
call sym._error_exit
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
inc ebx
cmp ebx, dword [ebp - 0x2c]
jl 0x409b50
jne 0x409cb0
cmp dword [ebp - 0x30], 2
jne 0x409e21
mov dword [esp], 0xbbd
call sym._output_message
mov dword [esp], 0xbbb
call sym._error_exit
mov esi, dword [ebp - 0x1c]
jmp 0x409c43
mov dword [esp], 0xbb9
call sym._error_exit
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
jmp case.0x409b91.4
mov dword [ebp - 0x30], 1
jmp case.0x409b91.4
movzx ecx, word [esi + 4]
cmp cx, 0x3a
je 0x409b7c
test cx, cx
je 0x409b7c
lea esi, [esi]
nop
mov esi, dword [ebp - 0x2c]
cmp esi, ebx
jg 0x409c5e
jmp 0x409cb0
mov dword [esp], esi
call sym._delete_registry_key
inc ebx
cmp ebx, dword [ebp - 0x1c]
jge 0x409cb0
mov edx, dword [ebp - 0x30]
mov esi, dword [edi + ebx*4]
lea eax, [ebx*4]
cmp edx, 1
je 0x409ce0
cmp edx, 2
je 0x409c50
mov dword [esp + 4], 0x411a92
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x409d10
mov dword [esp], 0
inc ebx
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], eax
call sym._import_registry_file
cmp ebx, dword [ebp - 0x1c]
jl 0x409c5e
lea esi, [esi]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x30], 2
jmp case.0x409b91.4
mov eax, dword [edi + eax + 4]
inc ebx
test eax, eax
je 0x409cf3
cmp word [eax], 0
jne 0x409de0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call sym._export_registry_key
jmp 0x409c58
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_SearchPathW]
mov dword [ebp - 0x2c], 0
sub esp, 0x18
mov edx, eax
test eax, eax
jle 0x409d93
add eax, eax
mov dword [ebp - 0x34], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [ebp - 0x2c], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_SearchPathW]
sub esp, 0x18
mov edx, eax
test edx, edx
je 0x409e00
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], 0x411a96
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wfopen]
test eax, eax
je 0x409e55
mov dword [esp], eax
mov esi, eax
call sym._import_registry_file
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x409c58
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fclose]
jmp 0x409c58
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._export_registry_key
jmp 0x409c58
mov dword [esp + 4], esi
mov dword [esp], 0xbbe
call sym._output_message
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x409c58
mov dword [esp], 0xbbc
call sym._output_message
jmp 0x409be4
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LocalFree]
xor eax, eax
sub esp, 4
jmp 0x409cc1
mov dword [esp], 0x411a9c
call dword [sym.imp.ucrtbase.dll__wperror]
mov dword [esp + 4], esi
mov dword [esp], 0xbbf
call sym._output_message
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x409c58