Function at 0x4016da
Capabilities:
Accept command line arguments
Check if file exists
Create directory
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x31c0]
mov eax, 0x3240
call fcn.00406060
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x31bc], eax
mov eax, dword [ebp + 0x31c8]
push ebx
push esi
push edi
mov dword [0x41b500], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov esi, eax
jmp 0x401728
inc esi
inc esi
cmp word [esi], 0x20
je 0x401726
xor ebx, ebx
push 9
mov word [ebp + 0x3194], bx
xor eax, eax
pop ecx
lea edi, [ebp + 0x3196]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp word [esi], 0x2d
mov dword [ebp + 0x14], ebx
jne 0x4017c4
push 7
lea edi, [esi + 2]
push str.obmode:
push edi
call fcn.00405f3d
add esp, 0xc
test eax, eax
jne 0x4017c4
add edi, 0xe
lea eax, [ebp + 0x3194]
movzx ecx, word [edi]
cmp cx, 0x30
jb 0x40177e
cmp cx, 0x39
jbe 0x4017a2
cmp cx, 0x41
jb 0x40178a
cmp cx, 0x46
jbe 0x4017a2
cmp cx, 0x61
jb 0x401796
cmp cx, 0x66
jbe 0x4017a2
cmp cx, 0x78
je 0x4017a2
cmp cx, 0x58
jne 0x4017ab
mov word [eax], cx
inc eax
inc eax
inc edi
inc edi
jmp 0x40176f
add edi, 2
push edi
push esi
mov word [eax], bx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp + 0x14], 1
jmp 0x4017c4
inc esi
inc esi
cmp word [esi], 0x20
je 0x4017c2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x401827
push esi
push 0x41b508
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4015ee
push 0xc8
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov dword [0x41b504], eax
jmp 0x401814
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x401800
inc eax
jmp 0x401d93
mov esi, 0x206
push esi
lea eax, [ebp + 0x2876]
push ebx
push eax
mov word [ebp + 0x2874], bx
call fcn.00405900
push esi
lea eax, [ebp + 0x2466]
push ebx
push eax
mov word [ebp + 0x2464], bx
call fcn.00405900
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp + 0x2874]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x2874]
push eax
lea eax, [ebp + 0x2464]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x2464]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [ebp + 0x2e8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x4155b4
push 0x65
push dword [0x41b500]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4018eb
push esi
push dword [0x41b500]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [0x41b500]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
lea eax, [ebp + 0x3094]
push eax
call fcn.00405af0
add esp, 0xc
jmp 0x401910
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x401d91
push 0x64
lea eax, [ebp + 0x3094]
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp + 0x3094]
push eax
lea eax, [ebp + 0x2e8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
lea eax, [ebp + 0x2e8c]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x2e8c]
push eax
lea eax, [ebp + 0x225c]
push str._sSDPlugins
push eax
call esi
lea eax, [ebp + 0x2e8c]
push eax
lea eax, [ebp + 0x1e4c]
push str._sAppData
push eax
call esi
add esp, 0x18
push ebx
lea eax, [ebp + 0x225c]
push eax
call edi
push ebx
lea eax, [ebp + 0x1e4c]
push eax
call edi
lea eax, [ebp + 0x2e8c]
push eax
push 0x65
call fcn.004013b0
lea eax, [ebp + 0x2e8c]
push eax
lea eax, [ebp + 0x1c44]
push str._sDXAppCustom.bin
push eax
call esi
lea eax, [ebp + 0x2464]
push eax
lea eax, [ebp + 0x2e8c]
push eax
lea eax, [ebp + 0x266c]
push str._s_s
push eax
call esi
add esp, 0x24
lea eax, [ebp + 0x266c]
push eax
lea eax, [ebp + 0x1c44]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp + 0x1e4c]
push eax
push 0x66
call fcn.004013b0
lea eax, [ebp + 0x225c]
push eax
push 0x67
call fcn.004013b0
lea eax, [ebp + 0x2e8c]
push eax
push 0x69
call fcn.004013b0
lea eax, [ebp + 0x2e8c]
push eax
lea eax, [ebp + 0x2054]
push str._sSDPluginsDXAxHost.app
push eax
call esi
lea eax, [ebp + 0x2e8c]
push eax
lea eax, [ebp + 0x1a3c]
push str._sSDPluginsDXAxHost.dll
push eax
call esi
add esp, 0x30
lea eax, [ebp + 0x2054]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401a4d
lea eax, [ebp + 0x1a3c]
push eax
lea eax, [ebp + 0x2054]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.APP_PACK
push 0x68
push dword [0x41b500]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x401d09
lea eax, [ebp + 0x20]
push eax
push 0x20019
push ebx
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EB
push 0x80000000
mov dword [ebp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401b79
push dword [ebp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x20]
push eax
push 0x20019
push ebx
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EBInProcServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401b79
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x2a7c]
push eax
push ebx
push ebx
push 0x41544c
push dword [ebp + 0x20]
mov dword [ebp + 0x1c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401b70
lea eax, [ebp + 0x2a7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401b70
lea eax, [ebp + 0x18]
push eax
push 0x20019
push ebx
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EBVersion
push 0x80000000
mov dword [ebp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401b70
push 0xc6
lea eax, [ebp + 0x30ce]
push ebx
push eax
mov word [ebp + 0x30cc], bx
call fcn.00405900
add esp, 0xc
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x30cc]
push eax
push ebx
push ebx
push 0x41544c
push dword [ebp + 0x18]
mov dword [ebp + 0x1c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401b67
lea eax, [ebp + 0x30cc]
push eax
call fcn.00405ae2
fstp st(0)
add esp, 4
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1834]
push str.regsvr32.exe
push eax
call esi
lea eax, [ebp + 0x2c84]
push 0x41544c
push eax
call fcn.004059a4
add esp, 0x10
push 1
push 0x23
lea eax, [ebp + 0x2c84]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x2c84]
push eax
call fcn.004059c0
test eax, eax
pop ecx
lea eax, [ebp + 0x2c84]
je 0x401c17
push str.Stardock
push eax
call fcn.0040597a
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x2c84]
push eax
call edi
lea eax, [ebp + 0x2c84]
push str.DesktopX
push eax
call fcn.0040597a
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x2c84]
push eax
call edi
lea eax, [ebp + 0x2c84]
push str.GadgetRuntime
push eax
call fcn.0040597a
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x2c84]
push eax
call edi
jmp 0x401c23
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x2c84]
push eax
lea eax, [ebp + 0x2a7c]
push str._sSDCtrls.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp + 0x2a7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401d09
push ebx
push ebx
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp + 0x2a7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, ebx
je 0x401d09
cmp eax, 0xffffffff
je 0x401d09
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x2a7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x2c84]
push eax
push 0x68
call fcn.004013b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x14
call edi
lea eax, [ebp + 0x2a7c]
push eax
lea eax, [ebp + 0x1034]
push str._s___s_
push eax
call esi
push 0x3c
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00405900
lea eax, [ebp + 0x1834]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1034]
mov dword [ebp - 0x14], eax
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x3c
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x24], 0x200
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x14
call edi
cmp dword [ebp + 0x14], ebx
lea eax, [ebp + 0x266c]
push eax
lea eax, [ebp + 0x2874]
push eax
je 0x401d36
lea eax, [ebp + 0x3194]
push eax
lea eax, [ebp + 0x1434]
push str._obmode:_s___s___s
push eax
call esi
add esp, 0x14
jmp 0x401d47
lea eax, [ebp + 0x1434]
push str.__s___s
push eax
call esi
add esp, 0x10
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00405900
lea eax, [ebp + 0x266c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x64], esi
lea eax, [ebp + 0x1434]
xor esi, esi
mov dword [ebp - 0x50], eax
add esp, 0xc
lea eax, [ebp - 0x64]
inc esi
push eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x60], 0x200
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, esi
jmp 0x401d93
xor eax, eax
mov ecx, dword [ebp + 0x31bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004058e2
add ebp, 0x31c0
leave
ret 0x10