Function at 0x401686
Capabilities:
Accept command line arguments
Check if file exists
Create directory
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x2214
lea ebp, [esp - 0x2194]
call fcn.00405a20
mov eax, dword [0x4131b4]
mov dword [ebp + 0x2190], eax
mov eax, dword [ebp + 0x219c]
push ebx
push esi
mov dword [0x414060], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov esi, eax
jmp 0x4016c3
inc esi
inc esi
cmp word [esi], 0x20
je 0x4016c1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x401728
push esi
push 0x414068
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4015a1
push 0xbb8
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov dword [0x414868], eax
jmp 0x401715
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call esi
test eax, eax
jne 0x401701
inc eax
jmp 0x401c3d
push edi
mov edx, 0x81
xor eax, eax
xor ebx, ebx
mov word [ebp + 0x1658], bx
mov ecx, edx
lea edi, [ebp + 0x165a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp + 0x1860], bx
mov ecx, edx
lea edi, [ebp + 0x1862]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
push esi
lea eax, [ebp + 0x1658]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1658]
push eax
lea eax, [ebp + 0x1860]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x1860]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [ebp + 0x1e78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x40f514
push 0x65
push dword [0x414060]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4017ec
push esi
push dword [0x414060]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [0x414060]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
lea eax, [ebp + 0x2080]
push eax
call fcn.00405680
add esp, 0xc
jmp 0x401817
lea eax, [ebp + 0x2180]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x401c3a
push 0x64
lea eax, [ebp + 0x2080]
push eax
lea eax, [ebp + 0x2180]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp + 0x2080]
push eax
lea eax, [ebp + 0x1e78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
lea eax, [ebp + 0x1e78]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0x1040]
push str._sSDPlugins
push eax
call esi
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0x1248]
push str._sAppData
push eax
call esi
add esp, 0x18
push ebx
lea eax, [ebp + 0x1040]
push eax
call edi
push ebx
lea eax, [ebp + 0x1248]
push eax
call edi
lea eax, [ebp + 0x1e78]
push eax
push 0x65
call fcn.0040137b
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0xc30]
push str._sDXAppCustom.bin
push eax
call esi
lea eax, [ebp + 0x1860]
push eax
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0x1450]
push str._s_s
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
add esp, 0x24
lea eax, [ebp + 0x1450]
push eax
lea eax, [ebp + 0xc30]
push eax
call edi
lea eax, [ebp + 0x1248]
push eax
push 0x66
call fcn.0040137b
lea eax, [ebp + 0x1040]
push eax
push 0x67
call fcn.0040137b
lea eax, [ebp + 0x1e78]
push eax
push 0x69
call fcn.0040137b
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0xe38]
push str._sSDPluginsDXAxHost.app
push eax
call esi
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0x820]
push str._sSDPluginsDXAxHost.dll
push eax
call esi
add esp, 0x30
lea eax, [ebp + 0xe38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401952
lea eax, [ebp + 0x820]
push eax
lea eax, [ebp + 0xe38]
push eax
call edi
push str.APP_PACK
push 0x68
push dword [0x414060]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x401bd4
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp + 0x1c]
push eax
push 0x20019
push ebx
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EB
push 0x80000000
mov dword [ebp + 0x219c], ebx
mov dword [ebp + 0x1c], ebx
call edi
test eax, eax
jne 0x401ab1
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1c]
push eax
push 0x20019
push ebx
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EBInProcServer32
push 0x80000000
call edi
test eax, eax
jne 0x401a9b
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x1a68]
push eax
push ebx
push ebx
push 0x40f3ac
push dword [ebp + 0x1c]
mov dword [ebp + 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a86
lea eax, [ebp + 0x1a68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401a86
lea eax, [ebp + 0x14]
push eax
push 0x20019
push ebx
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EBVersion
push 0x80000000
mov dword [ebp + 0x14], ebx
call edi
test eax, eax
jne 0x401a86
push 0x31
pop ecx
mov word [ebp + 0x20b8], bx
lea edi, [ebp + 0x20ba]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x20b8]
push eax
push ebx
push ebx
push 0x40f3ac
push dword [ebp + 0x14]
mov dword [ebp + 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a71
lea eax, [ebp + 0x20b8]
push eax
call fcn.004055a0
fcomp qword [0x40f338]
pop ecx
fnstsw ax
test ah, 5
jp 0x401a7b
mov dword [ebp + 0x219c], 1
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401a90
mov dword [ebp + 0x219c], 1
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401aa5
mov dword [ebp + 0x219c], 1
cmp dword [ebp + 0x219c], ebx
je 0x401bd4
push 0x104
lea eax, [ebp + 0x1c70]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x1c70]
push eax
lea eax, [ebp + 0xa28]
push str._s_regsvr32.exe
push eax
call esi
lea eax, [ebp + 0x1c70]
push eax
mov edi, str._sSDCtrls.dll
lea eax, [ebp + 0x1a68]
push edi
push eax
call esi
add esp, 0x18
push ebx
push ebx
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp + 0x1a68]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x401b24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x1a68]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x401b4c
lea eax, [ebp + 0x1e78]
push eax
lea eax, [ebp + 0x1c70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + 0x1c70]
push eax
lea eax, [ebp + 0x1a68]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp + 0x1c70]
push eax
push 0x68
call fcn.0040137b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
push 0x14
call edi
push str.SDCtrls.dll
lea eax, [ebp + 0x1c70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x1c70]
push eax
lea eax, [ebp + 0x20]
push str._i__s__s
push eax
call esi
push 0x3c
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00405540
lea eax, [ebp + 0xa28]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x50], eax
add esp, 0x18
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x60], 0x200
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x14
call edi
lea eax, [ebp + 0x1450]
push eax
lea eax, [ebp + 0x1658]
push eax
lea eax, [ebp + 0x420]
push str.__s___s
push eax
call esi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00405540
lea eax, [ebp + 0x1450]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], esi
lea eax, [ebp + 0x420]
xor esi, esi
mov dword [ebp - 0x14], eax
add esp, 0x1c
lea eax, [ebp - 0x28]
inc esi
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x24], 0x200
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, esi
jmp 0x401c3c
xor eax, eax
pop edi
mov ecx, dword [ebp + 0x2190]
pop esi
pop ebx
call fcn.00405525
add ebp, 0x2194
leave
ret 0x10