Function at 0x402ea0
Capabilities:
Accept command line arguments
Delete registry value

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [esp + 0x130]
push 0x410288
push edi
push 0x4123c8
mov ecx, 0x415428
mov esi, eax
call fcn.004039e0
push 0x100
push 0x4154ac
mov ebp, 1
push 0x64
push edi
mov dword [0x4155d0], ebp
call dword [sym.imp.USER32.dll_LoadStringA]
mov ax, word [0x412510]
mov cl, byte [0x412512]
lea edx, [esp + 0x1c]
xor edi, edi
push edx
push esi
mov dword [0x4155ac], edi
mov dword [0x4155b0], 0x10
mov dword [0x4155b4], ebp
mov dword [0x4155b8], ebp
mov dword [0x4155bc], edi
mov dword [0x4155c0], edi
mov dword [0x4155c4], edi
mov dword [0x4155c8], edi
mov dword [0x4155d4], ebp
mov dword [0x4155d8], 0xffffffff
mov dword [0x4155dc], edi
mov dword [0x4155d0], ebp
mov word [esp + 0x24], ax
mov byte [esp + 0x26], cl
call fcn.00402910
mov esi, eax
add esp, 8
cmp esi, edi
je 0x402fb1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnregServer
push esi
call ebx
test eax, eax
je 0x403070
push str.RegServer
push esi
call ebx
test eax, eax
je 0x4030b5
push str.Service
push esi
call ebx
test eax, eax
je 0x403161
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00402910
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x402f6d
lea edx, [esp + 0x10]
mov dword [esp + 0x18], edi
push edx
push 0x20019
push edi
push str.AppID
push closesocket
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x403058
lea ecx, [esp + 0x18]
call fcn.00405120
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, edi
mov dword [esp + 0x18], eax
jne 0x403058
push 0x20019
push str.5F521369_DE2C_4F20_AC01_7CF62A5C5D61
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], edi
call fcn.004052e0
mov esi, eax
cmp esi, edi
jne 0x40304f
lea eax, [esp + 0x24]
lea ecx, [esp + 0x28]
push eax
push str.LocalService
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0x104
call fcn.00405330
cmp eax, edi
mov dword [0x4155d0], edi
jne 0x40303f
mov dword [0x4155d0], ebp
mov ecx, 0x415428
call fcn.00403420
mov esi, dword [0x4155bc]
lea ecx, [esp + 0x20]
call fcn.00405120
lea ecx, [esp + 0x18]
call fcn.00405120
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 0x10
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, edi
jl 0x403063
push edi
push edi
push edi
push 0x64
push 0x415428
call fcn.004066e0
mov ecx, 0x415428
call fcn.00403340
push edi
push ebp
push 0x415428
call fcn.00406350
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret 0x10
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, edi
jl 0x403063
mov ecx, 0x415428
call fcn.00403340
push edi
push ebp
push 0x64
push 0x415428
call fcn.00403ab0
push 0x20006
push str.AppID
push closesocket
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
call fcn.004052e0
mov esi, eax
cmp esi, edi
jne 0x403149
mov ecx, dword [esp + 0x14]
push 0x20006
push str.5F521369_DE2C_4F20_AC01_7CF62A5C5D61
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004052e0
mov esi, eax
cmp esi, edi
jne 0x403140
mov edx, dword [esp + 0x10]
push str.LocalService
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push ebp
push 0x415428
call fcn.00406170
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x10]
call fcn.00405120
lea ecx, [esp + 0x14]
call fcn.00405120
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 0x10
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, edi
jl 0x403063
mov ecx, 0x415428
call fcn.00403340
push edi
push ebp
push 0x64
push 0x415428
call fcn.00403ab0
push 0x20006
push str.AppID
push closesocket
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004052e0
mov esi, eax
cmp esi, edi
jne 0x403229
mov eax, dword [esp + 0x10]
push 0x20006
push str.5F521369_DE2C_4F20_AC01_7CF62A5C5D61
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
call fcn.004052e0
mov esi, eax
cmp esi, edi
jne 0x403220
mov ecx, dword [esp + 0x14]
push str.LocalService
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.LocalService
push str.ImtsEventSvr
lea ecx, [esp + 0x1c]
call fcn.00405360
push str.ServiceParameters
push str._Service
lea ecx, [esp + 0x1c]
call fcn.00405360
mov ecx, 0x415428
call fcn.00403250
push edi
push ebp
push 0x415428
call fcn.00406170
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x14]
call fcn.00405120
lea ecx, [esp + 0x10]
call fcn.00405120
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 0x10