Function at 0x44c680
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x59bc84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x258], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 8
push eax
mov dword [ebp - 0x260], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
push eax
push str.Start_run__cmd___s
call fcn.0044d190
push edi
push str.lpstrCmdLine_s
call fcn.0044d190
add esp, 0x10
mov ecx, 0x5a107c
push 0
push dword [ebp + 8]
push 0
call fcn.00448a40
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
lea ecx, [ebp - 0x284]
call fcn.00413d30
push 1
call fcn.0045fdc0
push edi
call fcn.00444a80
mov ecx, eax
call fcn.0043e330
lea ecx, [ebp - 0x27c]
call fcn.00451c40
call fcn.00444a80
mov ecx, eax
call fcn.0043dfa0
push eax
lea ecx, [ebp - 0x27c]
call fcn.00451c90
call fcn.00444a80
mov ecx, eax
call fcn.0043fca0
push dword [eax]
call fcn.0045fdf0
mov ecx, 0x5a10b8
call fcn.004161b0
test eax, eax
jne 0x44c7b0
push str.CheckSingleInstance_failed__exit
call fcn.0044d190
add esp, 4
push 1
push 0
push 0
push 0
push 0x5596c4
push 0
call fcn.0045fe10
push 1
lea ecx, [ebp - 0x27c]
mov dword [0x5a1078], 1
call fcn.00451ca0
xor edi, edi
jmp 0x44d153
call fcn.00444a80
mov ecx, eax
call fcn.0043e1c0
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430e90
call fcn.00444a80
mov ecx, eax
call fcn.0043dfd0
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430e80
call fcn.00444a80
mov ecx, eax
call fcn.0043e1d0
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430ea0
call fcn.00444a80
mov ecx, eax
call fcn.0043e200
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430f10
call fcn.004346a0
mov ecx, eax
call fcn.0042ee50
push str.instnew
call fcn.004346a0
mov ecx, eax
call fcn.00430ec0
call fcn.00444a80
cmp dword [eax + 0x44], 0
je 0x44c84d
push str.lite_pack
call fcn.004346a0
mov ecx, eax
call fcn.00430ec0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e3050
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430de0
call fcn.00462840
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
neg eax
sbb eax, eax
inc eax
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430e70
call fcn.0040ca70
mov ecx, eax
test ecx, ecx
je 0x44d17e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
call esi
push eax
lea ecx, [ebp - 0x26c]
call fcn.0040dd80
push str.NtQueryInformationProcess
push str.NTDLL.DLL
mov dword [ebp - 0x25c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44c92c
lea eax, [ebp - 0x25c]
push eax
push 0x18
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x44c92c
cmp dword [ebp - 0x25c], 0x18
jne 0x44c92c
mov eax, dword [ebp - 0x210]
jmp 0x44c92f
or eax, 0xffffffff
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x44c97f
push str.Failed_to_open_process.
call fcn.0044d190
add esp, 4
mov dword [ebp - 0x244], esi
xor eax, eax
mov dword [ebp - 0x240], 7
lea ecx, [ebp - 0x254]
mov word [ebp - 0x254], ax
push eax
push 0x5539e4
call fcn.004125f0
jmp 0x44ca2f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
xor eax, eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c9c0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.004125f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x23c]
xor eax, eax
lea ecx, [ebp - 0x23c]
mov word [ebp - 0x23c], ax
movups xmmword [ebp - 0x254], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
call fcn.004106a0
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x268]
cmovae eax, dword [ebp - 0x254]
push eax
call fcn.0040dd80
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00467020
mov esi, eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00467020
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x270]
push str.ex_ary_pro__sex_ary_param__s
push eax
call fcn.0040ade0
mov edx, dword [ebp - 0x280]
or ebx, 0xffffffff
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44caaf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44cacc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x268]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44cae9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x254]
call fcn.004106a0
mov edx, dword [ebp - 0x26c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44cb11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x270]
push esi
push str.run_ex__s
call fcn.0044d190
add esp, 8
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x448510
push 0x558370
mov dword [eax + 0x24], eax
call fcn.004346a0
mov ecx, eax
call fcn.00430840
sub esp, 0x28
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x448510
push 0x558370
mov dword [eax + 0x24], eax
call fcn.004346a0
mov ecx, eax
call fcn.00430440
call fcn.00444a80
mov ecx, eax
call fcn.0043e1b0
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430e80
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.setup_pid
mov dword [eax + 0x24], 0
call fcn.004346a0
mov ecx, eax
call fcn.00430840
lea eax, [ebp - 0x260]
push eax
call fcn.00444a80
mov ecx, eax
call fcn.0043e110
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430e80
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44cbf2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.res_pid
mov dword [eax + 0x24], 0
call fcn.004346a0
mov ecx, eax
call fcn.00430840
call fcn.00444a80
mov ecx, eax
call fcn.0043dfd0
push eax
call fcn.004346a0
mov ecx, eax
call fcn.00430e80
cmp dword [0x59b42c], 0
je 0x44ccf2
push str.ntdll.dll
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x270], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x44cce2
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ccb2
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
call eax
movzx eax, word [ebp - 0x25c]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x270], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x270], 0
je 0x44cce2
cmp dword [ebp - 0x26c], 6
jne 0x44ccd6
cmp dword [ebp - 0x268], 1
jae 0x44ccd8
jmp 0x44cce2
jbe 0x44cce2
mov dword [0x5a10f4], 1
mov edi, dword [ebp - 0x258]
mov dword [0x59b42c], 0
cmp dword [0x5a10f4], 0
jne 0x44cd7a
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_os_fail
mov dword [eax + 0x24], 0
call fcn.004346a0
mov ecx, eax
call fcn.00430840
push 1
push 0
push 0x558bc4
push 0
push str.S_MRHr_g
push 0
call fcn.0045fe10
cmp eax, 1
jne 0x44cd51
push eax
push 0
push 0
push str.https:__cdn_file_ssl.ludashi.com_pc_appstore_ludashi_ludashisetup.exe
push 0x55493c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
lea ecx, [ebp - 0x27c]
call fcn.00451ca0
mov ecx, 0x5a10b8
call fcn.00416940
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x44d13e
call fcn.00448b60
test eax, eax
jne 0x44cdbc
push dword [0x5a1078]
lea ecx, [ebp - 0x27c]
call fcn.00451ca0
call fcn.00444b20
mov ecx, eax
call fcn.004423d0
mov ecx, 0x5a10b8
call fcn.00416940
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x44d13e
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_init_packinfo
mov dword [eax + 0x24], 0
call fcn.004346a0
mov ecx, eax
call fcn.00430840
call fcn.00449750
push 0
sub esp, 0x28
test eax, eax
mov eax, esp
push 0
mov dword [eax + 0x24], 0
push 0
jne 0x44ce0f
push str.install_file_fail
call fcn.004346a0
mov ecx, eax
call fcn.00430840
push 5
jmp 0x44ce3b
push str.install_version_cmp
call fcn.004346a0
mov ecx, eax
call fcn.00430840
call fcn.00446cf0
test eax, eax
jne 0x44ce7b
push 1
push eax
push eax
push eax
push str.S_MR5u
push eax
call fcn.0045fe10
push 6
lea ecx, [ebp - 0x27c]
call fcn.00451ca0
mov ecx, 0x5a10b8
call fcn.00416940
call fcn.00462840
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.00444b20
mov ecx, eax
call fcn.004423d0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x44d13e
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_check_se_sf
mov dword [eax + 0x24], 0
call fcn.004346a0
mov ecx, eax
call fcn.00430840
call fcn.00447a00
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_will_msgloop
mov dword [eax + 0x24], 0
call fcn.004346a0
mov ecx, eax
call fcn.00430840
call fcn.00444a80
cmp dword [eax + 0x98], 0
je 0x44cf00
push 4
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 1
push eax
push 4
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x44cf15
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [ebp + 0x14]
push edi
call fcn.0044b170
mov ecx, dword [0x5a1060]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x260], eax
test ecx, ecx
jne 0x44cf8c
push 0x59b3e8
call edi
cmp dword [0x5a1060], 0
jne 0x44cf7b
push 0x18
call fcn.0049e469
add esp, 4
test eax, eax
je 0x44cf69
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x14], 7
jmp 0x44cf6b
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0x258]
lock or dword [ecx], edx
mov dword [0x5a1060], eax
push 0x59b3e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x5a1060]
call fcn.0045e410
lea ecx, [ebp - 0x25c]
call fcn.0040a880
push dword [0x5a1108]
lea eax, [ebp - 0x25c]
push str.ex_ary_result_result__d
push eax
call fcn.0040ade0
add esp, 0xc
push 0
sub esp, 0x28
mov eax, esp
push 1
push dword [ebp - 0x25c]
mov dword [eax + 0x24], 0
push str.install_result
call fcn.004346a0
mov ecx, eax
call fcn.00430840
call fcn.00444b20
mov ecx, eax
call fcn.004423d0
push dword [0x5a1108]
lea ecx, [ebp - 0x27c]
call fcn.00451cb0
mov eax, dword [0x5a1068]
add eax, 0x10
push eax
mov dword [ebp - 0x258], eax
call edi
mov edi, dword [0x5a10b4]
test edi, edi
je 0x44d05d
cmp dword [edi + 4], 0
jle 0x44d02b
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [0x5a10b4]
test edi, edi
je 0x44d05d
mov eax, dword [edi]
test eax, eax
je 0x44d044
push eax
call fcn.004fff88
add esp, 4
mov dword [edi], 0
push 0xc
push edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0049dede
add esp, 8
push dword [ebp - 0x258]
mov dword [0x5a10b4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x5a10b0]
test edi, edi
je 0x44d0bb
mov eax, dword [edi]
test eax, eax
je 0x44d092
push eax
call fcn.004fff88
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x44d0a9
push eax
call fcn.004fff88
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
mov dword [edi + 8], 0
call fcn.0049dede
add esp, 8
mov edi, dword [0x5a10a8]
test edi, edi
je 0x44d0f3
cmp dword [edi], 0
je 0x44d0f3
nop word [eax + eax]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x44d0dd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [edi + 0x20]
push 0
mov dword [edi + 0x10], 0
call eax
add edi, 0x24
cmp dword [edi], 0
jne 0x44d0d0
mov edi, dword [0x59b40c]
mov ecx, dword [0x59b410]
cmp edi, ecx
jae 0x44d11d
mov eax, dword [edi]
test eax, eax
je 0x44d116
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x59b410]
add edi, 4
cmp edi, ecx
jb 0x44d103
mov ecx, 0x5a107c
call fcn.0044b8d0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x25c]
call fcn.0040a960
mov edi, dword [ebp - 0x260]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44d153
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x27c]
call fcn.00451c60
lea ecx, [ebp - 0x284]
call fcn.00413d70
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049dec8
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0040aab0
int3