Function at 0x406da0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
test eax, eax
je 0x406df1
mov edi, eax
mov eax, dword [ebp - 0x1c]
xor esi, esi
cmp eax, 1
je 0x406fdf
mov dword [ebp - 0x14], 0
cmp eax, 2
mov dword [ebp - 0x10], edi
mov esi, 1
jl 0x406e82
mov dword [ebp - 0x14], 0
mov edi, dword [sym.imp.ucrtbase.dll_towupper]
jmp 0x406e08
xor esi, esi
jmp 0x406fe6
mov dword [ebp - 0x14], 1
nop
inc esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jge 0x406e77
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + esi*4]
movzx ebx, word [edx]
mov ecx, ebx
or ecx, 2
cmp ecx, 0x2f
jne 0x406e77
movzx ecx, word [edx + 2]
test cx, cx
je 0x406e40
movzx edx, word [edx + 4]
cmp edx, 0x3a
je 0x406e46
test edx, edx
je 0x406e46
jmp 0x406e77
cmp bx, 0x2d
je 0x406e77
movzx eax, cx
push eax
call edi
add esp, 4
movzx eax, ax
add eax, 0xffffffc1
cmp eax, 0x17
ja case.0x406e5e.64
jmp dword [eax*4 + 0x40dd30]
mov dword [ebp - 0x14], 2
jmp case.0x406e5e.67
mov byte [0x41217c], 1
jmp case.0x406e5e.67
cmp esi, eax
je 0x407015
mov edi, dword [ebp - 0x10]
cmp esi, eax
jge 0x406fda
mov eax, dword [ebp - 0x14]
jmp 0x406eaa
push 1
push 0
push ebx
call dbg.export_registry_key
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
jge 0x406fda
mov ebx, dword [edi + esi*4]
cmp eax, 2
je 0x406ed0
cmp eax, 1
jne 0x406ee0
mov eax, dword [edi + esi*4 + 4]
inc esi
test eax, eax
je 0x406e90
cmp word [eax], 0
je 0x406e90
push 1
push eax
jmp 0x406e94
push ebx
call dbg.delete_registry_key
jmp 0x406f86
push 0x40de0e
push ebx
call dword [sym.imp.kernel32.dll_lstrcmpW]
test eax, eax
je 0x406f75
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], 0
mov eax, dword [sym.imp.kernel32.dll_SearchPathW]
call eax
mov edi, eax
test eax, eax
jle 0x406f8e
mov eax, edi
add eax, edi
push eax
call dword [sym.imp.ucrtbase.dll_malloc]
add esp, 4
push 0
mov dword [ebp - 0x18], eax
push eax
push edi
push 0
push ebx
push 0
call dword [sym.imp.kernel32.dll_SearchPathW]
mov edi, eax
test edi, edi
je 0x406f99
push 0x40de12
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.ucrtbase.dll__wfopen]
add esp, 8
test eax, eax
je 0x406fac
mov ebx, eax
push eax
call dbg.import_registry_file
add esp, 4
test edi, edi
je 0x406fd2
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
push ebx
call dword [sym.imp.ucrtbase.dll_fclose]
jmp 0x406fcf
push 0
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
add esp, 4
push eax
call dbg.import_registry_file
add esp, 4
jmp 0x406e9d
mov dword [ebp - 0x18], 0
test edi, edi
jne 0x406f3d
push ebx
push 0xbbe
call dbg.output_message
add esp, 8
push dword [ebp - 0x18]
jmp 0x406fc9
push 0x40de18
call dword [sym.imp.ucrtbase.dll__wperror]
add esp, 4
push ebx
push 0xbbf
call dbg.output_message
add esp, 8
push edi
call dword [sym.imp.ucrtbase.dll_free]
add esp, 4
mov edi, dword [ebp - 0x10]
jmp 0x406e9d
mov esi, 1
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xbb9
call dbg.output_message
add esp, 4
push 0
call dword [sym.imp.ucrtbase.dll_exit]
mov eax, dword [ebp - 0x10]
push dword [eax + esi*4]
push 0xbba
call dbg.usage
cmp dword [ebp - 0x14], 1
ja 0x407025
push 0xbbc
call dbg.usage
push 0xbbd
call dbg.usage
nop