Function at 0x404e40
Capabilities:
Accept command line arguments
Read file via mapping

Disassembly:
sub esp, 0x48
mov eax, dword [0x42f180]
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push ecx
mov ebp, 1
mov dword [esp + 0x18], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x10], ebx
jle 0x4051a8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
nop
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + ebx*4]
mov ax, word [esi]
cmp ax, 0x2f
je 0x404e96
cmp ax, 0x2d
jne 0x404ef1
push 0x427928
add esi, 2
push esi
call edi
test eax, eax
je 0x4050f6
push 0x427924
push esi
call edi
test eax, eax
je 0x4050f6
push 0x427910
push esi
call edi
test eax, eax
je 0x405046
push 0x42790c
push esi
call edi
test eax, eax
je 0x405046
push 0x427900
push esi
call edi
test eax, eax
je 0x404eff
push 0x4278fc
push esi
call edi
test eax, eax
je 0x404eff
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x404e80
jmp 0x4051a6
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SoftwareClasses
push 0x80000001
call esi
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push ecx
push 0x80000000
call edi
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
push 0
push 0
push 0x65
push 0x4300f4
call fcn.004047b0
push 0
push 1
mov ecx, 0x4300f4
call fcn.00404a20
mov ebp, dword [esp + 0x60]
mov dword [ebp], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareClasses
push 0x80000002
call esi
mov ecx, dword [esp + 0x10]
push ecx
push 0x80000000
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
push 0
push 0
push 0x65
push 0x4300f4
call fcn.004047b0
push 0
push 1
mov ecx, 0x4300f4
call fcn.00404a20
mov dword [ebp], eax
mov ecx, 0xb
mov esi, str.Local_shmPeerAdapterE
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor eax, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x4c], eax
push ecx
push eax
push 4
xor ebp, ebp
or ebx, 0xffffffff
mov word [esp + 0x5c], ax
call esi
test eax, eax
jne 0x405013
inc ebx
cmp ebx, 0x1e
jge 0x40500b
push ebx
lea edx, [esp + 0x24]
push str.Local_shmPeerAdapterE_d
push edx
call fcn.0041ab14
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
push 4
call esi
test eax, eax
je 0x404fe1
jmp 0x405013
test eax, eax
je 0x4051a6
push 0xf
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
mov esi, eax
push 0x12
push esi
call fcn.0041aab0
add esp, 4
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4051a6
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.SoftwareClasses
push 0x80000001
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push edx
push 0x80000000
call edi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
push 0
push 0
push 0x65
push 0x4300f4
call fcn.004047b0
push 0
push 1
mov ecx, 0x4300f4
call fcn.00404a20
mov ebp, dword [esp + 0x60]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push str.SoftwareClasses
push 0x80000002
mov dword [ebp], eax
call esi
mov edx, dword [esp + 0x14]
push edx
push 0x80000000
call edi
mov eax, dword [esp + 0x14]
push eax
call ebx
push 0
push 0
push 0x65
push 0x4300f4
call fcn.004047b0
push 0
push 1
mov ecx, 0x4300f4
call fcn.00404990
jmp 0x4051a1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.SoftwareClasses
push 0x80000001
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push edx
push 0x80000000
call edi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
push 0
push 0
push 0x65
push 0x4300f4
call fcn.004047b0
push 0
push 1
mov ecx, 0x4300f4
call fcn.00404a20
mov ebp, dword [esp + 0x60]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push 0
push str.SoftwareClasses
push 0x80000002
mov dword [ebp], eax
call esi
mov edx, dword [esp + 0x14]
push edx
push 0x80000000
call edi
mov eax, dword [esp + 0x14]
push eax
call ebx
push 0
push 0
push 0x65
push 0x4300f4
call fcn.004047b0
push 0
push 1
mov ecx, 0x4300f4
call fcn.00404a20
mov dword [ebp], eax
xor ebp, ebp
pop esi
pop edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x4c]
mov eax, ebp
pop ebp
pop ebx
call fcn.00419d15
add esp, 0x48
ret