Function at 0x406600
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x10]
push ebx
sub esp, 0x28
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.shcore.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
je 0x4068f8
mov esi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp eax, 1
je 0x406902
jle 0x40678c
mov dword [ebp - 0x18], 0
mov ebx, 1
mov edi, ebx
lea esi, [esi]
mov ebx, dword [esi + edi*4]
movzx ecx, word [ebx]
mov eax, ecx
and eax, 0xfffffffd
cmp ax, 0x2d
jne 0x406720
movzx eax, word [ebx + 2]
test ax, ax
jne 0x406700
cmp cx, 0x2d
je 0x406720
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_towupper]
sub eax, 0x3f
cmp ax, 0x17
ja case.0x406695.1
movzx eax, ax
jmp dword [eax*4 + 0x412818]
mov dword [0x411200], 1
inc edi
cmp dword [ebp - 0x14], edi
jne 0x406650
cmp dword [ebp - 0x18], 2
jne 0x406971
mov dword [esp], 0xbbd
call sym._usage
lea esi, cs:[esi]
nop
mov dword [ebp - 0x18], 1
inc edi
cmp dword [ebp - 0x14], edi
jne 0x406650
jmp 0x4066b0
mov dword [ebp - 0x18], 2
inc edi
cmp dword [ebp - 0x14], edi
jne 0x406650
jmp 0x4066b0
movzx ecx, word [ebx + 4]
test cx, cx
je 0x40667c
cmp cx, 0x3a
je 0x40667c
lea esi, cs:[esi]
nop
mov ebx, edi
cmp dword [ebp - 0x14], edi
je 0x4066b0
jg 0x406767
jmp 0x40678c
mov dword [esp + 4], 0x4127fe
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x4067d8
mov dword [esp], 0
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], eax
call sym._import_registry_file
inc ebx
cmp ebx, dword [ebp - 0x10]
jge 0x40678c
mov edx, dword [ebp - 0x18]
mov edi, dword [esi + ebx*4]
lea eax, [ebx*4]
cmp edx, 1
je 0x4067a8
cmp edx, 2
jne 0x406730
mov dword [esp], edi
inc ebx
call sym._delete_registry_key
cmp ebx, dword [ebp - 0x10]
jl 0x406767
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LocalFree]
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + eax + 4]
inc ebx
test eax, eax
je 0x4067bb
cmp word [eax], 0
jne 0x4068b0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], edi
call sym._export_registry_key
jmp 0x406761
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_SearchPathW]
mov dword [ebp - 0x14], 0
sub esp, 0x18
mov edx, eax
test eax, eax
jle 0x40685b
add eax, eax
mov dword [ebp - 0x1c], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [ebp - 0x14], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_SearchPathW]
sub esp, 0x18
mov edx, eax
test edx, edx
je 0x4068d0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], 0x412802
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wfopen]
test eax, eax
je 0x406915
mov dword [esp], eax
mov edi, eax
call sym._import_registry_file
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x406761
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_fclose]
jmp 0x406761
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._export_registry_key
jmp 0x406761
mov dword [esp + 4], edi
mov dword [esp], 0xbbe
call sym._output_message
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x406761
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LocalFree]
xor eax, eax
sub esp, 4
jmp 0x40679d
mov dword [esp], 0x412808
call dword [sym.imp.ucrtbase.dll__wperror]
mov dword [esp + 4], edi
mov dword [esp], 0xbbf
call sym._output_message
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x406761
mov dword [esp + 4], ebx
mov dword [esp], 0xbba
call sym._usage
lea esi, cs:[esi]
mov dword [esp], 0xbb9
call sym._output_message
call sym._error_exit
mov dword [esp], 0xbbc
call sym._usage
nop
nop
nop