Function at 0x1004c670
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x1019bc84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x258], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 8
push eax
mov dword [ebp - 0x260], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
push eax
push str.Start_run__cmd___s
call fcn.1004d170
push edi
push str.lpstrCmdLine_s
call fcn.1004d170
add esp, 0x10
mov ecx, 0x101a107c
push 0
push dword [ebp + 8]
push 0
call fcn.10048a40
lea ecx, [ebp - 0x284]
call fcn.10013d30
push 1
call fcn.1005fd90
push edi
call fcn.10044a80
mov ecx, eax
call fcn.1003e330
lea ecx, [ebp - 0x27c]
call fcn.10051c20
call fcn.10044a80
mov ecx, eax
call fcn.1003dfa0
push eax
lea ecx, [ebp - 0x27c]
call fcn.10051c70
call fcn.10044a80
mov ecx, eax
call fcn.1003fca0
push dword [eax]
call fcn.1005fdc0
mov ecx, 0x101a10b8
call fcn.100161b0
test eax, eax
jne 0x1004c79a
push str.CheckSingleInstance_failed__exit
call fcn.1004d170
add esp, 4
push 1
push 0
push 0
push 0
push 0x101596b4
push 0
call fcn.1005fde0
push 1
lea ecx, [ebp - 0x27c]
mov dword [0x101a1078], 1
call fcn.10051c80
xor edi, edi
jmp 0x1004d134
call fcn.10044a80
mov ecx, eax
call fcn.1003e1c0
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030e90
call fcn.10044a80
mov ecx, eax
call fcn.1003dfd0
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030e80
call fcn.10044a80
mov ecx, eax
call fcn.1003e1d0
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030ea0
call fcn.10044a80
mov ecx, eax
call fcn.1003e200
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030f10
call fcn.100346a0
mov ecx, eax
call fcn.1002ee50
push str.instnew
call fcn.100346a0
mov ecx, eax
call fcn.10030ec0
call fcn.10044a80
cmp dword [eax + 0x44], 0
je 0x1004c837
push str.lite_pack
call fcn.100346a0
mov ecx, eax
call fcn.10030ec0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100e3030
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030de0
call fcn.10062810
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
neg eax
sbb eax, eax
inc eax
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030e70
call fcn.1000ca70
mov ecx, eax
test ecx, ecx
je 0x1004d15f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
call esi
push eax
lea ecx, [ebp - 0x26c]
call fcn.1000dd80
push str.NtQueryInformationProcess
push str.NTDLL.DLL
mov dword [ebp - 0x25c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1004c916
lea eax, [ebp - 0x25c]
push eax
push 0x18
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x1004c916
cmp dword [ebp - 0x25c], 0x18
jne 0x1004c916
mov eax, dword [ebp - 0x210]
jmp 0x1004c919
or eax, 0xffffffff
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x1004c969
push str.Failed_to_open_process.
call fcn.1004d170
add esp, 4
mov dword [ebp - 0x244], esi
xor eax, eax
mov dword [ebp - 0x240], 7
lea ecx, [ebp - 0x254]
mov word [ebp - 0x254], ax
push eax
push 0x101539d4
call fcn.100125f0
jmp 0x1004ca12
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
xor eax, eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004c9a3
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.100125f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x23c]
xor eax, eax
lea ecx, [ebp - 0x23c]
mov word [ebp - 0x23c], ax
movups xmmword [ebp - 0x254], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
call fcn.100106a0
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x268]
cmovae eax, dword [ebp - 0x254]
push eax
call fcn.1000dd80
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.10066ff0
mov esi, eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.10066ff0
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x270]
push str.ex_ary_pro__sex_ary_param__s
push eax
call fcn.1000ade0
mov edx, dword [ebp - 0x280]
or ebx, 0xffffffff
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004ca92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004caaf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x268]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004cacc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x254]
call fcn.100106a0
mov edx, dword [ebp - 0x26c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004caf4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x270]
push esi
push str.run_ex__s
call fcn.1004d170
add esp, 8
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x10048510
push 0x10158360
mov dword [eax + 0x24], eax
call fcn.100346a0
mov ecx, eax
call fcn.10030840
sub esp, 0x28
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x10048510
push 0x10158360
mov dword [eax + 0x24], eax
call fcn.100346a0
mov ecx, eax
call fcn.10030440
call fcn.10044a80
mov ecx, eax
call fcn.1003e1b0
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030e80
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.setup_pid
mov dword [eax + 0x24], 0
call fcn.100346a0
mov ecx, eax
call fcn.10030840
lea eax, [ebp - 0x260]
push eax
call fcn.10044a80
mov ecx, eax
call fcn.1003e110
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030e80
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004cbd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.res_pid
mov dword [eax + 0x24], 0
call fcn.100346a0
mov ecx, eax
call fcn.10030840
call fcn.10044a80
mov ecx, eax
call fcn.1003dfd0
push eax
call fcn.100346a0
mov ecx, eax
call fcn.10030e80
cmp dword [0x1019b42c], 0
je 0x1004ccd5
push str.ntdll.dll
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x270], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1004ccc5
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004cc95
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
call eax
movzx eax, word [ebp - 0x25c]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x270], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x270], 0
je 0x1004ccc5
cmp dword [ebp - 0x26c], 6
jne 0x1004ccb9
cmp dword [ebp - 0x268], 1
jae 0x1004ccbb
jmp 0x1004ccc5
jbe 0x1004ccc5
mov dword [0x101a10f4], 1
mov edi, dword [ebp - 0x258]
mov dword [0x1019b42c], 0
cmp dword [0x101a10f4], 0
jne 0x1004cd61
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_os_fail
mov dword [eax + 0x24], 0
call fcn.100346a0
mov ecx, eax
call fcn.10030840
push 1
push 0
push 0x10158bb4
push 0
push str.S_MRHr_g
push 0
call fcn.1005fde0
cmp eax, 1
jne 0x1004cd38
push eax
push 0
push 0
push str.https:__cdn_file_ssl.ludashi.com_pc_appstore_ludashi_ludashisetup.exe
push 0x1015492c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
lea ecx, [ebp - 0x27c]
call fcn.10051c80
mov ecx, 0x101a10b8
call fcn.10016940
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x1004d11f
call fcn.10048b60
test eax, eax
jne 0x1004cda3
push dword [0x101a1078]
lea ecx, [ebp - 0x27c]
call fcn.10051c80
call fcn.10044b20
mov ecx, eax
call fcn.100423d0
mov ecx, 0x101a10b8
call fcn.10016940
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x1004d11f
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_init_packinfo
mov dword [eax + 0x24], 0
call fcn.100346a0
mov ecx, eax
call fcn.10030840
call fcn.10049750
push 0
sub esp, 0x28
test eax, eax
mov eax, esp
push 0
mov dword [eax + 0x24], 0
push 0
jne 0x1004cdf6
push str.install_file_fail
call fcn.100346a0
mov ecx, eax
call fcn.10030840
push 5
jmp 0x1004ce22
push str.install_version_cmp
call fcn.100346a0
mov ecx, eax
call fcn.10030840
call fcn.10046cf0
test eax, eax
jne 0x1004ce62
push 1
push eax
push eax
push eax
push str.S_MR5u
push eax
call fcn.1005fde0
push 6
lea ecx, [ebp - 0x27c]
call fcn.10051c80
mov ecx, 0x101a10b8
call fcn.10016940
call fcn.10062810
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.10044b20
mov ecx, eax
call fcn.100423d0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x1004d11f
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_check_se_sf
mov dword [eax + 0x24], 0
call fcn.100346a0
mov ecx, eax
call fcn.10030840
call fcn.10047a00
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_will_msgloop
mov dword [eax + 0x24], 0
call fcn.100346a0
mov ecx, eax
call fcn.10030840
call fcn.10044a80
cmp dword [eax + 0x98], 0
je 0x1004cee7
push 4
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 1
push eax
push 4
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1004cefc
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [ebp + 0x14]
push edi
call fcn.1004b170
mov ecx, dword [0x101a1060]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x260], eax
test ecx, ecx
jne 0x1004cf73
push 0x1019b3e8
call edi
cmp dword [0x101a1060], 0
jne 0x1004cf62
push 0x18
call fcn.1009e3f9
add esp, 4
test eax, eax
je 0x1004cf50
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x14], 7
jmp 0x1004cf52
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0x258]
lock or dword [ecx], edx
mov dword [0x101a1060], eax
push 0x1019b3e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x101a1060]
call fcn.1005e3e0
lea ecx, [ebp - 0x25c]
call fcn.1000a880
push dword [0x101a1108]
lea eax, [ebp - 0x25c]
push str.ex_ary_result_result__d
push eax
call fcn.1000ade0
add esp, 0xc
push 0
sub esp, 0x28
mov eax, esp
push 1
push dword [ebp - 0x25c]
mov dword [eax + 0x24], 0
push str.install_result
call fcn.100346a0
mov ecx, eax
call fcn.10030840
call fcn.10044b20
mov ecx, eax
call fcn.100423d0
push dword [0x101a1108]
lea ecx, [ebp - 0x27c]
call fcn.10051c90
mov eax, dword [0x101a1068]
add eax, 0x10
push eax
mov dword [ebp - 0x258], eax
call edi
mov edi, dword [0x101a10b4]
test edi, edi
je 0x1004d044
cmp dword [edi + 4], 0
jle 0x1004d012
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [0x101a10b4]
test edi, edi
je 0x1004d044
mov eax, dword [edi]
test eax, eax
je 0x1004d02b
push eax
call fcn.100fff68
add esp, 4
mov dword [edi], 0
push 0xc
push edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1009de6e
add esp, 8
push dword [ebp - 0x258]
mov dword [0x101a10b4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x101a10b0]
test edi, edi
je 0x1004d0a2
mov eax, dword [edi]
test eax, eax
je 0x1004d079
push eax
call fcn.100fff68
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1004d090
push eax
call fcn.100fff68
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
mov dword [edi + 8], 0
call fcn.1009de6e
add esp, 8
mov edi, dword [0x101a10a8]
test edi, edi
je 0x1004d0d4
cmp dword [edi], 0
je 0x1004d0d4
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1004d0be
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [edi + 0x20]
push 0
mov dword [edi + 0x10], 0
call eax
add edi, 0x24
cmp dword [edi], 0
jne 0x1004d0b1
mov edi, dword [0x1019b40c]
mov ecx, dword [0x1019b410]
cmp edi, ecx
jae 0x1004d0fe
mov eax, dword [edi]
test eax, eax
je 0x1004d0f7
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x1019b410]
add edi, 4
cmp edi, ecx
jb 0x1004d0e4
mov ecx, 0x101a107c
call fcn.1004b8d0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x25c]
call fcn.1000a960
mov edi, dword [ebp - 0x260]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1004d134
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x27c]
call fcn.10051c40
lea ecx, [ebp - 0x284]
call fcn.10013d70
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009de58
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.1000aab0
int3