Function at 0x40e760
Capabilities:
Accept command line arguments
Check mutex on windows
Copy file
Get common file path
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb5c
mov eax, dword [0x43fb20]
xor eax, esp
mov dword [esp + 0xb58], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0xc
mov dword [esp + 0x40], 1
call fcn.00409715
test eax, eax
jne 0x40e7c0
xor ebx, ebx
push ebx
push ebx
push str.create_dacl_error
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x40f38d
mov ecx, esi
call fcn.0040e126
call fcn.0040e587
xor ebx, ebx
cmp eax, ebx
mov dword [0x443ea0], eax
push 0x7f
je 0x40e7e9
lea eax, [esp + 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x40e7f4
push 0x443ca0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
lea eax, [esp + 0x264]
jmp 0x40e802
lea ecx, [eax + 2]
push ecx
push eax
call fcn.0041a076
lea eax, [esp + 0x268]
push 0x22
push eax
call fcn.00418d3e
add esp, 0x10
cmp eax, ebx
jne 0x40e7fe
lea eax, [esp + 0x260]
push 0x438050
push eax
call fcn.00419920
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x40e852
lea eax, [esp + 0x260]
push 0x438058
push eax
call fcn.00419920
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x40e860
lea eax, [edi + 4]
push eax
push edi
call fcn.0041a076
pop ecx
pop ecx
cmp edi, ebx
setne al
mov byte [0x443c98], al
lea eax, [esp + 0x260]
push 0x438060
push eax
call fcn.00419920
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x40e89c
lea eax, [esp + 0x260]
push 0x438068
push eax
call fcn.00419920
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x40e8aa
lea eax, [edi + 4]
push eax
push edi
call fcn.0041a076
pop ecx
pop ecx
cmp edi, ebx
push 0x80
mov edi, 0x443b98
push edi
push ebx
setne byte [esp + 0x27]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push edi
call fcn.004198f0
pop ecx
pop ecx
mov word [eax], bx
call fcn.0040e0b3
cmp al, bl
mov byte [esp + 0x1a], al
jne 0x40e8e8
push edi
push 0x443da0
call fcn.0041a076
pop ecx
pop ecx
cmp byte [0x443c98], bl
mov byte [esp + 0x23], bl
jne 0x40e922
cmp byte [esp + 0x1a], bl
je 0x40e922
cmp byte [esp + 0x1b], bl
jne 0x40e922
push 1
push 0x40e67a
push ebx
push 0x74
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
sub eax, 6
je 0x40e922
dec eax
jne 0x40e7b9
mov byte [esp + 0x23], 1
push str.mutex_freeime_unicode
push ebx
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x30], bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call esi
cmp eax, 0xb7
jne 0x40e94f
mov byte [esp + 0x24], 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x24], bl
jne 0x40e9a0
push str.B8CF830B_A53C_4acc_BB73_A20036FBC5EF
push ebx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x14], eax
call esi
cmp eax, 0xb7
jne 0x40e98c
mov byte [esp + 0x24], 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x23], bl
jne 0x40f2f6
lea eax, [esp + 0x260]
push 0x4380f0
push eax
call fcn.00419920
test eax, eax
pop ecx
pop ecx
jne 0x40f2f6
lea eax, [esp + 0x260]
push 0x4380f8
push eax
call fcn.00419920
test eax, eax
pop ecx
pop ecx
jne 0x40f2f6
lea eax, [esp + 0x260]
push edi
push eax
call fcn.0041a076
cmp dword [0x443ea0], ebx
pop ecx
pop ecx
je 0x40ea0e
lea eax, [esp + 0x260]
push str._freeime64.ime
push eax
call fcn.0041a04c
pop ecx
pop ecx
push edi
mov esi, str._s_freeime.ime
lea eax, [esp + 0x464]
push esi
push eax
call fcn.0041a16c
add esp, 0xc
cmp dword [0x443ea0], ebx
je 0x40ea61
lea eax, [esp + 0x260]
push ebx
push eax
call fcn.0041a415
test eax, eax
pop ecx
pop ecx
je 0x40ea61
cmp byte [0x443c98], bl
jne 0x40e7b9
push 0x10
lea eax, [esp + 0x264]
push eax
push 0x4381c8
jmp 0x40e7b2
lea eax, [esp + 0x460]
push ebx
push eax
call fcn.0041a415
test eax, eax
pop ecx
pop ecx
je 0x40ea95
cmp byte [0x443c98], bl
jne 0x40e7b9
push 0x10
lea eax, [esp + 0x464]
push eax
push str.S_MR
jmp 0x40e7b2
cmp dword [0x443ea0], ebx
je 0x40eab7
lea eax, [esp + 0x660]
push eax
lea eax, [esp + 0x64]
push str._s_system32_freeime.ime
push eax
call fcn.0041a16c
add esp, 0xc
push 0x443ca0
lea eax, [esp + 0x364]
push esi
push eax
call fcn.0041a16c
add esp, 0xc
cmp byte [esp + 0x1b], bl
jne 0x40ebfe
cmp byte [0x443c98], bl
jne 0x40ebfe
cmp byte [esp + 0x24], bl
je 0x40ebfe
mov dword [esp + 0x14], ebx
jmp 0x40ebd7
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40ebfe
mov byte [eax], bl
call fcn.0040e675
mov eax, dword [esp + 0x10]
cmp byte [eax], bl
je 0x40ebfe
lea eax, [esp + 0x760]
push 0x438278
push eax
call fcn.0041a076
mov eax, dword [esp + 0x18]
pop ecx
xor esi, esi
cmp byte [eax], bl
pop ecx
jbe 0x40eb9f
mov dword [esp + 0x28], ebx
inc esi
push esi
lea eax, [esp + 0x48]
push 0x4382e8
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x764]
push eax
call fcn.0041a04c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax + 2]
push eax
lea eax, [esp + 0x76c]
push eax
call fcn.0041a04c
lea eax, [esp + 0x770]
push 0x4341c8
push eax
call fcn.0041a04c
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
add dword [esp + 0x40], 0x208
add esp, 0x18
cmp esi, eax
jl 0x40eb37
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x22
push 0x437ffc
lea eax, [esp + 0x768]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x40e7b9
dec eax
dec eax
je 0x40ebfe
lea eax, [esp + 0x10]
push eax
lea esi, [esp + 0x18]
call fcn.0040979a
test eax, eax
pop ecx
jne 0x40eaf6
push ebx
push 0x438258
push 0x438260
jmp 0x40e7b2
call fcn.0040e1c4
cmp byte [esp + 0x24], bl
je 0x40ec2c
cmp dword [0x443ea0], ebx
je 0x40ec1d
push 1
lea esi, [esp + 0x64]
call fcn.0040de7e
pop ecx
push 1
lea esi, [esp + 0x364]
call fcn.0040de7e
pop ecx
cmp dword [0x443ea0], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
je 0x40ec8c
lea eax, [esp + 0x14]
push eax
call fcn.00409864
pop ecx
push ebx
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x268]
push eax
call esi
test eax, eax
jne 0x40ec82
cmp byte [0x443c98], bl
jne 0x40ec82
push dword [esp + 0x14]
call fcn.0040989d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x4382f8
push eax
call fcn.0040e4f7
pop ecx
jmp 0x40e7b9
push dword [esp + 0x14]
call fcn.0040989d
pop ecx
push ebx
lea eax, [esp + 0x364]
push eax
lea eax, [esp + 0x468]
push eax
call esi
test eax, eax
jne 0x40ecb8
cmp byte [0x443c98], bl
jne 0x40ecb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x438320
jmp 0x40ec76
call fcn.0040d8a1
test al, al
jne 0x40ecd2
push 0x10
push 0x437ffc
push 0x438348
jmp 0x40e7b2
call fcn.004099cb
push edi
call fcn.004098d0
pop ecx
push edi
lea eax, [esp + 0x64]
push str._s_symbol.txt
push eax
call fcn.0041a16c
lea eax, [esp + 0x6c]
add esp, 0xc
push eax
call fcn.004098d0
pop ecx
push edi
lea eax, [esp + 0x64]
push str._smbdefault
push eax
call fcn.0041a16c
lea eax, [esp + 0x6c]
add esp, 0xc
push eax
call fcn.004098d0
pop ecx
push edi
lea eax, [esp + 0x64]
push str._smbdefault_freeime.mb
push eax
call fcn.0041a16c
lea eax, [esp + 0x6c]
add esp, 0xc
push eax
call fcn.004098d0
pop ecx
push edi
lea eax, [esp + 0x64]
push str._sconf
push eax
call fcn.0041a16c
lea eax, [esp + 0x6c]
add esp, 0xc
push eax
call fcn.004098d0
pop ecx
push edi
lea eax, [esp + 0x64]
push str._s_skin
push eax
call fcn.0041a16c
lea eax, [esp + 0x6c]
add esp, 0xc
push eax
call fcn.004098d0
pop ecx
push edi
lea eax, [esp + 0x64]
push str._splugin
push eax
call fcn.0041a16c
lea eax, [esp + 0x6c]
add esp, 0xc
push eax
call fcn.004098d0
pop ecx
lea eax, [esp + 0x560]
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
lea eax, [esp + 0x164]
push str._smb
push eax
call fcn.0041a16c
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call esi
lea eax, [esp + 0x160]
push eax
call fcn.004098d0
pop ecx
lea ecx, [esp + 0x44]
call fcn.00410c43
push ebx
push 0x438424
lea ecx, [esp + 0x4c]
call fcn.00410cd1
test eax, eax
je 0x40eee4
lea ecx, [esp + 0x44]
call fcn.0041093d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 0x10
lea ecx, [esp + 0x48]
call dword [eax + 0x38]
test eax, eax
je 0x40eeda
lea ecx, [esp + 0x44]
call fcn.00410c06
test eax, eax
jne 0x40eeda
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._smb_s_freeime.mb
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x24]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._smb_s_attach.mb
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x38]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._smb_squick.txt
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
cmp dword [esp + 0x10], ebx
jne 0x40edf9
push edi
lea eax, [esp + 0x164]
push str._s_skin
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call esi
lea eax, [esp + 0x160]
push eax
call fcn.004098d0
pop ecx
push ebx
push 0x438424
lea ecx, [esp + 0x4c]
call fcn.00410cd1
test eax, eax
je 0x40ef90
lea ecx, [esp + 0x44]
call fcn.0041093d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 0x10
lea ecx, [esp + 0x48]
call dword [eax + 0x38]
test eax, eax
je 0x40ef8a
lea ecx, [esp + 0x44]
call fcn.00410c06
test eax, eax
jne 0x40ef8a
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._s_skin_s_skin.ini
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
cmp dword [esp + 0x10], ebx
jne 0x40ef25
push edi
lea eax, [esp + 0x164]
push str._splugin
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call esi
lea eax, [esp + 0x160]
push eax
call fcn.004098d0
pop ecx
push ebx
push 0x438424
lea ecx, [esp + 0x4c]
call fcn.00410cd1
test eax, eax
je 0x40f02f
lea ecx, [esp + 0x44]
call fcn.0041093d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 0x20
lea ecx, [esp + 0x48]
call dword [eax + 0x38]
test eax, eax
je 0x40f029
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._splugin_s
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
cmp dword [esp + 0x10], ebx
jne 0x40efd1
push edi
lea eax, [esp + 0x164]
push str._splugindata
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call esi
lea eax, [esp + 0x160]
push eax
call fcn.004098d0
pop ecx
push ebx
push 0x438424
lea ecx, [esp + 0x4c]
call fcn.00410cd1
test eax, eax
je 0x40f0ce
lea ecx, [esp + 0x44]
call fcn.0041093d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 0x20
lea ecx, [esp + 0x48]
call dword [eax + 0x38]
test eax, eax
je 0x40f0c8
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._splugindata_s
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
cmp dword [esp + 0x10], ebx
jne 0x40f070
push edi
lea eax, [esp + 0x164]
push str._sconf
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [esp + 0x160]
push eax
call esi
lea eax, [esp + 0x160]
push eax
call fcn.004098d0
pop ecx
push ebx
push 0x438424
lea ecx, [esp + 0x4c]
call fcn.00410cd1
test eax, eax
je 0x40f16d
lea ecx, [esp + 0x44]
call fcn.0041093d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
push 0x20
lea ecx, [esp + 0x48]
call dword [eax + 0x38]
test eax, eax
je 0x40f167
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
call fcn.00410f61
push dword [eax]
lea eax, [esp + 0x64]
push edi
push str._sconf_s
push eax
call fcn.0041a16c
mov ecx, dword [esp + 0x2c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [esp + 0x60]
push eax
call fcn.004098d0
pop ecx
cmp dword [esp + 0x10], ebx
jne 0x40f10f
lea eax, [esp + 0x560]
push eax
call esi
lea ecx, [esp + 0x44]
call fcn.00410c69
call fcn.00409933
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x564]
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_x
push eax
call fcn.0041a16c
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x564]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp byte [esp + 0x1a], bl
mov esi, str.system
je 0x40f24c
push 0x50
call fcn.0040f40a
pop ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x3c]
push eax
push ebx
push esi
push dword [esp + 0x3c]
mov dword [esp + 0x4c], 1
mov dword [esp + 0x34], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40f207
mov dword [esp + 0x10], 0x443da0
jmp 0x40f20f
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push edi
push dword [esp + 0x14]
call fcn.00418f4c
test eax, eax
pop ecx
pop ecx
je 0x40f242
push dword [esp + 0x10]
call fcn.0041970d
pop ecx
add eax, eax
push eax
push dword [esp + 0x14]
push 1
push ebx
push str.system_bak
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
call fcn.0040f40f
pop ecx
push edi
call fcn.0041970d
pop ecx
add eax, eax
push eax
push edi
push 1
push ebx
push esi
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push dword [esp + 0x34]
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
call fcn.0040dc1b
cmp byte [0x443c98], bl
jne 0x40f2de
cmp byte [esp + 0x1a], bl
jne 0x40f2b6
cmp byte [esp + 0x24], bl
jne 0x40f2bc
cmp eax, ebx
push 0x40
push 0x437ffc
je 0x40f2ac
push 0x438544
jmp 0x40e7b2
push 0x438568
jmp 0x40e7b2
cmp byte [esp + 0x24], bl
je 0x40f2cd
push 0x40
push 0x437ffc
push 0x438594
jmp 0x40e7b2
push 0x40
push 0x437ffc
push 0x4385c4
jmp 0x40e7b2
push ebx
push 0x40e67a
push ebx
push 0x74
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x40e7b9
call fcn.0040e1c4
call fcn.0040e1d2
push 0x443ca0
lea eax, [esp + 0x364]
push str._s_freeime.ime
push eax
call fcn.0041a16c
add esp, 0xc
push dword [esp + 0x24]
lea esi, [esp + 0x364]
call fcn.0040de7e
cmp dword [0x443ea0], ebx
pop ecx
je 0x40f35b
lea eax, [esp + 0x660]
push eax
lea eax, [esp + 0x64]
push str._s_system32_freeime.ime
push eax
call fcn.0041a16c
add esp, 0xc
push dword [esp + 0x24]
lea esi, [esp + 0x64]
call fcn.0040de7e
pop ecx
cmp byte [0x443c98], bl
jne 0x40f38a
cmp byte [esp + 0x24], bl
je 0x40f377
push 0x10
push 0x437ffc
push 0x438150
jmp 0x40f383
push 0x40
push 0x437ffc
push 0x438184
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 2
pop eax
mov ecx, dword [esp + 0xb64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00418c19
mov esp, ebp
pop ebp
ret 0x10