Function at 0x44c2d0
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x5dccb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0
mov dword [ebp - 0x25c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 8
push eax
mov dword [ebp - 0x260], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
push eax
push str.Start_run__cmd___s
call fcn.0044ceb0
push ebx
push str.lpstrCmdLine_s
call fcn.0044ceb0
add esp, 0x10
mov ecx, 0x5e3b58
push 0
push dword [ebp + 8]
push 0
call fcn.00448470
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
lea ecx, [ebp - 0x284]
call fcn.004141b0
push 1
call fcn.00470400
push ebx
call fcn.004443b0
mov ecx, eax
call fcn.0043d910
lea ecx, [ebp - 0x27c]
call fcn.00451bc0
call fcn.004443b0
mov ecx, eax
call fcn.0043d580
push eax
lea ecx, [ebp - 0x27c]
call fcn.00451c10
call fcn.004443b0
mov ecx, eax
call fcn.0043f280
push dword [eax]
call fcn.00470430
mov ecx, 0x5e3b94
call fcn.00415100
test eax, eax
jne 0x44c400
push str.CheckSingleInstance_failed__exit
call fcn.0044ceb0
add esp, 4
push 1
push 0
push 0
push 0
push 0x59096c
push 0
call fcn.00470450
push 1
lea ecx, [ebp - 0x27c]
mov dword [0x5e3b54], 1
call fcn.00451c20
xor esi, esi
jmp 0x44ce73
call fcn.004443b0
mov ecx, eax
call fcn.0043d7a0
push eax
call fcn.00434730
mov ecx, eax
call fcn.00430830
call fcn.004443b0
mov ecx, eax
call fcn.0043d5b0
push eax
call fcn.00434730
mov ecx, eax
call fcn.004307d0
call fcn.004443b0
mov ecx, eax
call fcn.0043d7b0
push eax
call fcn.00434730
mov ecx, eax
call fcn.00430960
call fcn.004443b0
mov ecx, eax
call fcn.0043d7e0
push eax
call fcn.00434730
mov ecx, eax
call fcn.004309d0
call fcn.00434730
mov ecx, eax
call fcn.0042e6b0
push str.instnew
call fcn.00434730
mov ecx, eax
call fcn.00430980
call fcn.004443b0
cmp dword [eax + 0x44], 0
je 0x44c49d
push str.lite_pack
call fcn.00434730
mov ecx, eax
call fcn.00430980
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00516300
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00434730
mov ecx, eax
call fcn.00430730
call fcn.00472ff0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
neg eax
sbb eax, eax
inc eax
push eax
call fcn.00434730
mov ecx, eax
call fcn.004307c0
call fcn.0042e350
mov ecx, eax
test ecx, ecx
je 0x44ce9e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x268], eax
call esi
push eax
lea ecx, [ebp - 0x270]
call fcn.0040e210
push str.NtQueryInformationProcess
push str.NTDLL.DLL
mov dword [ebp - 0x258], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44c57c
lea eax, [ebp - 0x258]
push eax
push 0x18
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x44c57c
cmp dword [ebp - 0x258], 0x18
jne 0x44c57c
mov eax, dword [ebp - 0x210]
jmp 0x44c57f
or eax, 0xffffffff
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x44c5cf
push str.Failed_to_open_process.
call fcn.0044ceb0
add esp, 4
mov dword [ebp - 0x244], esi
xor eax, eax
mov dword [ebp - 0x240], 7
lea ecx, [ebp - 0x254]
mov word [ebp - 0x254], ax
push eax
push 0x58ac10
call fcn.00412a70
jmp 0x44c67f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
xor eax, eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44c610
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.00412a70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x23c]
xor eax, eax
lea ecx, [ebp - 0x23c]
mov word [ebp - 0x23c], ax
movups xmmword [ebp - 0x254], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
call fcn.00410b20
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x26c]
cmovae eax, dword [ebp - 0x254]
push eax
call fcn.0040e210
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00477be0
mov esi, eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00477be0
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x268]
push str.ex_ary_pro__sex_ary_param__s
push eax
call fcn.0040b270
mov edx, dword [ebp - 0x280]
or ebx, 0xffffffff
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c6ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c71c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x26c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c739
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x254]
call fcn.00410b20
mov edx, dword [ebp - 0x270]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c761
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x268]
push edi
push str.run_ex__s
call fcn.0044ceb0
add esp, 8
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x447f40
push 0x58f53c
mov dword [eax + 0x24], eax
call fcn.00434730
mov ecx, eax
call fcn.00430190
sub esp, 0x28
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x447f40
push 0x58f53c
mov dword [eax + 0x24], eax
call fcn.00434730
mov ecx, eax
call fcn.0042fd90
call fcn.004443b0
mov ecx, eax
call fcn.0043d790
push eax
call fcn.00434730
mov ecx, eax
call fcn.004307d0
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.setup_pid
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
lea eax, [ebp - 0x260]
push eax
call fcn.004443b0
mov ecx, eax
call fcn.0043d6f0
push eax
call fcn.00434730
mov ecx, eax
call fcn.004307d0
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44c842
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.res_pid
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
call fcn.004443b0
mov ecx, eax
call fcn.0043d5b0
push eax
call fcn.00434730
mov ecx, eax
call fcn.004307d0
cmp dword [0x5dc42c], 0
je 0x44c93c
push str.ntdll.dll
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x268], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x44c932
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44c902
lea ecx, [ebp - 0x258]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
lea ecx, [ebp - 0x270]
push ecx
call eax
movzx eax, word [ebp - 0x258]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x268], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x268], 0
je 0x44c932
cmp dword [ebp - 0x270], 6
jne 0x44c926
cmp dword [ebp - 0x26c], 1
jae 0x44c928
jmp 0x44c932
jbe 0x44c932
mov dword [0x5e3be4], 1
mov dword [0x5dc42c], 0
cmp dword [0x5e3be4], 0
jne 0x44c9c4
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_os_fail
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
push 1
push 0
push 0x58fdec
push 0
push str.S_MRHr_g
push 0
call fcn.00470450
cmp eax, 1
jne 0x44c99b
push eax
push 0
push 0
push str.https:__cdn_file_ssl.ludashi.com_pc_appstore_ludashi_ludashisetup.exe
push 0x58b8fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
lea ecx, [ebp - 0x27c]
call fcn.00451c20
mov ecx, 0x5e3b94
call fcn.00415890
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x44ce5e
call fcn.004486c0
test eax, eax
jne 0x44ca06
push dword [0x5e3b54]
lea ecx, [ebp - 0x27c]
call fcn.00451c20
call fcn.00444440
mov ecx, eax
call fcn.00441cf0
mov ecx, 0x5e3b94
call fcn.00415890
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x44ce5e
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_init_packinfo
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
call fcn.00472ff0
push 0x59062c
push str.SETUPCONFIG
push 0xd5
push dword [0x5e3d94]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x44cb2d
push str.InitConfig_failed__exit
call fcn.0044ceb0
add esp, 4
push 1
push 0
push 0
push 4
push 0x58fd28
push 0
call fcn.00470450
cmp eax, 6
jne 0x44ca8f
push 1
push 0
push 0
push str.https:__cdn_file_ssl_pc.ludashi.com_pc_appstore_ludashi_ludashisetup2020.exe
push 0x58b8fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.0042e350
mov ecx, eax
test ecx, ecx
je 0x44ce9e
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0
add eax, 0x10
push str.055EE061_E6A1_4a97_BCA3_B47A227F452A
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
push str._sInitConfig:_d
push eax
call fcn.0040b270
mov esi, dword [ebp - 0x268]
add esp, 0x10
push 0
sub esp, 0x28
mov eax, esp
push 0
push esi
push str.install_init_fail
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44cb06
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_file_fail
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
push 5
jmp 0x44cb5b
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_version_cmp
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
call fcn.00446720
test eax, eax
jne 0x44cb9b
push 6
lea ecx, [ebp - 0x27c]
call fcn.00451c20
mov ecx, 0x5e3b94
call fcn.00415890
call fcn.00472ff0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
call fcn.00444440
mov ecx, eax
call fcn.00441cf0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x44ce5e
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_check_se_sf
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
call fcn.00447430
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_will_msgloop
mov dword [eax + 0x24], 0
call fcn.00434730
mov ecx, eax
call fcn.00430190
call fcn.004443b0
cmp dword [eax + 0x98], 0
je 0x44cc20
push 4
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 1
push eax
push 4
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x44cc35
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [ebp + 0x14]
push dword [ebp - 0x25c]
call fcn.0044add0
mov ecx, dword [0x5e3b50]
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x260], eax
test ecx, ecx
jne 0x44ccaf
push 0x5dc3e8
call esi
cmp dword [0x5e3b50], 0
jne 0x44cc9e
push 0x18
call fcn.004b1019
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x44cc90
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x14], 7
jmp 0x44cc92
xor ecx, ecx
xchg dword [ebp - 0x25c], eax
mov dword [0x5e3b50], ecx
push 0x5dc3e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x5e3b50]
call fcn.0046ea50
lea ecx, [ebp - 0x258]
call fcn.0040ad10
push dword [0x5e3bf8]
lea eax, [ebp - 0x258]
push str.ex_ary_result_result__d
push eax
call fcn.0040b270
add esp, 0xc
push 0
sub esp, 0x28
mov eax, esp
push 1
push dword [ebp - 0x258]
mov dword [eax + 0x24], 0
push str.install_result
call fcn.00434730
mov ecx, eax
call fcn.00430190
call fcn.00444440
mov ecx, eax
call fcn.00441cf0
push dword [0x5e3bf8]
lea ecx, [ebp - 0x27c]
call fcn.00451c30
mov eax, dword [0x5e3bc4]
add eax, 0x10
push eax
mov dword [ebp - 0x25c], eax
call esi
mov esi, dword [0x5e3b90]
test esi, esi
je 0x44cd80
cmp dword [esi + 4], 0
jle 0x44cd4e
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x5e3b90]
test esi, esi
je 0x44cd80
mov eax, dword [esi]
test eax, eax
je 0x44cd67
push eax
call fcn.005338b8
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004b0a8e
add esp, 8
push dword [ebp - 0x25c]
mov dword [0x5e3b90], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x5e3b8c]
test esi, esi
je 0x44cdde
mov eax, dword [esi]
test eax, eax
je 0x44cdb5
push eax
call fcn.005338b8
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x44cdcc
push eax
call fcn.005338b8
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.004b0a8e
add esp, 8
mov esi, dword [0x5e3b84]
test esi, esi
je 0x44ce13
cmp dword [esi], 0
je 0x44ce13
nop dword [eax]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x44cdfd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esi + 0x20]
push 0
mov dword [esi + 0x10], 0
call eax
add esi, 0x24
cmp dword [esi], 0
jne 0x44cdf0
mov esi, dword [0x5dc40c]
mov ecx, dword [0x5dc410]
cmp esi, ecx
jae 0x44ce3d
mov eax, dword [esi]
test eax, eax
je 0x44ce36
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x5dc410]
add esi, 4
cmp esi, ecx
jb 0x44ce23
mov ecx, 0x5e3b58
call fcn.0044b530
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x258]
call fcn.0040adf0
mov esi, dword [ebp - 0x260]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44ce73
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x27c]
call fcn.00451be0
lea ecx, [ebp - 0x284]
call fcn.004141f0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b0a78
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0040af40
int3