Function at 0x40e64a
Capabilities:
Accept command line arguments
Check mutex on windows
Copy file
Get common file path
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xecc]
sub esp, 0xf48
mov eax, dword [0x43fda4]
xor eax, ebp
mov dword [ebp + 0xec8], eax
push ebx
push esi
mov esi, dword [ebp + 0xed4]
push edi
mov dword [ebp - 0x74], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push esi
mov edi, eax
call fcn.0040a445
mov esi, 0x4412b0
push esi
call fcn.0040a8ae
pop ecx
xor ebx, ebx
cmp eax, ebx
pop ecx
mov dword [0x4414b0], eax
push 0x7f
je 0x40e6a8
lea eax, [ebp + 0x7ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x40e6af
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
lea eax, [ebp + 0xbac]
jmp 0x40e6bc
lea ecx, [eax + 2]
push ecx
push eax
call fcn.0041a59a
lea eax, [ebp + 0xbac]
push 0x22
push eax
call fcn.00418e9f
add esp, 0x10
cmp eax, ebx
jne 0x40e6b8
lea eax, [ebp + 0xbac]
push 0x435a28
push eax
call fcn.00418e40
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x40e709
lea eax, [ebp + 0xbac]
push 0x435a20
push eax
call fcn.00418e40
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40e717
lea eax, [esi + 4]
push eax
push esi
call fcn.0041a59a
pop ecx
pop ecx
cmp esi, ebx
setne al
mov byte [0x4412a8], al
lea eax, [ebp + 0xbac]
push 0x435a18
push eax
call fcn.00418e40
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x40e751
lea eax, [ebp + 0xbac]
push 0x435a10
push eax
call fcn.00418e40
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40e75f
lea eax, [esi + 4]
push eax
push esi
call fcn.0041a59a
pop ecx
pop ecx
cmp esi, ebx
push 0x80
mov esi, 0x4411a8
push esi
push ebx
setne byte [ebp - 0x61]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push esi
call fcn.00418ec1
mov edi, 0x4413b0
push edi
mov word [eax], bx
call fcn.0040a3ca
add esp, 0xc
cmp al, bl
mov byte [ebp - 0x59], al
jne 0x40e79e
push esi
push edi
call fcn.0041a59a
pop ecx
pop ecx
cmp byte [0x4412a8], bl
mov byte [ebp - 0x62], bl
jne 0x40e7d9
cmp byte [ebp - 0x59], bl
je 0x40e7d9
cmp byte [ebp - 0x61], bl
jne 0x40e7d9
push 1
push 0x40a994
push ebx
push 0x74
push dword [ebp - 0x74]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
sub eax, 6
je 0x40e7d9
dec eax
je 0x40e7d5
xor eax, eax
jmp 0x40f1ea
mov byte [ebp - 0x62], 1
push str.mutex_freeime_unicode
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push edi
sete byte [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [ebp - 0x62], bl
jne 0x40f155
lea eax, [ebp + 0xbac]
push 0x4359dc
push eax
call fcn.00418e40
test eax, eax
pop ecx
pop ecx
jne 0x40f155
lea eax, [ebp + 0xbac]
push 0x4359d4
push eax
call fcn.00418e40
test eax, eax
pop ecx
pop ecx
jne 0x40f155
lea eax, [ebp + 0xbac]
push esi
push eax
call fcn.0041a59a
cmp dword [0x4414b0], ebx
pop ecx
pop ecx
je 0x40e868
lea eax, [ebp + 0xbac]
push str._freeime64.ime
push eax
call fcn.0041a570
pop ecx
pop ecx
push esi
mov edi, str._s_freeime.ime
lea eax, [ebp + 0x8ac]
push edi
push eax
call fcn.0041a34e
add esp, 0xc
cmp dword [0x4414b0], ebx
je 0x40e8b8
lea eax, [ebp + 0xbac]
push ebx
push eax
call fcn.0041a63d
test eax, eax
pop ecx
pop ecx
je 0x40e8b8
cmp byte [0x4412a8], bl
jne 0x40e7ce
push 0x10
lea eax, [ebp + 0xbac]
push eax
push str.S_MR
jmp 0x40ea34
lea eax, [ebp + 0x8ac]
push ebx
push eax
call fcn.0041a63d
test eax, eax
pop ecx
pop ecx
je 0x40e8ea
cmp byte [0x4412a8], bl
jne 0x40e7ce
push 0x10
lea eax, [ebp + 0x8ac]
push eax
push 0x435920
jmp 0x40ea34
cmp dword [0x4414b0], ebx
je 0x40e90d
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0xdac]
push str._s_system32_freeime.ime
push eax
call fcn.0041a34e
add esp, 0xc
push 0x4412b0
lea eax, [ebp + 0xaac]
push edi
push eax
call fcn.0041a34e
add esp, 0xc
cmp byte [ebp - 0x61], bl
jne 0x40ea45
cmp byte [0x4412a8], bl
jne 0x40ea45
cmp byte [ebp - 0x70], bl
je 0x40ea77
mov dword [ebp - 0x68], ebx
jmp 0x40ea0c
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x40ea45
mov byte [eax], bl
call fcn.0040a986
mov eax, dword [ebp - 0x58]
cmp byte [eax], bl
je 0x40ea40
lea eax, [ebp - 0x54]
push 0x435880
push eax
call fcn.0041a59a
mov eax, dword [ebp - 0x58]
pop ecx
xor edi, edi
cmp byte [eax], bl
pop ecx
jbe 0x40e9da
mov dword [ebp - 0x6c], ebx
inc edi
push edi
lea eax, [ebp + 0xeac]
push 0x43586c
push eax
call fcn.0041a34e
lea eax, [ebp + 0xeac]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0041a570
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x6c]
lea eax, [ecx + eax + 2]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0041a570
lea eax, [ebp - 0x54]
push 0x43164c
push eax
call fcn.0041a570
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
add dword [ebp - 0x6c], 0x208
add esp, 0x24
cmp edi, eax
jl 0x40e981
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x22
push 0x43365c
lea eax, [ebp - 0x54]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x40e7ce
dec eax
dec eax
je 0x40ea45
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push str.process_list
call fcn.00409824
add esp, 0xc
test eax, eax
jne 0x40e948
push ebx
push 0x435848
push 0x435834
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40e7ce
mov byte [ebp - 0x70], bl
jmp 0x40ea77
call fcn.0040a4e6
cmp byte [ebp - 0x70], bl
je 0x40ea77
cmp dword [0x4414b0], ebx
je 0x40ea67
lea eax, [ebp + 0xdac]
push 1
push eax
call fcn.0040a193
pop ecx
pop ecx
lea eax, [ebp + 0xaac]
push 1
push eax
call fcn.0040a193
pop ecx
pop ecx
cmp dword [0x4414b0], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
je 0x40ead6
lea eax, [ebp - 0x68]
push eax
call fcn.004098d7
pop ecx
push ebx
lea eax, [ebp + 0xdac]
push eax
lea eax, [ebp + 0xbac]
push eax
call edi
test eax, eax
jne 0x40eacd
cmp byte [0x4412a8], bl
jne 0x40eacd
push dword [ebp - 0x68]
call fcn.00409910
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43580c
call fcn.0040a819
pop ecx
pop ecx
jmp 0x40e7ce
push dword [ebp - 0x68]
call fcn.00409910
pop ecx
push ebx
lea eax, [ebp + 0xaac]
push eax
lea eax, [ebp + 0x8ac]
push eax
call edi
test eax, eax
jne 0x40eb01
cmp byte [0x4412a8], bl
jne 0x40eb01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4357e4
jmp 0x40eac1
call fcn.00409bb6
test al, al
jne 0x40eb1b
push 0x10
push 0x43365c
push 0x4357b4
jmp 0x40ea34
push esi
call fcn.0040e532
push esi
call fcn.00409943
push esi
lea eax, [ebp + 0xdac]
push str._s_symbol.txt
push eax
call fcn.0041a34e
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
push esi
lea eax, [ebp + 0xdac]
push str._smbdefault
push eax
call fcn.0041a34e
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
push esi
lea eax, [ebp + 0xdac]
push str._smbdefault_freeime.mb
push eax
call fcn.0041a34e
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
push esi
lea eax, [ebp + 0xdac]
push str._sconf
push eax
call fcn.0041a34e
lea eax, [ebp + 0xdac]
add esp, 0x44
push eax
call fcn.00409943
push esi
lea eax, [ebp + 0xdac]
push str._s_skin
push eax
call fcn.0041a34e
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
push esi
lea eax, [ebp + 0xdac]
push str._splugin
push eax
call fcn.0041a34e
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
add esp, 0x24
lea eax, [ebp + 0x9ac]
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp + 0xcac]
push str._smb
push eax
call fcn.0041a34e
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add esp, 0xc
lea eax, [ebp + 0xcac]
push eax
call edi
lea eax, [ebp + 0xcac]
push eax
call fcn.00409943
pop ecx
lea ecx, [ebp + 0xeac]
call fcn.00410aa9
push ebx
push 0x435700
lea ecx, [ebp + 0xeac]
call fcn.00410b37
test eax, eax
je 0x40ed45
lea ecx, [ebp + 0xeac]
call fcn.004107a3
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xeac]
push 0x10
lea ecx, [ebp + 0xeac]
call dword [eax + 0x38]
test eax, eax
je 0x40ed3c
lea ecx, [ebp + 0xeac]
call fcn.00410a6c
test eax, eax
jne 0x40ed3c
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._smb_s_freeime.mb
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x68]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._smb_s_attach.mb
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x6c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._smb_squick.txt
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x60]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
cmp dword [ebp - 0x58], ebx
jne 0x40ec48
push esi
lea eax, [ebp + 0xcac]
push str._s_skin
push eax
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp + 0xcac]
push eax
call edi
lea eax, [ebp + 0xcac]
push eax
call fcn.00409943
pop ecx
push ebx
push 0x435700
lea ecx, [ebp + 0xeac]
call fcn.00410b37
test eax, eax
je 0x40edfa
lea ecx, [ebp + 0xeac]
call fcn.004107a3
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xeac]
push 0x10
lea ecx, [ebp + 0xeac]
call dword [eax + 0x38]
test eax, eax
je 0x40edf5
lea ecx, [ebp + 0xeac]
call fcn.00410a6c
test eax, eax
jne 0x40edf5
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._s_skin_s_skin.ini
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x60]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
cmp dword [ebp - 0x58], ebx
jne 0x40ed85
push esi
lea eax, [ebp + 0xcac]
push str._splugin
push eax
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp + 0xcac]
push eax
call edi
lea eax, [ebp + 0xcac]
push eax
call fcn.00409943
pop ecx
push ebx
push 0x435700
lea ecx, [ebp + 0xeac]
call fcn.00410b37
test eax, eax
je 0x40eea0
lea ecx, [ebp + 0xeac]
call fcn.004107a3
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xeac]
push 0x20
lea ecx, [ebp + 0xeac]
call dword [eax + 0x38]
test eax, eax
je 0x40ee9b
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._splugin_s
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x60]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
cmp dword [ebp - 0x58], ebx
jne 0x40ee3a
push esi
lea eax, [ebp + 0xcac]
push str._splugindata
push eax
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp + 0xcac]
push eax
call edi
lea eax, [ebp + 0xcac]
push eax
call fcn.00409943
pop ecx
push ebx
push 0x435700
lea ecx, [ebp + 0xeac]
call fcn.00410b37
test eax, eax
je 0x40ef46
lea ecx, [ebp + 0xeac]
call fcn.004107a3
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xeac]
push 0x20
lea ecx, [ebp + 0xeac]
call dword [eax + 0x38]
test eax, eax
je 0x40ef41
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._splugindata_s
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x60]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
cmp dword [ebp - 0x58], ebx
jne 0x40eee0
push esi
lea eax, [ebp + 0xcac]
push str._sconf
push eax
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp + 0xcac]
push eax
call edi
lea eax, [ebp + 0xcac]
push eax
call fcn.00409943
pop ecx
push ebx
push 0x435700
lea ecx, [ebp + 0xeac]
call fcn.00410b37
test eax, eax
je 0x40efec
lea ecx, [ebp + 0xeac]
call fcn.004107a3
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xeac]
push 0x20
lea ecx, [ebp + 0xeac]
call dword [eax + 0x38]
test eax, eax
je 0x40efe7
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp + 0xeac]
call fcn.00410dc7
push dword [eax]
lea eax, [ebp + 0xdac]
push esi
push str._sconf_s
push eax
call fcn.0041a34e
mov ecx, dword [ebp - 0x60]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401128
lea eax, [ebp + 0xdac]
push eax
call fcn.00409943
pop ecx
cmp dword [ebp - 0x58], ebx
jne 0x40ef86
lea eax, [ebp + 0x9ac]
push eax
call edi
lea ecx, [ebp + 0xeac]
call fcn.00410acf
call fcn.004099a6
push eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x9ac]
push str.SYSTEMCurrentControlSetControlKeyboard_Layouts_x
push eax
call fcn.0041a34e
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x9ac]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp byte [ebp - 0x59], bl
mov edi, str.system
je 0x40f0b5
push 0x50
call fcn.0040f26a
pop ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x78]
push eax
push ebx
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x60], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40f077
mov dword [ebp - 0x58], 0x4413b0
jmp 0x40f07d
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x58], eax
push esi
push dword [ebp - 0x58]
call fcn.00418daf
test eax, eax
pop ecx
pop ecx
je 0x40f0ac
push dword [ebp - 0x58]
call fcn.004194ab
pop ecx
add eax, eax
push eax
push dword [ebp - 0x58]
push 1
push ebx
push str.system_bak
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x68]
call fcn.0040f26f
pop ecx
push esi
call fcn.004194ab
pop ecx
add eax, eax
push eax
push esi
push 1
push ebx
push edi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
push esi
call fcn.00409f30
cmp byte [0x4412a8], bl
pop ecx
jne 0x40f13e
cmp byte [ebp - 0x59], bl
jne 0x40f117
cmp eax, ebx
push 0x40
push 0x43365c
je 0x40f10d
push 0x4355a8
jmp 0x40ea34
push 0x43557c
jmp 0x40ea34
cmp byte [ebp - 0x70], bl
je 0x40f12d
push 0x10
push 0x43365c
push 0x43554c
jmp 0x40ea34
push 0x40
push 0x43365c
push 0x435520
jmp 0x40ea34
push ebx
push 0x40a994
push ebx
push 0x74
push dword [ebp - 0x74]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x40e7ce
call fcn.0040a4e6
call fcn.0040a4f4
push 0x4412b0
lea eax, [ebp + 0xaac]
push str._s_freeime.ime
push eax
call fcn.0041a34e
push dword [ebp - 0x70]
lea eax, [ebp + 0xaac]
push eax
call fcn.0040a193
add esp, 0x14
cmp dword [0x4414b0], ebx
je 0x40f1b9
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp + 0xdac]
push str._s_system32_freeime.ime
push eax
call fcn.0041a34e
push dword [ebp - 0x70]
lea eax, [ebp + 0xdac]
push eax
call fcn.0040a193
add esp, 0x14
cmp byte [0x4412a8], bl
jne 0x40f1e7
cmp byte [ebp - 0x70], bl
je 0x40f1d4
push 0x10
push 0x43365c
push 0x4354ec
jmp 0x40f1e0
push 0x40
push 0x43365c
push 0x4354c8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 2
pop eax
mov ecx, dword [ebp + 0xec8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419911
add ebp, 0xecc
leave
ret 0x10