Function at 0x1004c880
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x101d7c7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x258], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 8
push eax
mov dword [ebp - 0x260], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
push eax
push str.Start_run__cmd___s
call fcn.1004d370
push edi
push str.lpstrCmdLine_s
call fcn.1004d370
add esp, 0x10
mov ecx, 0x101deb2c
push 0
push dword [ebp + 8]
push 0
call fcn.10048c40
lea ecx, [ebp - 0x284]
call fcn.10014080
push 1
call fcn.1006f4f0
push edi
call fcn.10044c90
mov ecx, eax
call fcn.1003e700
lea ecx, [ebp - 0x27c]
call fcn.10051fe0
call fcn.10044c90
mov ecx, eax
call fcn.1003e370
push eax
lea ecx, [ebp - 0x27c]
call fcn.10052030
call fcn.10044c90
mov ecx, eax
call fcn.10040070
push dword [eax]
call fcn.1006f520
mov ecx, 0x101deb68
call fcn.10016500
test eax, eax
jne 0x1004c9aa
push str.CheckSingleInstance_failed__exit
call fcn.1004d370
add esp, 4
push 1
push 0
push 0
push 0
push 0x1018c76c
push 0
call fcn.1006f540
push 1
lea ecx, [ebp - 0x27c]
mov dword [0x101deb28], 1
call fcn.10052040
xor edi, edi
jmp 0x1004d333
call fcn.10044c90
mov ecx, eax
call fcn.1003e590
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311e0
call fcn.10044c90
mov ecx, eax
call fcn.1003e3a0
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311d0
call fcn.10044c90
mov ecx, eax
call fcn.1003e5a0
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311f0
call fcn.10044c90
mov ecx, eax
call fcn.1003e5d0
push eax
call fcn.100349e0
mov ecx, eax
call fcn.10031260
call fcn.100349e0
mov ecx, eax
call fcn.1002f1b0
push str.instnew
call fcn.100349e0
mov ecx, eax
call fcn.10031210
call fcn.10044c90
cmp dword [eax + 0x44], 0
je 0x1004ca47
push str.lite_pack
call fcn.100349e0
mov ecx, eax
call fcn.10031210
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10112750
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.100349e0
mov ecx, eax
call fcn.10031130
call fcn.10071f70
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
neg eax
sbb eax, eax
inc eax
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311c0
call fcn.1000cdc0
mov ecx, eax
test ecx, ecx
je 0x1004d35e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
call esi
push eax
lea ecx, [ebp - 0x26c]
call fcn.1000e0d0
push str.NtQueryInformationProcess
push str.NTDLL.DLL
mov dword [ebp - 0x25c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1004cb26
lea eax, [ebp - 0x25c]
push eax
push 0x18
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x1004cb26
cmp dword [ebp - 0x25c], 0x18
jne 0x1004cb26
mov eax, dword [ebp - 0x210]
jmp 0x1004cb29
or eax, 0xffffffff
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x1004cb79
push str.Failed_to_open_process.
call fcn.1004d370
add esp, 4
mov dword [ebp - 0x244], esi
xor eax, eax
mov dword [ebp - 0x240], 7
lea ecx, [ebp - 0x254]
mov word [ebp - 0x254], ax
push eax
push 0x10186a64
call fcn.10012940
jmp 0x1004cc22
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
xor eax, eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004cbb3
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.10012940
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x23c]
xor eax, eax
lea ecx, [ebp - 0x23c]
mov word [ebp - 0x23c], ax
movups xmmword [ebp - 0x254], xmm0
movq xmm0, qword [ebp - 0x22c]
movq qword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
call fcn.100109e0
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x268]
cmovae eax, dword [ebp - 0x254]
push eax
call fcn.1000e0d0
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.100767b0
mov esi, eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.100767b0
push dword [esi]
push dword [eax]
lea eax, [ebp - 0x270]
push str.ex_ary_pro__sex_ary_param__s
push eax
call fcn.1000b130
mov edx, dword [ebp - 0x280]
or ebx, 0xffffffff
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004cca2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004ccbf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x268]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004ccdc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x254]
call fcn.100109e0
mov edx, dword [ebp - 0x26c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004cd04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x270]
push esi
push str.run_ex__s
call fcn.1004d370
add esp, 8
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x10048710
push 0x1018b420
mov dword [eax + 0x24], eax
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
sub esp, 0x28
mov eax, esp
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_void____cdecl___int___void__int_.0
mov dword [eax + 4], 0x10048710
push 0x1018b420
mov dword [eax + 0x24], eax
call fcn.100349e0
mov ecx, eax
call fcn.10030790
call fcn.10044c90
mov ecx, eax
call fcn.1003e580
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311d0
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.setup_pid
mov dword [eax + 0x24], 0
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
lea eax, [ebp - 0x260]
push eax
call fcn.10044c90
mov ecx, eax
call fcn.1003e4e0
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311d0
mov edx, dword [ebp - 0x260]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004cde5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.res_pid
mov dword [eax + 0x24], 0
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
call fcn.10044c90
mov ecx, eax
call fcn.1003e3a0
push eax
call fcn.100349e0
mov ecx, eax
call fcn.100311d0
cmp dword [0x101d742c], 0
je 0x1004cee5
push str.ntdll.dll
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x270], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1004ced5
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004cea5
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x26c]
push ecx
call eax
movzx eax, word [ebp - 0x25c]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x270], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x270], 0
je 0x1004ced5
cmp dword [ebp - 0x26c], 6
jne 0x1004cec9
cmp dword [ebp - 0x268], 1
jae 0x1004cecb
jmp 0x1004ced5
jbe 0x1004ced5
mov dword [0x101deba4], 1
mov edi, dword [ebp - 0x258]
mov dword [0x101d742c], 0
cmp dword [0x101deba4], 0
jne 0x1004cf71
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_os_fail
mov dword [eax + 0x24], 0
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
push 1
push 0
push 0x1018bc6c
push 0
push str.S_MRHr_g
push 0
call fcn.1006f540
cmp eax, 1
jne 0x1004cf48
push eax
push 0
push 0
push str.https:__cdn_file_ssl.ludashi.com_pc_appstore_ludashi_ludashisetup.exe
push 0x101879bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
lea ecx, [ebp - 0x27c]
call fcn.10052040
mov ecx, 0x101deb68
call fcn.10016c90
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x1004d31e
call fcn.10048d60
test eax, eax
jne 0x1004cfb3
push dword [0x101deb28]
lea ecx, [ebp - 0x27c]
call fcn.10052040
call fcn.10044d20
mov ecx, eax
call fcn.100425e0
mov ecx, 0x101deb68
call fcn.10016c90
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x1004d31e
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_init_packinfo
mov dword [eax + 0x24], 0
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
call fcn.10049950
push 0
sub esp, 0x28
test eax, eax
mov eax, esp
push 0
mov dword [eax + 0x24], 0
push 0
jne 0x1004d006
push str.install_file_fail
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
push 5
jmp 0x1004d022
push str.install_version_cmp
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
call fcn.10046ef0
test eax, eax
jne 0x1004d062
push 6
lea ecx, [ebp - 0x27c]
call fcn.10052040
mov ecx, 0x101deb68
call fcn.10016c90
call fcn.10071f70
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
call fcn.10044d20
mov ecx, eax
call fcn.100425e0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
jmp 0x1004d31e
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_check_se_sf
mov dword [eax + 0x24], 0
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
call fcn.10047c00
push 0
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.install_will_msgloop
mov dword [eax + 0x24], 0
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
call fcn.10044c90
cmp dword [eax + 0x98], 0
je 0x1004d0e7
push 4
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], 1
push eax
push 4
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1004d0fc
push str.extension_tag
push str.SoftwareLudashi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push dword [ebp + 0x14]
push edi
call fcn.1004b370
mov ecx, dword [0x101deb10]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 0x260], eax
test ecx, ecx
jne 0x1004d171
push 0x101d73e8
call edi
cmp dword [0x101deb10], 0
jne 0x1004d160
push 0x18
call fcn.100ad0a9
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1004d152
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x14], 7
jmp 0x1004d154
xor ecx, ecx
xchg dword [ebp - 0x258], eax
mov dword [0x101deb10], ecx
push 0x101d73e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x101deb10]
call fcn.1006db40
lea ecx, [ebp - 0x25c]
call fcn.1000abd0
push dword [0x101debb8]
lea eax, [ebp - 0x25c]
push str.ex_ary_result_result__d
push eax
call fcn.1000b130
add esp, 0xc
push 0
sub esp, 0x28
mov eax, esp
push 1
push dword [ebp - 0x25c]
mov dword [eax + 0x24], 0
push str.install_result
call fcn.100349e0
mov ecx, eax
call fcn.10030b90
call fcn.10044d20
mov ecx, eax
call fcn.100425e0
push dword [0x101debb8]
lea ecx, [ebp - 0x27c]
call fcn.10052050
mov eax, dword [0x101deb18]
add eax, 0x10
push eax
mov dword [ebp - 0x258], eax
call edi
mov edi, dword [0x101deb64]
test edi, edi
je 0x1004d242
cmp dword [edi + 4], 0
jle 0x1004d210
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [0x101deb64]
test edi, edi
je 0x1004d242
mov eax, dword [edi]
test eax, eax
je 0x1004d229
push eax
call fcn.1012fd0c
add esp, 4
mov dword [edi], 0
push 0xc
push edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100acb1e
add esp, 8
push dword [ebp - 0x258]
mov dword [0x101deb64], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x101deb60]
test edi, edi
je 0x1004d2a0
mov eax, dword [edi]
test eax, eax
je 0x1004d277
push eax
call fcn.1012fd0c
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1004d28e
push eax
call fcn.1012fd0c
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
mov dword [edi + 8], 0
call fcn.100acb1e
add esp, 8
mov edi, dword [0x101deb58]
test edi, edi
je 0x1004d2d3
cmp dword [edi], 0
je 0x1004d2d3
nop
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1004d2bd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [edi + 0x20]
push 0
mov dword [edi + 0x10], 0
call eax
add edi, 0x24
cmp dword [edi], 0
jne 0x1004d2b0
mov edi, dword [0x101d740c]
mov ecx, dword [0x101d7410]
cmp edi, ecx
jae 0x1004d2fd
mov eax, dword [edi]
test eax, eax
je 0x1004d2f6
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x101d7410]
add edi, 4
cmp edi, ecx
jb 0x1004d2e3
mov ecx, 0x101deb2c
call fcn.1004bad0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x25c]
call fcn.1000acb0
mov edi, dword [ebp - 0x260]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1004d333
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x27c]
call fcn.10052000
lea ecx, [ebp - 0x284]
call fcn.100140c0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100acb08
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.1000ae00
int3