Function at 0x420a15
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Inspect section memory permissions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8618
call fcn.00448890
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x85ac], edi
mov dword [ebp - 0x85c4], eax
call fcn.00401b96
shl eax, 6
xor eax, dword [edi + 0x98]
push 0x104
and eax, 0x40
xor dword [edi + 0x98], eax
xor eax, eax
mov word [ebp - 0x384], ax
lea eax, [ebp - 0x594]
push eax
xor ebx, ebx
push ebx
mov dword [ebp - 0x38c], 0x44f4c4
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x8594]
push str.settingApp.json
lea ecx, [ebp - 0x594]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x85a4], ebx
mov dword [ebp - 0x85a0], ebx
mov dword [ebp - 0x859c], eax
mov dword [ebp - 0x8598], ebx
call fcn.00444a59
pop ecx
mov eax, esi
push eax
mov dword [ebp - 0x85b0], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x420b33
mov esi, 0xffff
xor ebx, ebx
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x85a4]
call fcn.00410d87
pop ecx
test eax, eax
jns 0x420c04
mov ecx, eax
and ecx, esi
cmp ecx, 0x20
jne 0x420b05
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
mov eax, 0x800704d5
cmp ebx, 0xa
jl 0x420ace
test eax, eax
jns 0x420c04
and eax, esi
cmp eax, 0x4d5
jne 0x420b3a
push 0x32
mov ecx, str.confirmLoadSettingError
xor ebx, ebx
call fcn.00445749
pop ecx
cmp eax, 3
je 0x420c4d
cmp eax, 4
je 0x420acc
or dword [edi + 0x78], 0x40000000
test dword [edi + 0x98], 0x100
je 0x420b4b
call fcn.004455d4
test dword [edi + 0x98], 0x200
je 0x420b78
push 4
lea eax, [ebp - 0x85bc]
push eax
push 0
push dword [0x45283c]
mov dword [ebp - 0x85bc], 2
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, section.Shared
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x85bc], eax
cmp eax, ebx
jle 0x420cc3
test dword [edi + 0x98], 0x1000
je 0x420cc3
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, 0x4000
mov word [ebp - 0x8604], ax
mov eax, dword [ebp - 0x85c4]
push 3
xor esi, esi
pop ecx
mov dword [ebp - 0x85fc], eax
mov word [ebp - 0x85ec], cx
cmp eax, esi
je 0x420c8d
cmp word [eax], si
je 0x420c8d
mov eax, dword [edi + 0x84]
shr eax, 6
and eax, ecx
je 0x420c7c
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp - 0x85e4], ecx
jmp 0x420c93
lea eax, [ebp - 0x38c]
push eax
push dword [ebp - 0x859c]
call fcn.00443da4
pop ecx
pop ecx
test eax, eax
jne 0x420b3a
lea eax, [edi + 0xf8]
push eax
lea eax, [ebp - 0x38c]
lea ecx, [edi + 0x104]
lea edx, [edi + 0x18]
push eax
call fcn.0042c8f1
pop ecx
pop ecx
mov dword [ebp - 0x85b0], 1
jmp 0x420b3a
cmp dword [ebp - 0x8598], ebx
je 0x420c6a
push dword [ebp - 0x8598]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x38c]
call fcn.004439e7
xor eax, eax
jmp 0x42160c
mov eax, dword [edi + 0xc0]
and eax, 4
mov dword [ebp - 0x85e4], eax
jmp 0x420c93
mov dword [ebp - 0x85e4], ebx
push esi
push esi
lea eax, [ebp - 0x85ec]
push eax
lea eax, [ebp - 0x8604]
push eax
push 0x60000016
mov eax, edi
call fcn.0041520f
add esp, 0x14
cmp dword [ebp - 0x8598], esi
je 0x420c6a
push dword [ebp - 0x8598]
push esi
jmp 0x420c5d
lea ebx, [edi + 0x210]
lea ecx, [edi + 0x18]
mov eax, ebx
mov dword [ebp - 0x85b4], ecx
mov dword [ebp - 0x85b8], ebx
call fcn.0042640e
mov edx, dword [edi + 0xd8]
lea ecx, [ebp - 0x594]
call fcn.0042643f
lea ecx, [ebp - 0x594]
mov edx, ebx
call fcn.0042674a
lea eax, [ebp - 0x36c]
xor esi, esi
push eax
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x364], esi
mov dword [ebp - 0x36c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x368], 5
jne 0x420d3a
cmp dword [ebp - 0x364], esi
jbe 0x420d69
mov byte [edi + 0x97], 0
cmp dword [ebp - 0x368], 6
jne 0x420d60
mov byte [edi + 0x97], 1
cmp dword [ebp - 0x364], esi
jbe 0x420d69
cmp dword [ebp - 0x368], 6
mov byte [edi + 0x97], 2
jbe 0x420d69
mov byte [edi + 0x97], 0x1f
mov eax, dword [edi + 0x84]
lea ecx, [eax + eax]
xor ecx, eax
and ecx, 0x20
xor ecx, eax
test byte [edi + 0x98], 0x40
mov dword [edi + 0x84], ecx
je 0x420dc8
cmp byte [edi + 0x97], 1
jb 0x420dc8
call fcn.00401273
mov ebx, eax
shl eax, 7
xor eax, dword [edi + 0x98]
and eax, 0x80
xor dword [edi + 0x98], eax
call dword [sym.imp.UxTheme.dll_BufferedPaintInit]
cmp ebx, esi
je 0x420dc8
xor eax, eax
cmp ax, word [ebp - 0x384]
jne 0x420dc8
or dword [edi + 0x84], 0x30
xor edx, edx
test byte [edi + 0x80], 0x10
je 0x420ddc
mov dword [ebp + 0x10], 3
jmp 0x420ded
cmp dword [ebp + 0x10], esi
jne 0x420ded
mov edx, 0x20000000
mov dword [ebp + 0x10], 6
mov esi, dword [ebp - 0x85b4]
lea edi, [ebp - 0x85dc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x85a5], 0
cmp dword [ebp - 0x85b0], ecx
je 0x420e3a
mov eax, SysReAllocStringLen
cmp dword [ebp - 0x85dc], eax
jne 0x420e78
cmp dword [ebp - 0x85d8], eax
jne 0x420e78
cmp dword [ebp - 0x85d4], ecx
jne 0x420e78
cmp dword [ebp - 0x85d0], ecx
jne 0x420e78
mov byte [ebp - 0x85a5], 1
mov ebx, dword [ebp - 0x85ac]
or dword [ebx + 0xdc], 8
lea eax, [ebp - 0x594]
push eax
push edx
lea edx, [ebp - 0x85dc]
mov ecx, ebx
call fcn.0041f090
xor esi, esi
mov dword [ebp - 0x85c0], eax
cmp eax, esi
jne 0x420eaf
push section.Shared
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x420cb2
mov ebx, dword [ebp - 0x85ac]
mov eax, dword [ebx + 0x20]
mov byte [ebp - 0x85a5], cl
mov dword [ebp - 0x85dc], ecx
mov dword [ebp - 0x85d8], ecx
mov ecx, dword [ebp - 0x85b4]
sub eax, dword [ecx]
mov dword [ebp - 0x85d4], eax
mov eax, dword [ebx + 0x24]
sub eax, dword [ebx + 0x1c]
mov dword [ebp - 0x85d0], eax
jmp 0x420e40
cmp dword [ebp - 0x85b0], esi
je 0x420ef9
cmp byte [ebp - 0x85a5], 0
jne 0x420ef9
and dword [ebp - 0x34], esi
mov esi, dword [ebp - 0x85b4]
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x38], 0x2c
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
jmp 0x420f03
push dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [ebx + 0x14]
mov eax, dword [edi]
push 1
push edi
mov dword [ebp - 0x85c8], edi
call dword [eax + 0x54]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [ebx + 0xf50]
call esi
mov eax, dword [ebx + 0xf88]
test eax, eax
je 0x420f33
push 5
push eax
call esi
cmp byte [ebx + 0x97], 2
jb 0x420fee
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebx + 0x98]
shr eax, 0x17
xor ecx, eax
and ecx, 0x18
xor dword [ebx + 0x98], ecx
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420fae
push str.ChangeWindowMessageFilter
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x420fae
test byte [ebx + 0x98], 8
je 0x420fa8
push 1
push 0x111
call esi
push 1
push 0x112
call esi
push 1
push 0x323
call esi
push 1
push 0x326
call esi
push 1
push 0x4a
call esi
cmp byte [ebx + 0x97], 2
jb 0x420fee
cmp dword [ebp - 0x85bc], 1
jne 0x420fee
test byte [ebx + 0x80], 0x40
je 0x420fee
lea eax, [ebp - 0x594]
push eax
push 1
push dword [ebp - 0x85b8]
call fcn.0041512b
add esp, 0xc
test al, al
je 0x420fee
or dword [ebx + 0xc0], 0x40000000
lea eax, [ebp - 0x85b0]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42108b
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x85bc]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x85b8]
push eax
push esi
push str.Version
push dword [ebp - 0x85b0]
mov dword [ebp - 0x85b8], 1
mov dword [ebp - 0x85bc], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x85b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x4c], si
je 0x42108b
mov eax, dword [ebp - 0x4c]
add eax, 0xffffffca
cmp ax, 3
ja 0x42106d
mov al, byte [ebp - 0x4c]
jmp 0x421085
cmp word [ebp - 0x4c], 0x31
jne 0x42108b
mov eax, dword [ebp - 0x4a]
add eax, 0xffffffd0
cmp ax, 9
ja 0x42108b
mov al, byte [ebp - 0x4a]
add al, 0x11
mov byte [ebx + 0x96], al
cmp byte [ebx + 0x96], 0x38
jae 0x4210b2
lea esi, [ebx + 0x170]
push 0
mov ecx, 0x8022
call fcn.00407b7f
push 0
mov ecx, 0x801c
call fcn.00407b7f
lea eax, [ebp - 0x594]
push eax
mov ecx, ebx
call fcn.0041f652
mov eax, dword [ebx + 0x84]
shr eax, 2
and eax, 1
lea ecx, [ebx + 0x124]
call fcn.00407687
and dword [ebp - 0x85bc], 0
test byte [ebx + 0x84], 4
je 0x421100
lea eax, [ebx + 0x11c]
push eax
lea edx, [ebp - 0x85bc]
lea ecx, [ebp - 0x594]
call fcn.00406bcd
pop ecx
lea eax, [ebx + 0x120]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov esi, edi
call fcn.0040cb70
cmp dword [ebp + 0x10], 6
mov ebx, dword [ebp - 0x85ac]
je 0x421131
push 0x10000000
push 0
xor edx, edx
mov ecx, ebx
call fcn.0041f25b
mov eax, dword [ebx + 0x78]
and eax, 0x18
test dword [ebx + 0x84], 0x4000000
je 0x421146
or eax, 0x20
test eax, eax
je 0x421159
push 0x38
push dword [ebp - 0x85c0]
call fcn.00444a2d
pop ecx
pop ecx
cmp dword [ebp - 0x8598], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
je 0x421179
push dword [ebp - 0x8598]
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea ecx, [ebp - 0x38c]
call fcn.004439e7
lea esi, [ebx + 0xcd4]
call fcn.0042f40d
mov eax, dword [ebx + 0xb4]
push 0xffffffffffffffff
push dword [ebp - 0x85b4]
call fcn.00406000
mov eax, dword [ebp - 0x85b4]
pop ecx
pop ecx
call fcn.00406292
test byte [ebx + 0x98], 4
je 0x4211f4
call edi
mov ecx, dword [ebx + 0xe0]
xor esi, esi
push 0xa0
cmp ecx, esi
je 0x4211d6
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x4211de
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
je 0x4211f6
mov dword [ebx + 0xe0], eax
mov dword [ebx + 0xe8], 0xa
jmp 0x4211f6
xor esi, esi
mov edi, dword [ebp - 0x85c4]
mov dword [ebp - 0x85ac], esi
cmp edi, esi
je 0x421228
cmp word [edi], si
je 0x421228
test dword [ebx + 0x98], 0x1000
je 0x4212c5
test byte [ebx + 0x80], 0x20
je 0x4212c5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x85ac], 0xc9
cmp ecx, esi
je 0x421272
lea eax, [ecx - 0x8000]
cmp eax, 0xa8
ja 0x421251
shl eax, 4
mov eax, dword [eax + 0x44aa78]
jmp 0x4212a1
push 1
push esi
movzx eax, cx
mov ecx, dword [ebp - 0x85c8]
push esi
push eax
push ecx
xor edx, edx
mov dword [ebp - 0x85ac], esi
call fcn.0042778a
add esp, 0x14
jmp 0x4212a7
movzx ecx, word [ebx + 0x46]
mov eax, ecx
sub eax, 0x8036
je 0x421292
sub eax, 0x1f
je 0x421482
sub eax, 4
je 0x421292
sub eax, 0x11
jne 0x4212af
add ecx, 0xffff8000
shl ecx, 4
mov eax, dword [ecx + 0x44aa78]
mov dword [ebp - 0x85ac], eax
cmp dword [ebp - 0x85ac], esi
je 0x4212c5
mov eax, dword [ebp - 0x85c8]
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push dword [ebp - 0x85ac]
push eax
call dword [ecx + 0xc]
cmp edi, esi
je 0x4214be
cmp word [edi], si
je 0x4214be
lea eax, [ebp - 0x85b0]
push eax
push dword [ebp - 0x85c4]
xor edi, edi
mov dword [ebp - 0x85b0], edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test dword [ebx + 0x98], 0x1000
push 8
mov dword [ebp - 0x85b8], eax
pop eax
mov dword [ebp - 0x85c4], edi
lea esi, [ebp - 0x8614]
mov word [ebp - 0x8604], ax
je 0x42137c
mov ecx, dword [ebx + 0x80]
test cl, 0x20
je 0x42137c
mov eax, dword [ebx + 0x84]
shr eax, 6
and eax, 3
je 0x421358
lea edx, [ebp - 0x85dc]
mov dword [ebp - 0x85c4], edx
push 0xb
pop edx
mov word [ebp - 0x85dc], dx
xor edx, edx
cmp eax, 1
setne dl
dec edx
mov word [ebp - 0x85d4], dx
mov eax, ecx
shr eax, 0x1d
test eax, eax
je 0x42137c
push 3
pop ecx
mov word [ebp - 0x85ec], cx
or ecx, 0xffffffff
sub ecx, eax
lea edi, [ebp - 0x85ec]
mov dword [ebp - 0x85e4], ecx
and dword [ebp - 0x85b4], 0
cmp dword [ebp - 0x85b0], 0
jle 0x4214b0
mov eax, dword [ebp - 0x85b8]
mov ecx, dword [ebp - 0x85b4]
push dword [eax + ecx*4]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push esi
push edi
push dword [ebp - 0x85c4]
lea edx, [ebp - 0x8604]
push edx
mov dword [ebp - 0x85fc], eax
mov eax, dword [ebp - 0x85c8]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0xc]
push dword [ebp - 0x85fc]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
je 0x421491
cmp dword [ebp - 0x85b0], 1
jle 0x421475
push 0xb
pop eax
mov word [ebp - 0x85dc], ax
xor eax, eax
mov word [ebp - 0x85d4], ax
lea edx, [ebp - 0x85c0]
lea eax, [ebp - 0x85dc]
push edx
mov dword [ebp - 0x85c4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push 0x44c6b4
push eax
call dword [ecx]
test eax, eax
js 0x421475
mov eax, dword [ebp - 0x85c0]
mov ecx, dword [eax]
lea edx, [ebp - 0x85f0]
push edx
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x85c8]
mov ecx, dword [eax]
lea edx, [ebp - 0x85f4]
push edx
push dword [ebp - 0x85f0]
push eax
call dword [ecx + 0x30]
push 3
pop eax
mov word [ebp - 0x85ec], ax
mov eax, dword [ebp - 0x85f4]
inc eax
mov dword [ebp - 0x85e4], eax
mov eax, dword [ebp - 0x85c0]
mov ecx, dword [eax]
push eax
lea edi, [ebp - 0x85ec]
call dword [ecx + 8]
mov esi, dword [esi + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
xor esi, esi
jmp 0x421498
mov dword [ebp - 0x85ac], 0xa9
jmp 0x4212af
test edi, edi
je 0x421498
inc dword [edi + 8]
inc dword [ebp - 0x85b4]
mov eax, dword [ebp - 0x85b4]
cmp eax, dword [ebp - 0x85b0]
jl 0x421390
push dword [ebp - 0x85b8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
cmp dword [ebx + 0x140], esi
jne 0x4214f0
cmp dword [ebp - 0x85ac], 0x7d
jne 0x4214d9
push ebx
xor edi, edi
call fcn.0041f9a1
jmp 0x4214f0
mov ecx, dword [ebp - 0x85c8]
mov edx, dword [ecx]
xor eax, eax
push eax
push eax
push eax
push eax
push 0xc9
push ecx
call dword [edx + 0xc]
mov eax, dword [ebx + 0xf3c]
test eax, eax
jle 0x421558
xor edi, edi
mov dword [ebp - 0x85c0], eax
mov esi, dword [ebx + 0xf38]
add esi, edi
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42154d
mov ecx, dword [eax]
lea edx, [ebp - 0x85b8]
push edx
push 0x44b894
push eax
call dword [ecx]
test eax, eax
js 0x421540
mov eax, dword [ebp - 0x85b8]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x85b8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi + 0x14], 0
add edi, 0x18
dec dword [ebp - 0x85c0]
jne 0x421502
mov eax, dword [ebx + 0x84]
and eax, 0x20
cmp al, 0x20
jne 0x421572
push 0
push 0
xor edx, edx
mov ecx, ebx
call fcn.0041f25b
mov eax, dword [ebx + 0xdc]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
and eax, 0xfffffff7
push 4
push dword [ebx + 0xd2c]
or eax, 4
mov dword [ebx + 0xdc], eax
call edi
push 4
push dword [ebx + 0xce8]
call edi
push dword [ebx + 0xd2c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0x85bc]
test eax, eax
je 0x4215d5
cmp eax, dword [ebx + 0xf70]
jb 0x4215d5
inc eax
mov ecx, eax
and ecx, 3
mov dword [ebx + 0xf70], eax
je 0x4215d5
sub eax, ecx
add eax, 4
mov dword [ebx + 0xf70], eax
test dword [ebx + 0x98], 0x800
je 0x4215e9
call fcn.00422501
mov dword [ebx + 0x68], eax
mov ecx, dword [ebp - 0x85c8]
call fcn.0042437b
cmp dword [ebx + 0x168], 0
mov esi, eax
je 0x42160a
push section.Shared
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00447d7e
leave
ret