Function at 0x416560
Capabilities:
Accept command line arguments
Create thread
Extract resource via kernel32 functions
Set registry value
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f6f0
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x6d906c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x238]
call fcn.004cd9ba
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x4165af
xor esi, esi
jmp 0x4168b6
lea ecx, [ebp - 0x22c]
call fcn.004cd9ba
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004cdeb7
call fcn.004cce63
mov esi, dword [0x6e94f8]
test esi, esi
jne 0x416640
push 0x6e94c0
call fcn.0041f2ca
add esp, 4
test eax, eax
je 0x4165f5
push eax
call fcn.0041ecf6
add esp, 4
mov esi, dword [0x6e94f8]
test esi, esi
jne 0x416618
push 0x3c
call fcn.00421335
add esp, 4
mov ecx, eax
call fcn.004c9447
mov esi, eax
mov dword [0x6e94f8], esi
push 0x6e94c0
mov dword [ebp - 4], 0
call fcn.0041f2ef
add esp, 4
test eax, eax
je 0x416639
push eax
call fcn.0041ecf6
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 0
mov ecx, esi
call fcn.004c9bfd
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xb
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x6c2504
mov word [ecx], ax
call fcn.00403da0
push 0
push edi
call fcn.00405860
mov ecx, eax
call fcn.004c5596
push 9
call fcn.004ce1a3
mov esi, dword [0x6e963c]
add esp, 4
test esi, esi
jne 0x4166f6
push 0x6e95d8
call fcn.0041f2ca
add esp, 4
test eax, eax
je 0x4166ac
push eax
call fcn.0041ecf6
add esp, 4
mov esi, dword [0x6e963c]
test esi, esi
jne 0x4166ce
push 4
call fcn.00421335
mov esi, eax
add esp, 4
mov dword [esi], vtable.CPublicParamUtil.0
mov dword [0x6e963c], esi
push 0x6e95d8
mov dword [ebp - 4], 1
call fcn.0041f2ef
add esp, 4
test eax, eax
je 0x4166ef
push eax
call fcn.0041ecf6
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00415b80
call fcn.00410720
mov esi, eax
mov byte [esi], 1
call fcn.004039f0
cmp dword [esi + 4], 0
jne 0x416736
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 0
push 0x403100
mov dword [esi + 8], eax
call fcn.004fe651
add esp, 0xc
mov dword [esi + 4], eax
xor al, al
mov ebx, 0x6e9410
xchg byte [ebx], al
sub esp, 0xc
call fcn.0041a570
test eax, eax
jne 0x4167ba
push edi
call fcn.0042e0c0
add esp, 4
push 4
call fcn.0042e4f0
add esp, 4
push 0x6c2c10
push 0x84
call fcn.00425fc0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4167bc
push esi
call fcn.00425fc0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4167b1
push esi
call fcn.00425fc0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4167b1
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0042e500
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4167bc
js 0x4167d2
call fcn.0041a7e0
mov ecx, dword [0x6e9494]
test ecx, ecx
je 0x4167d2
mov eax, dword [ecx]
push 1
call dword [eax + 0x14]
mov al, 1
xchg byte [ebx], al
call fcn.004cce12
call fcn.00410720
mov esi, eax
mov dl, 1
lea ecx, [esi + 0xc]
xchg byte [ecx], dl
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 4]
test eax, eax
je 0x41683c
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x416835
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x21c]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 4], 0
lea eax, [ebp - 0x224]
push eax
push 0xf003f
push 0
push 0x6c2e58
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4168a0
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4168a0
push 4
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 1
push eax
push 4
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x22c]
mov esi, 1
call fcn.004c9591
lea ecx, [ebp - 0x238]
call fcn.004c9591
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421065
mov esp, ebp
pop ebp
ret 0x10