Function at 0x402dae
Capabilities:
Accept command line arguments
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push esi
mov dword [0x4056b0], edi
call fcn.00401302
test eax, eax
pop ecx
je 0x402ddb
call fcn.004037f7
jmp 0x4032d1
push esi
call fcn.0040161f
test eax, eax
pop ecx
je 0x402e00
call fcn.0040173b
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4032d1
push edi
call fcn.00402d20
xor ebx, ebx
push ebx
call fcn.00401b5b
pop ecx
test eax, eax
pop ecx
je 0x402f08
push ebx
call fcn.00401b7e
push ebx
call fcn.00401e62
pop ecx
lea eax, [ebp + 0x10]
pop ecx
mov esi, str.softwarewebexRecorderPlayback
push eax
push 0xf003f
push ebx
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402e68
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.OLType
push dword [ebp + 0x10]
call edi
push str.OLAuthor
push dword [ebp + 0x10]
call edi
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401838
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [0x405768]
cmp eax, ebx
je 0x402e8b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x267]
mov byte [ebp - 0x268], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x268]
push eax
push str.MSIAuthor
push esi
call fcn.0040107d
add esp, 0xc
test eax, eax
je 0x4032d1
push 1
pop edi
push edi
push str.rp_isMSI
push esi
call fcn.004010d1
lea eax, [ebp - 0x268]
add esp, 0xc
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], str._msi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x4032d1
call fcn.00401121
test eax, eax
je 0x402f5f
push str.OLType
push str.softwarewebexRecorderPlayback
call fcn.0040102a
pop ecx
lea edi, [ebp - 7]
pop ecx
mov byte [ebp - 8], bl
mov ecx, eax
xor eax, eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp ecx, 2
stosb byte es:[edi], al
jge 0x402f46
lea eax, [ebp - 8]
push 0x4051dc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.0040186c
lea eax, [ebp - 8]
push eax
call fcn.0040218e
pop ecx
pop ecx
jmp 0x403073
call fcn.00401144
test eax, eax
je 0x402fb7
push str.MSIType
push str.softwarewebexRecorderPlayback
call fcn.0040102a
pop ecx
lea edi, [ebp - 7]
pop ecx
mov byte [ebp - 8], bl
mov ecx, eax
xor eax, eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp ecx, 2
stosb byte es:[edi], al
jge 0x402f93
push 0x4051dc
jmp 0x402f9d
cmp ecx, 3
jne 0x402fa9
push 0x4051d4
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.0040186c
lea eax, [ebp - 8]
jmp 0x402f52
push esi
call fcn.0040150a
test eax, eax
pop ecx
je 0x40308b
push esi
call fcn.00401334
test eax, eax
pop ecx
je 0x402fd8
push esi
call fcn.0040186c
pop ecx
push esi
call fcn.0040218e
push ebx
mov esi, str.softwarewebexRecorderPlayback
push str.rp_isMSI
push esi
mov edi, eax
call fcn.004010d1
push edi
push str.OLType
push esi
call fcn.004010d1
add esp, 0x1c
xor eax, eax
lea edi, [ebp - 0x267]
mov byte [ebp - 0x268], bl
push 0x7f
mov byte [ebp - 0x468], bl
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x467]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x200
lea eax, [ebp - 0x268]
push edi
push eax
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x468]
push edi
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00403847
lea eax, [ebp - 0x468]
push eax
push str.OLAuthor
push esi
push 0x80000001
call fcn.00401651
add esp, 0x1c
call fcn.0040173b
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4032c1
call fcn.0040173b
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.004012ab
test eax, eax
je 0x4030b1
call fcn.0040272d
jmp 0x4032c1
call fcn.004011ce
cmp eax, ebx
mov dword [0x40575c], eax
jne 0x403195
push str.WebExOnDemandAuthorClass
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
je 0x403195
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x267]
mov byte [ebp - 0x268], bl
push 0x7f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x467]
mov byte [ebp - 0x468], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
stosb byte es:[edi], al
mov eax, dword [0x405768]
mov edi, 0x200
cmp eax, ebx
je 0x403137
lea ecx, [ebp - 0x268]
push edi
push ecx
push 0x3737
push eax
call esi
test eax, eax
jne 0x40314a
lea eax, [ebp - 0x268]
push str.WebEx_Recorder_is_running__you_can_not_launch_another_WebEx_Recorder.
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [0x405768]
cmp eax, ebx
je 0x403167
lea ecx, [ebp - 0x468]
push edi
push ecx
push 0x373d
push eax
call esi
test eax, eax
jne 0x40317a
lea eax, [ebp - 0x468]
push str.WebEx_recorder
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x468]
push ebx
push eax
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4032c1
call fcn.004032da
push edi
call fcn.00402bea
test eax, eax
pop ecx
je 0x4032c1
push dword [ebp + 0x14]
push edi
call fcn.00402c5c
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4032c1
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x36b]
mov byte [ebp - 0x36c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x200
lea eax, [ebp - 0x268]
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x268]
push edi
push eax
push dword [0x4056b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x268]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x403255
lea ecx, [ebp - 0x268]
sub eax, ecx
inc eax
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x36c]
push str._atasctrl.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x36c]
mov ecx, 0x405748
push eax
push esi
call fcn.004039f0
test eax, eax
je 0x4032bb
push dword [ebp + 0x10]
cmp dword [0x40575c], ebx
push esi
je 0x403280
call fcn.00403487
pop ecx
pop ecx
jmp 0x40328b
call fcn.00403376
pop ecx
test eax, eax
pop ecx
je 0x4032c1
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [ebp - 0x68]
push ebx
push eax
call esi
test eax, eax
je 0x4032bb
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x68]
push ebx
push eax
jmp 0x403298
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [0x405768]
cmp eax, ebx
je 0x4032d1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10