Function at 0x40128f
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push esi
push edi
push 0x110
xor ebx, ebx
lea eax, [esp + 0x20]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [esp + 0x18]
mov edi, 0x114
push eax
mov dword [esp + 0x1c], edi
call esi
cmp dword [esp + 0x1c], 6
jb 0x4014a0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x403174
push eax
call dword [sym.imp.MSVCR80.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x4014a0
mov eax, dword [0x4043b8]
or eax, dword [0x4043bc]
jne 0x4013f8
cmp byte [0x4043a8], bl
jne 0x40139d
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], edi
call esi
test eax, eax
je 0x40133b
cmp dword [esp + 0x1c], 6
setb al
cmp al, bl
mov byte [0x4043a9], al
jne 0x401396
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
cmp esi, ebx
je 0x40138f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EventWrite
push esi
call edi
cmp eax, ebx
mov dword [0x4043ac], eax
je 0x40138f
push str.EventRegister
push esi
call edi
cmp eax, ebx
mov dword [0x404018], eax
je 0x401385
push str.EventUnregister
push esi
call edi
cmp eax, ebx
mov dword [0x4043b0], eax
jne 0x401396
mov dword [0x404018], 0x4010bb
mov byte [0x4043a9], 1
mov byte [0x4043a8], 1
cmp byte [0x4043a9], bl
jne 0x4013c1
push 0x4043b8
push 0x4043c0
push 0x40106b
push 0x4031cc
call dword [0x404018]
jmp 0x4013f8
mov ecx, 0x4043c0
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x4043bc], edx
lea edx, [esp + 0x1c]
push edx
push 1
mov dword [0x4043b8], eax
mov eax, 0x4031cc
push eax
push ecx
push section..text
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
cmp dword [0x4043e4], ebx
je 0x40144d
cmp byte [0x4043a9], bl
mov al, byte [0x4043e8]
je 0x401415
cmp al, 4
jae 0x401448
cmp al, bl
jmp 0x401446
cmp al, 4
jae 0x40141d
cmp al, bl
jne 0x40144d
mov ecx, dword [0x4043d4]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x40144d
mov ecx, dword [0x4043dc]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x4043d8]
jne 0x40144d
cmp eax, ecx
jne 0x40144d
call fcn.00401222
cmp byte [0x4043a8], bl
je 0x4014a0
mov esi, dword [0x4043b8]
mov eax, dword [0x4043bc]
mov ecx, esi
or ecx, eax
je 0x4014a0
cmp byte [0x4043a9], bl
jne 0x401478
push eax
push esi
call dword [0x4043b0]
jmp 0x401494
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [0x4043b8], ebx
mov dword [0x4043bc], ebx
push str.HummerEngine.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp esi, ebx
je 0x4014c7
push str.RunQQHummerEngine
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x4014c9
xor eax, eax
cmp eax, ebx
jne 0x4014d4
call edi
or eax, 0xffffffff
jmp 0x4014da
push dword [ebp + 8]
call eax
pop ecx
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004018df
mov esp, ebp
pop ebp
ret 4