Function at 0x4047f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc14
mov ecx, 0x10
xor eax, eax
push ebx
push esi
push edi
mov esi, 0x40b8f0
lea edi, [esp + 0x820]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x6f
lea edi, [esp + 0x861]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x820]
push eax
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404a7c
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x20]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [esp + eax + 0x20]
dec eax
cmp cl, 0x5c
jne 0x40485d
mov byte [esp + eax + 0x21], 0
mov edi, 0x40b8e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x21
mov esi, 0x40b85c
lea edi, [esp + 0x620]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x5f
lea edi, [esp + 0x6a4]
rep stosd dword es:[edi], eax
mov ecx, 0x20
mov esi, 0x40b7d8
lea edi, [esp + 0xa20]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x5f
lea edi, [esp + 0xaa1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x620]
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x4102d4]
xor ebx, ebx
test eax, eax
jle 0x4049a2
push ebp
mov ebp, 0x40c2d4
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x404948
mov al, byte [esi + ebp]
cmp al, 0x5c
mov byte [esp + edx + 0x224], al
jne 0x404936
inc edx
mov byte [esp + edx + 0x224], al
inc edx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x404920
mov byte [esp + edx + 0x224], 0
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x428]
push 0x40b7d0
push eax
call fcn.00405520
add esp, 0xc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x424]
lea eax, [esp + 0x624]
push ecx
push 0x40b7c0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x4102d4]
inc ebx
add ebp, 0x200
cmp ebx, eax
jl 0x40490c
pop ebp
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x18]
and eax, 0xffff
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1a]
and eax, 0xffff
lea ecx, [eax + edx*4 + 2]
lea edx, [esp + 0x420]
push ecx
push 0x40b7b4
push edx
call fcn.00405520
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x420]
lea edx, [esp + 0xa20]
push eax
push ecx
push 0x40b7a8
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x220]
push eax
push 0x40b798
push ecx
call fcn.00405520
add esp, 0xc
lea edx, [esp + 0x220]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3a980
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40b78c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x404a7c
push 0x40b77c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40b714
mov edi, eax
push 0x80000001
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push 0x40b6b4
push 0x80000001
call edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
add esp, 0xc14
ret