Function at 0x405b62
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0xa0], 0
mov word [ebp - 0x78], 0x9c
lea eax, [ebp - 0x9c]
push eax
push 0xffffffffffffffff
push 0
call dword [0x418388]
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
cmp edx, 0x30
jne 0x405bb2
push 0x30
push 0x41b9e8
push 0x41b9f4
mov eax, dword [ebp + 8]
push eax
call dword [0x418314]
jmp 0x40624d
push 0x41ba34
call fcn.0040dd60
add esp, 4
push eax
push 0x41ba3c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x405c30
push 0x41ba44
call fcn.0040dd60
add esp, 4
mov edx, dword [ebp + 0xc]
add edx, eax
push edx
push str.HKEY_LOCAL_MACHINE_s
lea eax, [ebp - 0x1ec]
push eax
call fcn.0040dddb
add esp, 0xc
lea ecx, [ebp - 0x1f4]
push ecx
push 0x41ba64
call fcn.0040dd60
add esp, 4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax + 1]
push eax
mov ecx, dword [0x41b0b8]
push ecx
call dword [0x41801c]
mov dword [ebp - 0x1f0], eax
jmp 0x405e88
push 0x41ba6c
call fcn.0040dd60
add esp, 4
push eax
push 0x41ba74
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x405cfa
cmp dword [0x420aac], 0
je 0x405c9f
mov eax, dword [0x420aac]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
jne 0x405c9f
push 0x41ba7c
call fcn.0040dd60
add esp, 4
mov edx, dword [ebp + 0xc]
add edx, eax
push edx
mov eax, dword [0x420aac]
add eax, 8
push eax
push str.HKEY_USERS_s_s
lea ecx, [ebp - 0x1ec]
push ecx
call fcn.0040dddb
add esp, 0x10
jmp 0x405cc6
push 0x41ba98
call fcn.0040dd60
add esp, 4
mov edx, dword [ebp + 0xc]
add edx, eax
push edx
push str.HKEY_CURRENT_USER_s
lea eax, [ebp - 0x1ec]
push eax
call fcn.0040dddb
add esp, 0xc
lea ecx, [ebp - 0x1f4]
push ecx
push 0x41bab8
call fcn.0040dd60
add esp, 4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax + 1]
push eax
mov ecx, dword [0x41b0bc]
push ecx
call dword [0x41801c]
mov dword [ebp - 0x1f0], eax
jmp 0x405e88
push 0x41bac0
call fcn.0040dd60
add esp, 4
push eax
push 0x41bac8
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x405d76
push 0x41bad0
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
push str.HKEY_CURRENT_CONFIG_s
lea edx, [ebp - 0x1ec]
push edx
call fcn.0040dddb
add esp, 0xc
lea eax, [ebp - 0x1f4]
push eax
push str.HKCC
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax + 1]
push edx
push 0x80000005
call dword [0x41801c]
mov dword [ebp - 0x1f0], eax
jmp 0x405e88
push 0x41baf8
call fcn.0040dd60
add esp, 4
push eax
push 0x41bb00
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x405df2
push 0x41bb08
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
push str.HKEY_CLASSES_ROOT_s
lea edx, [ebp - 0x1ec]
push edx
call fcn.0040dddb
add esp, 0xc
lea eax, [ebp - 0x1f4]
push eax
push str.HKCR
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax + 1]
push edx
push 0x80000000
call dword [0x41801c]
mov dword [ebp - 0x1f0], eax
jmp 0x405e88
push 0x41bb30
call fcn.0040dd60
add esp, 4
push eax
push 0x41bb34
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x405e6b
push 0x41bb38
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
push str.HKEY_USERS_s
lea edx, [ebp - 0x1ec]
push edx
call fcn.0040dddb
add esp, 0xc
lea eax, [ebp - 0x1f4]
push eax
push 0x41bb4c
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax + 1]
push edx
push 0x80000003
call dword [0x41801c]
mov dword [ebp - 0x1f0], eax
jmp 0x405e88
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1ec]
push ecx
call fcn.0040dc70
add esp, 8
mov dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0
jne 0x405eb4
mov edx, dword [ebp - 0x1f4]
push edx
call dword [0x41800c]
push 0x41bb50
lea eax, [ebp - 0x1ec]
push eax
call fcn.0040dc80
add esp, 8
jmp 0x405ee2
push 0x5c
lea ecx, [ebp - 0x1ec]
push ecx
call fcn.0040e530
add esp, 8
add eax, 1
mov dword [ebp - 0xa0], eax
push 0x5c
lea edx, [ebp - 0x1ec]
push edx
call fcn.0040e530
add esp, 8
mov byte [eax], 0
push 0
push 0x41bb54
call dword [0x4182e0]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x405f74
push 0x3c
push 0
lea eax, [ebp - 0xe0]
push eax
call fcn.0040deb0
add esp, 0xc
mov dword [ebp - 0xe0], 0x3c
mov dword [ebp - 0xdc], 0x40
mov dword [ebp - 0xd4], 0x41bb64
mov dword [ebp - 0xd0], str.regedit.exe
mov dword [ebp - 0xc4], 1
lea ecx, [ebp - 0xe0]
push ecx
call dword [0x418254]
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa8]
push edx
call dword [0x4182e4]
push 0
push str.RegEdit_RegEdit
call dword [0x4182e0]
mov dword [ebp - 0xe4], eax
jmp 0x405f9f
lea eax, [ebp - 0x1fc]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [0x4182e8]
mov edx, dword [ebp - 0x1fc]
push edx
push 0
push 0
call dword [0x4181e4]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xe4], 0
jne 0x405fc3
push 0x10
push str.AutoRuns
push 0x41bb94
mov eax, dword [ebp + 8]
push eax
call dword [0x418314]
jmp 0x40624d
push 5
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [0x41836c]
mov edx, dword [ebp - 0xe4]
push edx
call dword [0x4182ec]
push 0
push str.SysTreeView32
push 0
mov eax, dword [ebp - 0xe4]
push eax
call dword [0x4182f0]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [0x4182ec]
mov edx, dword [ebp - 0xa4]
push edx
call dword [0x418344]
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa8]
push eax
call dword [0x4182e4]
push 0
push 0x10288
push 0x111
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [0x41835c]
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa8]
push edx
call dword [0x4182e4]
mov dword [ebp - 0x1f8], 0
jmp 0x406067
mov eax, dword [ebp - 0x1f8]
add eax, 1
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0x1e
jge 0x4060a6
mov dword [ebp - 0x200], 0x25
push 0
mov ecx, dword [ebp - 0x200]
push ecx
push 0x100
mov edx, dword [ebp - 0xa4]
push edx
call dword [0x41835c]
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa8]
push eax
call dword [0x4182e4]
jmp 0x406058
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0xe8], ecx
jmp 0x4060c3
mov edx, dword [ebp - 0xe8]
add edx, 1
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0xe8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40614c
mov edx, dword [ebp - 0xe8]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x406105
mov dword [ebp - 0x204], 0x27
push 0
mov ecx, dword [ebp - 0x204]
push ecx
push 0x100
mov edx, dword [ebp - 0xa4]
push edx
call dword [0x41835c]
jmp 0x406138
mov eax, dword [ebp - 0xe8]
movsx ecx, byte [eax]
push ecx
call fcn.0040eb48
add esp, 4
mov dword [ebp - 0x208], eax
push 0
mov edx, dword [ebp - 0x208]
push edx
push 0x102
mov eax, dword [ebp - 0xa4]
push eax
call dword [0x41835c]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [0x4182e4]
jmp 0x4060b4
push 0xffffffffffffffff
mov edx, dword [ebp - 0xa8]
push edx
call dword [0x4182e4]
cmp dword [ebp - 0xa0], 0
je 0x406233
mov dword [ebp - 0x20c], 0x24
push 0
push 0x41bbcc
push 0
mov eax, dword [ebp - 0xe4]
push eax
call dword [0x4182f0]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [0x4182ec]
mov edx, dword [ebp - 0xa4]
push edx
call dword [0x418344]
cmp dword [ebp - 0x34], 8
jbe 0x4061b9
push 0x2ee
call dword [0x4181e8]
push 0
mov eax, dword [ebp - 0x20c]
push eax
push 0x100
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [0x41835c]
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xe8], edx
jmp 0x4061f1
mov eax, dword [ebp - 0xe8]
add eax, 1
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
movsx edx, byte [ecx]
test edx, edx
je 0x406233
mov eax, dword [ebp - 0xe8]
movsx ecx, byte [eax]
push ecx
call fcn.0040eb48
add esp, 4
mov dword [ebp - 0x210], eax
push 0
mov edx, dword [ebp - 0x210]
push edx
push 0x102
mov eax, dword [ebp - 0xa4]
push eax
call dword [0x41835c]
jmp 0x4061e2
mov ecx, dword [ebp - 0xe4]
push ecx
call dword [0x4182ec]
mov edx, dword [ebp - 0xe4]
push edx
call dword [0x418344]
mov esp, ebp
pop ebp
ret