Function at 0x417627
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push 0x4f8
mov eax, 0x556dd8
call fcn.0052faf2
mov esi, ecx
mov edi, edx
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4c0]
call fcn.0040217f
and dword [ebp - 4], 0
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4b4]
call fcn.0040217f
mov byte [ebp - 4], 1
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4b8]
call fcn.0040217f
cmp dword [ebp + 8], 0
mov byte [ebp - 4], 2
je 0x41769a
mov edi, 0x587cac
push edi
call fcn.0052ba99
pop ecx
push eax
push edi
lea ecx, [ebp - 0x4b4]
call fcn.00401e12
jmp 0x4176a6
push edi
lea ecx, [ebp - 0x4b4]
call fcn.00401ee1
mov eax, dword [esi]
push 3
push eax
lea eax, [ebp - 0x4ac]
lea ecx, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4ac], ecx
call fcn.00404273
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x4ac]
call fcn.00416e6a
mov bl, al
lea eax, [ebp - 0x4a8]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x4ac], eax
je 0x4176f2
push dword [ebp - 0x4ac]
call fcn.0052b484
pop ecx
test bl, bl
je 0x4177ec
xor edi, edi
cmp dword [ebp + 8], edi
je 0x41772b
mov ecx, dword [ebp - 0x4b8]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x4c0]
add ecx, 0xfffffff0
jmp 0x417975
push dword [ebp - 0x4b4]
lea eax, [ebp - 0x4c0]
push dword [esi]
push str._TEMP_DNAME___s__IP__s
push eax
call fcn.004034f1
add esp, 0x10
lea eax, [ebp - 0x4b0]
push eax
push 0x20019
push edi
push 0x58adb4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4178f6
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x4bc]
push eax
push edi
push str.BaseModulePath
push dword [ebp - 0x4b0]
mov dword [ebp - 0x4c4], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4177db
push 0xffffffffffffffff
push str.Corees2utility.exe
lea eax, [ebp - 0x424]
push 0x208
push eax
call fcn.0052f1fe
lea eax, [ebp - 0x424]
push eax
call fcn.0052ba99
add esp, 0x14
push eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00401e12
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4178f6
push dword [ebp - 0x4b4]
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x4c0]
push str._T:__s___s
push eax
call fcn.004034f1
add esp, 0x10
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsestcfg.exe
lea ecx, [ebp - 0x4c4]
call fcn.00401daf
mov byte [ebp - 4], 4
call fcn.0042b589
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0040217f
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x4c4]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x4bc], esp
mov esi, esp
push eax
call fcn.00401e83
add eax, 0x10
mov dword [esi], eax
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call fcn.00429900
pop ecx
pop ecx
test eax, eax
je 0x417876
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00401ee1
jmp 0x4178da
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsescfg.exe
lea ecx, [ebp - 0x4bc]
call fcn.00401daf
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x4bc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x4c8], esp
mov esi, esp
push eax
call fcn.00401e83
add eax, 0x10
mov dword [esi], eax
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call fcn.00429900
pop ecx
pop ecx
test eax, eax
je 0x4178cc
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00401ee1
mov ecx, dword [ebp - 0x4bc]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x4b0]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x4c4]
add ecx, 0xfffffff0
call fcn.004021a7
push 0x38
lea eax, [ebp - 0x500]
push 0
push eax
call fcn.0052bfd0
mov esi, dword [ebp - 0x4b8]
mov edi, dword [ebp - 0x4c0]
add esp, 0xc
lea eax, [ebp - 0x504]
push eax
mov dword [ebp - 0x504], 0x3c
mov dword [ebp - 0x500], 0x40
mov dword [ebp - 0x4f4], esi
mov dword [ebp - 0x4f0], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x4cc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x4cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esi - 0x10]
call fcn.004021a7
mov ecx, dword [ebp - 0x4b4]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [edi - 0x10]
call fcn.004021a7
call fcn.0052fb75
ret