Function at 0x40c42b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00415a90
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x9c76
cmp ecx, eax
push edi
mov ebx, edx
jg 0x40c6be
je 0x40c674
mov eax, ecx
sub eax, 0x9c56
je 0x40c631
sub eax, 3
je 0x40c57a
sub eax, 9
je 0x40c55f
sub eax, 7
je 0x40c4f2
dec eax
jne 0x40c83b
xor edi, edi
cmp dword [ebx + 0xcd4], edi
ja 0x40c494
cmp dword [ebx + 0xcf4], edi
jne 0x40c83b
mov eax, dword [esi + 0x408]
cmp dword [eax + 0xb80], 2
jne 0x40c4b8
add eax, 0x870
push eax
push edi
add ebx, 0xc
push ebx
call fcn.00413d44
jmp 0x40c835
lea eax, [ebx + 0xd2c]
cmp byte [eax], 0
jne 0x40c4a8
push edi
push edi
lea eax, [ebx + 0xc]
push eax
call fcn.00413d44
add esi, 0x3d0
cmp eax, edi
mov dword [esi], eax
jne 0x40c83b
call fcn.00405f3f
test eax, eax
je 0x40c83b
push str._enable___s_
jmp 0x40c552
cmp dword [ebx + 0xcd4], 0
jne 0x40c83b
mov eax, dword [esi + 0x408]
cmp dword [eax + 0xb80], 2
jne 0x40c518
add eax, 0x870
push eax
push 1
jmp 0x40c4aa
lea eax, [ebx + 0xd2c]
cmp byte [eax], 0
jne 0x40c513
push 0
push 1
lea eax, [ebx + 0xc]
push eax
call fcn.00413d44
add esi, 0x3d0
test eax, eax
mov dword [esi], eax
jne 0x40c83b
call fcn.00405f3f
test eax, eax
je 0x40c83b
push str._disable___s_
push ebx
call fcn.0040c37f
mov dword [esi], eax
jmp 0x40c83b
movzx ebx, byte [ebx + 0xca5]
test bl, bl
je 0x40c83b
push ebx
call fcn.00401c06
pop ecx
jmp 0x40c83b
mov eax, dword [esi + 0x408]
cmp dword [eax + 0xb80], 2
jne 0x40c59d
add eax, 0x870
push eax
add ebx, 0xc
push ebx
call fcn.00413ed3
jmp 0x40c835
lea eax, [ebx + 0xd2c]
cmp byte [eax], 0
jne 0x40c58e
push 0
lea edi, [ebx + 0xc]
push edi
call fcn.00413ed3
mov dword [esi + 0x3d0], eax
call fcn.00405f3f
test eax, eax
je 0x40c60d
xor eax, eax
cmp dword [esi + 0x3d0], eax
je 0x40c60d
lea ecx, [ebp + 8]
push ecx
push 0x2011f
push eax
push str.SYSTEMCurrentControlSet
push reloc.WS2_32.dll_bind
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c5f8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c60d
push 0
push edi
call fcn.00413ed3
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 0x3d0], ecx
cmp dword [esi + 0x3d0], 0
jne 0x40c83b
call fcn.00405f3f
test eax, eax
je 0x40c83b
push str._remove___s_
jmp 0x40c82f
mov eax, dword [esi + 0x408]
cmp dword [eax + 0xb80], 2
jne 0x40c658
lea ecx, [eax + 0x870]
add ebx, 0xc
push ecx
push dword [eax + 0x58]
push ebx
call fcn.00413b8a
jmp 0x40c835
lea ecx, [ebx + 0xd2c]
add ebx, 0xc
cmp byte [ecx], 0
jne 0x40c649
push dword [eax + 0x58]
push ebx
call fcn.00413ade
jmp 0x40c835
mov cl, byte [ebx + 0xca5]
test cl, cl
je 0x40c83b
xor eax, eax
lea edi, [ebp + 9]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [ebx + 0xca6]
push 5
push 0
push 0
mov byte [ebp + 9], al
lea eax, [ebp + 8]
push eax
push str.open
push dword [esi + 0x108]
mov byte [ebp + 8], cl
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40c83b
mov eax, ecx
sub eax, 0x9c77
je 0x40c794
sub eax, 0x1c
je 0x40c744
sub eax, 3
je 0x40c6f1
sub eax, 0x1f4f
jne 0x40c83b
push ebx
lea eax, [esi + 0x3ec]
call fcn.0040f4cb
jmp 0x40c83b
mov esi, dword [esi + 0x408]
xor ecx, ecx
cmp dword [esi + 0xb80], 2
jne 0x40c70a
lea ecx, [esi + 0x870]
jmp 0x40c716
lea eax, [ebx + 0xd2c]
cmp byte [eax], cl
je 0x40c716
mov ecx, eax
push ecx
lea eax, [ebx + 0xc]
call fcn.00413ba8
test eax, eax
jne 0x40c83b
call fcn.00405f3f
test eax, eax
je 0x40c83b
push str._reload_hub___s_
push ebx
call fcn.0040c37f
jmp 0x40c83b
mov eax, dword [esi + 0x3c8]
mov eax, dword [eax + 0x1c0]
mov edx, dword [ebx]
lea ecx, [ebp - 0x2000]
push ecx
and eax, 0xffff
push eax
mov ecx, ebx
mov byte [ebp - 0x2000], 0
call dword [edx]
cmp byte [eax], 0
je 0x40c83b
push eax
lea edi, [esi + 0x3d8]
or eax, 0xffffffff
call fcn.00406ee1
push 0x417010
or eax, 0xffffffff
call fcn.00406ee1
jmp 0x40c83b
cmp dword [ebx + 0xcd4], 0
jne 0x40c83b
mov eax, dword [esi + 0x408]
cmp dword [eax + 0xb80], 2
jne 0x40c7b8
add eax, 0x870
push eax
jmp 0x40c7c5
lea eax, [ebx + 0xd2c]
cmp byte [eax], 0
jne 0x40c7b5
push 0
push 1
lea edi, [ebx + 0xc]
push edi
call fcn.00413d44
mov dword [esi + 0x3d0], eax
mov eax, dword [esi + 0x408]
push dword [eax + 0x5c]
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi + 0x408]
cmp dword [eax + 0xb80], 2
jne 0x40c802
add eax, 0x870
push eax
push 0
push edi
jmp 0x40c4ae
lea eax, [ebx + 0xd2c]
cmp byte [eax], 0
jne 0x40c7f9
push 0
push 0
push edi
call fcn.00413d44
test eax, eax
mov dword [esi + 0x3d0], eax
jne 0x40c83b
call fcn.00405f3f
test eax, eax
je 0x40c83b
push str._disable_enable___s_
push ebx
call fcn.0040c37f
mov dword [esi + 0x3d0], eax
pop edi
pop esi
pop ebx
leave
ret 4