Function at 0x403850
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc14
mov ecx, 0x10
xor eax, eax
push ebx
push esi
push edi
mov esi, 0x40a76c
lea edi, [esp + 0x820]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x6f
lea edi, [esp + 0x861]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x820]
push eax
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403adc
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x20]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [esp + eax + 0x20]
dec eax
cmp cl, 0x5c
jne 0x4038bd
mov byte [esp + eax + 0x21], 0
mov edi, 0x40a75c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x21
mov esi, 0x40a6d8
lea edi, [esp + 0x620]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x5f
lea edi, [esp + 0x6a4]
rep stosd dword es:[edi], eax
mov ecx, 0x20
mov esi, 0x40a654
lea edi, [esp + 0xa20]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x5f
lea edi, [esp + 0xaa1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x620]
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x40f154]
xor ebx, ebx
test eax, eax
jle 0x403a02
push ebp
mov ebp, 0x40b154
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4039a8
mov al, byte [esi + ebp]
cmp al, 0x5c
mov byte [esp + edx + 0x224], al
jne 0x403996
inc edx
mov byte [esp + edx + 0x224], al
inc edx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x403980
mov byte [esp + edx + 0x224], 0
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x428]
push 0x40a64c
push eax
call fcn.00404580
add esp, 0xc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x424]
lea eax, [esp + 0x624]
push ecx
push 0x40a63c
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x40f154]
inc ebx
add ebp, 0x200
cmp ebx, eax
jl 0x40396c
pop ebp
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x18]
and eax, 0xffff
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1a]
and eax, 0xffff
lea ecx, [eax + edx*4 + 2]
lea edx, [esp + 0x420]
push ecx
push 0x40a630
push edx
call fcn.00404580
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x420]
lea edx, [esp + 0xa20]
push eax
push ecx
push 0x40a624
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x220]
push eax
push 0x40a614
push ecx
call fcn.00404580
add esp, 0xc
lea edx, [esp + 0x220]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3a980
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40a608
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403adc
push 0x40a5f8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a590
mov edi, eax
push 0x80000001
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push 0x40a530
push 0x80000001
call edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
add esp, 0xc14
ret