Function at 0x401960
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45330c
mov eax, dword fs:[0]
push eax
sub esp, 0x1fc
mov eax, dword [0x46f020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x194]
mov dword [ebp - 0x198], 0x104
push eax
push 0x20019
push 0
push str.http_shellopencommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4019df
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x4019c7
mov eax, dword [eax]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor al, al
jmp 0x401e86
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0
push dword [ebp - 0x194]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x194]
test eax, eax
je 0x401a11
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4019bc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18d]
mov dword [ebp - 0x134], 0
push 8
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x1a0], eax
call fcn.00402460
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x1a4], eax
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x120], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401aa0
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.00402230
mov dword [ebp - 4], 1
lea eax, [ebp - 0x130]
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0x10
mov edx, dword [ebp - 0x130]
cmovae eax, edx
cmp byte [eax], 0x22
jne 0x401be7
mov eax, dword [ebp - 0x120]
lea esi, [ebp - 0x130]
cmp ecx, 0x10
cmovae esi, edx
cmp eax, 1
jbe 0x401b13
dec eax
push eax
lea eax, [esi + 1]
push 0x22
push eax
call fcn.00410e00
add esp, 0xc
test eax, eax
je 0x401b13
sub eax, esi
jmp 0x401b16
or eax, 0xffffffff
dec eax
lea ecx, [ebp - 0x134]
push eax
push 1
lea eax, [ebp - 0x16c]
push eax
call fcn.00401eb0
mov esi, eax
lea eax, [ebp - 0x134]
cmp eax, esi
je 0x401bd0
push 3
lea ecx, [ebp - 0x18c]
call fcn.0040baa0
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x401b83
cmp dword [ecx + 4], 0
je 0x401b7c
nop dword [eax]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
test eax, eax
jne 0x401b60
mov ecx, dword [ebp - 0x134]
mov dword [ecx + 4], 0
lea ecx, [ebp - 0x18c]
call fcn.0040bb50
mov eax, dword [ebp - 0x11c]
cmp eax, 0x10
jb 0x401ba9
inc eax
push eax
push dword [ebp - 0x130]
call fcn.00402500
add esp, 8
push esi
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
call fcn.00402340
lea ecx, [ebp - 0x16c]
call fcn.00401f90
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x130]
mov ebx, dword [ebp - 0x120]
mov eax, SysReAllocString
sub eax, ebx
mov dword [ebp - 0x19c], ebx
cmp eax, 1
jb 0x401ea2
cmp ecx, 0x10
mov dword [ebp - 0x150], 0
lea eax, [ebp - 0x130]
mov dword [ebp - 0x14c], 0
cmovae eax, edx
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x1a0], eax
mov esi, 0xf
lea eax, [ebx + 1]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x18c], eax
lea ebx, [ebp - 0x14c]
lea eax, [ebp - 0x18e]
push 8
mov dword [ebp - 0x1a8], eax
call fcn.00402460
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x1ac], eax
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], 0
mov dword [ebp - 0x150], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18c]
cmp eax, esi
jbe 0x401cc8
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x401ca4
mov esi, SysReAllocString
jmp 0x401cae
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
call fcn.00402460
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x14c], ebx
push dword [ebp - 0x19c]
lea ecx, [ebx + 1]
mov dword [ebp - 0x13c], eax
push dword [ebp - 0x1a0]
mov dword [ebp - 0x138], esi
push ecx
mov byte [ebx], 0x22
call fcn.00410670
mov eax, dword [ebp - 0x18c]
add esp, 0xc
mov byte [ebx + eax], 0
push 2
push 0x46b494
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 3
call fcn.00402640
mov esi, eax
mov byte [ebp - 4], 4
push 8
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
call fcn.00402460
add esp, 4
lea ecx, [ebp - 0x16c]
mov dword [eax + 4], 0
mov dword [ebp - 0x16c], eax
push esi
mov dword [eax], ecx
call fcn.00402340
mov byte [ebp - 4], 5
lea ebx, [edi + 4]
cmp dword [edi + 0x18], 0x10
mov eax, ebx
jb 0x401d73
mov eax, dword [ebx]
push dword [edi + 0x14]
lea ecx, [ebp - 0x16c]
push eax
call fcn.00402640
mov esi, eax
mov byte [ebp - 4], 6
push 8
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
call fcn.00402460
add esp, 4
lea ecx, [ebp - 0x188]
mov dword [eax + 4], 0
mov dword [ebp - 0x188], eax
push esi
mov dword [eax], ecx
call fcn.00402340
lea ecx, [ebp - 0x16c]
call fcn.00401f90
lea ecx, [ebp - 0x150]
call fcn.00401f90
push 0x40
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0x44
push 0
push eax
call fcn.00410bf0
add esp, 0xc
lea ecx, [ebp - 0x1bc]
cmp dword [ebp - 0x170], 0x10
lea eax, [ebp - 0x184]
cmovae eax, dword [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x208]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401e56
cmp dword [edi + 0x18], 0x10
jb 0x401e41
mov ebx, dword [ebx]
push 5
push 0
push 0
push ebx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor bl, bl
jmp 0x401e6e
push dword [ebp - 0x1bc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1b8]
call esi
mov bl, 1
lea ecx, [ebp - 0x188]
call fcn.00401f90
lea ecx, [ebp - 0x134]
call fcn.00401f90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c1e0
mov esp, ebp
pop ebp
ret
call fcn.00401950
int3