Function at 0x402c6d
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push ebx
push esi
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 8]
push edi
push eax
push 0x41cf3c
xor ebx, ebx
push 1
push ebx
push 0x41cf1c
call esi
test eax, eax
jl 0x402d31
lea eax, [ebp - 0x14]
push eax
push 0x41cf2c
push 1
push ebx
push 0x41cf0c
call esi
test eax, eax
jl 0x402d21
push 0x420434
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.00402a10
push 0x420418
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.00402a10
push 0x420404
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.00402a10
push 0x4203ec
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.00402a10
push 0x4203d4
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.00402a10
push 0x4203bc
push dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.00402a10
mov eax, dword [ebp - 0x14]
add esp, 0x48
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x402d26
call fcn.00402af8
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x402d36
call fcn.00402af8
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 2
push ebx
push 0x420378
push SysReAllocString
call esi
test eax, eax
jne 0x402d76
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push 0x420370
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21f]
mov byte [ebp - 0x220], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x220]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
cmp byte [ebp + eax - 0x220], 0x5c
je 0x402dc3
dec eax
jmp 0x402db6
push 0x40
mov byte [ebp + eax - 0x21f], bl
pop ecx
xor eax, eax
lea edi, [ebp - 0x323]
mov byte [ebp - 0x324], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 1
push ebx
push 0x42033c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0x104
call esi
test eax, eax
jne 0x402f2a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x324]
push eax
push ebx
push ebx
push 0x420338
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
call sub.MFC42.DLL_CString::CString_2
cmp dword [ebp - 0x10], 7
jne 0x402ebe
lea eax, [ebp - 0x220]
push 0x42032c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x464]
pop ecx
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x402e9d
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xc]
push 0x420318
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x402f20
lea eax, [ebp - 4]
push eax
push 2
push ebx
push 0x420378
push SysReAllocString
call esi
test eax, eax
jne 0x402f20
mov dword [ebp - 0x10], ebx
push 4
lea eax, [ebp - 0x10]
jmp 0x402f09
lea eax, [ebp - 0x220]
push 0x42030c
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x464]
pop ecx
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x402e76
lea eax, [ebp - 4]
push eax
push 2
push ebx
push 0x420378
push SysReAllocString
call esi
test eax, eax
jne 0x402f20
mov dword [ebp - 0x10], ebx
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push 0x420370
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call edi
lea ecx, [ebp - 0xc]
call sub.MFC42.DLL_CString::CString
jmp 0x402f64
lea eax, [ebp - 4]
push eax
push 2
push ebx
push 0x420378
push SysReAllocString
call esi
test eax, eax
jne 0x402f64
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push ebx
push 0x420370
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret