Function at 0x4066b0
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x67c
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x678], eax
mov eax, dword [esp + 0x680]
mov edx, dword [0x596c5c]
push ebp
push edi
xor ebp, ebp
push 0x38
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, dword [str.Version]
lea eax, [esp + 0x24]
push ebp
push eax
mov dword [esp + 0x24], 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x28], 0x3c
call fcn.00412eb0
add esp, 0xc
cmp edi, ebp
jne 0x40672f
pop edi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
push esi
mov esi, str.HKEY_LOCAL_MACHINE
call fcn.00407920
lea ecx, [esp + 0x10]
push ecx
push 0x20119
push ebp
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406c97
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push ebp
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x6c]
push ecx
push edx
call esi
mov ebp, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
push 0
lea eax, [esp + 0x6c]
push eax
push ecx
call esi
or eax, ebp
mov eax, dword [esp + 0x18]
jne 0x406c7e
cmp eax, 0x71e0203
jb 0x406c7e
mov edx, dword [0x5a7518]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x64]
push eax
push edi
mov edi, str.InstallLocation
mov eax, str.HKEY_LOCAL_MACHINE
call fcn.00407a40
mov esi, eax
add esp, 8
test esi, esi
jne 0x406c58
lea ecx, [esp + 0x64]
push ecx
push str.location:__s
call fcn.00402730
add esp, 8
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x64]
mov byte [esp + eax + 0x164], cl
inc eax
test cl, cl
jne 0x4067f0
lea edi, [esp + 0x164]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406808
mov dx, word [0x59656c]
lea eax, [esp + 0x164]
mov word [edi], dx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406822
mov ecx, dword [str.iNodeCmd.exe]
mov edx, dword [0x596cf8]
mov dword [eax], ecx
mov ecx, dword [0x596cfc]
mov dword [eax + 4], edx
mov dl, byte [0x596d00]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x164]
push eax
push str.path_of_inode_cmd:__s
call fcn.00402730
lea ecx, [esp + 0x16c]
push 0
push ecx
call fcn.0040a89a
add esp, 0x10
cmp eax, 0xffffffff
je 0x406c97
mov ecx, ebx
call fcn.004081d0
mov esi, eax
test esi, esi
je 0x4068a4
pop esi
pop edi
mov eax, 0xfffffffb
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
push 0x104
lea edx, [esp + 0x378]
push edx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x374]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4068c4
mov ecx, dword [str.cookie.ini]
mov edx, dword [0x5970ac]
mov dword [eax], ecx
mov ecx, dword [0x5970b0]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea edx, [esp + 0x374]
push edx
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0x484]
push str._c__s__g_inodecmd.txt__f__s__v_7000
push ecx
call fcn.00409b67
lea edx, [esp + 0x48c]
push edx
push 0x5970d8
call fcn.00402730
add esp, 0x18
call fcn.00407730
test eax, eax
je 0x40696f
push 0
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x484]
push ecx
push 0x596d54
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
mov eax, dword [0x5a7518]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x64]
lea eax, [esp + 0x47c]
push ecx
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x30], str.runas
mov dword [esp + 0x34], str.iNodeCmd.exe
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x406a2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x4069f1
push str.failed_to_granted_elevated.
call fcn.00402730
mov eax, dword [0x5a7518]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
cmp eax, 2
jne 0x406c58
push str.faild_to_find_file.
call fcn.00402730
mov eax, dword [0x5a7518]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [esp + eax + 0x26c], cl
inc eax
test cl, cl
jne 0x406a40
lea eax, [esp + 0x26c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406a58
mov edx, dword [str.inodecmd.txt]
mov ecx, dword [0x5970e0]
mov dword [eax], edx
mov edx, dword [0x5970e4]
mov dword [eax + 4], ecx
mov cx, word [0x5970e8]
mov dword [eax + 8], edx
lea edx, [esp + 0x26c]
push 0x5970ec
push edx
mov word [eax + 0xc], cx
call fcn.0040aea0
mov esi, eax
add esp, 8
test esi, esi
jne 0x406ad0
lea eax, [esp + 0x26c]
push eax
push str.failed_to_open__s.
call fcn.00402730
add esp, 8
lea eax, [esi - 3]
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
push 0
push 0xc
push esi
call fcn.0040af77
push esi
lea ecx, [esp + 0x74]
push 0x100
push ecx
call fcn.0040ac94
add esp, 0x18
test eax, eax
jne 0x406b21
push str.failed_to_get_file_stream.
call fcn.00402730
push esi
call fcn.0040b073
add esp, 8
pop esi
pop edi
mov eax, 0xfffffffc
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
push esi
call fcn.0040b073
lea edx, [esp + 0x6f]
push edx
push str.status__s.
call fcn.00402730
add esp, 0xc
mov ecx, 0x59712c
lea eax, [esp + 0x6b]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406b62
test dl, dl
je 0x406b5e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406b62
add eax, 2
add ecx, 2
test dl, dl
jne 0x406b42
xor eax, eax
jmp 0x406b67
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406b85
mov ecx, dword [str.offline]
mov eax, dword [esp + 0xc]
mov dword [eax], ecx
mov edx, dword [0x597134]
mov dword [eax + 4], edx
jmp 0x406c56
mov ecx, 0x597138
lea eax, [esp + 0x6b]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406bb0
test dl, dl
je 0x406bac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406bb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x406b90
xor eax, eax
jmp 0x406bb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406bde
mov ecx, dword [str.online]
mov eax, dword [esp + 0xc]
mov dword [eax], ecx
mov dx, word [0x597140]
mov word [eax + 4], dx
mov cl, byte [0x597142]
mov byte [eax + 6], cl
jmp 0x406c56
mov ecx, 0x597144
lea eax, [esp + 0x6b]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x406c07
test dl, dl
je 0x406c03
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x406c07
add eax, 2
add ecx, 2
test dl, dl
jne 0x406be7
xor eax, eax
jmp 0x406c0c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x406c32
mov edx, dword [str.different]
mov eax, dword [esp + 0xc]
mov dword [eax], edx
mov ecx, dword [0x59714c]
mov dword [eax + 4], ecx
mov dx, word [0x597150]
mov word [eax + 8], dx
jmp 0x406c56
push str.other_status.
call fcn.00402730
mov ecx, dword [str.other]
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
mov dx, word [0x597168]
add esp, 4
mov word [eax + 4], dx
xor esi, esi
mov eax, dword [0x5a7518]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00409b58
add esp, 0x67c
ret
push eax
push str.version:__d
call fcn.00402730
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x684]
pop esi
pop edi
pop ebp
xor ecx, esp
mov eax, 0xfffffffe
call fcn.00409b58
add esp, 0x67c
ret