Function at 0x40b120
Capabilities:
Create thread
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541021
mov eax, dword fs:[0]
push eax
sub esp, 0xa4c
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, 0x484c6f67
ja 0x40b621
je 0x40b562
cmp eax, 0x45727221
ja 0x40b38d
je 0x40b2b2
cmp eax, 0x43535052
ja 0x40b27f
je 0x40b21a
cmp eax, 0x4150726f
je 0x40b1da
cmp eax, 0x41537464
jne 0x40bac0
xor bl, bl
call fcn.00402f10
test al, al
je 0x40b1ac
call fcn.00402f40
test al, al
jne 0x40b1d0
push 0xc8
call fcn.00409e00
add esp, 4
cmp eax, 1
je 0x40b1d0
push 0xc8
call fcn.00409e00
add esp, 4
cmp eax, 0xffffffff
jne 0x40b1d2
mov bl, 1
movzx eax, bl
jmp 0x40bac2
xor bl, bl
call fcn.00402f10
test al, al
je 0x40b1f8
call fcn.00402f20
test al, al
je 0x40b1f8
mov cl, 1
movzx eax, cl
jmp 0x40bac2
push 0x12c
call fcn.00409e00
mov edx, 1
movzx ecx, bl
add esp, 4
cmp eax, edx
cmove ecx, edx
movzx eax, cl
jmp 0x40bac2
lea eax, [ebp - 0xa4c]
push eax
push 0x5543ec
push 0x554440
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40bac0
push 0xa
lea eax, [ebp - 0x218]
push eax
push dword [esi + 4]
call fcn.00528aca
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xa4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xa4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40bac0
cmp eax, 0x4368726d
je 0x40b2a5
cmp eax, 0x44697374
jne 0x40bac0
push 0
push 0x12c
call fcn.0040c490
add esp, 8
jmp 0x40bac2
call fcn.00402f30
movzx eax, al
jmp 0x40bac2
mov edx, dword [esi + 8]
test edx, edx
je 0x40b317
mov ecx, edx
lea edi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b2c0
sub ecx, edi
sar ecx, 1
je 0x40b317
push 0x80
push edx
push 0x5a94d4
call fcn.00528086
push dword [esi + 8]
push dword [0x5a925c]
call fcn.0040d430
push 0xffffffffffffffff
push dword [0x5a925c]
call fcn.0040d430
add esp, 0x1c
push 0
push 0x1b58
push 0x9006
push dword [0x5a94a8]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x554484
mov ecx, 0x5a94a8
call fcn.0040fe60
push 0
mov ecx, 0x5a94a8
call fcn.0040f790
mov eax, dword [0x5a925c]
test eax, eax
je 0x40bac0
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push 0x144
push 0xc9
push eax
call esi
push 0
push 0
push 0x146
push 0xc9
push dword [0x5a925c]
call esi
test eax, eax
jne 0x40bac0
push eax
push 2
push 0x111
push dword [0x5a925c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40bac0
cmp eax, 0x48456e64
ja 0x40b517
je 0x40b4a5
cmp eax, 0x45756c61
je 0x40b3c0
cmp eax, 0x47504446
jne 0x40bac0
push dword [esi + 8]
call fcn.0040abb0
add esp, 4
jmp 0x40bac2
mov eax, dword [0x5a9268]
cmp eax, 0x47
je 0x40b491
cmp eax, 0x17b
je 0x40b491
cmp dword [0x5a9274], 1
je 0x40b49b
cmp dword [0x5a9270], 0
ja 0x40b46b
mov eax, dword [esi + 8]
xor edi, edi
test eax, eax
je 0x40b3fc
mov esi, dword [eax]
jmp 0x40b404
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp dword [0x5a926c], edi
jg 0x40b446
call fcn.00402f10
test al, al
jne 0x40b446
push 0
push 0x15f90
push 0x9009
push dword [0x5a94a8]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x5a926c], 0xffffffff
mov edi, 1
mov dword [0x5a9278], 1
push 0x5a9270
push 0
push esi
push 0x40a4e0
push 0
push 0
call fcn.00528ef7
mov dword [0x5a9238], eax
add esp, 0x18
mov eax, edi
jmp 0x40bac2
mov ecx, dword [0x5a926c]
xor eax, eax
cmp ecx, 0xffffffff
jne 0x40b487
cmp dword [0x5a9278], 1
sete al
jmp 0x40bac2
test ecx, ecx
sete al
jmp 0x40bac2
mov dword [0x5a9274], 1
mov eax, 1
jmp 0x40bac2
call fcn.0040d750
test al, al
je 0x40bac0
push 0x5a90d0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 2
cmp dword [0x5a9288], 0
jne 0x40b4e1
cmp dword [0x5a924c], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
mov dword [ebp - 4], 0xffffffff
push 0x5a90d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x40bac0
call fcn.00404870
test al, al
je 0x40bac0
push 0
call fcn.00406550
add esp, 4
jmp 0x40bac0
cmp eax, 0x484c6b76
jne 0x40bac0
call fcn.0040d750
test al, al
je 0x40bac0
call fcn.00404870
test al, al
je 0x40b562
cmp dword [esi + 4], 0x20c
jne 0x40b562
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40b562
lea eax, [ecx + 0x108]
push eax
lea eax, [ecx + 4]
push eax
push dword [ecx]
call fcn.004064c0
add esp, 0xc
jmp 0x40bac2
mov eax, dword [0x5a9238]
test eax, eax
je 0x40b58d
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x5a9238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5a9238], 0
call fcn.00402f10
test al, al
je 0x40bac0
call fcn.0040d750
test al, al
je 0x40bac0
call fcn.00404870
test al, al
jne 0x40b5b5
call fcn.00404660
call fcn.00404870
test al, al
je 0x40b617
cmp dword [esi + 4], 0x104
jbe 0x40b5fa
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40b5fa
push dword [ecx + 0xc4]
lea eax, [ecx + 0xd0]
push dword [ecx + 0xc8]
push eax
lea eax, [ecx + 0x82]
push eax
lea eax, [ecx + 0x41]
push eax
push ecx
call fcn.00404ae0
add esp, 0x18
jmp 0x40bac2
push 0
push 0
push 0
push str.Invalid_Data
push str.HeadLight
push str.CreatePDF
call fcn.00404ae0
add esp, 0x18
call fcn.00402ef0
jmp 0x40bac0
cmp eax, 0x53504446
ja 0x40b8a5
je 0x40b81b
cmp eax, 0x4e446973
ja 0x40b6d8
je 0x40b6c4
cmp eax, 0x49737573
je 0x40b6b7
cmp eax, 0x4d61696c
jne 0x40bac0
lea eax, [ebp - 0xa50]
push eax
push 0x554414
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40bac0
push 4
lea eax, [ebp - 0xa4c]
mov dword [ebp - 0xa4c], 1
push eax
push 4
push 0
push dword [esi + 8]
push dword [ebp - 0xa50]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x1388
push 0x9003
push dword [0x5a94a8]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40bac0
call fcn.0040eac0
movzx eax, al
jmp 0x40bac2
push 1
push 0x12c
call fcn.0040c490
add esp, 8
jmp 0x40bac2
cmp eax, 0x5253564e
je 0x40b7e5
cmp eax, 0x53446c67
jne 0x40bac0
push 0x2001f
push 0
push SysReAllocString
lea ecx, [ebp - 0xa54]
call fcn.00407cf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa54]
push 1
push str.AcroTrayShowStatus
call fcn.00408030
test al, al
je 0x40b7ce
mov eax, dword [esi + 4]
cmp eax, 0x830
jne 0x40b738
push dword [esi + 8]
jmp 0x40b7c6
cmp eax, 0x41c
jne 0x40b7ce
mov edi, dword [esi + 8]
lea eax, [ebp - 0xa44]
push 0x82c
push 0
push eax
mov dword [ebp - 0xa48], 0
call fcn.00525b40
mov eax, dword [edi + 4]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xa44], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x220], eax
mov eax, dword [edi]
push 0x208
mov dword [ebp - 0xa48], eax
lea eax, [ebp - 0x630]
push eax
push 0x208
lea eax, [edi + 0x214]
push eax
push 1
push 0
call esi
push 0x208
lea eax, [ebp - 0xa40]
push eax
push 0x208
lea eax, [edi + 0xc]
push eax
push 1
push 0
call esi
lea eax, [ebp - 0xa48]
push eax
call fcn.00409eb0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa54]
call fcn.00407da0
jmp 0x40bac0
call fcn.00402f50
mov bl, al
call fcn.00402f10
test al, al
je 0x40b7fc
call fcn.00402f00
jmp 0x40b801
call fcn.0040c110
test bl, bl
je 0x40bac0
test al, al
je 0x40bac0
mov eax, 1
jmp 0x40bac2
lea eax, [ebp - 0xa4c]
push eax
push 0x554374
push 0x5543a8
call fcn.00403f40
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test edi, edi
jne 0x40b89e
mov esi, dword [esi + 8]
lea eax, [ebp - 0x218]
push 0xa
push eax
push dword [esi + 0x410]
call fcn.00528aca
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b865
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xa4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xa4c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40bac2
cmp eax, 0x546f6f6c
ja 0x40ba5b
je 0x40ba3c
cmp eax, 0x53686f77
je 0x40ba2d
cmp eax, 0x54456e64
jne 0x40bac0
push 0x104
push dword [esi + 8]
push 0x5a9290
call fcn.00528086
add esp, 0xc
mov ecx, 0x5a94a8
push 0x5a9290
call fcn.0040f560
push 0x5a9290
push dword [0x5a925c]
call fcn.0040d430
add esp, 8
test eax, eax
je 0x40b972
push dword [0x5a925c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40b972
push 0x2001f
push 0
push SysReAllocString
lea ecx, [ebp - 0xa54]
call fcn.00407cf0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xa54]
push 1
push str.AcroTrayDisplayPDFCreation
call fcn.00408030
test al, al
je 0x40b7ce
push 0x5a9290
mov ecx, 0x5a94a8
call fcn.0040ff70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa54]
call fcn.00407da0
jmp 0x40b97c
mov ecx, 0x5a94a8
call fcn.0040f6d0
mov eax, dword [0x5a925c]
test eax, eax
je 0x40bac0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40bac0
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
push 0x150
push 0xc9
push dword [0x5a925c]
call esi
test eax, eax
je 0x40bac0
cmp eax, 0xffffffff
je 0x40b9d1
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0
push 0x144
push 0xc9
push dword [0x5a925c]
call esi
push 0
push 0
push 0x146
push 0xc9
push dword [0x5a925c]
call esi
push 0
test eax, eax
jne 0x40ba14
push dword [0x5a925c]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40bac0
push 0
push 0x14e
push 0xc9
push dword [0x5a925c]
call esi
jmp 0x40bac0
mov ecx, 0x5a94a8
call fcn.0040ff30
jmp 0x40bac0
push dword [esi + 8]
mov ecx, 0x5a94a8
call fcn.0040fe60
push 0x5a94d4
push dword [0x5a925c]
call fcn.0040d430
jmp 0x40babd
cmp eax, 0x56696577
jne 0x40bac0
mov edi, dword [esi + 8]
test edi, edi
je 0x40bac0
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00525b40
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0
push edi
call fcn.00528b56
lea eax, [ebp - 0x210]
push str..pdf
push eax
call fcn.005280c6
add esp, 0x28
test eax, eax
jne 0x40bac0
push dword [esi + 8]
push dword [0x5a94a8]
call fcn.0040d880
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret