Function at 0x418d80
Capabilities:
Create process on windows
Create process suspended
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f035
mov eax, dword fs:[0]
push eax
sub esp, 0x55c
mov eax, dword [0x4c5484]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x550], ecx
call fcn.00401870
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.00401186
push eax
lea ecx, [ebp - 0x30]
call fcn.00401ec4
mov dword [ebp - 4], 0
push 0x4ac7f4
lea ecx, [ebp - 0x4c0]
call fcn.00403f8a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00403841
push eax
push str.Runnning_cmdLine___s__if_it_is_not_empty
push 0x1e7
lea eax, [ebp - 0x4c0]
push eax
push 0x4c71bc
call fcn.004021a8
push eax
call fcn.00403e63
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c0]
call fcn.0040206d
lea ecx, [ebp - 0x30]
call fcn.0040272f
test eax, eax
je 0x419105
mov ecx, dword [ebp - 0x550]
movzx edx, byte [ecx + 0x101]
test edx, edx
je 0x418ee5
lea ecx, [ebp - 0x38]
call fcn.004025ef
mov byte [ebp - 4], 2
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push SysReAllocString
lea ecx, [ebp - 0x38]
call fcn.00403030
test eax, eax
jne 0x418ed4
push 1
lea ecx, [ebp - 0x30]
call fcn.00403841
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.00401181
mov ecx, eax
call fcn.00401a7d
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x558], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x558]
call fcn.00403841
push eax
lea ecx, [ebp - 0x38]
call fcn.00401474
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4dc]
call fcn.00403364
lea ecx, [ebp - 0x38]
call fcn.00403e8b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00403eb8
jmp 0x419105
push 0x44
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.004630d0
add esp, 0xc
mov dword [ebp - 0x84], 0x44
push 0x10
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.004630d0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x4a4], cx
push 0x206
push 0
lea edx, [ebp - 0x4a2]
push edx
call fcn.004630d0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x29c], ax
push 0x206
push 0
lea ecx, [ebp - 0x29a]
push ecx
call fcn.004630d0
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00403841
push eax
push str.__s_
lea edx, [ebp - 0x4a4]
push edx
call fcn.00464435
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4f8]
push ecx
call fcn.004023b0
add esp, 8
mov dword [ebp - 0x55c], eax
mov edx, dword [ebp - 0x55c]
mov dword [ebp - 0x560], edx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x560]
call fcn.00403841
push eax
push 0x4ac890
lea eax, [ebp - 0x29c]
push eax
call fcn.00464435
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4f8]
call fcn.00403364
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x29c]
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x4a4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x419070
mov edx, dword [ebp - 0x94]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4ac8ec
lea ecx, [ebp - 0x514]
call fcn.00403f8a
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00403841
push eax
push str.Process___s__started__process_id_is___d_
push 0x1ff
lea edx, [ebp - 0x514]
push edx
push 0x4c71bc
call fcn.004021a8
push eax
call fcn.00403e63
add esp, 0x1c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x514]
call fcn.0040206d
jmp 0x419105
push str.CMainDlg::StartOrScheduleApplication
lea ecx, [ebp - 0x54c]
call fcn.00403f8a
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.004019d3
add esp, 8
mov dword [ebp - 0x564], eax
mov ecx, dword [ebp - 0x564]
mov dword [ebp - 0x568], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x568]
call fcn.00403841
push eax
lea edx, [ebp - 0x4a4]
push edx
push str.Failed_to_launch__s____s
push 0x202
lea eax, [ebp - 0x54c]
push eax
push 0x4c71fc
call fcn.004021a8
push eax
call fcn.00403e63
add esp, 0x1c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x530]
call fcn.00403364
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54c]
call fcn.0040206d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00403364
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00462614
mov esp, ebp
pop ebp
ret