Function at 0x53b8ac
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x53bce3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
cmp eax, 0x22
ja case.default.0x53b8d6
jmp dword [eax*4 + 0x53b8dd]
lea eax, [ebp - 0xc]
mov edx, 0x53bcf8
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bd10
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bd28
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bd40
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bd58
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bd70
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bd88
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bda0
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bdb8
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bdd4
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bdec
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be04
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be20
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be3c
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be58
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be70
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be88
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53be9c
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53beac
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bec4
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bedc
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bef4
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf0c
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf24
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf38
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf50
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf64
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf7c
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bf94
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bfac
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bfc4
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bfd4
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53bff4
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53c014
call fcn.00403ca4
jmp case.default.0x53b8d6
lea eax, [ebp - 0xc]
mov edx, 0x53c02c
call fcn.00403ca4
mov eax, dword [ebp - 0xc]
mov edx, dword [0x581dd8]
mov edx, dword [edx]
call fcn.00403f98
je 0x53bc15
sub bl, 0x20
jne 0x53bbf8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x53c04c
call fcn.00409ffc
jmp 0x53bc15
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x53c060
call fcn.00409ffc
lea eax, [ebp - 0xc]
mov edx, 0x53c078
call fcn.00403ca4
lea edx, [ebp - 0x1c]
mov eax, dword [0x581ca8]
mov eax, dword [eax]
call fcn.0043b928
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00409508
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x53c0a0
call fcn.00403ed4
mov eax, dword [ebp - 4]
call fcn.004092ac
test al, al
je 0x53bca3
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403ed4
call fcn.004ec924
test al, al
je 0x53bc89
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040404c
push eax
push 0
mov eax, dword [0x581eec]
mov eax, dword [eax]
call eax
jmp 0x53bcbb
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040404c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x53bcbb
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040404c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53bcea
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403c30
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403c30
ret