Function at 0x402c40
Capabilities:
Create process on windows
Create process suspended
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587e82
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x5f3fcc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x254]
mov dword [ebp - method.RegistryKey.virtual_0], vtable.RegistryKey.0
xor bl, bl
call fcn.004213f0
push ecx
push 1
push str.SOFTWAREMicrosoftDirectXUserGpuPreferences
push SysReAllocString
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], 0
call fcn.00412e10
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 1
call fcn.004213f0
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.00412930
lea ecx, [ebp - 0x270]
call fcn.004213f0
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x228]
call fcn.00421910
push eax
lea ecx, [ebp - 0x260]
call fcn.00412d00
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test al, al
je 0x402d0f
push str.GpuPreference0_
lea ecx, [ebp - 0x270]
call fcn.00421810
test eax, eax
jne 0x402d35
lea ecx, [ebp - 0x228]
call fcn.00421910
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
je 0x402d33
push 0x22
push str.GpuPreference0_
push 1
push 0
push eax
push ecx
call esi
mov bl, 1
lea ecx, [ebp - 0x238]
mov dword [ebp - method.RegistryKey.virtual_0], vtable.RegistryKey.0
call fcn.004213f0
push ecx
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentversionAppCompatFlagsLayers
push SysReAllocString
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 4
call fcn.00412e10
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x228]
call fcn.00421910
push eax
lea ecx, [ebp - 0x244]
call fcn.00412d00
test al, al
jne 0x402db2
lea ecx, [ebp - 0x228]
call fcn.00421910
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x402dba
push 0x1a
push str.HIGHDPIAWARE
push 1
push 0
push eax
push ecx
call esi
jmp 0x402dba
test bl, bl
je 0x402e64
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2b4], 0x44
push eax
lea eax, [ebp - 0x2b4]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
movlpd qword [ebp - 0x2b0], xmm0
push eax
movlpd qword [ebp - 0x2a8], xmm0
movlpd qword [ebp - 0x2a0], xmm0
movlpd qword [ebp - 0x298], xmm0
movlpd qword [ebp - 0x290], xmm0
movlpd qword [ebp - 0x288], xmm0
movlpd qword [ebp - 0x280], xmm0
movlpd qword [ebp - 0x278], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x240]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - method.RegistryKey.virtual_0], vtable.RegistryKey.0
test eax, eax
je 0x402e93
cmp eax, dword [ebp - 0x23c]
je 0x402e89
push eax
call esi
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x238]
call fcn.00421460
lea ecx, [ebp - 0x270]
call fcn.00421460
lea ecx, [ebp - 0x228]
call fcn.00421460
mov eax, dword [ebp - 0x25c]
mov dword [ebp - method.RegistryKey.virtual_0], vtable.RegistryKey.0
test eax, eax
je 0x402edd
cmp eax, dword [ebp - 0x258]
je 0x402ed3
push eax
call esi
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x254]
call fcn.00421460
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00567879
mov esp, ebp
pop ebp
ret