Function at 0x45d2e0
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x45d2e8
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x463238
mov edi, 0x4635d8
xor eax, eax
push ebp
push 0x45dfa6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4635f0], 0xfffffffd
je 0x45df56
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x318]
call fcn.004364c4
lea eax, [ebp - 0x10]
mov edx, 0x45dfbc
call fcn.00404bd8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x318]
call fcn.004364f4
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x318]
call fcn.004364c4
mov edx, dword [ebp - 0x14]
mov eax, 0x4635dc
call fcn.00404964
xor edx, edx
mov eax, dword [ebx + 0x318]
mov ecx, dword [eax]
call dword [ecx + 0x64]
cmp byte [0x463601], 1
jne 0x45d382
lea eax, [ebp - 8]
mov edx, 0x45dfc8
call fcn.004049a8
jmp 0x45d38f
lea eax, [ebp - 8]
mov edx, 0x45dfe4
call fcn.004049a8
push dword [edi]
push 0x45e000
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x1c]
push 0x45e010
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00404c90
mov edx, dword [ebp - 0x18]
mov eax, 0x463610
call fcn.00402e48
mov eax, dword [0x461170]
mov byte [eax], 0
mov eax, 0x463610
call fcn.00402bd8
call fcn.0040287c
mov eax, 0x463610
call fcn.00403300
mov dword [0x463604], eax
mov eax, 0x463610
call fcn.00403300
mov dword [0x463608], eax
mov eax, 0x463610
call fcn.00403450
call fcn.0040287c
xor eax, eax
mov al, byte [0x463601]
add eax, 0xb
xor edx, edx
mov dl, byte [0x463600]
add eax, dword [edx*4 + 0x463604]
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fld dword [0x45e018]
call fcn.004030b0
fstp qword [0x4637ec]
wait
mov byte [0x4635f6], 1
xor eax, eax
mov dword [0x4637e4], eax
mov dword [0x4637e8], eax
xor edx, edx
mov eax, dword [ebx + 0x34c]
call fcn.004581ec
push 0
lea eax, [ebp - 0x24]
mov ecx, 0x45e024
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
mov ecx, 0x45e034
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x28]
xor ecx, ecx
pop edx
call fcn.0045c978
call fcn.0045c85c
lea eax, [ebp - 0x2c]
mov ecx, 0x45e034
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x2c]
mov edx, 0x4635d4
call fcn.0045b388
mov eax, dword [0x4635d4]
push eax
call sub.gdi32.dll_AddFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
call fcn.0045c85c
xor edx, edx
mov eax, dword [ebx + 0x34c]
call fcn.004581ec
push 0
lea eax, [ebp - 0x30]
mov ecx, 0x45e024
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
mov ecx, 0x45e054
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x34]
xor ecx, ecx
pop edx
call fcn.0045c978
call fcn.0045c85c
lea eax, [ebp - 0x38]
mov ecx, 0x45e054
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x38]
mov edx, 0x4635d4
call fcn.0045b388
mov eax, dword [0x4635d4]
push eax
call sub.gdi32.dll_AddFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
call fcn.0045c85c
push 0x45e070
push dword [edi]
push dword [ebp - 8]
push 0x45e088
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404c90
mov edx, 0x4635d4
mov eax, dword [ebp - 4]
call fcn.0045b388
push 0
mov eax, dword [0x4635d4]
push eax
call sub.kernel32.dll_WinExec
call fcn.0045c85c
push 0
lea eax, [ebp - 0x3c]
mov ecx, 0x45e094
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov edx, dword [0x4635fc]
call fcn.0045c978
call fcn.0045c85c
cmp byte [0x463601], 1
jne 0x45d62d
push 0
lea eax, [ebp - 0x40]
mov ecx, 0x45e0b0
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
mov ecx, 0x45e0c4
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x44]
xor ecx, ecx
pop edx
call fcn.0045c978
call fcn.0045c85c
push 0
lea eax, [ebp - 0x48]
mov ecx, 0x45e0b0
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
mov ecx, 0x45e0e4
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
pop edx
call fcn.0045c978
call fcn.0045c85c
jmp 0x45d679
push 0
lea eax, [ebp - 0x50]
mov ecx, 0x45e100
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov edx, dword [0x4635fc]
call fcn.0045c978
call fcn.0045c85c
push 0
lea eax, [ebp - 0x54]
mov ecx, 0x45e11c
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov edx, dword [0x4635fc]
call fcn.0045c978
call fcn.0045c85c
push 1
lea eax, [ebp - 0x58]
mov ecx, 0x45e13c
mov edx, dword [edi]
call fcn.00404c1c
mov eax, dword [ebp - 0x58]
mov cl, 1
mov edx, dword [0x4635dc]
call fcn.0045c978
call fcn.0045c85c
xor eax, eax
mov al, byte [0x463600]
mov eax, dword [eax*4 + 0x463604]
call fcn.0045cb94
push 0x45e158
lea edx, [ebp - 0x60]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x60]
push 0x45e178
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00404c90
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
cmp byte [0x463600], 0
jne 0x45d83e
push 0x45e184
push dword [edi]
push 0x45e198
lea edx, [ebp - 0x68]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x68]
push 0x45e1a8
lea edx, [ebp - 0x6c]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x6c]
push 0x45e1bc
push dword [edi]
push 0x45e1cc
lea eax, [ebp - 0x64]
mov edx, 9
call fcn.00404c90
mov edx, dword [ebp - 0x64]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [edi]
push 0x45e1d8
lea edx, [ebp - 0x74]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x74]
push 0x45e1ec
push dword [edi]
push 0x45e1cc
lea eax, [ebp - 0x70]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0x70]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [edi]
push 0x45e204
lea edx, [ebp - 0x7c]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x7c]
push 0x45e21c
push dword [edi]
push 0x45e1cc
lea eax, [ebp - 0x78]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0x78]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [edi]
push 0x45e238
lea edx, [ebp - 0x84]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x84]
push 0x45e24c
push dword [edi]
push 0x45e1cc
lea eax, [ebp - 0x80]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0x80]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x45d9c2
push 0x45e184
push dword [0x4635dc]
push 0x45e198
lea edx, [ebp - 0x8c]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x8c]
push 0x45e1a8
lea edx, [ebp - 0x90]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x90]
push 0x45e1cc
lea eax, [ebp - 0x88]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0x88]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [0x4635dc]
push 0x45e1d8
lea edx, [ebp - 0x98]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0x98]
push 0x45e1ec
push dword [0x4635dc]
push 0x45e1cc
lea eax, [ebp - 0x94]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0x94]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [0x4635dc]
push 0x45e204
lea edx, [ebp - 0xa0]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0xa0]
push 0x45e21c
push dword [0x4635dc]
push 0x45e1cc
lea eax, [ebp - 0x9c]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [0x4635dc]
push 0x45e238
lea edx, [ebp - 0xa8]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0xa8]
push 0x45e24c
push dword [0x4635dc]
push 0x45e1cc
lea eax, [ebp - 0xa4]
mov edx, 7
call fcn.00404c90
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x45e184
push dword [0x4635dc]
push 0x45e264
lea edx, [ebp - 0xb0]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0xb0]
push 0x45e1cc
lea eax, [ebp - 0xac]
mov edx, 5
call fcn.00404c90
mov edx, dword [ebp - 0xac]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x220]
mov edx, 0x45e28c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x30c]
mov edx, dword [eax + 0x220]
mov cl, 1
mov eax, dword [ebx + 0x304]
call fcn.00459ea0
call fcn.0045c85c
cmp byte [0x463601], 1
je 0x45ddc4
mov eax, dword [0x461170]
mov byte [eax], 0
mov eax, esi
call fcn.00402bd8
call fcn.0040287c
lea eax, [ebp - 0xb4]
mov ecx, 0x45e2a8
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov edx, dword [ebp - 0xb4]
mov eax, 0x463404
call fcn.00402e48
mov eax, 0x463404
call fcn.00402be4
call fcn.0040287c
lea edx, [ebp - 4]
mov eax, esi
call fcn.004033e4
mov eax, esi
call fcn.00403450
call fcn.0040287c
mov edx, dword [ebp - 4]
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov eax, dword [ebp - 4]
mov edx, 0x45e2bc
call fcn.00404d1c
je 0x45daf9
mov eax, dword [ebp - 4]
mov edx, 0x45e2d0
call fcn.00404d1c
je 0x45daf9
mov eax, esi
call fcn.00403078
call fcn.0040287c
test al, al
je 0x45da9e
mov eax, esi
call fcn.00403078
call fcn.0040287c
test al, al
jne 0x45dca7
mov eax, dword [ebp - 4]
mov edx, 0x45e2bc
call fcn.00404d1c
jne 0x45db69
cmp byte [0x4637df], 0
jne 0x45db3e
mov edx, 0x45e2e4
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
cmp byte [0x4637e0], 0
jne 0x45db60
mov edx, 0x45e300
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov dword [ebp - 0xc], 1
jmp 0x45db70
mov dword [ebp - 0xc], 2
lea edx, [ebp - 4]
mov eax, esi
call fcn.004033e4
mov eax, esi
call fcn.00403450
call fcn.0040287c
mov edx, dword [ebp - 4]
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov eax, dword [ebp - 4]
mov edx, 0x45e2bc
call fcn.00404d1c
je 0x45dbcb
mov eax, dword [ebp - 4]
mov edx, 0x45e2d0
call fcn.00404d1c
je 0x45dbcb
mov eax, esi
call fcn.00403078
call fcn.0040287c
test al, al
je 0x45db70
mov eax, esi
call fcn.00403078
call fcn.0040287c
test al, al
jne 0x45dc3b
mov eax, dword [ebp - 4]
mov edx, 0x45e2d0
call fcn.00404d1c
je 0x45dd30
cmp byte [0x4637df], 0
jne 0x45dc10
mov edx, 0x45e2e4
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
cmp byte [0x4637e0], 0
jne 0x45dd30
mov edx, 0x45e300
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
jmp 0x45dd30
mov eax, dword [ebp - 0xc]
sub eax, 2
je 0x45dc48
jmp 0x45dd30
mov eax, 0x463404
call fcn.00403688
call fcn.0040287c
mov edx, 0x45e2bc
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov edx, 0x45e2e4
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov edx, 0x45e300
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
jmp 0x45dd30
mov eax, 0x463404
call fcn.00403688
call fcn.0040287c
mov edx, 0x45e2bc
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov edx, 0x45e2e4
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov edx, 0x45e300
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
jmp 0x45dd30
lea edx, [ebp - 4]
mov eax, esi
call fcn.004033e4
mov eax, esi
call fcn.00403450
call fcn.0040287c
mov edx, dword [ebp - 4]
mov eax, 0x463404
call fcn.00404fc0
call fcn.00403688
call fcn.0040287c
mov eax, esi
call fcn.00403078
call fcn.0040287c
test al, al
je 0x45dd03
mov eax, 0x463404
call fcn.00402f10
call fcn.0040287c
mov eax, esi
call fcn.00402f10
call fcn.0040287c
push 1
lea eax, [ebp - 0xb8]
mov ecx, 0x45e320
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0xb8]
push eax
lea eax, [ebp - 0xbc]
mov ecx, 0x45e2a8
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
pop edx
call fcn.0045c978
lea eax, [ebp - 0xc0]
mov ecx, 0x45e2a8
mov edx, dword [0x4635f8]
call fcn.00404c1c
mov eax, dword [ebp - 0xc0]
call fcn.00409040
call fcn.0045c85c
push 1
push dword [edi]
push 0x45e000
lea edx, [ebp - 0xc8]
mov eax, 8
call fcn.0040896c
push dword [ebp - 0xc8]
push 0x45e010
lea eax, [ebp - 0xc4]
mov edx, 4
call fcn.00404c90
mov eax, dword [ebp - 0xc4]
mov cl, 1
mov edx, dword [0x4635dc]
call fcn.0045c978
call fcn.0045c85c
mov dl, 1
mov eax, dword [ebx + 0x350]
call fcn.004363e4
mov eax, 0x463610
call fcn.00402f10
call fcn.0040287c
mov eax, dword [0x461168]
mov dl, byte [0x463600]
mov byte [eax], dl
cmp byte [0x463601], 1
jne 0x45de56
mov eax, dword [0x461168]
push edi
lea edi, [eax + 1]
mov esi, 0x45e32c
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
jmp 0x45de68
mov eax, dword [0x461168]
push edi
lea edi, [eax + 1]
mov esi, 0x45e330
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [0x461168]
add eax, 0x204
mov edx, dword [edi]
mov ecx, 0xff
call fcn.00404bac
mov eax, dword [0x461168]
add eax, 0x304
mov edx, dword [0x4635dc]
mov ecx, 0xff
call fcn.00404bac
mov al, byte [0x463600]
sub al, 1
jb 0x45dea5
je 0x45ded1
jmp 0x45df03
mov eax, dword [0x461168]
add eax, 4
mov edx, dword [edi]
mov ecx, 0xff
call fcn.00404bac
mov eax, dword [0x461168]
add eax, 0x104
mov edx, dword [edi]
mov ecx, 0xff
call fcn.00404bac
jmp 0x45df03
mov eax, dword [0x461168]
add eax, 4
mov edx, dword [0x4635dc]
mov ecx, 0xff
call fcn.00404bac
mov eax, dword [0x461168]
add eax, 0x104
mov edx, dword [0x4635dc]
mov ecx, 0xff
call fcn.00404bac
lea edx, [ebp - 0xd0]
mov eax, dword [ebx + 0x3a0]
call fcn.004364c4
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.0045b46c
mov edx, dword [ebp - 0xcc]
mov eax, dword [0x461168]
add eax, 0x504
mov ecx, 0xff
call fcn.00404bac
mov eax, dword [0x461168]
mov cl, 8
mov edx, dword [0x4635fc]
call fcn.0045ba8c
call fcn.0045c85c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dfad
lea eax, [ebp - 0xd0]
call fcn.00404910
lea eax, [ebp - 0xcc]
mov edx, 0x2b
call fcn.00404934
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404934
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404934
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404934
ret