Function at 0x673e6c4b
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
and edi, 0xd
je 0x673e6ece
mov eax, dword [0x67466460]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], 0x673e6c1c
mov dword [ebp - 0x28], str.DPPPDLL32
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x673e6cc2
push esi
push str.Fatal_Error
push str.Cannot_register_class_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x673e7075
xor ebx, ebx
mov eax, dword [0x67466460]
push ebx
push eax
push ebx
mov eax, Ordinal_2
push ebx
mov esi, str.DPPPDLL32
push ebx
push eax
push ebx
push eax
push 0xa0000
push esi
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
mov dword [ebp - 0x10], eax
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x673e6d40
push 6
push str.machnm1.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x673e6d40
push ebx
push str.Fatal_Error
push str.Cannot_execute_machnm1.exe_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x67466460]
push eax
push esi
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x673e7075
mov esi, 0xe
xor ebx, ebx
push ebx
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x673e6da2
push 1
lea eax, [ebp - 0x68]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x673e6d94
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
lea eax, [ebp - 0x68]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x673e6d6d
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x673e6d47
test esi, esi
jne 0x673e6dde
push 0
push str.Fatal_Error
push str.Cannot_communicate_with_machnm1.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x67466460]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x673e7075
push dword [ebp + 0xc]
push 0x674666e4
xor esi, esi
mov dword [0x674666e0], edi
call sub.MSVCR80.dll_strcpy
add esp, 8
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], esi
mov al, byte [eax]
push ecx
push dword [ebp - 0x10]
push 0x4a
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], 0x674666e0
mov byte [0x674666f3], al
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov edi, 0xe
push esi
push 0x10
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x673e6e51
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
jne 0x673e6e35
push dword [ebp - 0x10]
mov esi, dword [0x67464880]
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
jne 0x673e6e93
push 0
push str.Fatal_Error
push str.Cannot_close_window_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x67466460]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x673e7075
mov eax, dword [0x67466460]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
test eax, eax
jne 0x673e6ec6
push 0
push str.Fatal_Error
push str.Cannot_unregister_class_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x673e7075
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test byte [ebp + 8], 2
je 0x673e6ee6
push dword [ebp + 0x10]
call fcn.673eb954
cdq
mov ecx, 0xe1
idiv ecx
add esi, eax
test byte [ebp + 8], 0x10
je 0x673e6ef9
push dword [ebp + 0x10]
call fcn.673eb860
add esp, 4
add esi, eax
test byte [ebp + 8], 0x20
je 0x673e6f06
call fcn.673eb735
add esi, eax
test byte [ebp + 8], 0x40
je 0x673e6f1e
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.673eb458
add esp, 8
add esi, dword [ebp - 0x18]
test byte [ebp + 8], 0x80
je 0x673e706d
xor ebx, ebx
lea eax, [ebp - 4]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 1
mov byte [ebp - 0xcc], bl
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.ImNtUtilU.dll_Ordinal_2
call edi
test eax, eax
jne 0x673e6fd9
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcc]
push eax
lea edx, [ebp - 0xc]
mov dword [ebp - 8], 0x64
push ecx
push edx
push ebx
push str.ProductId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x673e6f90
lea eax, [ebp - 0xcc]
push eax
call fcn.673eb3ec
and eax, 0x7fffffff
jmp 0x673e7023
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.ImNtUtilU.dll_Ordinal_2
call edi
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcc]
push eax
lea edx, [ebp - 0xc]
mov dword [ebp - 8], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x673e7025
jmp 0x673e7017
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.ImNtUtilU.dll_Ordinal_2
call edi
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcc]
push eax
lea edx, [ebp - 0xc]
mov dword [ebp - 8], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x673e7025
lea eax, [ebp - 0xcc]
push eax
call fcn.673eb3ec
add esi, eax
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcc]
push eax
lea edx, [ebp - 0xc]
mov byte [ebp - 0xcc], 0
mov dword [ebp - 8], 0x64
push ecx
push edx
push 0
push str.ProductKey
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x673e7064
lea eax, [ebp - 0xcc]
push eax
call fcn.673eb3ec
add esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and esi, 0x7fffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc