Function at 0x4711a0
Capabilities:
Create process on windows
Hide graphical window
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0c97
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, 0xdc
mov dword [ebp - 0x310], 0
mov word [ebp - 0x2b0], ax
lea eax, [ebp - 0x2f4]
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
push esi
lea ecx, [ebp - 0x300]
call fcn.00405020
mov dword [ebp - 4], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4fcc44]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4fc998]
cmp eax, dword [ecx + 0xc]
jg 0x4719d7
call fcn.00406d20
test eax, eax
je 0x4719cd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x308], eax
mov byte [ebp - 4], 0xc
mov esi, 0x4fc95c
or ebx, 0xffffffff
mov eax, dword [esi]
lea ecx, [ebp - 0x300]
push dword [eax - 0xc]
lea eax, [ebp - 0x2f8]
push eax
call fcn.0040e950
mov byte [ebp - 4], 0xd
mov ecx, dword [esi]
test ecx, ecx
je 0x4719cd
push ecx
push dword [eax]
call fcn.0048cccb
add esp, 8
mov edi, eax
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4712a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x4712c2
add esi, 0xc
cmp esi, 0x4fc998
jne 0x471254
mov byte [ebp - 0x2f9], 0
jmp 0x471968
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
inc ecx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x300]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x300]
call fcn.00408a10
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x310], 2
push eax
lea ecx, [ebp - 0x300]
call fcn.0040eb00
mov edi, 2
mov dword [ebp - 0x310], edi
and edi, 0xfffffffd
mov dword [ebp - 0x310], edi
mov byte [ebp - 4], 0xc
mov eax, ebx
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47133c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x304]
push 0x4c5fe4
push eax
call fcn.0040a8e0
mov byte [ebp - 4], 0x11
push 0x4c5fe4
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00404f30
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x300]
push ecx
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.00419250
add esp, 0x24
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x308]
push eax
call fcn.0040eb00
mov byte [ebp - 4], 0x12
mov eax, ebx
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4713b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, ebx
mov edx, dword [ebp - 0x30c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4713d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov eax, ebx
mov edx, dword [ebp - 0x304]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4713f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi + 4]
test esi, esi
jne 0x471408
mov byte [ebp - 0x2f9], 0
jmp 0x471968
call fcn.00406d20
test eax, eax
je 0x4719cd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x314], eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x318], 0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x2f8]
push eax
push 0x2001f
push 0
push dword [ebp - 0x300]
mov dword [ebp - 0x2f8], 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4715ea
mov esi, dword [ebp - 0x2f8]
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], eax
test esi, esi
je 0x4714a5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x31c], 0
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push 0x4b67b4
call edi
mov ebx, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov esi, eax
mov dword [ebp - 0x30c], esi
test esi, esi
jne 0x471728
call fcn.00420e60
test al, al
je 0x4714ea
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov byte [ebp - 4], 0x20
xor eax, eax
mov word [ebp - 0x336], ax
xorps xmm0, xmm0
mov eax, 1
movlpd qword [ebp - 0x374], xmm0
mov word [ebp - 0x348], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
push str._systemroot__regedit.exe
movlpd qword [ebp - 0x36c], xmm0
movlpd qword [ebp - 0x364], xmm0
movlpd qword [ebp - 0x35c], xmm0
movlpd qword [ebp - 0x354], xmm0
movlpd qword [ebp - 0x346], xmm0
movlpd qword [ebp - 0x33e], xmm0
mov dword [ebp - 0x378], 0x44
mov dword [ebp - 0x34c], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x378]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4715ac
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
push dword [ebp - 0x32c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4b67b4
call edi
mov esi, eax
mov dword [ebp - 0x30c], esi
mov byte [ebp - 4], 0x19
call fcn.00420e60
test al, al
je 0x4715d6
push dword [ebp - 0x304]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test esi, esi
jne 0x47174f
mov byte [ebp - 0x2f9], 0
jmp 0x47191b
cmp eax, 2
jne 0x4714a5
push 0x5c
push dword [ebp - 0x300]
call fcn.0047fdbb
mov esi, eax
add esp, 8
test esi, esi
jne 0x47160e
or esi, 0xffffffff
jmp 0x471616
sub esi, dword [ebp - 0x300]
sar esi, 1
lea ecx, [esi + 1]
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x300]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x300]
call fcn.00408a10
lea eax, [ebp - 0x2f8]
or edi, 4
push eax
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x310], edi
call fcn.0040eb00
and edi, 0xfffffffb
mov dword [ebp - 0x310], edi
mov byte [ebp - 4], 0x19
mov eax, ebx
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x471681
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x300]
push esi
mov edi, dword [eax - 0xc]
lea eax, [ebp - 0x304]
push eax
sub edi, esi
call fcn.0040e950
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x300]
push eax
call fcn.0040eb00
mov byte [ebp - 4], 0x19
mov eax, ebx
mov edx, dword [ebp - 0x304]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4716d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
mov eax, dword [eax - 0xc]
sub eax, edi
push eax
lea eax, [ebp - 0x304]
push eax
call fcn.0040e950
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x308]
push eax
call fcn.0040eb00
mov byte [ebp - 4], 0x19
mov eax, ebx
mov edx, dword [ebp - 0x304]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4714af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4714af
lea eax, [ebp - 0x304]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x304]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x330], eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push str.SysTreeView32
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
push 0
push 0x10288
push 0x111
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
mov dword [ebp - 0x2f8], 0x1e
push 0
push 0x25
push 0x100
push edi
call esi
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
sub dword [ebp - 0x2f8], 1
jne 0x4717b2
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x2f8], eax
movzx eax, word [eax]
test ax, ax
je 0x471832
mov ecx, eax
cmp cx, 0x5c
jne 0x4717f8
push 0
push 0x27
push 0x100
jmp 0x47180c
push ecx
call fcn.0048f1a0
add esp, 4
movzx eax, ax
push 0
push eax
push 0x102
push edi
call esi
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
mov edx, dword [ebp - 0x2f8]
add edx, 2
mov dword [ebp - 0x2f8], edx
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x4717e7
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
mov eax, dword [ebp - 0x314]
mov edi, dword [ebp - 0x30c]
cmp dword [eax - 0xc], 0
je 0x4718fa
push 0
push str.SysListView32
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0x2f8], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0x2f8]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x24c], 8
jbe 0x47188f
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x24
push 0x100
push dword [ebp - 0x2f8]
call esi
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x334], eax
movzx eax, word [eax]
test ax, ax
je 0x4718fa
mov edi, dword [ebp - 0x334]
mov ecx, eax
nop dword [eax]
push ecx
call fcn.0048f1a0
add esp, 4
movzx eax, ax
push 0
push eax
push 0x102
push dword [ebp - 0x2f8]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x330]
call ebx
movzx eax, word [edi + 2]
lea edi, [edi + 2]
mov ecx, eax
test ax, ax
jne 0x4718c0
mov edi, dword [ebp - 0x30c]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2f9], 1
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x47193a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x31c], 0
mov byte [ebp - 4], 0xc
or ebx, 0xffffffff
mov edx, dword [ebp - 0x314]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x471968
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x308]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x471989
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x300]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4719ab
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x2f9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00406ac0
push 0x4fc998
call fcn.0047df05
add esp, 4
cmp dword [0x4fc998], 0xffffffff
jne 0x47122b
mov byte [ebp - 4], 1
mov ecx, 0x4fc95c
push str.HKLM
call fcn.00405020
mov byte [ebp - 4], 2
mov ecx, 0x4fc964
push str.HKEY_LOCAL_MACHINE
mov dword [0x4fc960], 0x80000002
call fcn.00405020
mov byte [ebp - 4], 3
mov ecx, 0x4fc968
push str.HKCU
call fcn.00405020
mov byte [ebp - 4], 4
mov ecx, 0x4fc970
push str.HKEY_CURRENT_USER
mov dword [0x4fc96c], 0x80000001
call fcn.00405020
mov byte [ebp - 4], 5
mov ecx, 0x4fc974
push str.HKCR
call fcn.00405020
mov byte [ebp - 4], 6
mov ecx, 0x4fc97c
push str.HKEY_CLASSES_ROOT
mov dword [0x4fc978], 0x80000000
call fcn.00405020
mov byte [ebp - 4], 7
mov ecx, 0x4fc980
push str.HKCC
call fcn.00405020
mov byte [ebp - 4], 8
mov ecx, 0x4fc988
push str.HKEY_CURRENT_CONFIG
mov dword [0x4fc984], 0x80000005
call fcn.00405020
mov byte [ebp - 4], 9
mov ecx, 0x4fc98c
push 0x4b4828
call fcn.00405020
mov byte [ebp - 4], 0xa
mov ecx, 0x4fc994
push str.HKEY_USERS
mov dword [0x4fc990], 0x80000003
call fcn.00405020
mov byte [ebp - 4], 1
push 0x4b2cb0
call fcn.0047de74
mov byte [ebp - 4], 0
push 0x4fc998
call fcn.0047deb4
add esp, 8
jmp 0x47122b