Function at 0x406b50
Capabilities:
Create process on windows
Create thread
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x3b4
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24d]
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x348], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x310], esi
mov dword [ebp - 0x220], edi
call fcn.00408ba0
push 0x5f409c
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
push edi
call fcn.00408bb0
add esp, 8
mov byte [ebp - 0x33d], 1
call fcn.0040aac0
movzx edx, byte [ebp - 0x33d]
xor ecx, ecx
cmp eax, 1
cmovl edx, ecx
xor eax, eax
mov dword [ebp - 0x344], edx
test dl, dl
je 0x406c9d
push 8
push str._dllLoad
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.00408f30
mov ecx, esi
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406c43
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24c]
call fcn.00408f30
lea eax, [ebp - 0x280]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x24c]
mov edi, 3
push eax
mov dword [ebp - 0x220], edi
call fcn.0040af20
add esp, 8
cmp eax, 0xffffffff
je 0x406c99
mov ecx, edi
mov byte [ebp - 0x33e], 1
mov eax, ecx
jmp 0x406ca4
mov eax, edi
mov ecx, eax
mov byte [ebp - 0x33e], 0
test cl, 2
je 0x406d14
mov edx, dword [ebp - 0x238]
and eax, 0xfffffffd
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
cmp edx, 8
jb 0x406d05
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 3
cmp edx, 0x1000
jb 0x406cf5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b1b
push edx
push ecx
call fcn.00409f25
mov eax, dword [ebp - 0x33c]
add esp, 8
mov edi, dword [ebp - 0x33c]
xor ecx, ecx
mov word [ebp - 0x24c], cx
mov dword [ebp - 4], 0
test al, 1
je 0x406d7f
mov edx, dword [ebp - 0x26c]
and eax, 0xfffffffe
mov dword [ebp - 0x33c], eax
cmp edx, 8
jb 0x406d70
mov ecx, dword [ebp - 0x280]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 4
cmp edx, 0x1000
jb 0x406d62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b75
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x33c]
xor eax, eax
mov word [ebp - 0x280], ax
cmp byte [ebp - 0x33e], 0
je 0x406d99
call fcn.0048f7f0
call fcn.0048fd50
xor edi, edi
jmp 0x408af1
call fcn.0040b570
mov ecx, str.type
mov dword [ebp - 0x36c], 0
mov esi, eax
mov dword [ebp - 0x368], 0xf
mov dword [ebp - 0x2ac], esi
mov byte [ebp - 0x37c], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406dd0
sub ecx, edx
push ecx
push str.type
lea ecx, [ebp - 0x37c]
call fcn.0040b580
lea eax, [ebp - 0x37c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x2a8]
mov ecx, esi
push eax
call fcn.0040b680
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 7
call fcn.0040ba20
push str.renderer
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
push str.compute_only_renderer
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 0x33d], al
call fcn.0040be60
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 0x33f], al
call fcn.0040be60
mov byte [ebp - 0x335], al
call fcn.0040bef0
cmp dword [ebp - 0x298], 0
mov byte [ebp - 0x33e], al
je 0x406e9d
cmp byte [ebp - 0x33d], 0
jne 0x406ed4
cmp byte [ebp - 0x33f], 0
jne 0x406ed4
cmp byte [ebp - 0x335], 0
jne 0x406ed4
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0
call fcn.0040ba20
mov edi, dword [ebp - 0x228]
jmp 0x408ae4
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 4
push eax
push 0x5f2024
push 0
push 0x10
push str.bLTEnableDLLOptimization
push 0x58be00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x406f87
mov dword [0x5f2024], 0
cmp dword [ebp - 0x298], 0
jne 0x40711c
xor eax, eax
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 0xa
push eax
call fcn.0040c320
add esp, 4
test al, al
je 0x4070c7
cmp dword [ebp - 0x258], 0
je 0x4070c7
push dword [ebp - 0x310]
call fcn.0048fb30
add esp, 4
test al, al
je 0x4070c7
push 0x40100000
call fcn.00412780
add esp, 4
mov eax, dword [ebp - 0x254]
mov byte [ebp - 4], 0xb
cmp eax, 8
jb 0x406f75
inc eax
lea ecx, [ebp - 0x268]
push eax
push dword [ebp - 0x268]
call fcn.0040a2e0
lea ecx, [ebp - 0x2a8]
xor edi, edi
call fcn.0040ba20
jmp 0x408af1
cmp dword [0x5f2024], 0
je 0x406ede
call fcn.0040b570
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x22c], 0
xorps xmm0, xmm0
push ecx
mov ecx, eax
movq qword [ebp - 0x234], xmm0
call fcn.0040c060
mov ecx, dword [ebp - 0x230]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x234]
sub ecx, esi
imul ecx
mov ecx, 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x284], eax
je 0x40700c
cmp dword [esi + 0x10], 1
jb 0x407004
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x406ff8
mov eax, dword [esi]
cmp word [eax], 0x2f
je 0x407041
mov eax, dword [ebp - 0x284]
inc ecx
add esi, 0x18
cmp ecx, eax
jb 0x406fe8
mov byte [ebp - 0x219], 0
lea ecx, [ebp - 0x234]
call fcn.0042f520
cmp byte [ebp - 0x219], 0
jne 0x406ede
push 4
call fcn.00406a5e
add esp, 4
test eax, eax
je 0x40704a
mov dword [eax], 0x48f4f0
jmp 0x40704c
mov byte [ebp - 0x219], 1
jmp 0x407013
xor eax, eax
mov dword [ebp - 0x284], eax
or edi, 0x400
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x454a80
push 0
push 0
call fcn.00430ca7
add esp, 0x18
mov dword [ebp - 0x230], eax
test eax, eax
je 0x408b2d
mov dword [ebp - 0x284], 0
mov ecx, dword [ebp - 0x22c]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x408b20
push ecx
push eax
call fcn.0053ba92
add esp, 8
test eax, eax
jne 0x408b27
xorps xmm0, xmm0
mov byte [ebp - 4], 7
movlpd qword [ebp - 0x230], xmm0
jmp 0x406ede
mov edx, dword [ebp - 0x254]
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x407113
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0xc
cmp edx, 0x1000
jb 0x407105
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b3e
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 7
xor eax, eax
mov word [ebp - 0x268], ax
call fcn.0040c930
test al, al
je 0x406e83
mov eax, dword [ebp - 0x344]
test al, al
je 0x40755f
cmp dword [ebp - 0x298], 0
jne 0x40715d
push 0x58be74
push 0x58be7c
call fcn.0040e660
add esp, 8
test eax, eax
setne al
mov dword [ebp - 0x344], eax
test al, al
je 0x40755f
cmp dword [ebp - 0x298], 0
je 0x407182
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
je 0x40718c
call fcn.0040fe50
mov byte [0x5f2014], al
cmp byte [ebp - 0x33e], 0
je 0x4071ca
call fcn.0040aac0
cmp eax, 3
jl 0x4071ca
push 0x58bc7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4071ca
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4071ca
mov ecx, esi
call dword [0x5817c0]
call esi
cmp dword [ebp - 0x298], 0
je 0x407509
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
jne 0x407509
cmp dword [0x5f39b8], 0
jne 0x40720f
push 0xc0100010
mov edi, 3
call fcn.0047a5c0
add esp, 4
jmp 0x408ad5
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x310]
push 0x58be9c
push 0x8002
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x228], eax
test eax, eax
je 0x407217
push str.AcroExe_load_done
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov esi, eax
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x284]
push dword [ebp - 0x288]
push esi
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x407217
mov esi, dword [ebp - 0x310]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407587
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x268]
call fcn.00408f30
push 0
push 0x58bc58
lea ecx, [ebp - 0x268]
call fcn.0040fe00
cmp eax, 0xffffffff
lea ecx, [ebp - 0x268]
push 0
push 0x58bc60
setne byte [ebp - 0x219]
call fcn.0040fe00
movzx ecx, byte [ebp - 0x219]
cmp eax, 0xffffffff
mov eax, 1
cmovne ecx, eax
push 0
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x268]
push 0x58bc68
call fcn.0040fe00
cmp eax, 0xffffffff
call fcn.0054223b
push 1
call fcn.0053bb42
push eax
call fcn.0053bb15
push 6
mov dword [ebp - 0x22c], 0
call fcn.0053bb42
call fcn.0054223b