Function at 0x402e60
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ef8d
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push esi
push edi
mov eax, dword [0x42b018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xd], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
jne 0x402eae
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x4032d8
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], 0
push eax
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], 4
push eax
push 0x13
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402f11
call esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push str.Fast_Engine:_Token_Error__d
push 0x42cc98
call ebx
mov eax, dword [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x1c], eax
jmp 0x402fac
lea eax, [ebp - 0x1c]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
jne 0x402f42
push str.Fast_Engine:_Duplicate_Token_Error
push 0x42cc98
call ebx
add esp, 8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push str.S_1_5_32_544
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x402f72
push str.Fast_Engine:_Convert_SID_error
push 0x42cc98
call ebx
add esp, 8
mov eax, dword [ebp - 0x18]
push eax
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x38], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x38]
push eax
push 0x19
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x402fac
push str.Fast_Engine:_Set_Token_Info_Error
push 0x42cc98
call ebx
add esp, 8
push 1
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4032ba
push 0x40
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xa0], 0x44
push 0
push eax
call fcn.0040e8e0
add esp, 0xc
mov dword [ebp - 0x98], str.winsta0default
call fcn.004029e0
mov ecx, eax
test ecx, ecx
je 0x403307
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push eax
push 2
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFast_
push 0x80000002
mov dword [ebp - 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, dword [ebp - 0x18]
test edi, edi
js 0x403321
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x403068
push edi
lea ecx, [ebp - 0x14]
call fcn.004037c0
mov esi, dword [ebp - 0x14]
cmp edi, dword [esi - 8]
jg 0x403321
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
cmp dword [esi - 4], 1
jle 0x40308e
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.004036c0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 2
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFast_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [esi - 0xc], 0
jl 0x403321
push str.uninstaller.exe
push esi
call fcn.0040c726
mov edi, eax
add esp, 8
test edi, edi
je 0x403321
sub edi, esi
sar edi, 1
js 0x403321
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4030f7
push edi
lea ecx, [ebp - 0x14]
call fcn.004037c0
mov esi, dword [ebp - 0x14]
cmp edi, dword [esi - 8]
jg 0x403321
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov eax, str.fast_.exe
mov edi, dword [esi - 0xc]
sub eax, esi
sar eax, 1
push 9
push str.fast_.exe
mov dword [ebp - 0x2c], str.fast_.exe
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], edi
call fcn.0040ffa3
mov ecx, eax
add esp, 8
mov eax, 0x7fffffff
mov dword [ebp - 0x40], ecx
sub eax, ecx
cmp eax, edi
jl 0x403321
add edi, ecx
js 0x403321
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, edi
or eax, edx
jge 0x40316d
push edi
lea ecx, [ebp - 0x14]
call fcn.004037c0
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
cmp eax, edx
ja 0x40317d
lea eax, [esi + eax*2]
mov dword [ebp - 0x2c], eax
lea eax, [esi + edx*2]
add ecx, ecx
je 0x4031b7
test eax, eax
je 0x4031a7
mov edx, dword [ebp - 0x2c]
push ecx
test edx, edx
je 0x40319c
push edx
push eax
call fcn.0040ccf0
add esp, 0xc
jmp 0x4031b7
push 0
push eax
call fcn.0040e8e0
add esp, 0xc
call fcn.00410545
mov dword [eax], 0x16
call fcn.0041046a
cmp edi, dword [esi - 8]
jg 0x403321
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov edi, dword [esi - 0xc]
cmp edi, 1
jl 0x403229
dec edi
cmp dword [esi - 4], 1
jle 0x4031e6
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
call fcn.004036c0
mov esi, dword [ebp - 0x14]
lea ecx, [edi*2 + 2]
lea eax, [esi + 2]
test ecx, ecx
je 0x40320f
test esi, esi
je 0x403311
test eax, eax
je 0x403311
push ecx
push eax
push esi
call fcn.0040ccf0
add esp, 0xc
test edi, edi
js 0x403321
cmp edi, dword [esi - 8]
jg 0x403321
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0
push dword [ebp - 0x30]
push 0x480
push 0
push 0
push 0
push 0
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40326a
push dword [ebp - 0x50]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0xd], 1
call edi
push dword [ebp - 0x54]
call edi
jmp 0x403286
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fast_Engine:_Create_Process_Error__d
push 0x42cc98
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push dword [ebp - 0x30]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4032cc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x20]
call edi
push dword [ebp - 0x1c]
call edi
jmp 0x4032f2
call esi
push eax
push str.Fast_Engine:_Create_Env_Block_Error__d
push 0x42cc98
call ebx
add esp, 0xc
push dword [ebp - 0x20]
call edi
push dword [ebp - 0x1c]
call edi
jmp 0x4032f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fast_Engine:_Query_User_Token_Error__d
push 0x42cc98
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004028b0
call fcn.00410545
mov dword [eax], 0x16
call fcn.0041046a
push 0x80070057
call fcn.004028b0
int3