Function at 0x404600
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x40a1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7f4
push ebx
mov ebx, dword [esp + 0x808]
push ebp
push esi
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov esi, eax
mov ecx, 0xc2
xor eax, eax
lea edi, [esp + 0x4f9]
mov byte [esp + 0x4f8], 0
mov byte [esp + 0xe8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xe9]
push str..exe
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404759
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x4f8]
push ebx
push eax
call esi
lea ecx, [esp + 0xe8]
push ebx
push ecx
call esi
lea edx, [esp + 0xe8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov ebx, 0x10
xor eax, eax
mov ecx, ebx
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x818]
xor ecx, ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x38], ecx
lea edx, [esp + 0x30]
mov dword [esp + 0x3c], ecx
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0xec]
push eax
push ecx
push 0
push 0x20
push 0
push 0
lea edx, [esp + 0x514]
push 0
push edx
push 0
mov dword [esp + 0x88], 0x44
mov word [esp + 0xb8], 1
mov dword [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x40eb78]
mov ecx, dword [0x40eb7c]
sub ecx, eax
mov esi, eax
sar ecx, 4
cmp ecx, 1
jae 0x404cf5
mov edx, dword [0x40eb74]
test edx, edx
je 0x404c30
mov ecx, eax
sub ecx, edx
sar ecx, 4
cmp ecx, 1
jbe 0x404c30
mov ecx, eax
sub ecx, edx
sar ecx, 4
jmp 0x404c35
test esi, esi
je 0x4046a3
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x20019
push 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4049e3
mov ecx, 7
lea edi, [esp + 0x41]
mov byte [esp + 0x40], al
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x40]
push ecx
push edx
stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
push 0
push 0
push 0
push eax
mov dword [esp + 0x30], 0x20
call esi
mov ecx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3f5]
mov byte [esp + 0x3f4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x40]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x3f8]
push str._s_shellopencommand
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x3f4]
mov dword [esp + 0x14], 0
push ecx
push 0x20019
push 0
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4049e3
mov ecx, 0x40
lea edi, [esp + 0x1ed]
mov byte [esp + 0x1ec], al
mov edx, dword [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1ec]
push eax
push ecx
push 0
push 0
push 0
push edx
mov dword [esp + 0x30], 0x104
call esi
mov eax, dword [esp + 0x14]
push eax
call ebp
lea ecx, [esp + 0xe8]
push ecx
push 0
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableA]
lea edx, [esp + 0xe8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x1ec]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._SystemRoot_
lea ecx, [esp + 0x14]
mov dword [esp + 0x810], 0
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
je 0x4048e8
lea ecx, [esp + 0x2f0]
push 0x104
push ecx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea edx, [esp + 0x2f0]
push edx
push str._SystemRoot_
jmp 0x404920
push str._ProgramFiles_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
je 0x404929
lea eax, [esp + 0x2f0]
push 0x104
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [esp + 0x2f0]
push ecx
push str._ProgramFiles_
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Replace
push 0x40e874
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
push 0x40e870
lea ecx, [esp + 0x14]
mov esi, eax
call sub.MFC42.DLL_CString::Find
cmp esi, 0xffffffff
mov edi, eax
je 0x40497a
push 2
push esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Delete
push ebx
push esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Insert
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x4f8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4049ca
cmp edi, 0xffffffff
je 0x4049ab
push 2
push edi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Delete
push ebx
push edi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Insert
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x4f8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4049ca
lea eax, [esp + 0x1ec]
push ebx
push eax
lea ecx, [esp + 0x500]
push str._s___s_
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x80c], 0xffffffff
call fcn.00409cc8
jmp 0x4046a3
push ebx
lea edx, [esp + 0x4fc]
push str.rundll32.exe_shell32.dll_OpenAs_RunDLL__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ebx, 0x10
xor eax, eax
mov ecx, ebx
lea edi, [esp + 0xb4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x824]
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0xac], eax
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x20]
lea eax, [esp + 0xa4]
mov dword [esp + 0x28], ecx
push edx
push eax
push ecx
push ecx
push 0x20
push ecx
push ecx
mov dword [esp + 0x48], ecx
push ecx
lea ecx, [esp + 0x518]
push ecx
push 0
mov dword [esp + 0xcc], 0x44
mov word [esp + 0xfc], 1
mov dword [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x40eb78]
mov edx, dword [0x40eb7c]
sub edx, eax
mov esi, eax
sar edx, 4
cmp edx, 1
jae 0x404b48
mov edx, dword [0x40eb74]
test edx, edx
je 0x404aa3
mov ecx, eax
sub ecx, edx
sar ecx, 4
cmp ecx, 1
jbe 0x404aa3
mov ecx, eax
sub ecx, edx
sar ecx, 4
jmp 0x404aa8
mov ecx, 1
test edx, edx
jne 0x404ab0
xor eax, eax
jmp 0x404ab5
sub eax, edx
sar eax, 4
lea edi, [eax + ecx]
test edi, edi
mov eax, edi
jge 0x404ac0
xor eax, eax
shl eax, 4
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [0x40eb74]
add esp, 4
mov ebx, eax
mov ecx, 0x40eb70
push ebx
push esi
push edx
call fcn.00405ea0
mov ebp, eax
lea eax, [esp + 0x20]
push eax
push 1
push ebp
mov ecx, 0x40eb70
call fcn.00405ef0
mov ecx, dword [0x40eb78]
add ebp, 0x10
push ebp
push ecx
push esi
mov ecx, 0x40eb70
call fcn.00405ea0
mov eax, dword [0x40eb74]
push eax
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_operatordelete
shl edi, 4
add edi, ebx
add esp, 4
mov ecx, 0x40eb70
mov dword [0x40eb7c], edi
call fcn.00405e50
inc eax
mov dword [0x40eb74], ebx
shl eax, 4
add eax, ebx
mov dword [0x40eb78], eax
jmp 0x404dd7
mov edx, eax
sub edx, esi
sar edx, 4
cmp edx, 1
jae 0x404bbd
lea ecx, [esi + 0x10]
push ecx
push eax
push esi
mov ecx, 0x40eb70
call fcn.00405ea0
mov eax, dword [0x40eb78]
lea edx, [esp + 0x20]
mov ecx, eax
push edx
sub ecx, esi
mov edx, 1
sar ecx, 4
sub edx, ecx
mov ecx, 0x40eb70
push edx
push eax
call fcn.00405ef0
mov eax, dword [0x40eb78]
cmp esi, eax
je 0x404dd1
mov edx, dword [esp + 0x20]
mov ecx, esi
add esi, ebx
mov dword [ecx], edx
mov edx, dword [esp + 0x24]
cmp esi, eax
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 0xc], edx
jne 0x404b95
jmp 0x404dd1
push eax
push eax
add eax, 0xfffffff0
mov ecx, 0x40eb70
push eax
call fcn.00405ea0
mov eax, dword [0x40eb78]
mov ecx, eax
add eax, 0xfffffff0
cmp esi, eax
je 0x404bfd
sub eax, ebx
sub ecx, ebx
mov edx, eax
mov edi, ecx
cmp eax, esi
mov ebp, dword [edx]
mov dword [edi], ebp
mov ebp, dword [edx + 4]
mov dword [edi + 4], ebp
mov ebp, dword [edx + 8]
mov dword [edi + 8], ebp
mov edx, dword [edx + 0xc]
mov dword [edi + 0xc], edx
jne 0x404bdb
lea eax, [esi + 0x10]
cmp esi, eax
je 0x404dd1
mov edx, dword [esp + 0x20]
mov ecx, esi
add esi, ebx
mov dword [ecx], edx
mov edx, dword [esp + 0x24]
cmp esi, eax
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 0xc], edx
jne 0x404c08
jmp 0x404dd1
mov ecx, 1
test edx, edx
jne 0x404c3d
xor eax, eax
jmp 0x404c42
sub eax, edx
sar eax, 4
lea ebp, [eax + ecx]
test ebp, ebp
mov eax, ebp
jge 0x404c4d
xor eax, eax
shl eax, 4
push eax
call sub.MFC42.DLL_operatornew
mov edi, dword [0x40eb74]
add esp, 4
cmp edi, esi
mov dword [esp + 0x14], eax
mov ebx, eax
je 0x404c7d
push edi
push ebx
call fcn.00405f30
add edi, 0x10
add esp, 8
add ebx, 0x10
cmp edi, esi
jne 0x404c69
lea edx, [esp + 0x30]
push edx
push ebx
call fcn.00405f30
mov eax, dword [0x40eb78]
add esp, 8
add ebx, 0x10
mov ecx, 0x40eb70
push ebx
push eax
push esi
call fcn.00405ea0
mov ecx, dword [0x40eb78]
mov edx, dword [0x40eb74]
push ecx
push edx
mov ecx, 0x40eb70
call fcn.00402aa0
mov eax, dword [0x40eb74]
push eax
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x18]
add esp, 4
shl ebp, 4
add ebp, esi
mov ecx, 0x40eb70
mov dword [0x40eb7c], ebp
call fcn.00405e50
inc eax
mov dword [0x40eb74], esi
shl eax, 4
add eax, esi
mov dword [0x40eb78], eax
jmp 0x404dd7
mov ecx, eax
sub ecx, esi
sar ecx, 4
cmp ecx, 1
jae 0x404d67
lea edx, [esi + 0x10]
mov ecx, 0x40eb70
push edx
push eax
push esi
call fcn.00405ea0
lea eax, [esp + 0x30]
mov edx, 1
push eax
mov eax, dword [0x40eb78]
mov ecx, eax
sub ecx, esi
sar ecx, 4
sub edx, ecx
mov ecx, 0x40eb70
push edx
push eax
call fcn.00405ef0
mov eax, dword [0x40eb78]
cmp esi, eax
je 0x404dd1
mov edx, dword [esp + 0x30]
mov ecx, esi
add esi, ebx
mov dword [ecx], edx
mov edx, dword [esp + 0x34]
cmp esi, eax
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [ecx + 0xc], edx
jne 0x404d42
jmp 0x404dd1
push eax
push eax
add eax, 0xfffffff0
mov ecx, 0x40eb70
push eax
call fcn.00405ea0
mov eax, dword [0x40eb78]
mov ecx, eax
add eax, 0xfffffff0
cmp esi, eax
je 0x404da7
sub eax, ebx
sub ecx, ebx
mov edx, eax
mov edi, ecx
cmp eax, esi
mov ebp, dword [edx]
mov dword [edi], ebp
mov ebp, dword [edx + 4]
mov dword [edi + 4], ebp
mov ebp, dword [edx + 8]
mov dword [edi + 8], ebp
mov edx, dword [edx + 0xc]
mov dword [edi + 0xc], edx
jne 0x404d85
lea eax, [esi + 0x10]
cmp esi, eax
je 0x404dd1
mov edx, dword [esp + 0x30]
mov ecx, esi
add esi, ebx
mov dword [ecx], edx
mov edx, dword [esp + 0x34]
cmp esi, eax
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [ecx + 0xc], edx
jne 0x404dae
add dword [0x40eb78], ebx
mov ecx, dword [esp + 0x804]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x800
ret