Function at 0x4ab780
Capabilities:
Create process on windows
Hide graphical window
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539947
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, 0xdc
mov dword [ebp - 0x30c], 0
mov word [ebp - 0x2b0], ax
lea eax, [ebp - 0x2f4]
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
push esi
lea ecx, [ebp - 0x2fc]
call fcn.0040c130
mov dword [ebp - 4], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x596df0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5969f8]
cmp eax, dword [ecx + 8]
jg 0x4abfa3
call fcn.00410080
test eax, eax
je 0x4abf99
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 0xc
mov esi, 0x5969bc
or edi, 0xffffffff
mov eax, dword [esi]
lea ecx, [ebp - 0x2fc]
push dword [eax - 0xc]
lea eax, [ebp - 0x2f8]
push eax
call fcn.0041a230
mov byte [ebp - 4], 0xd
mov ecx, dword [esi]
test ecx, ecx
je 0x4abf99
push ecx
push dword [eax]
call fcn.004fb9d0
add esp, 8
test eax, eax
sete bl
mov byte [ebp - 4], 0xc
mov eax, edi
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ab88a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x4ab89e
add esi, 0xc
cmp esi, 0x5969f8
jne 0x4ab834
jmp 0x4abf38
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
inc ecx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.00412e80
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x30c], 2
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0041a410
mov ebx, 2
mov dword [ebp - 0x30c], ebx
and ebx, 0xfffffffd
mov dword [ebp - 0x30c], ebx
mov byte [ebp - 4], 0xc
mov eax, edi
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ab918
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x300]
push 0x560f9c
push eax
call fcn.00415af0
mov byte [ebp - 4], 0x11
push 0x560f9c
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.0040c040
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2fc]
push ecx
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.0042a110
add esp, 0x24
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x304]
push eax
call fcn.0041a410
mov byte [ebp - 4], 0x12
mov eax, edi
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ab98f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, edi
mov edx, dword [ebp - 0x308]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ab9b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov eax, edi
mov edx, dword [ebp - 0x300]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4ab9d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi + 4]
test esi, esi
jne 0x4ab9df
xor bl, bl
jmp 0x4abf38
call fcn.00410080
test eax, eax
je 0x4abf99
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x310], eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x2f8]
push eax
push 0x2001f
push 0
push dword [ebp - 0x2fc]
mov dword [ebp - 0x2f8], 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4abbbe
mov ebx, dword [ebp - 0x2f8]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], eax
test ebx, ebx
je 0x4aba7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x318], 0
push 0
push 0x544cbc
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov esi, eax
mov dword [ebp - 0x308], esi
test esi, esi
jne 0x4abcfc
call fcn.00436220
test al, al
je 0x4ababf
lea eax, [ebp - 0x300]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov byte [ebp - 4], 0x20
xor eax, eax
mov word [ebp - 0x332], ax
xorps xmm0, xmm0
mov eax, 1
movlpd qword [ebp - 0x370], xmm0
mov word [ebp - 0x344], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
push str._systemroot__regedit.exe
movlpd qword [ebp - 0x368], xmm0
movlpd qword [ebp - 0x360], xmm0
movlpd qword [ebp - 0x358], xmm0
movlpd qword [ebp - 0x350], xmm0
movlpd qword [ebp - 0x342], xmm0
movlpd qword [ebp - 0x33a], xmm0
mov dword [ebp - 0x374], 0x44
mov dword [ebp - 0x348], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x374]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4abb81
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x544cbc
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov dword [ebp - 0x308], esi
mov byte [ebp - 4], 0x19
call fcn.00436220
test al, al
je 0x4abbaf
push dword [ebp - 0x300]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
test esi, esi
jne 0x4abd23
xor bl, bl
jmp 0x4abeee
cmp eax, 2
jne 0x4aba7c
push 0x5c
push dword [ebp - 0x2fc]
call fcn.004d5b9d
mov esi, eax
add esp, 8
test esi, esi
jne 0x4abbe2
or esi, 0xffffffff
jmp 0x4abbea
sub esi, dword [ebp - 0x2fc]
sar esi, 1
lea ecx, [esi + 1]
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x2fc]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.00412e80
lea eax, [ebp - 0x2f8]
or ebx, 4
push eax
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x30c], ebx
call fcn.0041a410
and ebx, 0xfffffffb
mov dword [ebp - 0x30c], ebx
mov byte [ebp - 4], 0x19
mov eax, edi
mov edx, dword [ebp - 0x2f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4abc55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2fc]
lea ecx, [ebp - 0x2fc]
push esi
mov ebx, dword [eax - 0xc]
lea eax, [ebp - 0x300]
push eax
sub ebx, esi
call fcn.0041a230
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x2fc]
push eax
call fcn.0041a410
mov byte [ebp - 4], 0x19
mov eax, edi
mov edx, dword [ebp - 0x300]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4abca4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x304]
lea ecx, [ebp - 0x304]
mov eax, dword [eax - 0xc]
sub eax, ebx
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.0041a230
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x304]
push eax
call fcn.0041a410
mov byte [ebp - 4], 0x19
mov eax, edi
mov edx, dword [ebp - 0x300]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4aba86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4aba86
lea eax, [ebp - 0x300]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x300]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x32c], eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push str.SysTreeView32
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
push 0
push 0x10288
push 0x111
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
mov dword [ebp - 0x2f8], 0x1e
push 0
push 0x25
push 0x100
push edi
call esi
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
sub dword [ebp - 0x2f8], 1
jne 0x4abd86
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2f8], eax
movzx eax, word [eax]
test ax, ax
je 0x4abe0b
mov ecx, eax
nop dword [eax + eax]
cmp cx, 0x5c
jne 0x4abdd1
push 0
push 0x27
push 0x100
jmp 0x4abde5
push ecx
call fcn.004ff2a7
add esp, 4
movzx eax, ax
push 0
push eax
push 0x102
push edi
call esi
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
mov edx, dword [ebp - 0x2f8]
add edx, 2
mov dword [ebp - 0x2f8], edx
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x4abdc0
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
mov eax, dword [ebp - 0x310]
mov edi, dword [ebp - 0x308]
cmp dword [eax - 0xc], 0
je 0x4abecf
push 0
push str.SysListView32
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
push eax
mov dword [ebp - 0x2f8], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0x2f8]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x24c], 8
jbe 0x4abe68
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x24
push 0x100
push dword [ebp - 0x2f8]
call esi
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x330], eax
movzx eax, word [eax]
test ax, ax
je 0x4abecf
mov edi, dword [ebp - 0x330]
mov ecx, eax
push ecx
call fcn.004ff2a7
add esp, 4
movzx eax, ax
push 0
push eax
push 0x102
push dword [ebp - 0x2f8]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x32c]
call ebx
movzx eax, word [edi + 2]
lea edi, [edi + 2]
mov ecx, eax
test ax, ax
jne 0x4abe95
mov edi, dword [ebp - 0x308]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebp - 0x32c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
or edi, 0xffffffff
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x4abf0d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x318], 0
mov byte [ebp - 4], 0xc
mov eax, edi
mov edx, dword [ebp - 0x310]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4abf38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x304]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4abf59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2fc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4abf7b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d2a60
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040fbc0
push 0x5969f8
call fcn.004d2972
add esp, 4
cmp dword [0x5969f8], 0xffffffff
jne 0x4ab80b
mov byte [ebp - 4], 1
mov ecx, 0x5969bc
push str.HKLM
call fcn.0040c130
mov byte [ebp - 4], 2
mov ecx, 0x5969c4
push str.HKEY_LOCAL_MACHINE
mov dword [0x5969c0], 0x80000002
call fcn.0040c130
mov byte [ebp - 4], 3
mov ecx, 0x5969c8
push str.HKCU
call fcn.0040c130
mov byte [ebp - 4], 4
mov ecx, 0x5969d0
push str.HKEY_CURRENT_USER
mov dword [0x5969cc], 0x80000001
call fcn.0040c130
mov byte [ebp - 4], 5
mov ecx, 0x5969d4
push str.HKCR
call fcn.0040c130
mov byte [ebp - 4], 6
mov ecx, 0x5969dc
push str.HKEY_CLASSES_ROOT
mov dword [0x5969d8], 0x80000000
call fcn.0040c130
mov byte [ebp - 4], 7
mov ecx, 0x5969e0
push str.HKCC
call fcn.0040c130
mov byte [ebp - 4], 8
mov ecx, 0x5969e8
push str.HKEY_CURRENT_CONFIG
mov dword [0x5969e4], 0x80000005
call fcn.0040c130
mov byte [ebp - 4], 9
mov ecx, 0x5969ec
push 0x542b98
call fcn.0040c130
mov byte [ebp - 4], 0xa
mov ecx, 0x5969f4
push str.HKEY_USERS
mov dword [0x5969f0], 0x80000003
call fcn.0040c130
mov byte [ebp - 4], 1
push 0x5403f0
call fcn.004d282a
mov byte [ebp - 4], 0
push 0x5969f8
call fcn.004d2928
add esp, 8
jmp 0x4ab80b