Function at 0x409170
Capabilities:
Create process on windows
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460ff5
mov eax, dword fs:[0]
push eax
sub esp, 0x968
mov eax, dword [0x479408]
xor eax, esp
mov dword [esp + 0x960], eax
push ebx
push esi
push edi
mov eax, dword [0x479408]
xor eax, esp
push eax
lea eax, [esp + 0x978]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
push 0x100
mov dword [esp + 0x20], edi
mov byte [esp + 0x1f], bl
call fcn.0040be28
mov esi, eax
add esp, 4
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x38], esi
call fcn.00402c70
lea ecx, [esp + 0x24]
push ecx
push 1
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
mov dword [esp + 0x990], ebx
push reloc.WS2_32.dll_accept
mov dword [esp + 0x24], 1
mov dword [esp + 0x44], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x409233
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push ebx
push str.Start_Page
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004152b9
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40924d
push 0x80004005
call fcn.00401690
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
push esi
lea ecx, [esp + 0x28]
push 0x46dbcc
push ecx
mov byte [esp + 0x98c], 1
call fcn.00401d30
mov esi, dword [esp + 0x30]
add esp, 0xc
push str.http:__www.280dd.com
push esi
call fcn.0042a034
add esp, 8
cmp eax, ebx
sete al
test al, al
je 0x409298
mov byte [esp + 0x1b], 1
push 0x103
lea edx, [esp + 0x659]
push ebx
push edx
mov byte [esp + 0x660], 0
call fcn.0042d310
add esp, 0xc
push 0x103
lea eax, [esp + 0x449]
push ebx
push eax
mov byte [esp + 0x450], 0
call fcn.0042d310
add esp, 0xc
push 0x103
lea ecx, [esp + 0x551]
push ebx
push ecx
mov byte [esp + 0x558], 0
call fcn.0042d310
add esp, 0xc
push 0x103
lea edx, [esp + 0x761]
push ebx
push edx
mov byte [esp + 0x768], 0
call fcn.0042d310
add esp, 0xc
push 0x103
lea eax, [esp + 0x869]
push ebx
push eax
mov byte [esp + 0x870], 0
call fcn.0042d310
mov eax, dword [edi + 0x8ec]
add esp, 0xc
lea ecx, [esp + 0x31c]
push ecx
push eax
mov dword [esp + 0x324], ebx
mov dword [esp + 0x328], ebx
mov dword [esp + 0x32c], ebx
mov dword [esp + 0x330], ebx
mov dword [esp + 0x334], ebx
mov dword [esp + 0x338], ebx
call fcn.00422719
test eax, eax
jne 0x409399
push ebx
push ebx
push 0x46e128
call fcn.0041564d
lea eax, [esi - 0x10]
mov byte [esp + 0x980], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x409c57
mov eax, dword [edi + 0x8ec]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x100
lea ecx, [esp + 0x65c]
push ecx
push str.Error
push str.Name
push str.Main
call esi
lea eax, [esp + 0x654]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4093d0
sub eax, edx
push eax
lea ecx, [esp + 0x760]
lea eax, [esp + 0x658]
call fcn.004073c0
xor eax, eax
mov cl, byte [esp + eax + 0x75c]
mov byte [esp + eax + 0x654], cl
add eax, 1
test cl, cl
jne 0x4093f1
xor eax, eax
jmp 0x409410
mov cl, byte [esp + eax + 0x654]
mov byte [esp + eax + 0x444], cl
add eax, 1
test cl, cl
jne 0x409410
mov eax, dword [edi + 0x8ec]
push eax
push 0x100
lea edx, [esp + 0x554]
push edx
push str.Error
push str.Name
push str.Params
call esi
lea eax, [esp + 0x54c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409454
sub eax, edx
push eax
lea ecx, [esp + 0x760]
lea eax, [esp + 0x550]
call fcn.004073c0
xor eax, eax
jmp 0x409480
mov cl, byte [esp + eax + 0x75c]
mov byte [esp + eax + 0x54c], cl
add eax, 1
test cl, cl
jne 0x409480
lea ecx, [esp + 0x444]
call fcn.00409fc0
test al, al
jne 0x4094eb
lea ecx, [esp + 0x444]
call fcn.00409e60
test al, al
jne 0x4094eb
lea ecx, [esp + 0x444]
call fcn.0040a120
test al, al
jne 0x4094eb
lea eax, [esp + 0x444]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4094d0
mov ecx, dword [str..exe]
mov dl, byte [0x46d1e8]
mov dword [eax], ecx
mov byte [eax + 4], dl
push 0x46d0d1
lea ecx, [esp + 0x18]
call fcn.00401840
mov byte [esp + 0x980], 2
call fcn.00412af1
mov eax, dword [eax + 4]
lea esi, [eax + 0xa4]
lea eax, [esp + 0x444]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004022f0
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x984], 3
call fcn.00405c30
mov byte [esp + 0x980], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40955f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x46d0d1
lea ecx, [esp + 0x2c]
call fcn.00401840
push 0x46d0d1
lea ecx, [esp + 0x30]
mov byte [esp + 0x984], 4
call fcn.00401840
lea eax, [esp + 0x444]
mov byte [esp + 0x980], 5
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x409595
sub eax, edx
push eax
lea ecx, [esp + 0x448]
push ecx
lea ecx, [esp + 0x30]
call fcn.00401b80
mov edx, dword [esp + 0x28]
push 0x5c
push edx
call fcn.0042acc1
add esp, 8
cmp eax, ebx
je 0x409616
sub eax, dword [esp + 0x28]
cmp eax, ebx
jle 0x409616
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
call fcn.00402270
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x984], 6
call fcn.00405c30
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409616
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push esi
push edx
call fcn.0040bad0
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x984], 7
call fcn.00405c30
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409663
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x46d0d1
lea ecx, [esp + 0x24]
call fcn.00401840
lea ecx, [esp + 0x444]
push ecx
lea edx, [esp + 0x14]
push esi
push edx
mov byte [esp + 0x98c], 8
call fcn.004022f0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x984], 9
call fcn.00405c30
mov byte [esp + 0x980], 8
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x444]
call fcn.00409e60
test al, al
je 0x40972b
mov eax, dword [esp + 0x20]
mov edx, eax
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4096e0
lea edi, [esp + 0x864]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4096f5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0x864]
mov byte [esp + eax + 0x444], cl
add eax, 1
test cl, cl
jne 0x409711
jmp 0x4097ec
push 0x46e140
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004022f0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x984], 0xa
call fcn.00405c30
mov byte [esp + 0x980], 8
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40977c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x54c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.004022f0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x984], 0xb
call fcn.00405c30
mov byte [esp + 0x980], 8
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4097d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x444]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4097e0
lea edi, [esp + 0x14]
call fcn.00402210
push 0x38
lea ecx, [esp + 0x40]
push ebx
push ecx
call fcn.0042d310
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x54], eax
add eax, 0xfffffff0
add esp, 0xc
lea edx, [esp + 0x54c]
push eax
mov dword [esp + 0x3c], 0x3c
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], str.open
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], 5
mov dword [esp + 0x5c], ebx
call fcn.00401d70
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x30], esi
mov byte [esp + 0x980], 0xc
mov eax, dword [esi - 0xc]
cmp eax, ebx
jl 0x409894
push str..ocx
push esi
call fcn.0042abee
add esp, 8
cmp eax, ebx
je 0x409894
sub eax, esi
cmp eax, ebx
jle 0x409894
lea edx, [esp + 0x30]
push edx
call fcn.0040b7e0
mov esi, dword [esp + 0x30]
mov dword [esp + 0x48], esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x31c]
push eax
push ecx
call fcn.00422719
test eax, eax
jne 0x4098cd
lea edx, [esp + 0x31c]
push edx
push esi
call fcn.00422719
test eax, eax
jne 0x4098cd
push ebx
push ebx
push 0x46e16c
call fcn.0041564d
jmp 0x409b66
cmp byte [esp + 0x1b], 0
je 0x409a28
mov edi, dword [esp + 0x1c]
push 6
mov ecx, edi
call fcn.0041d5ab
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
push eax
call fcn.00401d70
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x1c], esi
mov byte [esp + 0x980], 0xd
xor bl, bl
cmp dword [esi - 0xc], 0
jl 0x409959
push str..ocx
push esi
call fcn.0042abee
add esp, 8
test eax, eax
je 0x409959
sub eax, esi
test eax, eax
jle 0x409959
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x31c]
push eax
push ecx
call fcn.00422719
test eax, eax
je 0x409959
lea edx, [esp + 0x1c]
push edx
call fcn.0040b7e0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push esi
push eax
call fcn.00415746
mov dword [esp + 0x48], esi
mov bl, 1
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4099ed
mov edx, dword [esp + 0x70]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
mov ecx, edi
call fcn.0041d5ab
test bl, bl
je 0x409991
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00415746
push 0x46d824
push 0x47dcc8
call fcn.00405640
add esp, 8
test al, al
je 0x4099fb
mov eax, dword [0x47dce4]
cmp eax, 1
jne 0x4099be
lea eax, [edi + 0xb24]
call fcn.004049b0
jmp 0x4099d8
cmp eax, 2
jne 0x4099cc
mov eax, edi
call fcn.00409d80
jmp 0x4099d8
cmp eax, 3
jne 0x4099d8
mov eax, edi
call fcn.00409ca0
push 0
push 0
push 0
push 0
push edi
push 0x407820
call fcn.00416b65
jmp 0x4099fb
push 0
push 0
push 0x46e14c
call fcn.0041564d
add esi, 0xfffffff0
mov byte [esp + 0x980], 0xc
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b66
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
jmp 0x409b66
lea ecx, [esp + 0x74]
call fcn.0041d161
cmp eax, 1
jne 0x409b66
mov edi, dword [esp + 0x1c]
push 6
mov ecx, edi
call fcn.0041d5ab
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
push eax
call fcn.00401d70
lea esi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x1c], esi
mov byte [esp + 0x980], 0xe
xor bl, bl
cmp dword [esi - 0xc], 0
jl 0x409abb
push str..ocx
push esi
call fcn.0042abee
add esp, 8
test eax, eax
je 0x409abb
sub eax, esi
test eax, eax
jle 0x409abb
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x31c]
push eax
push ecx
call fcn.00422719
test eax, eax
je 0x409abb
lea edx, [esp + 0x1c]
push edx
call fcn.0040b7e0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push esi
push eax
call fcn.00415746
mov dword [esp + 0x48], esi
mov bl, 1
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x409b4f
mov edx, dword [esp + 0x70]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
mov ecx, edi
call fcn.0041d5ab
test bl, bl
je 0x409af3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00415746
push 0x46d824
push 0x47dcc8
call fcn.00405640
add esp, 8
test al, al
je 0x409b5d
mov eax, dword [0x47dce4]
cmp eax, 1
jne 0x409b20
lea eax, [edi + 0xb24]
call fcn.004049b0
jmp 0x409b3a
cmp eax, 2
jne 0x409b2e
mov eax, edi
call fcn.00409d80
jmp 0x409b3a
cmp eax, 3
jne 0x409b3a
mov eax, edi
call fcn.00409ca0
push 0
push 0
push 0
push 0
push edi
push 0x407820
call fcn.00416b65
jmp 0x409b5d
push 0
push 0
push 0x46e15c
call fcn.0041564d
lea ecx, [esp + 0x1c]
call fcn.00401930
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0040be2d
mov byte [esp + 0x984], 8
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409b9b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 4
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409beb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 2
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x74]
mov dword [esp + 0x980], 0xffffffff
call fcn.00402d30
mov ecx, dword [esp + 0x978]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x960]
xor ecx, esp
call fcn.00428a74
mov esp, ebp
pop ebp
ret