Function at 0x4086f0
Capabilities:
Create process on windows
Hide graphical window
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
mov ecx, 8
mov esi, 0x40e274
lea edi, [esp + 0x148]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 8
lea edi, [esp + 0x169]
rep stosd dword es:[edi], eax
mov ecx, 9
mov esi, 0x40e24c
lea edi, [esp + 0x189]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
lea edi, [esp + 0x1af]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 9
mov esi, 0x40e228
lea edi, [esp + 0x1ca]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 7
lea edi, [esp + 0x1ee]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0xa
mov esi, 0x40e1fc
lea edi, [esp + 0x20b]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 6
lea edi, [esp + 0x234]
rep stosd dword es:[edi], eax
mov al, byte [0x40e508]
mov ecx, 0x3f
mov byte [esp + 0x48], al
xor eax, eax
lea edi, [esp + 0x49]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
mov dword [esp + 0x18], ebx
stosb byte es:[edi], al
call fcn.00408280
add esp, 8
test eax, eax
je 0x4087e1
push ebx
push 0xffffffffffffffff
push ebx
push 0x40e1f0
call fcn.00404ed0
add esp, 0x10
test eax, eax
je 0x4087d6
mov dword [esp + 0x10], 1
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40e1e4
push 0x40e188
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
cmp esi, ebx
jne 0x4088e8
lea ebp, [esp + 0x148]
lea ecx, [esp + 0x48]
push ecx
call fcn.00405050
add esp, 4
test eax, eax
jne 0x4088ab
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push eax
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40889e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push 0x40e1d8
push eax
mov dword [esp + 0x38], 0xff
mov dword [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408893
mov edi, 0x40e1c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add ebp, 0x41
cmp ebx, 4
jl 0x408802
lea ecx, [esp + 0x48]
push ecx
call fcn.00405050
add esp, 4
test eax, eax
je 0x4088d4
lea edx, [esp + 0x48]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40e1e4
push 0x40e188
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
jmp 0x4088f0
mov dword [esp + 0x10], 1
test esi, esi
je 0x408cf1
push 1
call fcn.0040a020
add esp, 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x408925
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0x8006
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
call ebx
push 0
push 0
call fcn.00408280
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x408961
inc esi
cmp esi, 0x1e
jl 0x40893a
jmp 0x408cb5
mov esi, dword [esp + 0x258]
test esi, esi
jne 0x408976
push esi
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40897d
push 0x7d0
call ebx
push ebp
push 0
push 0x40e1c4
call fcn.004081b0
add esp, 0xc
test eax, eax
je 0x4089a0
push 0
push 0
push 1
push eax
call fcn.00408110
add esp, 0x10
test esi, esi
je 0x4089ab
push 0x7d0
call ebx
push ebp
push 0
push 0x40e1c0
call fcn.004081b0
add esp, 0xc
test eax, eax
je 0x4089ce
push 1
push 0
push 0
push eax
call fcn.00408110
add esp, 0x10
test esi, esi
je 0x4089d9
push 0x7d0
call ebx
xor edi, edi
jmp 0x4089e3
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
call ebx
push 0
push ebp
call fcn.00408280
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4089fe
inc edi
cmp edi, 0x1e
jl 0x4089dd
push ebx
push 0
push 0x40e1bc
call fcn.004081b0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x408a66
mov eax, dword [esp + 0x258]
mov esi, ebx
test eax, eax
jne 0x408a2c
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x408a37
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push edi
call fcn.00408110
add esp, 0x10
xor edi, edi
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebp
call fcn.00408280
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x408a66
inc edi
cmp edi, 0x1e
jl 0x408a48
push 0
push 0x40e1b4
push 0
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
je 0x408cb1
mov eax, dword [esp + 0x258]
test eax, eax
jne 0x408a9c
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408aa9
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004085a0
add esp, 8
test eax, eax
je 0x408cb1
lea ecx, [esp + 0x28]
push ecx
push 0
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x408cb1
mov edx, dword [esp + 0x250]
test edx, edx
je 0x408b09
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0
push 0x40e1b0
call fcn.004081b0
add esp, 0xc
test eax, eax
je 0x408cb1
push 0
push 0
push 0
push eax
call fcn.00408110
add esp, 0x10
mov dword [esp + 0x18], 0
push ebp
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x408cb1
cmp dword [esp + 0x18], 0x1f4
jge 0x408cb1
push 0x14
call edi
push ebx
push ebp
call fcn.00408280
mov esi, eax
add esp, 8
test esi, esi
je 0x408bd1
mov eax, dword [esp + 0x258]
test eax, eax
jne 0x408b7f
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x408b86
push 0x7d0
call edi
mov eax, dword [esp + 0x254]
push esi
cmp eax, 1
push 0
jne 0x408ba8
push 0x40e1bc
call fcn.004081b0
add esp, 0xc
test eax, eax
jne 0x408bf8
jmp 0x408bb9
push 0x40e1ac
call fcn.004081b0
add esp, 0xc
test eax, eax
jne 0x408bee
push esi
push 0
push 0x40e1b0
call fcn.004081b0
add esp, 0xc
test eax, eax
jne 0x408c5f
mov esi, dword [esp + 0x18]
push ebp
inc esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x408b47
jmp 0x408cb1
cmp dword [esp + 0x254], 2
je 0x408c07
push 0
push 0
push 0
push eax
call fcn.00408110
add esp, 0x10
push 0
call fcn.0040a020
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x408c2c
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x408c4f
mov al, byte [esp + 0x48]
test al, al
je 0x408c4f
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x50]
push 0
push ecx
call fcn.00404ed0
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x23c
ret
push 0
push 0
push 0
push eax
call fcn.00408110
push ebx
push 0
push 0x40e1a4
call fcn.004081b0
add esp, 0x1c
test eax, eax
je 0x408c8e
push 0
push 0
push 0
push eax
call fcn.00408110
add esp, 0x10
push ebp
push 0
push 0x40e1a0
call fcn.004081b0
add esp, 0xc
test eax, eax
je 0x408cb1
push 0
push 0
push 0
push eax
call fcn.00408110
add esp, 0x10
mov edi, dword [esp + 0x14]
test edi, edi
je 0x408ccc
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x408ce7
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x50]
push 0
push edx
call fcn.00404ed0
add esp, 0x10
push 0
call fcn.0040a020
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x23c
ret