Function at 0x40a2b0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push edi
mov dword [ebp - 0xc], 0
mov ax, word [0x4788a8]
mov word [ebp - 0x124], ax
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x122]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00407980
add esp, 8
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x40a312
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5c
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40a335
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x40a33c
mov dword [ebp - 8], 0x4796c4
push 0
push 0x4788ac
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40a3c3
push 0x3c
push 0
lea eax, [ebp - 0x168]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x168], 0x3c
mov dword [ebp - 0x164], 0x40
mov dword [ebp - 0x15c], str.open
mov dword [ebp - 0x158], str.regedit.exe
mov dword [ebp - 0x14c], 1
lea ecx, [ebp - 0x168]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push str.RegEdit_RegEdit
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40a3e4
push 0x10
push str.Share_Enum
push str.Share_Enum_was_unable_to_launch_Regedit.
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40a539
push 5
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x478918
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x12c], 0
jmp 0x40a468
mov eax, dword [ebp - 0x12c]
add eax, 1
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x1e
jge 0x40a486
push 0
push 0x25
push pe_nt_image_headers32
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40a459
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea eax, [ebp - 0x124]
mov dword [ebp - 0x20], eax
jmp 0x40a4a6
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
movsx eax, byte [edx]
test eax, eax
je 0x40a51b
mov ecx, dword [ebp - 0x20]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x40a4eb
mov dword [ebp - 0x16c], 0x27
push 0
mov eax, dword [ebp - 0x16c]
push eax
push pe_nt_image_headers32
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
jmp 0x40a519
mov eax, dword [ebp - 0x20]
movsx ecx, byte [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_toupper]
add esp, 4
mov dword [ebp - 0x170], eax
push 0
mov edx, dword [ebp - 0x170]
push edx
push 0x102
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40a49d
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov esp, ebp
pop ebp
ret