Function at 0x403060
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5413ec
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x594ca8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
test byte [0x59cd4c], 1
jne 0x4030c5
or dword [0x59cd4c], 1
push 0x5704e4
mov ecx, 0x59cd48
mov byte [ebp - 4], 1
call fcn.004040f0
push 0x543770
call fcn.00516c82
add esp, 4
mov byte [ebp - 4], bl
mov eax, dword [0x59cd48]
mov eax, dword [eax - 0xc]
cmp eax, ebx
jne 0x40322f
push 0x3ff
lea ecx, [ebp - 0x40f]
push ebx
push ecx
mov byte [ebp - 0x410], bl
call fcn.00518ea0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsDyBrowser.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0x400
call esi
test eax, eax
jne 0x403151
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x410]
push ecx
push ebx
push ebx
push 0x57053a
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403151
mov eax, dword [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x403153
xor al, al
movzx eax, al
lea ecx, [ebp - 0x410]
cmp eax, ebx
jne 0x4031ef
push 0x400
push ebx
push ecx
call fcn.00518ea0
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsCKBrowser.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0x400
call esi
test eax, eax
jne 0x4031ce
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x410]
push ecx
push ebx
push ebx
push 0x57053a
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4031ce
mov eax, dword [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4031d0
xor al, al
movzx eax, al
cmp eax, ebx
je 0x40322f
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x414]
call fcn.00403ba0
mov byte [ebp - 4], 2
jmp 0x4031ff
push ecx
lea ecx, [ebp - 0x414]
call fcn.00403ba0
mov byte [ebp - 4], 3
push eax
mov ecx, 0x59cd48
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x414]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40322f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x59cd48]
mov ecx, dword [ebp + 8]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [eax - 0xc], ebx
jne 0x40325d
push 3
push ebx
push ebx
push ecx
push str.open
push ebx
call esi
cmp eax, 0x20
jge 0x403298
mov edx, dword [ebp + 8]
push 3
push ebx
push edx
jmp 0x40328b
push 5
push ebx
push ecx
push eax
push str.open
push ebx
call esi
cmp eax, 0x20
jge 0x403298
mov edx, dword [ebp + 8]
push 3
push ebx
push ebx
push edx
push str.open
push ebx
call esi
cmp eax, 0x20
jge 0x403298
mov eax, dword [ebp + 8]
push 3
push ebx
push eax
push str.IExplore.exe
push str.open
push ebx
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4032be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051553d
mov esp, ebp
pop ebp
ret