Function at 0x407d80
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42721d
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
xor ecx, ecx
mov dword [ebp - 0xbc], 0
add eax, 0x1c
mov dword [ebp - 0xb8], 0
xor bl, bl
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
cmp dword [eax + 0x14], 7
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0xc0], 0x44
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
jbe 0x407e75
mov eax, dword [eax]
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0xc0]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40810f
push 0xffffffffffffffff
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov dword [ebp - 0x60], 0x7fffff
lea eax, [ebp - 0x60]
test esi, esi
push eax
push dword [ebp - 0x74]
sete bl
mov byte [ebp - 0x51], bl
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
mov eax, dword [ebp - 0x60]
jne 0x407ed7
test eax, eax
je 0x407ed7
mov byte [ebp - 0x51], 0
jmp 0x407edf
test esi, esi
je 0x40810f
xor ecx, ecx
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov word [ebp - 0x50], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x38]
push 0x10
push ecx
push eax
call fcn.0041879e
lea esi, [ebp - 0x38]
add esp, 0xc
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x407f31
sub esi, ecx
mov ecx, dword [ebp - 0x3c]
sar esi, 1
mov dword [ebp - 0x58], ecx
cmp esi, ecx
ja 0x407f72
cmp ecx, 7
mov dword [ebp - 0x40], esi
lea edi, [ebp - 0x50]
cmova edi, dword [ebp - 0x50]
lea eax, [ebp - 0x38]
add esi, esi
push esi
push eax
push edi
call fcn.00410960
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
jmp 0x408056
cmp esi, 0x7ffffffe
ja 0x408142
mov ebx, esi
or ebx, 7
cmp ebx, 0x7ffffffe
ja 0x407fb8
mov edx, ecx
mov eax, 0x7ffffffe
shr edx, 1
sub eax, edx
cmp ecx, eax
ja 0x407fb8
lea eax, [ecx + edx]
cmp ebx, eax
cmovb ebx, eax
lea eax, [ebx + 1]
cmp eax, 0x7fffffff
ja 0x40813d
add eax, eax
jne 0x407fc4
xor edi, edi
jmp 0x407ffd
mov eax, 0x7fffffff
mov ebx, 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x407ff2
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40813d
push ecx
call fcn.0040f117
add esp, 4
test eax, eax
je 0x408147
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x407ffd
push eax
call fcn.0040f117
add esp, 4
mov edi, eax
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x38]
add esi, esi
mov dword [ebp - 0x3c], ebx
push esi
push eax
push edi
call fcn.00410960
xor eax, eax
add esp, 0xc
mov word [esi + edi], ax
mov eax, dword [ebp - 0x58]
cmp eax, 7
jbe 0x408053
mov edx, dword [ebp - 0x50]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x408049
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408147
push ecx
push edx
call fcn.0040f14c
add esp, 8
mov dword [ebp - 0x50], edi
mov eax, dword [ebp - 0x64]
add eax, 0x34
cmp dword [eax + 0x14], 7
jbe 0x408064
mov eax, dword [eax]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x58], 0
push ecx
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4080d6
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x4080d6
cmp dword [ebp - 0x3c], 7
lea edx, [ebp - 0x50]
cmova edx, dword [ebp - 0x50]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4080a7
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.ErrCode
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x40810c
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x408102
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408147
push ecx
push edx
call fcn.0040f14c
add esp, 8
mov bl, byte [ebp - 0x51]
push dword [ebp - 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x70]
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f104
mov esp, ebp
pop ebp
ret
call fcn.00401115
call fcn.0040118c
call fcn.00417f31
int3