Function at 0x402130
Capabilities:
Create process on windows
Query or enumerate registry value
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
lea edx, [esp + 0x14]
mov dword [esp + 0xc], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push str.CPLUtl64.exe__m
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x402040
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop esi
add esp, 0x54
ret
mov eax, dword [esp + 8]
cmp eax, 0x9c45
ja 0x402236
je 0x402211
cmp eax, 0xc9
ja 0x4021d9
je 0x4021ae
sub eax, 0x68
je 0x4021a9
sub eax, 4
je 0x40217f
sub eax, 0x5c
jne case.default.0x402244
push 0x40e418
call fcn.00404ef0
add esp, 4
test eax, eax
je case.default.0x402244
jmp 0x4039b0
mov eax, dword [0x40cbc4]
test eax, eax
je case.default.0x402244
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x40cbc4]
push 0
push 0
push 0x464
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret
jmp 0x403060
mov eax, dword [0x40cbc4]
test eax, eax
je case.default.0x402244
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x40cbc4]
push 0
push 0
push 0x464
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
ret
sub eax, 0x9c43
je 0x4021ec
dec eax
jne case.default.0x402244
jmp 0x402330
call fcn.00401fa0
test eax, eax
je 0x402203
push str.SNDREC32.EXE
call fcn.00402050
add esp, 4
ret
push 5
push str.SNDREC32.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
ret
call fcn.00401fa0
test eax, eax
je 0x402228
push str.SNDVOL32.EXE
call fcn.00402050
add esp, 4
ret
push 5
push str.SNDVOL32.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
ret
add eax, 0xffff63ba
cmp eax, 5
ja case.default.0x402244
jmp dword [eax*4 + 0x402310]
call fcn.00401fa0
test eax, eax
je 0x402259
jmp 0x401fe0
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL_mmsys.cpl__
call dword [sym.imp.KERNEL32.dll_WinExec]
ret
mov eax, dword [0x40bbb4]
test eax, eax
je case.default.0x402244
push 5
push str.RTLCPL.EXE
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x40cbc4]
test eax, eax
je case.default.0x402244
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
mov edx, dword [0x40e4b8]
xor eax, eax
test edx, edx
sete al
push eax
mov dword [0x40e4b8], eax
call fcn.00404e20
add esp, 4
ret
push 0
mov dword [0x40e4b8], 0
call fcn.00404e20
push 0x17700
call fcn.00404d50
add esp, 8
ret
push 0
mov dword [0x40e4b8], 0
call fcn.00404e20
push 0xbb80
call fcn.00404d50
add esp, 8
ret
push 0
mov dword [0x40e4b8], 0
call fcn.00404e20
push 0xac44
call fcn.00404d50
add esp, 8
ret
sub esp, 0x210
lea eax, [esp + 4]
push eax
push str.SoftwareMicrosoftMediaPlayer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40241b
lea ecx, [esp + 8]
push esi
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Installation_Directory
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40240f
mov esi, dword [sym.imp.KERNEL32.dll_SearchPathA]
lea edx, [esp + 4]
lea eax, [esp + 0x114]
push edx
push eax
push 0x100
push 0
lea ecx, [esp + 0x24]
push str.wmplayer.exe
push ecx
call esi
test eax, eax
jne 0x4023ff
lea edx, [esp + 4]
lea eax, [esp + 0x114]
push edx
push eax
push 0x100
push 0
lea ecx, [esp + 0x24]
push str.mplayer2.exe
push ecx
call esi
test eax, eax
jne 0x4023ff
lea edx, [esp + 4]
lea eax, [esp + 0x114]
push edx
push eax
push 0x100
push 0
lea ecx, [esp + 0x24]
push str.mplayer.exe
push ecx
call esi
test eax, eax
je 0x40240f
lea edx, [esp + 0x114]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x210
ret
mov eax, 0x40baa8
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
add eax, 0x20
cmp eax, 0x40bb08
jl 0x403067
push ecx
mov dword [0x40cbdc], ecx
call fcn.00402500
pop ecx
ret
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
call fcn.00403a60
cmp eax, 1
mov dword [0x40cbfc], eax
jne 0x403a51
cmp word [0x40e418], ax
mov byte [esp + 0x12], bl
setne al
mov byte [esp + 0x13], al
mov eax, dword [0x40e41c]
xor esi, esi
cmp eax, ebx
jle 0x403a23
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x40e2e0
xor edx, edx
lea ecx, [esp + 0x14]
mov dx, word [0x40e2a6]
push ebx
push ecx
mov ecx, dword [edi]
lea eax, [esp + 0x1a]
push edx
push eax
push ecx
call ebp
test eax, eax
je 0x403a23
mov eax, dword [0x40e41c]
inc esi
add edi, 4
cmp esi, eax
jl 0x4039f8
mov eax, dword [0x40e41c]
xor esi, esi
cmp eax, ebx
jle 0x403a51
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x40e2e0
mov edx, dword [edi]
push edx
call ebp
mov eax, dword [0x40e41c]
inc esi
add edi, 4
cmp esi, eax
mov dword [0x40cbfc], ebx
jl 0x403a39
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret