Function at 0x403e20
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x3bc
mov ecx, 5
push ebx
push ebp
push esi
push edi
mov esi, str._shellopencommand
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, 5
mov esi, str._shellprintcommand
lea edi, [esp + 0x28]
mov ebx, dword [esp + 0x3d8]
rep movsd dword es:[edi], dword [esi]
mov ebp, dword [sym.imp.MSVCRT.dll__mbsicmp]
push str.print
push ebx
movsb byte es:[edi], byte [esi]
call ebp
add esp, 8
test eax, eax
jne 0x403ec6
lea eax, [esp + 0x248]
push 0x80
push eax
push 0
push str.device
push str.windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x404095
mov ecx, dword [esp + 0x3e0]
mov edx, dword [esp + 0x3dc]
mov eax, dword [esp + 0x3d0]
push ecx
push 0
push 0
push edx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
pop edi
pop esi
setg cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x3bc
ret
mov edi, dword [esp + 0x3d4]
cmp byte [edi], 0x2e
jne 0x403ef5
lea edx, [esp + 0x10]
lea eax, [esp + 0x144]
push edx
push eax
push edi
push 0x80000000
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
jmp 0x403f19
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x144]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.open
push ebx
call ebp
add esp, 8
test eax, eax
jne 0x403f2e
lea edi, [esp + 0x14]
jmp 0x403f45
push str.print
push ebx
call ebp
add esp, 8
test eax, eax
jne 0x404095
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x144]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x148]
push ecx
push edx
push 0x80000000
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x404095
mov esi, dword [sym.imp.MSVCRT.dll__mbschr]
lea eax, [esp + 0x40]
push 0x25
push eax
call esi
add esp, 8
test eax, eax
je 0x403fbd
mov byte [eax + 1], 0x73
jmp 0x40404b
cmp byte [esp + 0x40], 0x22
jne 0x40400a
lea ecx, [esp + 0x41]
push 0x22
push ecx
call esi
add esp, 8
test eax, eax
je 0x403fda
mov byte [eax + 1], 0
jmp 0x40401d
mov edi, 0x4071b0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40401d
lea eax, [esp + 0x40]
push 0x20
push eax
call esi
add esp, 8
test eax, eax
je 0x40401d
mov byte [eax], 0
mov edi, 0x4071ac
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x3dc]
lea ecx, [esp + 0x40]
push eax
lea edx, [esp + 0x2cc]
push ecx
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x3ec]
add esp, 0xc
lea ecx, [esp + 0x2c8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 0x1f
pop edi
cmp edx, eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x3bc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3bc
ret