Function at 0x4892dc
Capabilities:
Create process on windows
Move file
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x4892e4
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x48992a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4898f8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004032dc
mov esi, eax
test esi, esi
jle 0x48932f
lea edx, [ebp - 0x20]
mov eax, 1
call fcn.0040333c
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00408f24
jmp 0x489337
lea eax, [ebp - 8]
call fcn.004050d0
mov eax, dword [ebp - 8]
mov edx, 0x489940
call fcn.00405514
sete byte [ebp - 0xd]
mov eax, dword [ebp - 8]
mov edx, 0x489958
call fcn.00405514
sete byte [ebp - 0xe]
mov eax, dword [ebp - 8]
mov edx, 0x489970
call fcn.00405514
sete byte [ebp - 0xf]
mov eax, dword [ebp - 8]
mov edx, 0x489988
call fcn.00405514
sete byte [ebp - 0x10]
mov eax, dword [ebp - 8]
mov edx, 0x48999c
call fcn.00405514
sete bl
mov eax, dword [ebp - 8]
mov edx, 0x4899b0
call fcn.00405514
sete byte [ebp - 0x11]
mov eax, dword [ebp - 8]
mov edx, 0x4899c4
call fcn.00405514
sete byte [ebp - 0x12]
mov eax, dword [ebp - 8]
mov edx, 0x4899d8
call fcn.00405514
sete byte [ebp - 0x13]
mov eax, dword [0x4904f4]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x4905c8]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x490558]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x4904e4]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x49056c]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x490614]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x490548]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x4906b0]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x490740]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
mov eax, dword [0x490498]
mov eax, dword [eax]
mov edx, 1
call fcn.004887d0
cmp byte [ebp - 0x10], 0
je 0x489480
call fcn.00489140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489902
test bl, bl
je 0x4894be
push 0
push 0x4899e8
call sub.user32.dll_FindWindowA
mov edi, eax
push edi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4894be
push 0
push 0
push 0x4899fc
call sub.user32.dll_RegisterWindowMessageA
push eax
push edi
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489902
cmp byte [ebp - 0x11], 0
je 0x4894d6
call fcn.00488a04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489902
cmp byte [ebp - 0xf], 0
je 0x489527
lea eax, [ebp - 0x28]
call fcn.0042ce38
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0040deb4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
mov ecx, 0x489a14
call fcn.00405404
mov eax, dword [ebp - 4]
call fcn.004099e4
test al, al
je 0x489527
lea eax, [ebp - 0x2c]
mov ecx, 0x489a2c
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dl, 1
call fcn.00441354
mov eax, dword [0x490514]
mov edx, 0x489a38
call fcn.00405124
mov eax, dword [0x4906e0]
mov edx, 0x489a4c
call fcn.00405124
call fcn.0042482c
cmp al, 9
jb 0x4895b3
lea eax, [ebp - 0x30]
call fcn.0042e1f4
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0042da00
test al, al
je 0x4895b3
cmp dword [ebp - 0x18], 0x1000
jne 0x4895b3
push 1
lea eax, [ebp - 0x34]
call fcn.0042e0f8
mov eax, dword [ebp - 0x34]
call fcn.0040557c
push eax
push 0x489a5c
lea eax, [ebp - 0x38]
call fcn.0042e1f4
mov eax, dword [ebp - 0x38]
call fcn.0040557c
push eax
push 0x489a68
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489902
cmp byte [ebp - 0xe], 0
je 0x4895c3
call fcn.00488818
jmp 0x4898ee
test esi, esi
je 0x4895e1
cmp byte [ebp - 0xd], 0
jne 0x4895e1
test bl, bl
jne 0x4895e1
cmp byte [ebp - 0x12], 0
jne 0x4895e1
cmp byte [ebp - 0x13], 0
je 0x489841
test esi, esi
jne 0x48961f
push 0
push 0x4899e8
call sub.user32.dll_FindWindowA
mov edi, eax
push edi
call sub.user32.dll_IsWindow
test eax, eax
je 0x48961f
push 0
push 0
push 0x489a70
call sub.user32.dll_RegisterWindowMessageA
push eax
push edi
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489902
xor esi, esi
cmp byte [ebp - 0xd], 0
je 0x489640
lea edx, [ebp - 0x3c]
mov eax, 2
call fcn.0040333c
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.00409524
mov esi, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x490520]
mov eax, dword [eax]
mov ecx, 0x489a84
mov edx, 0x489a98
call fcn.004231e4
mov eax, dword [ebp - 0xc]
mov edx, 0x489ac4
call fcn.00405514
je 0x489825
push 0x489ac4
mov eax, dword [0x490520]
mov eax, dword [eax]
mov ecx, 0x489a84
mov edx, 0x489a98
call fcn.00423138
lea eax, [ebp - 0x44]
call fcn.0042ce38
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0040deb4
mov eax, dword [ebp - 0x40]
push eax
mov ecx, 0x489a14
lea eax, [ebp - 4]
pop edx
call fcn.00405404
mov eax, dword [ebp - 4]
call fcn.004099e4
test al, al
je 0x489825
lea eax, [ebp - 0x48]
mov ecx, 0x489ad0
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x48]
call fcn.0042dc28
test al, al
je 0x489710
lea eax, [ebp - 0x4c]
mov ecx, 0x489ae8
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x4c]
call fcn.0040557c
push eax
lea eax, [ebp - 0x50]
mov ecx, 0x489ad0
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x50]
call fcn.0040557c
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x54]
mov ecx, 0x489b00
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x54]
call fcn.0042dc28
test al, al
je 0x489763
lea eax, [ebp - 0x58]
mov ecx, 0x489b18
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x58]
call fcn.0040557c
push eax
lea eax, [ebp - 0x5c]
mov ecx, 0x489b00
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x5c]
call fcn.0040557c
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x60]
mov ecx, 0x489b30
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov dl, 1
call fcn.00441354
lea eax, [ebp - 0x64]
mov ecx, 0x489ae8
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x64]
call fcn.0042dc28
test al, al
je 0x4897d2
lea eax, [ebp - 0x68]
mov ecx, 0x489ad0
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x68]
call fcn.0040557c
push eax
lea eax, [ebp - 0x6c]
mov ecx, 0x489ae8
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x6c]
call fcn.0040557c
push eax
call sub.kernel32.dll_MoveFileA
lea eax, [ebp - 0x70]
mov ecx, 0x489b18
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x70]
call fcn.0042dc28
test al, al
je 0x489825
lea eax, [ebp - 0x74]
mov ecx, 0x489b00
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x74]
call fcn.0040557c
push eax
lea eax, [ebp - 0x78]
mov ecx, 0x489b18
mov edx, dword [ebp - 4]
call fcn.00405404
mov eax, dword [ebp - 0x78]
call fcn.0040557c
push eax
call sub.kernel32.dll_MoveFileA
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
mov ecx, esi
mov edx, ebx
movzx eax, byte [ebp - 0xd]
call fcn.00488c74
jmp 0x4898ee
xor eax, eax
push ebp
push 0x4898e7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00441e18
xor eax, eax
push ebp
push 0x4898ca
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00486ebc
mov dl, 1
mov eax, dword [0x485730]
call fcn.004867d8
mov edx, dword [0x4905fc]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x4898b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4905fc]
mov eax, dword [eax]
call fcn.00449e60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4898c0
mov eax, dword [0x4905fc]
mov eax, dword [eax]
call fcn.004041ec
mov eax, dword [0x48681c]
call fcn.004492a0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x489902
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489931
lea eax, [ebp - 0x78]
mov edx, 0x17
call fcn.004050f4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050f4
ret