Function at 0x4ac210
Capabilities:
Create process on windows
Link many functions at runtime
Set registry value

Disassembly:
sub esp, 0x2a8
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x2a4], eax
mov eax, dword [esp + 0x2ac]
mov ecx, dword [esp + 0x2b0]
push esi
xor esi, esi
push 0x40
mov dword [esp + 0x38], eax
lea eax, [esp + 0x62]
xor edx, edx
push esi
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
mov word [esp + 0x68], dx
call fcn.005dfd60
add esp, 0xc
push esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
call fcn.00503120
test eax, eax
je 0x4ac2a7
push 0x103
lea ecx, [esp + 0x1a9]
push esi
push ecx
mov byte [esp + 0x1b0], 0
call fcn.005dfd60
add esp, 0xc
push esi
lea edx, [esp + 0x1a8]
push edx
push esi
call fcn.00504d70
test eax, eax
jne 0x4ac2cc
mov dword [esp + 0xc], 1
push ebp
push str.Rstrtmgr.dll
call fcn.004f4be0
mov ebp, eax
cmp ebp, esi
jne 0x4ac2e6
cmp dword [esp + 0x10], 1
jne 0x4ac2c5
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
jmp 0x4ac616
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2a4]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x2a8
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push edi
push str.RmStartSession
push ebp
call esi
push str.RmRegisterResources
push ebp
mov edi, eax
call esi
push str.RmGetList
push ebp
mov ebx, eax
call esi
push str.RmShutdown
push ebp
mov dword [esp + 0x3c], eax
call esi
push str.RmRestart
push ebp
mov dword [esp + 0x2c], eax
call esi
push str.RmEndSession
push ebp
mov dword [esp + 0x34], eax
call esi
mov dword [esp + 0x3c], eax
test edi, edi
je 0x4ac5fe
test ebx, ebx
je 0x4ac5fe
cmp dword [esp + 0x34], 0
je 0x4ac5fe
cmp dword [esp + 0x24], 0
je 0x4ac5fe
cmp dword [esp + 0x2c], 0
je 0x4ac5fe
test eax, eax
je 0x4ac5fe
lea eax, [esp + 0x68]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
call edi
test eax, eax
jne 0x4ac50e
lea edx, [esp + 0x50]
push edx
call fcn.00516940
mov ecx, dword [eax]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x4c], eax
test ecx, ecx
jbe 0x4ac505
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x4c]
push ecx
push 1
push 0
push 0
push edx
call ebx
test eax, eax
jne 0x4ac505
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
xor edi, edi
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
call dword [esp + 0x48]
cmp eax, ebx
je 0x4ac440
cmp eax, 0xea
jne 0x4ac4f8
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
cmp edi, ebx
je 0x4ac414
push edi
call fcn.005e132a
add esp, 4
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, 0x29c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005ddec6
mov edi, eax
mov eax, esi
add esp, 4
inc esi
cmp eax, 3
jb 0x4ac3d7
jmp 0x4ac4f8
cmp dword [esp + 0x30], ebx
jne 0x4ac4f8
mov ecx, dword [esp + 0x10]
push ebx
push 1
push ecx
call dword [esp + 0x30]
cmp eax, ebx
jne 0x4ac4f8
mov ecx, dword [esp + 0x40]
cmp ecx, ebx
je 0x4ac486
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x4ac486
mov edx, dword [esp + 0x2c4]
push edx
push eax
push 3
push ebx
push str.IconStreams
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push ebx
push ebx
push eax
call dword [esp + 0x38]
cmp eax, ebx
jne 0x4ac4f0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea ecx, [ecx]
push 0x64
call ebx
lea ecx, [esp + 0x5c]
push ecx
call fcn.00516940
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], eax
test ecx, ecx
jne 0x4ac4dc
inc esi
cmp esi, 0x28
mov dword [esp + 0x14], 1
jl 0x4ac4a0
mov dword [esp + 0x20], 1
xor ebx, ebx
jmp 0x4ac4f8
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 1
xor ebx, ebx
jmp 0x4ac4f8
mov dword [esp + 0x14], 1
cmp edi, ebx
je 0x4ac505
push edi
call fcn.005e132a
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x40]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x14], 0
je 0x4ac5eb
push 0x103
lea edx, [esp + 0x1b5]
push 0
push edx
mov byte [esp + 0x1bc], 0
call fcn.005dfd60
push 0x103
lea eax, [esp + 0xbd]
push 0
push eax
mov byte [esp + 0xc4], 0
call fcn.005dfd60
lea ecx, [esp + 0x1c8]
push 0x104
push ecx
call fcn.004ebf90
add esp, 0x20
lea edx, [esp + 0x1b0]
push edx
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0xac]
push ecx
call fcn.004e24e0
add esp, 4
push 0x618e20
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
lea eax, [esp + 0xb8]
push 0
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x4ac5d4
push 0xa
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4ac5eb
lea edx, [esp + 0xac]
push edx
push str.Unable_to_locate_explorer___s__
push 0
call fcn.004f0f30
add esp, 0xc
cmp dword [esp + 0x18], 1
jne 0x4ac5f8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [esp + 0x20]
jmp 0x4ac614
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x18], 1
jne 0x4ac612
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x2ac]
pop ebp
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x2a8
ret 0xc