Function at 0x426360
Capabilities:
Create process on windows
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov eax, 0x4262d0
call fcn.00406744
mov ebx, 0x428ac8
mov edi, 0x428aa8
xor eax, eax
push ebp
push 0x42689b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4268ac
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x428acc], eax
push 0x428b9c
push 0xf003f
push 0
push 0x4268bc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x42641e
mov dword [0x428ba0], 0x105
push 0x428ba0
push 0x428ba4
push 0
push 0
push 0x4268d0
mov eax, dword [0x428b9c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov esi, eax
mov eax, 0x428aa4
mov edx, 0x428ba4
mov ecx, 0x105
call fcn.00404680
test esi, esi
je 0x426411
mov edx, 0x428aa4
xor eax, eax
call fcn.00402894
mov eax, dword [0x428b9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x42642a
mov edx, 0x428aa4
xor eax, eax
call fcn.00402894
mov eax, 0x428cb0
xor ecx, ecx
mov edx, 0x28
call fcn.00402f94
mov dword [0x428cb0], 3
mov dword [0x428cb4], 0x425bf0
xor eax, eax
mov dword [0x428cb8], eax
xor eax, eax
mov dword [0x428cbc], eax
mov eax, dword [0x428cc0]
mov dword [0x428cc0], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x428cc8], eax
mov dword [0x428ccc], 6
xor eax, eax
mov dword [0x428cd0], eax
mov eax, 0x4268dc
mov dword [0x428cd4], eax
push 0x428cb0
call sub.user32.dll_RegisterClassA
test ax, ax
je 0x426880
push 0x4268e4
push 0x4268dc
call sub.user32.dll_FindWindowA
mov dword [0x428ac4], eax
cmp dword [0x428ac4], 0
jne 0x4264fb
push 0x80000000
push 0
push 0x80000000
push 0
push 0
push 0
mov eax, dword [0x428710]
push eax
push 0
mov edx, 0x4268e4
mov eax, 0x4268dc
mov ecx, 0xcf0000
call fcn.00406ca8
mov dword [0x428ac4], eax
jmp 0x4265af
call fcn.00402a58
test eax, eax
je 0x426880
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402ab8
mov eax, dword [ebp - 0x18]
mov edx, 0x428cd8
call fcn.00403020
push 0
push eax
push 0x453
mov eax, dword [0x428ac4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x428cac
mov edx, 0x4268f8
call fcn.0040446c
call fcn.00402a58
sub al, 2
jb 0x426598
inc eax
mov byte [ebp - 0x11], al
mov bl, 2
cmp bl, 2
jne 0x426569
mov edx, 0x428cac
mov eax, 2
call fcn.00402ab8
jmp 0x426592
push dword [0x428cac]
push 0x4268f8
lea edx, [ebp - 0x1c]
xor eax, eax
mov al, bl
call fcn.00402ab8
push dword [ebp - 0x1c]
mov eax, 0x428cac
mov edx, 3
call fcn.00404790
inc ebx
dec byte [ebp - 0x11]
jne 0x426553
push 1
mov eax, 0x428cac
call fcn.00404920
push eax
call sub.kernel32.dll_WinExec
jmp 0x426880
mov dword [0x428cdc], 0x20
push 0x428cdc
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [0x428ce4]
mov edx, eax
shr edx, 0x14
mov dword [0x428ad4], edx
and eax, 0xfffff
cmp eax, 5
jbe 0x4265e3
inc dword [0x428ad4]
mov eax, dword [0x428ce8]
shr eax, 0x14
mov dword [0x428ad8], eax
mov eax, dword [0x428ad4]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
fild qword [ebp - 0x24]
fmul dword [0x4268fc]
call fcn.00402b48
mov word [0x428adc], ax
call fcn.0042516c
mov dword [0x428ad0], eax
mov byte [0x428adf], 0
mov byte [0x428ade], 0
mov byte [0x428ae0], 1
mov eax, 0x428b44
xor ecx, ecx
mov edx, 0x58
call fcn.00402f94
mov eax, dword [0x428ac4]
mov dword [0x428b48], eax
mov dword [0x428b4c], 1
mov dword [0x428b50], 7
mov dword [0x428b54], 0x401
push 0x426900
mov eax, dword [0x428710]
push eax
call sub.user32.dll_LoadIconA
mov dword [0x428b58], eax
push edi
mov esi, 0x426908
mov edi, 0x428b5c
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [0x428b44], 0x58
push 0x4258e0
push 0x3e8
push 1
mov eax, dword [0x428ac4]
push eax
call sub.user32.dll_SetTimer
mov esi, eax
call sub.user32.dll_CreatePopupMenu
mov dword [ebx], eax
push 0x426948
push 0xc9
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x426958
push 0xca
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x426968
push 0xcb
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0
push 0
push 0
push 0x420
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x42697c
push 0xcc
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0
push 0
push 0
push 0x420
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x42698c
push 0xcd
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x42698c
push 0xce
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x42698c
push 0xcf
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0
push 0
push 0
push 0x420
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x426994
push 0xd0
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x4269a8
push 0xd1
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
push 0x4269bc
push 0xd2
push 0
push 0x400
mov eax, dword [ebx]
push eax
call sub.user32.dll_InsertMenuA
call fcn.0042469c
mov edx, dword [0x428b10]
xor eax, eax
call fcn.00425188
cmp dword [0x428af0], 1
jne 0x426819
mov byte [0x428afd], 0
mov byte [0x428afc], 1
jmp 0x42682e
mov byte [0x428afc], 0
jmp 0x42682e
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
push edi
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x426822
push esi
mov eax, dword [0x428ac4]
push eax
call sub.user32.dll_KillTimer
mov eax, dword [0x428b3c]
push eax
mov eax, dword [0x428ac4]
push eax
call sub.user32.dll_UnregisterHotKey
mov eax, dword [0x428b40]
push eax
mov eax, dword [0x428ac4]
push eax
call sub.user32.dll_UnregisterHotKey
mov eax, dword [ebx]
push eax
call sub.user32.dll_DestroyMenu
push 0x428b44
push 2
call sub.shell32.dll_Shell_NotifyIconA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4268a2
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040443c
ret