Function at 0x4a146c
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov dword [ebp - 0x20], 0x32
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
and edi, 0xd
je 0x4a1704
mov eax, dword [0x6a1394]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], 0x4a143d
mov dword [ebp - 0x30], str.DPPPDLL32
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x4a14ea
push esi
push str.Fatal_Error
push str.Cannot_register_class_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4a19f6
xor ebx, ebx
mov eax, dword [0x6a1394]
push ebx
push eax
push ebx
mov eax, OleUIInsertObjectA
push ebx
mov esi, str.DPPPDLL32
push ebx
push eax
push ebx
push eax
push 0xa0000
push esi
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
mov dword [ebp - 0x10], eax
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4a1568
push 6
push str.machnm1.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x4a1568
push ebx
push str.Fatal_Error
push str.Cannot_execute_machnm1.exe_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x6a1394]
push eax
push esi
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x4a19f6
mov ebx, 0xe
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
jne 0x4a15da
push 1
lea eax, [ebp - 0xa4]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4a15cc
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
lea eax, [ebp - 0xa4]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4a1599
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
jne 0x4a156d
test ebx, ebx
jne 0x4a1616
push 0
push str.Fatal_Error
push str.Cannot_communicate_with_machnm1.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x6a1394]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x4a19f6
push dword [ebp + 0xc]
push 0x6a1384
xor ebx, ebx
mov dword [0x6a1380], edi
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov al, byte [edi]
push ecx
push dword [ebp - 0x10]
push 0x4a
push esi
mov byte [0x6a1393], al
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x24], 0x6a1380
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x10
push esi
mov esi, 0xe
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4a1685
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x4a1669
push dword [ebp - 0x10]
mov esi, dword [0x69b7e8]
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
jne 0x4a16c7
push 0
push str.Fatal_Error
push str.Cannot_close_window_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x6a1394]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x4a19f6
mov eax, dword [0x6a1394]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
test eax, eax
jne 0x4a16fa
push 0
push str.Fatal_Error
push str.Cannot_unregister_class_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4a19f6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a1707
mov edi, dword [ebp + 0x10]
test byte [ebp + 8], 2
je 0x4a171d
push edi
call fcn.004a41d5
cdq
mov ecx, 0xe1
idiv ecx
add esi, eax
test byte [ebp + 8], 0x10
je 0x4a172e
push edi
call fcn.004a40e1
add esp, 4
add esi, eax
test byte [ebp + 8], 0x20
je 0x4a173b
call fcn.004a3fb6
add esi, eax
test byte [ebp + 8], 0x40
je 0x4a1753
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.004a3cd9
add esp, 8
add esi, dword [ebp - 0x18]
test byte [ebp + 8], 0x80
je 0x4a18a8
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 0x108], bl
push 1
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a1810
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push ebx
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a17c3
lea eax, [ebp - 0x108]
push eax
call fcn.004a3c6d
and eax, 0x7fffffff
jmp 0x4a185e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a1860
jmp 0x4a1852
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push OleUIInsertObjectA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a1860
lea eax, [ebp - 0x108]
push eax
call fcn.004a3c6d
add esi, eax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov byte [ebp - 0x108], 0
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductKey
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a189f
lea eax, [ebp - 0x108]
push eax
call fcn.004a3c6d
add esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [ebp + 9], 1
je 0x4a19ee
movsx eax, byte [edi + 1]
cmp eax, 0x3a
je 0x4a18d4
cmp eax, 0x5c
je 0x4a1923
push 0
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.004a32ec
add esp, 0xc
jmp 0x4a194c
mov al, byte [edi]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x88]
push edx
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
lea eax, [ebp - 4]
push eax
call sub.MPR.dll_WNetGetConnectionA
cmp byte [ebp - 0x86], 0
mov eax, 2
je 0x4a1944
mov cl, byte [ebp + eax - 0x88]
cmp cl, 0x5c
je 0x4a1944
mov byte [ebp + eax - 0x8a], cl
inc eax
cmp byte [ebp + eax - 0x88], 0
jne 0x4a1903
jmp 0x4a1944
cmp byte [edi + 2], 0
mov eax, 2
je 0x4a1944
mov cl, byte [eax + edi]
cmp cl, 0x5c
je 0x4a1944
mov byte [ebp + eax - 0x8a], cl
inc eax
cmp byte [eax + edi], 0
jne 0x4a192e
mov byte [ebp + eax - 0x8a], 0
cmp byte [ebp - 0x88], 0
je 0x4a19ee
push 0x6917e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a19ee
push 0x6917d4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x6917c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
mov dword [ebp - 0x1c], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x298]
push eax
push 0x101
call ebx
cmp eax, 0xffffffff
je 0x4a19e7
lea eax, [ebp - 0x88]
push eax
call dword [ebp - 0x1c]
test eax, eax
je 0x4a19e4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
xor eax, eax
mov al, byte [ecx]
and eax, 0x7f
shl eax, 0x18
add esi, eax
movsx eax, byte [ecx + 1]
shl eax, 0x10
add esi, eax
movsx eax, byte [ecx + 2]
movsx ecx, byte [ecx + 3]
shl eax, 8
add esi, eax
add esi, ecx
call dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and esi, 0x7fffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc