Function at 0x4011f0
Capabilities:
Create process on windows
Create process suspended
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471010
mov eax, dword fs:[0]
push eax
mov eax, 0x19e0
call fcn.00421130
mov eax, dword [0x4811c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x19ec]
xor edi, edi
mov dword [ebp - 0x1824], eax
push edi
push 1
mov dword [ebp - 0x1820], 3
mov dword [ebp - 0x1818], 0
call fcn.004129d0
xor bl, bl
mov dword [ebp - 4], edi
push str.mfehidk
mov byte [ebp - 0x1811], bl
call fcn.00412540
mov esi, eax
add esp, 4
test esi, esi
jne 0x40127f
push str.Unable_to_open_registry_key__mfehidk__containing_persisted_VTP.BIN_n
call fcn.00405650
add esp, 4
jmp 0x4016e6
lea eax, [ebp - 0x1818]
push eax
push 0
lea eax, [ebp - 0x1820]
push eax
push 0
push str.VTPCerts
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1818]
test eax, eax
jne 0x4015d6
mov dword [ebp - 0x1864], eax
mov dword [ebp - 0x1860], eax
mov dword [ebp - 0x185c], eax
mov dword [ebp - 0x1858], eax
mov dword [ebp - 0x1854], eax
mov dword [ebp - 0x1850], eax
mov dword [ebp - 0x184c], eax
mov dword [ebp - 0x1848], eax
mov dword [ebp - 0x1844], eax
mov dword [ebp - 0x1840], eax
mov dword [ebp - 0x183c], eax
mov dword [ebp - 0x1838], eax
mov dword [ebp - 0x1834], eax
mov dword [ebp - 0x1830], eax
mov dword [ebp - 0x182c], eax
mov dword [ebp - 0x1828], eax
lea eax, [ebp - 0x1810]
push 0x400
push eax
push str.vtpinfo.exe
push 1
call fcn.00412150
push dword [ebp - 0x1824]
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00409820
push 4
push str..tmp
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00408330
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x1810]
push eax
push str.__s___dumpbin___s_
lea eax, [ebp - 0x1010]
push 0x400
push eax
call fcn.00409e80
add esp, 0x40
push str.The_VTP.BIN_has_never_been_updated_on_this_system._n
call fcn.00405650
lea eax, [ebp - 0x1010]
push eax
push str.Launching_installed_vtpinfo.exe_to_dump_compiled_in_VTP.BIN:__n____S_n
call fcn.00405650
add esp, 0xc
mov dword [ebp - 0x1864], 0
xor eax, eax
mov dword [ebp - 0x1860], 0
mov dword [ebp - 0x1878], eax
mov dword [ebp - 0x1874], eax
mov dword [ebp - 0x1870], eax
mov dword [ebp - 0x186c], eax
lea eax, [ebp - 0x1878]
push eax
lea eax, [ebp - 0x1868]
mov dword [ebp - 0x185c], 0
push eax
push 0
push 0
push 0x8000000
push 0
mov dword [ebp - 0x1858], 0
mov dword [ebp - 0x1854], 0
mov dword [ebp - 0x1850], 0
mov dword [ebp - 0x184c], 0
mov dword [ebp - 0x1848], 0
mov dword [ebp - 0x1844], 0
mov dword [ebp - 0x1840], 0
mov dword [ebp - 0x183c], 0
mov dword [ebp - 0x1838], 0
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1830], 0
mov dword [ebp - 0x182c], 0
mov dword [ebp - 0x1828], 0
mov dword [ebp - 0x1868], 0x44
push 0
push 0
lea eax, [ebp - 0x1010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40149f
push str.Failed_to_launch_vtpinfo.exe_n
call fcn.00405650
add esp, 4
xor bl, bl
jmp 0x4016e6
push 0xffffffffffffffff
push dword [ebp - 0x1878]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1878]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x810]
push eax
push str.Reading_vtp.bin_from__S_n
call fcn.00405650
add esp, 8
lea eax, [ebp - 0x810]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40150b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x810]
push eax
push str._S_could_not_be_opened__error_code__d_n
jmp 0x4015b4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [ebp - 0x1818], eax
mov dword [ebp - 0x181c], 0
call fcn.0042c6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x401547
push str.Unable_to_allocate_memory_for_file_based_VTP.BIN_n
call fcn.00405650
add esp, 4
xor bl, bl
jmp 0x4016e6
push 0
lea eax, [ebp - 0x181c]
push eax
push dword [ebp - 0x1818]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40157d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x810]
push eax
push str.Failed_to_read__S__error_code__d_n
call fcn.00405650
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x181c]
cmp eax, 0xc
jae 0x4015a7
push eax
push str.Invalid_bin_header_size__u_n
call fcn.00405650
push edi
call fcn.0042c6a2
add esp, 0xc
xor edi, edi
jmp 0x4015bc
lea ecx, [ebp - 0x810]
push ecx
push eax
push str._u_bytes_read_from__S_n
call fcn.00405650
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x401681
mov bl, byte [ebp - 0x1811]
jmp 0x401658
push eax
call fcn.0042c6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x4015f9
push str.Unable_to_allocate_memory_for_persisted_VTP.BIN_n
call fcn.00405650
add esp, 4
xor bl, bl
jmp 0x4016e6
lea eax, [ebp - 0x1818]
push eax
push edi
lea eax, [ebp - 0x1820]
push eax
push 0
push str.VTPCerts
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40163e
push str.Unable_to_query_registry_value__VTPCerts__containing_persisted_VTP.BIN_n
call fcn.00405650
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0042c6a2
add esp, 4
xor bl, bl
jmp 0x4016e6
push dword [ebp - 0x1818]
push str._u_bytes_read_from_persisted_VTP.BIN_n
call fcn.00405650
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x19ec]
push eax
push edi
call fcn.00406360
push edi
mov esi, eax
call fcn.0042c6a2
add esp, 4
test esi, esi
je 0x401685
push str.Unable_to_convert_VTP.BIN_to_XML_n
call fcn.00405650
add esp, 4
xor bl, bl
jmp 0x4016e6
push dword [ebp - 0x1824]
push 0x47398c
call fcn.00409ea0
add esp, 8
lea ecx, [ebp - 0x19ec]
mov esi, eax
push 0
push esi
call fcn.00416c30
cmp dword [ebp - 0x19bc], 0
je 0x4016cd
lea ecx, [ebp - 0x19ec]
call fcn.004141b0
push eax
push esi
push str.Could_not_save_XML_to__s._TinyError_is__s
call fcn.00405650
add esp, 0xc
jmp 0x4016dd
push esi
push str._s_written_n
call fcn.00405650
add esp, 8
mov bl, 1
push esi
call fcn.0040bbd0
add esp, 4
lea ecx, [ebp - 0x19ec]
call fcn.00413100
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret 4