Function at 0x404913
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13f0
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.RegEdit_RegEdit
lea edi, [ebp - 0x14]
mov ebx, ecx
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.SysTreeView32
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00643470
push ebx
call fcn.00643470
push 0x5c
pop edx
xor ecx, ecx
cmp byte [eax + ebx - 1], dl
lea eax, [ebp - 0x13ac]
cmovne ecx, edx
push ecx
push ebx
push str._s_c
push 0x1388
push eax
call fcn.00402e0a
lea eax, [ebp - 0x13ac]
push eax
call fcn.00643470
inc eax
push eax
lea eax, [ebp - 0x13ac]
push eax
call fcn.00649c3f
add esp, 0x28
lea eax, [ebp - 0x14]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edi, eax
mov dword [ebp - 0x13b0], edi
test edi, edi
jne 0x404aec
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x13f0]
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov dword [ebp - 0x13f0], esi
lea eax, [ebp - 0x13f0]
mov dword [ebp - 0x13e4], str.Open
mov dword [ebp - 0x13e0], str.regedit.exe
mov dword [ebp - 0x13d4], 3
push eax
mov dword [ebp - 0x13ec], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x404b17
mov esi, dword [ebp - 0x13b8]
push 0xffffffffffffffff
push esi
call ebx
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
mov dword [ebp - 0x13b0], eax
test edi, edi
je 0x404b17
push 0xffffffffffffffff
push esi
call ebx
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ebx, eax
test ebx, ebx
je 0x404b17
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push 0x10288
push 0x111
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0x1e
pop edi
push 0
push 0x25
push 0x100
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_WaitForInputIdle]
sub edi, 1
jne 0x404a9a
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov al, byte [ebp - 0x13ac]
mov edi, dword [ebp - 0x13b0]
test al, al
je 0x404b4d
lea ecx, [ebp - 0x13ac]
mov dword [ebp - 0x13b0], ecx
push 0
cmp al, 0x5c
jne 0x404b21
push 0x27
push 0x100
jmp 0x404b2a
lea eax, [ebp - 0x13b4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x13b4]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x404a3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x404b65
movsx eax, al
push eax
push 0x102
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [ebp - 0x13b0]
inc ecx
mov dword [ebp - 0x13b0], ecx
mov al, byte [ecx]
test al, al
jne 0x404add
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret