Function at 0x44ea40
Capabilities:
Create process on windows
Delete registry value
Get file size
Query or enumerate registry value
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f54b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xa24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], 0x1b7740
mov dword [ebp - 0x28], 0x36ee80
mov dword [ebp - 0x24], 0x6ddd00
mov dword [ebp - 0x20], 0xa4cb80
mov dword [ebp - 0x1c], 0x112a880
mov dword [ebp - 0x18], 0x1b77400
mov dword [ebp - 0x14], 0x2710
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [0x4b8474]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
lea ecx, [ebp - 0x48]
call fcn.004236e0
mov ecx, dword [0x4a2ac8]
push ecx
push 0
push 0x4b8478
lea ecx, [ebp - 0x48]
call fcn.00423530
mov byte [ebp - 4], 1
mov edx, dword [0x4b8474]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
cmp dword [ebp - 0x34], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x44f0be
push 1
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x60c], esp
mov dword [ebp - 0x62c], edx
push 0
push 0
mov ecx, dword [ebp - 0x62c]
call fcn.004236e0
mov eax, dword [0x4a2ac8]
push eax
push 0
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x62c]
call fcn.00423530
mov edx, dword [ebp - 0x62c]
mov dword [ebp - 0xa18], edx
lea eax, [ebp - 0x68]
push eax
call fcn.0047ae00
add esp, 0x24
mov dword [ebp - 0xa1c], eax
mov byte [ebp - 4], 2
mov byte [ebp - 0x49], 0
xor ecx, ecx
cmp dword [ebp - 0x54], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x44ecf0
cmp dword [ebp - 0x50], 0x10
jb 0x44eb76
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa20], eax
jmp 0x44eb7f
lea ecx, [ebp - 0x64]
mov dword [ebp - 0xa20], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov edx, dword [ebp - 0xa20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffff
je 0x44ecf0
mov dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
push edx
call fcn.0048a6d0
add esp, 4
mov dword [ebp - 0xa24], eax
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x610]
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x70], 0
je 0x44ece6
cmp dword [0x4b84ac], 0x10
jb 0x44ec0b
mov edx, dword [0x4b8498]
mov dword [ebp - 0xa28], edx
jmp 0x44ec15
mov dword [ebp - 0xa28], 0x4b8498
mov eax, dword [ebp - 0xa28]
push eax
call fcn.0048bceb
add esp, 4
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], 0
mov ecx, dword [ebp - 0x74]
push ecx
push 0
mov edx, dword [ebp - 0x70]
push edx
call fcn.0048d000
add esp, 0xc
push 0
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44ecce
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x634], ecx
push 0
push 0
push 0
call fcn.00482980
add esp, 0xc
mov dword [ebp - 0x630], eax
mov edx, dword [ebp - 0x634]
push edx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x630]
push ecx
call fcn.00482980
add esp, 0xc
mov dword [ebp - 0x630], eax
mov edx, dword [ebp - 0x630]
xor edx, 0x5e340a23
mov dword [ebp - 0x630], edx
mov eax, dword [ebp - 0x630]
sub eax, dword [ebp - 0x7c]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x635], al
movzx ecx, byte [ebp - 0x635]
test ecx, ecx
je 0x44ecce
mov byte [ebp - 0x49], 1
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x614], edx
mov eax, dword [ebp - 0x614]
push eax
call fcn.0048bd78
add esp, 4
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x49]
test edx, edx
je 0x44ef7a
lea eax, [ebp - 0x298]
push eax
call fcn.0044f0f0
add esp, 4
lea ecx, [ebp - 0x298]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x29c], eax
push 0x104
lea edx, [ebp - 0x190]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp - 0x50], 0x10
jb 0x44ed49
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa2c], eax
jmp 0x44ed52
lea ecx, [ebp - 0x64]
mov dword [ebp - 0xa2c], ecx
push 0
push 0
lea edx, [ebp - 0x190]
push edx
mov eax, dword [ebp - 0xa2c]
push eax
push 0x4a2cb0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x927c0
mov ecx, dword [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x29c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x84], 0
jne 0x44eec8
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44eec0
lea ecx, [ebp - 0x3a8]
push ecx
call fcn.00433730
add esp, 4
lea edx, [ebp - 0x3a8]
push edx
call fcn.00433780
add esp, 4
mov dword [ebp - 0x3b4], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x3b0], SysStringLen
mov dword [ebp - 0x4c4], 0
jmp 0x44edfc
mov eax, dword [ebp - 0x4c4]
add eax, 1
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 2
jae 0x44ee8a
lea ecx, [ebp - 0x3ac]
push ecx
push 0x2001f
push 0
push 0x4b77d8
mov edx, dword [ebp - 0x4c4]
mov eax, dword [ebp + edx*4 - 0x3b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44ee85
mov dword [ebp - 0x5d4], 0x104
lea ecx, [ebp - 0x5d4]
push ecx
lea edx, [ebp - 0x5d0]
push edx
push 0
push 0
push 0x4b6fbc
mov eax, dword [ebp - 0x3ac]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44ee78
push 0x4b6fbc
mov ecx, dword [ebp - 0x3ac]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x3ac]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44eded
push 0x4b86a0
push str._u__s___s_
lea eax, [ebp - 0x4c0]
push eax
call fcn.0048cc64
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push str.regsvr32
push 0x4a2cb0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4b6788
lea ecx, [ebp - 0x5f0]
call fcn.00416a60
mov dword [ebp - 0xa30], eax
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x68]
push edx
lea ecx, [ebp - 0x5f0]
call fcn.00419710
push 0x4a30e8
call fcn.0048bc60
add esp, 4
push eax
push 0x4a30e8
lea ecx, [ebp - 0x5f0]
call fcn.0041c910
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x618], esp
mov dword [ebp - 0x988], eax
push 0
push 0
mov ecx, dword [ebp - 0x988]
call fcn.004236e0
mov ecx, dword [0x4a2ac8]
push ecx
push 0
lea edx, [ebp - 0x5f0]
push edx
mov ecx, dword [ebp - 0x988]
call fcn.00423530
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xa34], eax
call fcn.00445850
add esp, 0x1c
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x5f0]
call fcn.004236e0
jmp 0x44f0ae
mov ecx, dword [0x4b858c]
mov edx, dword [ebp + ecx*4 - 0x2c]
mov dword [ebp - 0x9ec], edx
mov eax, dword [0x4b858c]
add eax, 1
mov dword [0x4b858c], eax
push 0
call fcn.0048ea23
add esp, 4
mov dword [ebp - 0x9f4], eax
mov dword [ebp - 0x9f0], edx
push 0
call fcn.0048ea23
add esp, 4
mov dword [ebp - 0x9e0], eax
mov dword [ebp - 0x9dc], edx
mov ecx, dword [ebp - 0x9e0]
sub ecx, dword [ebp - 0x9f4]
mov edx, dword [ebp - 0x9dc]
sbb edx, dword [ebp - 0x9f0]
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0x9e4], edx
cmp dword [ebp - 0x9e4], 0
jg 0x44f007
jl 0x44effb
cmp dword [ebp - 0x9e8], 0
jae 0x44f007
mov dword [ebp - 0x5f4], 0
jmp 0x44f053
push 0
push 0x3e8
mov eax, dword [ebp - 0x9e4]
push eax
mov ecx, dword [ebp - 0x9e8]
push ecx
call fcn.0048ef50
mov dword [ebp - 0x9d8], eax
mov edx, dword [ebp - 0x9d8]
cmp edx, dword [ebp - 0x9ec]
jbe 0x44f041
mov dword [ebp - 0x5f4], 0
jmp 0x44f053
mov eax, dword [ebp - 0x9ec]
sub eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x5f4], eax
cmp dword [0x4b858c], 6
jb 0x44f066
mov dword [0x4b858c], 5
mov eax, dword [ebp - 0x5f4]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor edx, edx
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x604], edx
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x600], eax
mov ecx, dword [ebp - 0x604]
mov dword [ebp - 0x5fc], ecx
lea edx, [ebp - 0x600]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0044e9b0
add esp, 8
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.004236e0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004236e0
jmp 0x44f0d6
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret