Function at 0x4a8c40
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa94
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x44
push 0
lea edx, [ebp - 0x468]
push edx
call fcn.0066cc88
add esp, 0xc
mov dword [ebp - 0x468], 0x44
mov dword [ebp - 0x43c], 0x101
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x42c], eax
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x430], eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x428], eax
mov word [ebp - 0x438], 0
mov ecx, dword [ebp + 0xc]
dec ecx
je 0x4a918a
sub ecx, 2
jne 0x4a939b
mov byte [ebp - 0x56c], 0
mov eax, dword [0x80c0a8]
dec eax
je 0x4a8cd6
mov edx, dword [0x80c0a8]
cmp edx, 9
jne 0x4a8d82
push str.vaxscsi
call fcn.0049cbae
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8cf9
push str.Initiator_Id_31
call fcn.0049cfb3
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a8d15
push 0x771b62
push 0x771b51
call fcn.0049d4ee
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a8d31
push 0x771b76
push 0x771b65
call fcn.0049da9d
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 9
jne 0x4a8d64
push 0x8321df
push str._s__L
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0xc
jmp 0x4a957b
push 0x8321df
push str._s_1:__L
lea ecx, [ebp - 0x56c]
push ecx
call fcn.006712b0
add esp, 0xc
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 2
jne 0x4a8de3
push str.dtscsi
call fcn.0049cbae
pop ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a8daf
push str.Initiator_Id_15
call fcn.0049cfb3
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8dcb
push 0x771bb0
push str.Initiator_Id_255
call fcn.0049d4ee
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 5
jne 0x4a8e14
push str.Initiator_Id_127
call fcn.0049cfb3
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 6
je 0x4a8e38
mov edx, dword [0x80c0a8]
cmp edx, 7
je 0x4a8e38
mov ecx, dword [0x80c0a8]
cmp ecx, 0xb
jne 0x4a8ef6
push 0x6eb9f0
push 0x8321df
push 0x771bc4
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a8218
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8ed7
push 0x771bd5
push 0x6eb9f0
call fcn.0066d004
add esp, 8
test eax, eax
jne 0x4a8e97
push 0x771bda
push 0x6eb9f0
call fcn.0066ce08
add esp, 8
jmp 0x4a8ea9
push 0x771bdd
push 0x6eb9f0
call fcn.0066ce08
add esp, 8
push 0x6eb9f0
push 0x8321df
push 0x771be2
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a8218
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 0xc
jne 0x4a8fc2
push 0x6eb9f0
push 0x8321df
push 0x771bf3
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x10
lea ecx, [ebp - 0x56c]
push ecx
call fcn.004a8218
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a8fa3
push 0x771c04
push 0x6eb9f0
call fcn.0066d004
add esp, 8
test eax, eax
jne 0x4a8f63
push 0x771c09
push 0x6eb9f0
call fcn.0066ce08
add esp, 8
jmp 0x4a8f75
push 0x771c0c
push 0x6eb9f0
call fcn.0066ce08
add esp, 8
push 0x6eb9f0
push 0x8321df
push str._s__get_count__s
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x10
lea ecx, [ebp - 0x56c]
push ecx
call fcn.004a8218
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 0xd
jne 0x4a9015
push 0x8321df
push str._s__get_count
lea ecx, [ebp - 0x56c]
push ecx
call fcn.006712b0
add esp, 0xc
lea eax, [ebp - 0x56c]
push eax
call fcn.004a8218
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 0xa
jne 0x4a90e2
push 0x6eb9f0
push 0x8321df
push 0x771c30
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a82e8
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a90c3
push 0x771c4b
push 0x6eb9f0
call fcn.0066d004
add esp, 8
test eax, eax
jne 0x4a9083
push 0x771c50
push 0x6eb9f0
call fcn.0066ce08
add esp, 8
jmp 0x4a9095
push 0x771c53
push 0x6eb9f0
call fcn.0066ce08
add esp, 8
push 0x6eb9f0
push 0x8321df
push str._s___get_count___type___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a82e8
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 3
jne 0x4a9168
push str.VClone
call fcn.0049cbae
pop ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a957b
call fcn.004a89e8
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 4]
push ecx
push 0x771c7a
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4a957b
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x414]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push str.NumberOfDrives
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4a915b
movsx eax, byte [ebp - 0x414]
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 8
jne 0x4a957b
push str.vdrive
call fcn.0049cbae
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
dec ecx
jne 0x4a91b9
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
inc eax
push eax
push 0x8321df
push 0x771cbb
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 9
jne 0x4a91e8
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x8321df
push str._s__d:__M:__s_
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 2
jne 0x4a9217
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x8321df
push str._s__mount__d___s_
lea ecx, [ebp - 0x56c]
push ecx
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 5
je 0x4a9237
mov edx, dword [0x80c0a8]
cmp edx, 6
je 0x4a9237
mov ecx, dword [0x80c0a8]
cmp ecx, 7
jne 0x4a9260
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x6eb9f0
push 0x8321df
push str._s__mount__s___d___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x18
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 0xc
jne 0x4a9299
push dword [ebp + 0x10]
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbca755]
push eax
push 0x8321df
push 0x771d01
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 0xd
jne 0x4a92d7
push dword [ebp + 0x10]
imul eax, dword [ebp + 8], 0x23
movsx edx, byte [eax*8 + 0xbca755]
push edx
push 0x6eb9f0
push 0x8321df
push str._s__mount__s__c___s_
lea ecx, [ebp - 0x56c]
push ecx
call fcn.006712b0
add esp, 0x18
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 0xa
jne 0x4a930f
push dword [ebp + 0x10]
imul edx, dword [ebp + 8], 0x23
movsx ecx, byte [edx*8 + 0xbca755]
push ecx
push 0x8321df
push str._s___mount_to___letter___c____path___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 0xb
jne 0x4a9348
push dword [ebp + 0x10]
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbca755]
push eax
push 0x8321df
push str._s__mount_to__c___s_
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 8
jne 0x4a9377
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x8321df
push str._s__M:_d___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x8321df
push str._s__d_d___s_
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
dec ecx
jne 0x4a93c7
mov eax, dword [ebp + 8]
inc eax
push eax
push 0x8321df
push 0x771d84
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 9
jne 0x4a93f3
push dword [ebp + 8]
push 0x8321df
push str._s__d:__U
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 2
jne 0x4a941f
push dword [ebp + 8]
push 0x8321df
push str._s__unmount__d
lea ecx, [ebp - 0x56c]
push ecx
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 5
je 0x4a943f
mov edx, dword [0x80c0a8]
cmp edx, 6
je 0x4a943f
mov ecx, dword [0x80c0a8]
cmp ecx, 7
jne 0x4a9465
push dword [ebp + 8]
push 0x6eb9f0
push 0x8321df
push str._s__unmount__s___d
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x14
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 0xc
jne 0x4a949b
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbca755]
push eax
push 0x8321df
push 0x771dba
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 0xd
jne 0x4a94d1
imul eax, dword [ebp + 8], 0x23
movsx edx, byte [eax*8 + 0xbca755]
push edx
push 0x8321df
push 0x771dc9
lea ecx, [ebp - 0x56c]
push ecx
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov eax, dword [0x80c0a8]
cmp eax, 0xa
jne 0x4a9503
imul edx, dword [ebp + 8], 0x23
movsx ecx, byte [edx*8 + 0xbca755]
push ecx
push 0x8321df
push str._s___unmount___letter___c_
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov edx, dword [0x80c0a8]
cmp edx, 0xb
jne 0x4a9536
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbca755]
push eax
push 0x8321df
push str._s__unmount__c
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
mov ecx, dword [0x80c0a8]
cmp ecx, 8
jne 0x4a955f
push dword [ebp + 8]
push 0x8321df
push str._s__U:_d
lea eax, [ebp - 0x56c]
push eax
call fcn.006712b0
add esp, 0x10
jmp 0x4a957b
push dword [ebp + 8]
push 0x8321df
push str._s__d_d__u
lea edx, [ebp - 0x56c]
push edx
call fcn.006712b0
add esp, 0x10
mov cl, byte [ebp - 0x56c]
test cl, cl
je 0x4a9629
lea eax, [ebp - 0x424]
push eax
lea edx, [ebp - 0x468]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x56c]
push ecx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4a95b9
xor eax, eax
jmp 0x4a962c
push dword [ebp - 0x420]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
mov edx, dword [0x80c0a8]
dec edx
je 0x4a95da
mov ecx, dword [0x80c0a8]
cmp ecx, 9
jne 0x4a9602
push 0xffffffffffffffff
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x4a961e
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x4a961e
push 0xffffffffffffffff
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_WaitForSingleObject
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbca755]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret