Function at 0x402e60
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push edi
mov dword [ebp - 0x160], 0x44
mov dword [ebp - 0x15c], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x104
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
push str.SOFTWAREIBMNPDirectPath
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x164]
sub ecx, 1
mov dword [ebp - 0x164], ecx
cmp dword [ebp - 0x164], 5
ja case.default.0x402ef7
mov edx, dword [ebp - 0x164]
jmp dword [edx*4 + 0x4030d0]
mov eax, dword [ebp + 8]
push eax
push str.Pdirect.exe__A___s_
lea ecx, [ebp - 0x118]
push ecx
call fcn.00408fc0
add esp, 4
lea edx, [ebp + eax - 0x118]
push edx
call fcn.00408df6
add esp, 0xc
jmp case.default.0x402ef7
push str.Pdirect.exe__R
lea eax, [ebp - 0x118]
push eax
call fcn.00408fc0
add esp, 4
lea ecx, [ebp + eax - 0x118]
push ecx
call fcn.00408e50
add esp, 8
jmp case.default.0x402ef7
push str.Pdirect.exe
lea edx, [ebp - 0x118]
push edx
call fcn.00408fc0
add esp, 4
lea eax, [ebp + eax - 0x118]
push eax
call fcn.00408e50
add esp, 8
jmp case.default.0x402ef7
push str.Pdirect.exe__S
lea ecx, [ebp - 0x118]
push ecx
call fcn.00408fc0
add esp, 4
lea edx, [ebp + eax - 0x118]
push edx
call fcn.00408e50
add esp, 8
jmp case.default.0x402ef7
push str.Pdirect.exe__O
lea eax, [ebp - 0x118]
push eax
call fcn.00408fc0
add esp, 4
lea ecx, [ebp + eax - 0x118]
push ecx
call fcn.00408e50
add esp, 8
jmp case.default.0x402ef7
push str.Pdirect.exe__V
lea edx, [ebp - 0x118]
push edx
call fcn.00408fc0
add esp, 4
lea eax, [ebp + eax - 0x118]
push eax
call fcn.00408e50
add esp, 8
cmp dword [ebp - 0x11c], 0
je 0x40302c
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x160]
push edx
push 0
push 0
push 0x280
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40302c
mov dword [ebp - 0x168], 1
jmp 0x403036
mov dword [ebp - 0x168], 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp - 0x11c], ecx
cmp dword [ebp - 0x11c], 0
je 0x403057
push 2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x16c]
sub ecx, 1
mov dword [ebp - 0x16c], ecx
cmp dword [ebp - 0x16c], 5
ja case.default.0x40307e
mov edx, dword [ebp - 0x16c]
jmp dword [edx*4 + 0x4030e8]
cmp dword [ebp - 0x11c], 0
je 0x40309a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
jmp case.default.0x40307e
cmp dword [ebp - 0x11c], 0
je case.default.0x40307e
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x11c]
pop edi
mov esp, ebp
pop ebp
ret