Function at 0x4fea7c
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov dword [ebp - 0x20], 0x32
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
and edi, 0xd
je 0x4fed14
mov eax, dword [0x5c94d4]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], 0x4fea4d
mov dword [ebp - 0x30], str.DPPPDLL32
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x4feafa
push esi
push str.Fatal_Error
push str.Cannot_register_class_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4ff006
xor ebx, ebx
mov eax, dword [0x5c94d4]
push ebx
push eax
push ebx
mov eax, 0x80000000
push ebx
mov esi, str.DPPPDLL32
push ebx
push eax
push ebx
push eax
push 0xa0000
push esi
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
mov dword [ebp - 0x10], eax
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4feb78
push 6
push str.machnm1.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x4feb78
push ebx
push str.Fatal_Error
push str.Cannot_execute_machnm1.exe_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x5c94d4]
push eax
push esi
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x4ff006
mov ebx, 0xe
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
jne 0x4febea
push 1
lea eax, [ebp - 0xa4]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4febdc
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
lea eax, [ebp - 0xa4]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4feba9
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
jne 0x4feb7d
test ebx, ebx
jne 0x4fec26
push 0
push str.Fatal_Error
push str.Cannot_communicate_with_machnm1.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x5c94d4]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x4ff006
push dword [ebp + 0xc]
push 0x5c94c4
xor ebx, ebx
mov dword [0x5c94c0], edi
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov al, byte [edi]
push ecx
push dword [ebp - 0x10]
push 0x4a
push esi
mov byte [0x5c94d3], al
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x24], 0x5c94c0
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x10
push esi
mov esi, 0xe
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4fec95
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x4fec79
push dword [ebp - 0x10]
mov esi, dword [0x5c61e0]
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
jne 0x4fecd7
push 0
push str.Fatal_Error
push str.Cannot_close_window_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x5c94d4]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x4ff006
mov eax, dword [0x5c94d4]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
test eax, eax
jne 0x4fed0a
push 0
push str.Fatal_Error
push str.Cannot_unregister_class_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x4ff006
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4fed17
mov edi, dword [ebp + 0x10]
test byte [ebp + 8], 2
je 0x4fed2d
push edi
call fcn.00501828
cdq
mov ecx, 0xe1
idiv ecx
add esi, eax
test byte [ebp + 8], 0x10
je 0x4fed3e
push edi
call fcn.00501734
add esp, 4
add esi, eax
test byte [ebp + 8], 0x20
je 0x4fed4b
call fcn.00501609
add esi, eax
test byte [ebp + 8], 0x40
je 0x4fed63
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.0050132c
add esp, 8
add esi, dword [ebp - 0x18]
test byte [ebp + 8], 0x80
je 0x4feeb8
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 0x108], bl
push 1
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4fee20
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push ebx
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4fedd3
lea eax, [ebp - 0x108]
push eax
call fcn.005012c0
and eax, 0x7fffffff
jmp 0x4fee6e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4fee70
jmp 0x4fee62
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4fee70
lea eax, [ebp - 0x108]
push eax
call fcn.005012c0
add esi, eax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov byte [ebp - 0x108], 0
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductKey
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4feeaf
lea eax, [ebp - 0x108]
push eax
call fcn.005012c0
add esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [ebp + 9], 1
je 0x4feffe
movsx eax, byte [edi + 1]
cmp eax, 0x3a
je 0x4feee4
cmp eax, 0x5c
je 0x4fef33
push 0
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.005008fc
add esp, 0xc
jmp 0x4fef5c
mov al, byte [edi]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x88]
push edx
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
lea eax, [ebp - 4]
push eax
call sub.MPR.dll_WNetGetConnectionA
cmp byte [ebp - 0x86], 0
mov eax, 2
je 0x4fef54
mov cl, byte [ebp + eax - 0x88]
cmp cl, 0x5c
je 0x4fef54
mov byte [ebp + eax - 0x8a], cl
inc eax
cmp byte [ebp + eax - 0x88], 0
jne 0x4fef13
jmp 0x4fef54
cmp byte [edi + 2], 0
mov eax, 2
je 0x4fef54
mov cl, byte [eax + edi]
cmp cl, 0x5c
je 0x4fef54
mov byte [ebp + eax - 0x8a], cl
inc eax
cmp byte [eax + edi], 0
jne 0x4fef3e
mov byte [ebp + eax - 0x8a], 0
cmp byte [ebp - 0x88], 0
je 0x4feffe
push 0x5c0580
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4feffe
push 0x5c0574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x5c0564
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
mov dword [ebp - 0x1c], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x298]
push eax
push 0x101
call ebx
cmp eax, 0xffffffff
je 0x4feff7
lea eax, [ebp - 0x88]
push eax
call dword [ebp - 0x1c]
test eax, eax
je 0x4feff4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
xor eax, eax
mov al, byte [ecx]
and eax, 0x7f
shl eax, 0x18
add esi, eax
movsx eax, byte [ecx + 1]
shl eax, 0x10
add esi, eax
movsx eax, byte [ecx + 2]
movsx ecx, byte [ecx + 3]
shl eax, 8
add esi, eax
add esi, ecx
call dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and esi, 0x7fffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc