Function at 0x4873cc
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov dword [ebp - 0x20], 0x32
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], esi
and edi, 0xd
je 0x487664
mov eax, dword [0x534d74]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], 0x48739d
mov dword [ebp - 0x30], str.DPPPDLL32
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x48744a
push esi
push str.Fatal_Error
push str.Cannot_register_class_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x487956
xor ebx, ebx
mov eax, dword [0x534d74]
push ebx
push eax
push ebx
mov eax, 0x80000000
push ebx
mov esi, str.DPPPDLL32
push ebx
push eax
push ebx
push eax
push 0xa0000
push esi
push esi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
mov dword [ebp - 0x10], eax
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4874c8
push 6
push str.machnm1.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x4874c8
push ebx
push str.Fatal_Error
push str.Cannot_execute_machnm1.exe_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x534d74]
push eax
push esi
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x487956
mov ebx, 0xe
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
jne 0x48753a
push 1
lea eax, [ebp - 0xa4]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x48752c
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
lea eax, [ebp - 0xa4]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4874f9
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
jne 0x4874cd
test ebx, ebx
jne 0x487576
push 0
push str.Fatal_Error
push str.Cannot_communicate_with_machnm1.exe_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x534d74]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x487956
push dword [ebp + 0xc]
push 0x534d64
xor ebx, ebx
mov dword [0x534d60], edi
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov al, byte [edi]
push ecx
push dword [ebp - 0x10]
push 0x4a
push esi
mov byte [0x534d73], al
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x24], 0x534d60
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x10
push esi
mov esi, 0xe
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push str.machnum
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4875e5
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x4875c9
push dword [ebp - 0x10]
mov esi, dword [0x531aac]
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
jne 0x487627
push 0
push str.Fatal_Error
push str.Cannot_close_window_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x534d74]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x487956
mov eax, dword [0x534d74]
push eax
push str.DPPPDLL32
call dword [sym.imp.USER32.dll_UnregisterClassA]
test eax, eax
jne 0x48765a
push 0
push str.Fatal_Error
push str.Cannot_unregister_class_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x487956
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x487667
mov edi, dword [ebp + 0x10]
test byte [ebp + 8], 2
je 0x48767d
push edi
call fcn.0048a135
cdq
mov ecx, 0xe1
idiv ecx
add esi, eax
test byte [ebp + 8], 0x10
je 0x48768e
push edi
call fcn.0048a041
add esp, 4
add esi, eax
test byte [ebp + 8], 0x20
je 0x48769b
call fcn.00489f16
add esi, eax
test byte [ebp + 8], 0x40
je 0x4876b3
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.00489c39
add esp, 8
add esi, dword [ebp - 0x18]
test byte [ebp + 8], 0x80
je 0x487808
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 0x108], bl
push 1
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x487770
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push ebx
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x487723
lea eax, [ebp - 0x108]
push eax
call fcn.00489bcd
and eax, 0x7fffffff
jmp 0x4877be
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4877c0
jmp 0x4877b2
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductId
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4877c0
lea eax, [ebp - 0x108]
push eax
call fcn.00489bcd
add esi, eax
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x108]
push eax
lea edx, [ebp - 0x14]
mov byte [ebp - 0x108], 0
mov dword [ebp - 0xc], 0x64
push ecx
push edx
push 0
push str.ProductKey
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4877ff
lea eax, [ebp - 0x108]
push eax
call fcn.00489bcd
add esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [ebp + 9], 1
je 0x48794e
movsx eax, byte [edi + 1]
cmp eax, 0x3a
je 0x487834
cmp eax, 0x5c
je 0x487883
push 0
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.0048924c
add esp, 0xc
jmp 0x4878ac
mov al, byte [edi]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x88]
push edx
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
lea eax, [ebp - 4]
push eax
call sub.MPR.dll_WNetGetConnectionA
cmp byte [ebp - 0x86], 0
mov eax, 2
je 0x4878a4
mov cl, byte [ebp + eax - 0x88]
cmp cl, 0x5c
je 0x4878a4
mov byte [ebp + eax - 0x8a], cl
inc eax
cmp byte [ebp + eax - 0x88], 0
jne 0x487863
jmp 0x4878a4
cmp byte [edi + 2], 0
mov eax, 2
je 0x4878a4
mov cl, byte [eax + edi]
cmp cl, 0x5c
je 0x4878a4
mov byte [ebp + eax - 0x8a], cl
inc eax
cmp byte [eax + edi], 0
jne 0x48788e
mov byte [ebp + eax - 0x8a], 0
cmp byte [ebp - 0x88], 0
je 0x48794e
push 0x51e4e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x48794e
push 0x51e4d4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0x51e4c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
mov dword [ebp - 0x1c], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x298]
push eax
push 0x101
call ebx
cmp eax, 0xffffffff
je 0x487947
lea eax, [ebp - 0x88]
push eax
call dword [ebp - 0x1c]
test eax, eax
je 0x487944
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
xor eax, eax
mov al, byte [ecx]
and eax, 0x7f
shl eax, 0x18
add esi, eax
movsx eax, byte [ecx + 1]
shl eax, 0x10
add esi, eax
movsx eax, byte [ecx + 2]
movsx ecx, byte [ecx + 3]
shl eax, 8
add esi, eax
add esi, ecx
call dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and esi, 0x7fffffff
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc