Function at 0x401fb5
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565156
mov eax, dword fs:[0]
push eax
sub esp, 0x554
mov eax, dword [0x5c5fd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x53c], ebx
lea eax, [ebp - 0x560]
mov dword [ebp - 0x560], 8
push eax
mov dword [ebp - 0x55c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.004054ee
push 0
call fcn.00407696
push 0xc
call fcn.00404a90
add esp, 8
mov dword [ebp - 0x538], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x401f29
mov ecx, eax
call fcn.00408455
jmp 0x401f2b
xor eax, eax
push 0x5a80e8
mov ecx, ebx
mov dword [ebp - 0x558], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00408eac
lea eax, [ebx + 0xd0]
push 0
push 0x5a84ec
mov ecx, eax
mov dword [ebp - 0x52c], eax
call fcn.004044b0
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00549b30
add esp, 0xc
call fcn.0040665b
mov ecx, eax
test ecx, ecx
je 0x4026ed
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x534], eax
mov eax, 0x5a84ec
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x534]
test eax, 0xffff0000
jne 0x401fb5
movzx eax, ax
push eax
call fcn.00403fb0
jmp 0x401fc1
push 0
push 0x5a84ec
call fcn.004044b0
push 0x103
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.0040665b
mov ecx, eax
test ecx, ecx
je 0x4026f7
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x528], esi
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 3
test eax, 0xffff0000
jne 0x40201b
movzx eax, ax
lea ecx, [ebp - 0x528]
push eax
call fcn.00403fb0
jmp 0x402088
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40207d
mov ecx, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub ecx, edi
or ecx, edx
jge 0x402058
push edi
lea ecx, [ebp - 0x528]
call fcn.00404350
mov esi, dword [ebp - 0x528]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x114]
push eax
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x402701
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x40208e
lea ecx, [ebp - 0x528]
call fcn.00404220
mov esi, dword [ebp - 0x528]
mov byte [ebp - 4], 4
lea edx, [esi - 0x10]
mov edi, dword [ebp - 0x534]
or ebx, 0xffffffff
mov dword [ebp - 0x530], edx
lea ecx, [edi - 0x10]
mov dword [ebp - 0x54c], ecx
cmp edx, ecx
je 0x402114
cmp dword [ecx + 0xc], 0
lea edi, [ecx + 0xc]
jl 0x4020f9
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4020f9
push edx
call fcn.00403c50
add esp, 4
mov dword [ebp - 0x538], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4020ee
mov esi, dword [ebp - 0x54c]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x538]
lea edi, [eax + 0x10]
mov dword [ebp - 0x534], edi
jmp 0x40210e
push dword [esi - 0xc]
lea ecx, [ebp - 0x534]
push esi
call fcn.004044b0
mov edi, dword [ebp - 0x534]
mov edx, dword [ebp - 0x530]
mov byte [ebp - 4], 2
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40212c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi - 0xc], 0
je 0x4021f4
push 0x5c
push edi
call fcn.00548f82
add esp, 8
test eax, eax
jne 0x40214a
or eax, 0xffffffff
jmp 0x40214e
sub eax, edi
sar eax, 1
push eax
lea eax, [ebp - 0x54c]
push eax
lea ecx, [ebp - 0x534]
call fcn.00403540
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x52c]
mov ecx, dword [eax]
mov esi, dword [edx]
lea eax, [ecx - 0x10]
sub esi, 0x10
mov dword [ebp - 0x538], eax
cmp eax, esi
je 0x4021d3
cmp dword [esi + 0xc], 0
jl 0x4021c8
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x4021c8
push dword [ebp - 0x538]
call fcn.00403c50
mov dword [ebp - 0x538], eax
add esp, 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4021b5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x538]
add eax, 0x10
mov dword [ecx], eax
jmp 0x4021d3
push dword [ecx - 0xc]
push ecx
mov ecx, edx
call fcn.004044b0
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x54c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4021f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x53c]
mov ecx, esi
call fcn.00402740
cmp dword [esi + 0xcc], 0
je 0x402441
call fcn.0040665b
mov ecx, eax
test ecx, ecx
je 0x40270b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0
mov byte [ebp - 4], 7
mov ecx, dword [esi + 0xd0]
lea esi, [eax - 0x10]
mov dword [ebp - 0x550], 0x104
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x4022b8
cmp dword [esi + 0xc], 0
jl 0x4022a9
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4022a9
push edx
call fcn.00403c50
add esp, 4
mov dword [ebp - 0x53c], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40229e
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x53c]
add eax, 0x10
mov dword [ebp - 0x528], eax
jmp 0x4022b8
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x528]
call fcn.004044b0
push 4
push str.64_
lea ecx, [ebp - 0x528]
call fcn.00403990
call fcn.0040665b
mov ecx, eax
test ecx, ecx
je 0x402715
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
push 0x104
lea eax, [ebp - 0x31c]
mov byte [ebp - 4], 8
push 0
push eax
call fcn.00549b30
add esp, 0xc
lea ecx, [ebp - 0x548]
push 0x2001f
push str.SoftwareStellar_Data_RecoveryStellar_Converter_for_MBOX_Prof
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004038e0
mov ebx, dword [ebp - 0x548]
test eax, eax
jne 0x4023d1
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x530]
push eax
push 0
push str.ExeNameInt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4023b4
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x4023ab
mov ecx, dword [ebp - 0x530]
test ecx, ecx
je 0x4023ab
cmp ecx, 2
jbe 0x40239a
cmp ecx, 7
jne 0x4023ab
test al, 1
jne 0x4023ab
shr eax, 1
cmp eax, 1
jb 0x4023ab
cmp word [ebp + eax*2 - 0x31e], 0
jne 0x4023ab
cmp eax, 1
jbe 0x4023b4
cmp word [ebp + eax*2 - 0x320], 0
jmp 0x4023a9
test al, 1
jne 0x4023ab
shr eax, 1
cmp word [ebp + eax*2 - 0x31e], 0
je 0x4023b4
xor eax, eax
mov word [ebp - 0x31c], ax
test ebx, ebx
je 0x4023c7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x548], ebx
mov dword [ebp - 0x544], 0
lea ecx, [ebp - 0x31c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4023e0
sub ecx, edx
lea eax, [ebp - 0x31c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x52c]
call fcn.004044b0
mov esi, dword [ebp - 0x52c]
lea ecx, [ebp - 0x528]
push dword [esi - 0xc]
push esi
call fcn.00403990
push 0x12
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 5
push 0
push 0
push dword [ebp - 0x528]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 7
jmp 0x40265c
call fcn.0040665b
mov ecx, eax
test ecx, ecx
je 0x40271f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0
mov byte [ebp - 4], 0xa
lea esi, [eax - 0x10]
mov ecx, dword [ebp - 0x52c]
mov dword [ebp - 0x554], 0x104
mov ecx, dword [ecx]
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x4024ed
cmp dword [esi + 0xc], 0
jl 0x4024de
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4024de
push edx
call fcn.00403c50
add esp, 4
mov dword [ebp - 0x53c], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4024d3
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x53c]
add eax, 0x10
mov dword [ebp - 0x528], eax
jmp 0x4024ed
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x528]
call fcn.004044b0
push 4
push str.32_
lea ecx, [ebp - 0x528]
call fcn.00403990
call fcn.0040665b
mov ecx, eax
test ecx, ecx
je 0x402729
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
push 0x2001f
push str.SoftwareStellar_Data_RecoveryStellar_Converter_for_MBOX_Prof
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0xb
call fcn.004038e0
mov ebx, dword [ebp - 0x548]
test eax, eax
jne 0x4025f0
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x530]
push eax
push 0
push str.ExeNameInt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4025d3
mov eax, dword [ebp - 0x554]
test eax, eax
je 0x4025ca
mov ecx, dword [ebp - 0x530]
test ecx, ecx
je 0x4025ca
cmp ecx, 2
jbe 0x4025b9
cmp ecx, 7
jne 0x4025ca
test al, 1
jne 0x4025ca
shr eax, 1
cmp eax, 1
jb 0x4025ca
cmp word [ebp + eax*2 - 0x526], 0
jne 0x4025ca
cmp eax, 1
jbe 0x4025d3
cmp word [ebp + eax*2 - 0x528], 0
jmp 0x4025c8
test al, 1
jne 0x4025ca
shr eax, 1
cmp word [ebp + eax*2 - 0x526], 0
je 0x4025d3
xor eax, eax
mov word [ebp - 0x524], ax
test ebx, ebx
je 0x4025e6
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x548], ebx
mov dword [ebp - 0x544], 0
lea ecx, [ebp - 0x524]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402600
sub ecx, edx
lea eax, [ebp - 0x524]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x52c]
call fcn.004044b0
mov esi, dword [ebp - 0x52c]
lea ecx, [ebp - 0x528]
push dword [esi - 0xc]
push esi
call fcn.00403990
push 0x12
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 5
push 0
push 0
push dword [ebp - 0x528]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0xa
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402676
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x402681
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x528]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4026a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x558]
test ecx, ecx
je 0x4026b3
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x4026cf
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00547788
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404660
push 0x80004005
call fcn.00404660
push 0x80070057
call fcn.00404660
push 0x80004005
call fcn.00404660
push 0x80004005
call fcn.00404660
push 0x80004005
call fcn.00404660
push 0x80004005
call fcn.00404660
int3