Function at 0x489440
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
lea ebx, [ebp - 0x214]
sub esp, 0x290
mov dword [ebp - 0x270], edx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strrchr]
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
lea edx, [eax + 1]
test eax, eax
mov dword [esp], ebx
mov eax, edx
cmove eax, esi
mov dword [esp + 8], eax
call fcn.004879d0
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp + 4], 0x5a1161
lea edi, [eax - 3]
lea eax, [ebx + edi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strcmp]
test eax, eax
jne 0x4894b5
mov byte [ebp + edi - 0x214], 0
lea eax, [ebp - 0x26c]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
sub esp, 0xc
mov edi, eax
cmp eax, 5
je 0x489690
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xd3c
xor eax, eax
test edi, edi
sete al
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.failed_to_create__s_error__lu_n
mov dword [esp], eax
call fcn.00488240
test edi, edi
jne 0x489680
cmp dword [ebp - 0x270], 0xdeadbeef
mov eax, dword [ebp - 0x26c]
je 0x4896c0
lea edx, [ebp - 0x270]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.GlobalFlag
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov eax, dword [sym.imp.advapi32.dll_RegDeleteValueA]
sub esp, 0x18
mov dword [ebp - 0x274], eax
lea edx, [ebp - 0x254]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x258], 0x44
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x270]
mov dword [esp + 8], esi
lea esi, [ebp - 0x110]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str._s_heap.c_0x_lx
call fcn.004879d0
lea eax, [ebp - 0x268]
mov dword [esp + 4], esi
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xd49
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.failed_to_create_child_process_error__lu_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00488240
test esi, esi
jne 0x4896e0
mov dword [esp + 4], str.GlobalFlag
mov eax, dword [ebp - 0x26c]
mov dword [esp], eax
mov eax, dword [ebp - 0x274]
call eax
mov eax, dword [ebp - 0x26c]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xd39
mov dword [esp], str.Not_authorized_to_change_the_image_file_execution_options_n
call fcn.00487ca0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegDeleteValueA]
mov dword [esp + 4], str.GlobalFlag
mov dword [ebp - 0x274], eax
call eax
sub esp, 8
jmp 0x48956e
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xd4c
mov eax, dword [ebp - 0x268]
mov dword [esp], eax
call fcn.0057d980
mov eax, dword [ebp - 0x264]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x268]
sub esp, 4
mov dword [esp], eax
call esi
sub esp, 4
jmp 0x48963e