Function at 0x41de70
Capabilities:
Create process on windows
Set registry value

Disassembly:
mov eax, 0x1044
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
push esi
push edi
push 0x7fc
lea eax, [esp + 0x854]
mov dword [esp + 0x850], 0
push 0
push eax
mov edi, edx
mov ebx, ecx
call fcn.0048e770
mov esi, dword [sym.imp.user32.dll_SendMessageW]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call esi
lea ecx, [esp + 0x84c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x1073
push ebx
mov dword [esp + 0x38], 0x400
call esi
cmp word [esp + 0x84c], 0
jne 0x41dfaf
lea eax, [esp + 0xc]
push eax
push 0x4bf7d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41df40
push 0x4ad29c
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, eax
push eax
push 0x4ad29c
push 1
push 0
push 0x4bf84c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c1390]
push eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x4c
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x4addfc
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1040]
xor ecx, esp
call fcn.0048d815
add esp, 0x1044
ret
push 0
push 0x4bf7b8
call dword [sym.imp.user32.dll_FindWindowW]
test eax, eax
je 0x41dfd8
push 0
push 0
push 0x12
push eax
call dword [sym.imp.user32.dll_PostMessageW]
push 0x2bc
call dword [sym.imp.kernel32.dll_Sleep]
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
call fcn.0048e770
mov ax, word [esp + 0x85e]
add esp, 0xc
cmp ax, 0x53
jne 0x41e007
push 0x4ae578
jmp 0x41e02c
cmp ax, 0x55
jne 0x41e014
push 0x4ae540
jmp 0x41e02c
cmp ax, 0x4d
jne 0x41e021
push 0x4ae508
jmp 0x41e02c
cmp ax, 0x52
jne 0x41e037
push 0x4ae5a0
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x858]
push eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov esi, dword [sym.imp.kernel32.dll_lstrlenW]
lea eax, [esp + 0x4c]
push eax
call esi
cmp word [esp + eax*2 + 0x4a], 0x5c
jne 0x41e07f
lea eax, [esp + 0x4c]
push eax
call esi
lea eax, [eax*2 - 2]
cmp eax, 0x800
jae 0x41e1c0
xor ecx, ecx
mov word [esp + eax + 0x4c], cx
lea eax, [esp + 0xc]
push eax
push 0x4bf7d8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41e0c4
lea eax, [esp + 0x4c]
push eax
call esi
add eax, eax
push eax
lea eax, [esp + 0x50]
push eax
push 1
push 0
push 0x4bf84c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4bf544
mov dword [esp + 0x10], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.kernel32.dll_FreeLibrary]
mov esi, eax
mov ebx, dword [sym.imp.kernel32.dll_LoadLibraryW]
test esi, esi
jne 0x41e0f6
push 0x4bf544
call ebx
mov esi, eax
test esi, esi
je 0x41e110
push 0x4c0888
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x41e10d
lea ecx, [esp + 0xc]
push ecx
call eax
push esi
call edi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movaps xmm0, xmmword [0x4c1390]
push eax
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x4c
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x4addfc
movups xmmword [esp + 0x28], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [esp + 0xc], 0
je 0x41e1a3
push 0x4bf544
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x41e18a
push 0x4bf544
call ebx
mov esi, eax
test esi, esi
je 0x41e1a3
push 0x4c08a8
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x41e1a0
push dword [esp + 0xc]
call eax
push esi
call edi
mov ecx, dword [esp + 0x104c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1044
ret
call fcn.0048d945
int3