Function at 0x404c00
Capabilities:
Create process on windows

Disassembly:
push 0xf4
mov eax, 0x44de10
call fcn.0044bece
mov esi, ecx
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x2c], edi
xor ebx, ebx
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x30], ebx
call fcn.00404bbe
xor eax, eax
mov dword [ebp - 0x18], ebx
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
call fcn.00413950
lea ecx, [ebp - 0x94]
call fcn.00413900
test al, al
je 0x404f0f
push str.sfx.reg
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0xac]
call fcn.0040248d
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004023e5
lea ecx, [ebp - 0xac]
call fcn.0040203f
lea ecx, [ebp - 0x90]
call fcn.00417c90
xor eax, eax
lea ecx, [ebp - 0x60]
inc eax
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00413a10
test al, al
je 0x404f0f
push ebx
lea eax, [ebp - 0xb0]
mov word [ebp - 0xb4], 0xfeff
push eax
push 2
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x60]
call fcn.00413cd0
test al, al
je 0x404f0f
cmp dword [ebp - 0xb0], 2
jne 0x404f0f
cmp dword [esi + 0x14], 8
lea edi, [esi + 0x10]
mov eax, dword [edi]
jb 0x404ce7
mov esi, dword [esi]
push ebx
lea ecx, [ebp - 0xb0]
add eax, eax
push ecx
push eax
push esi
lea ecx, [ebp - 0x60]
call fcn.00413cd0
test al, al
je 0x404f0f
mov eax, dword [edi]
add eax, eax
cmp eax, dword [ebp - 0xb0]
jne 0x404f0f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00419c80
mov esi, 0x459a0c
push esi
call fcn.0043ef4e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040206a
mov edi, 0x459840
push edi
call fcn.0043ef4e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004025a8
cmp dword [ebp - 0x2c], 8
lea esi, [ebp - 0x40]
cmovae esi, dword [ebp - 0x40]
push esi
call fcn.0043ef4e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004025a8
push edi
call fcn.0043ef4e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004025a8
mov edi, ebx
mov dword [ebp - 0xb8], ebx
push str.Kernel32.dll
mov dword [ebp - 0xc4], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x404e1d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x459a14
push esi
mov dword [ebp - 0xb4], ebx
call edi
push str.IsWow64Process
push esi
mov dword [ebp - 0xb0], eax
call edi
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x404df3
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x404df3
lea ecx, [ebp - 0xb4]
push ecx
call eax
push eax
call dword [ebp - 0xc0]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb4], eax
jmp 0x404df9
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x404e17
push str.Wow64DisableWow64FsRedirection
push esi
call edi
push str.Wow64RevertWow64FsRedirection
push esi
mov dword [ebp - 0xb8], eax
call edi
mov edi, eax
jmp 0x404e1d
mov edi, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xb8]
mov byte [ebp - 0xb0], bl
mov dword [ebp - 0xbc], ebx
test eax, eax
je 0x404e57
test edi, edi
je 0x404e57
lea ecx, [ebp - 0xbc]
push ecx
call eax
mov ecx, dword [ebp - 0xb0]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
mov dword [ebp - 0xb0], ecx
push 0x3c
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.0043cc90
add esp, 0xc
mov dword [ebp - 0x100], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0xf8], ebx
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0x100]
push eax
mov dword [ebp - 0xfc], 0x140
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], str.regedit.exe
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test eax, eax
je 0x404eed
cmp dword [ebp - 0xc8], 0
je 0x404eed
push 0xffffffffffffffff
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xb0], 0
je 0x404f02
test edi, edi
je 0x404f02
push dword [ebp - 0xbc]
call edi
test esi, esi
je 0x404f1b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404f1b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00419c80
lea ecx, [ebp - 0x28]
call fcn.0040203f
lea ecx, [ebp - 0x94]
call fcn.004137d0
lea ecx, [ebp - 0x40]
call fcn.0040203f
mov al, bl
call fcn.0044be78
ret