Function at 0x420960
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582318
mov eax, dword fs:[0]
push eax
mov eax, 0x1334
call fcn.00529dc0
mov eax, dword [0x61b660]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1318], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00405860
mov dword [ebp - 4], 0
xor ecx, ecx
cmp dword [ebp - 0x298], 0
sete cl
movzx edx, cl
test edx, edx
je 0x4209e0
mov dword [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x2a8]
call fcn.00406060
mov dword [ebp - 4], 0xffffffff
jmp 0x420fb4
mov dword [ebp - 0x2b4], 0x100
mov dword [ebp - 0x2b0], 0x100
lea eax, [ebp - 0x12d5]
mov dword [ebp - 0x12d4], eax
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x131c], ecx
mov byte [ebp - 4], 2
push 0
push 0
lea ecx, [ebp - 0x188]
call fcn.00406060
mov byte [ebp - 4], 3
xor edx, edx
cmp dword [0x62cb4c], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x420bd3
mov ecx, dword [0x5a6ffc]
push ecx
push 0
push 0x62cb3c
lea ecx, [ebp - 0x188]
call fcn.00405c70
lea ecx, [ebp - 0x188]
call fcn.00406100
mov dword [ebp - 0x12dc], eax
push 0x5bf924
mov edx, dword [ebp - 0x12dc]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x420b1e
mov byte [ebp - 0xab4], 0
push 0x7ff
push 0
lea eax, [ebp - 0xab3]
push eax
call fcn.00529d40
add esp, 0xc
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x12e0], ecx
mov edx, dword [ebp - 0x12e0]
push edx
lea ecx, [ebp - 0x188]
call fcn.00406100
push eax
lea eax, [ebp - 0xab4]
push eax
call fcn.00529940
add esp, 0xc
push 0
lea ecx, [ebp - 0x2a8]
call fcn.00406100
push eax
push 0x5bf924
lea ecx, [ebp - 0xab4]
push ecx
mov ecx, dword [ebp - 0x1318]
call fcn.00421080
lea edx, [ebp - 0xab4]
push edx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x12e4], eax
mov eax, dword [ebp - 0x12e4]
push eax
lea ecx, [ebp - 0xab4]
push ecx
lea ecx, [ebp - 0x188]
call fcn.004064c0
jmp 0x420b7b
lea edx, [ebp - 0x2a8]
push edx
push 0x5a7344
lea eax, [ebp - 0x2c]
push eax
call fcn.00407200
add esp, 0xc
mov dword [ebp - 0x1320], eax
mov ecx, dword [ebp - 0x1320]
mov dword [ebp - 0x12e8], ecx
mov byte [ebp - 4], 4
mov edx, dword [0x5a6ffc]
push edx
push 0
mov eax, dword [ebp - 0x12e8]
push eax
lea ecx, [ebp - 0x188]
call fcn.00406240
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00406060
mov byte [ebp - 4], 3
push 1
push 0
push 0
lea ecx, [ebp - 0x2a8]
call fcn.00406100
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x188]
call fcn.00406060
mov byte [ebp - 4], 0
mov dword [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x2a8]
call fcn.00406060
mov dword [ebp - 4], 0xffffffff
jmp 0x420fb4
lea ecx, [ebp - 0x168]
push ecx
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x420f29
lea edx, [ebp - 0x2ac]
push edx
push 0xf003f
push 0
push str.http_shellopencommand
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420eea
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x16c]
push eax
push 0
lea ecx, [ebp - 0x2b4]
push ecx
lea edx, [ebp - 0x28c]
push edx
push 0
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [ebp - 0x164]
push ecx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x12ec], eax
mov edx, dword [ebp - 0x12ec]
push edx
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x188]
call fcn.004064c0
mov ecx, dword [0x5a6ffc]
mov dword [ebp - 0x12f4], ecx
push 0x5bf908
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x12f0], eax
mov edx, dword [ebp - 0x12f0]
push edx
mov eax, dword [ebp - 0x12f4]
push eax
push 0x5bf908
lea ecx, [ebp - 0x188]
call fcn.0040e660
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], 0
jl 0x420d36
mov ecx, dword [ebp - 0xab8]
add ecx, 1
push ecx
push 0
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x188]
call fcn.004058f0
mov dword [ebp - 0x1324], eax
mov eax, dword [ebp - 0x1324]
mov dword [ebp - 0x12f8], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x12f8]
push ecx
lea ecx, [ebp - 0x188]
call fcn.00405ab0
mov byte [ebp - 4], 9
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00406060
mov byte [ebp - 4], 3
mov edx, dword [0x5a6ffc]
push edx
push 0
lea eax, [ebp - 0x188]
push eax
mov ecx, 0x62cb3c
call fcn.00405c70
cmp dword [ebp - 0x174], 0x10
jb 0x420d4d
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x1328], ecx
jmp 0x420d59
lea edx, [ebp - 0x188]
mov dword [ebp - 0x1328], edx
push 0x5bf924
mov eax, dword [ebp - 0x1328]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x420e4f
mov byte [ebp - 0x12bc], 0
push 0x7ff
push 0
lea ecx, [ebp - 0x12bb]
push ecx
call fcn.00529d40
add esp, 0xc
mov edx, dword [ebp - 0x178]
mov dword [ebp - 0x12fc], edx
cmp dword [ebp - 0x174], 0x10
jb 0x420db3
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x132c], eax
jmp 0x420dbf
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x132c], ecx
mov edx, dword [ebp - 0x12fc]
push edx
mov eax, dword [ebp - 0x132c]
push eax
lea ecx, [ebp - 0x12bc]
push ecx
call fcn.00529940
add esp, 0xc
cmp dword [ebp - 0x294], 0x10
jb 0x420df3
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x1330], edx
jmp 0x420dff
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x1330], eax
push 0
mov ecx, dword [ebp - 0x1330]
push ecx
push 0x5bf924
lea edx, [ebp - 0x12bc]
push edx
mov ecx, dword [ebp - 0x1318]
call fcn.00421080
lea eax, [ebp - 0x12bc]
push eax
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x1300], eax
mov ecx, dword [ebp - 0x1300]
push ecx
lea edx, [ebp - 0x12bc]
push edx
lea ecx, [ebp - 0x188]
call fcn.004064c0
jmp 0x420eab
lea eax, [ebp - 0x2a8]
push eax
push 0x5a7344
lea ecx, [ebp - 0x64]
push ecx
call fcn.00407200
add esp, 0xc
mov dword [ebp - 0x1334], eax
mov edx, dword [ebp - 0x1334]
mov dword [ebp - 0x1304], edx
mov byte [ebp - 4], 0xa
mov eax, dword [0x5a6ffc]
push eax
push 0
mov ecx, dword [ebp - 0x1304]
push ecx
lea ecx, [ebp - 0x188]
call fcn.00406240
mov byte [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00406060
mov byte [ebp - 4], 3
cmp dword [ebp - 0x294], 0x10
jb 0x420ec2
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x1338], edx
jmp 0x420ece
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x1338], eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x1338]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x420f27
cmp dword [ebp - 0x294], 0x10
jb 0x420f01
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x133c], edx
jmp 0x420f0d
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x133c], eax
push 5
push 0
mov ecx, dword [ebp - 0x133c]
push ecx
push str.iexplore.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x420f66
cmp dword [ebp - 0x294], 0x10
jb 0x420f40
mov edx, dword [ebp - 0x2a8]
mov dword [ebp - 0x1340], edx
jmp 0x420f4c
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x1340], eax
push 5
push 0
mov ecx, dword [ebp - 0x1340]
push ecx
push str.iexplore.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x2ac]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xc
push 0
push 1
lea ecx, [ebp - 0x188]
call fcn.00406060
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xd
push 0
push 1
lea ecx, [ebp - 0x2a8]
call fcn.00406060
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052927b
mov esp, ebp
pop ebp
ret 4