Function at 0x404c1a
Capabilities:
Create process on windows

Disassembly:
push 0xf4
mov eax, 0x44e400
call fcn.0044c4ee
mov esi, ecx
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x2c], edi
xor ebx, ebx
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x30], ebx
call fcn.00404bd8
xor eax, eax
mov dword [ebp - 0x18], ebx
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
call fcn.00413c40
lea ecx, [ebp - 0x94]
call fcn.00413bf0
test al, al
je 0x404f29
push str.sfx.reg
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0xac]
call fcn.004024a7
pop ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004023ff
lea ecx, [ebp - 0xac]
call fcn.0040203f
lea ecx, [ebp - 0x90]
call fcn.00417f80
xor eax, eax
lea ecx, [ebp - 0x60]
inc eax
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00413d00
test al, al
je 0x404f29
push ebx
lea eax, [ebp - 0xb0]
mov word [ebp - 0xb4], 0xfeff
push eax
push 2
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x60]
call fcn.00413fc0
test al, al
je 0x404f29
cmp dword [ebp - 0xb0], 2
jne 0x404f29
cmp dword [esi + 0x14], 8
lea edi, [esi + 0x10]
mov eax, dword [edi]
jb 0x404d01
mov esi, dword [esi]
push ebx
lea ecx, [ebp - 0xb0]
add eax, eax
push ecx
push eax
push esi
lea ecx, [ebp - 0x60]
call fcn.00413fc0
test al, al
je 0x404f29
mov eax, dword [edi]
add eax, eax
cmp eax, dword [ebp - 0xb0]
jne 0x404f29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00419f40
mov esi, 0x459a1c
push esi
call fcn.0043f51e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040206a
mov edi, 0x459850
push edi
call fcn.0043f51e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004025c2
cmp dword [ebp - 0x2c], 8
lea esi, [ebp - 0x40]
cmovae esi, dword [ebp - 0x40]
push esi
call fcn.0043f51e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004025c2
push edi
call fcn.0043f51e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004025c2
mov edi, ebx
mov dword [ebp - 0xb8], ebx
push str.Kernel32.dll
mov dword [ebp - 0xc4], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x404e37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x459a24
push esi
mov dword [ebp - 0xb4], ebx
call edi
push str.IsWow64Process
push esi
mov dword [ebp - 0xb0], eax
call edi
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x404e0d
mov eax, dword [ebp - 0xb0]
test eax, eax
je 0x404e0d
lea ecx, [ebp - 0xb4]
push ecx
call eax
push eax
call dword [ebp - 0xc0]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb4], eax
jmp 0x404e13
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x404e31
push str.Wow64DisableWow64FsRedirection
push esi
call edi
push str.Wow64RevertWow64FsRedirection
push esi
mov dword [ebp - 0xb8], eax
call edi
mov edi, eax
jmp 0x404e37
mov edi, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xb8]
mov byte [ebp - 0xb0], bl
mov dword [ebp - 0xbc], ebx
test eax, eax
je 0x404e71
test edi, edi
je 0x404e71
lea ecx, [ebp - 0xbc]
push ecx
call eax
mov ecx, dword [ebp - 0xb0]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
mov dword [ebp - 0xb0], ecx
push 0x3c
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.0043d260
add esp, 0xc
mov dword [ebp - 0x100], 0x3c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0xf8], ebx
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0x100]
push eax
mov dword [ebp - 0xfc], 0x140
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], str.regedit.exe
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
test eax, eax
je 0x404f07
cmp dword [ebp - 0xc8], 0
je 0x404f07
push 0xffffffffffffffff
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xb0], 0
je 0x404f1c
test edi, edi
je 0x404f1c
push dword [ebp - 0xbc]
call edi
test esi, esi
je 0x404f35
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x404f35
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00419f40
lea ecx, [ebp - 0x28]
call fcn.0040203f
lea ecx, [ebp - 0x94]
call fcn.00413ac0
lea ecx, [ebp - 0x40]
call fcn.0040203f
mov al, bl
call fcn.0044c498
ret