Function at 0x442750
Capabilities:
Check os version
Create process on windows
Hide graphical window
Query or enumerate registry value

Disassembly:
mov eax, 0x1174
call fcn.0046be90
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x1170], eax
push ebp
mov ebp, dword [esp + 0x1180]
push esi
mov esi, dword [esp + 0x1180]
push edi
mov dword [0x4dced8], esi
call fcn.00435030
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
or eax, 0x8001
push eax
call edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push str.SetCurrentProcessExplicitAppUserModelID
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4427c0
push str.TrueCryptFoundation.TrueCrypt
call eax
push 6
lea eax, [esp + 0x74]
push eax
push str.Language
mov byte [esp + 0x7c], 0
call fcn.00438430
add esp, 0xc
test eax, eax
lea eax, [esp + 0x70]
jne 0x4427e6
mov eax, 0x48fa08
push eax
call fcn.0044c930
add esp, 4
cmp byte [esp + 0x70], 0
jne 0x442811
mov ecx, dword [0x4dced8]
push 1
push 0x44d200
push 0
push 0x201
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.0044c9a0
call fcn.00437a30
test eax, eax
je 0x44296f
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x44296f
call fcn.004378f0
test eax, eax
je 0x44296f
push str._q_UAC
push ebp
call fcn.0046c6d0
add esp, 8
cmp eax, ebp
jne 0x442864
push str.UAC_INIT_ERROR
call fcn.00433d70
add esp, 4
push 1
call fcn.0046cfc7
push 0x30
lea edx, [esp + 0x44]
push 0
push edx
call fcn.0046bf90
add esp, 0xc
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], 0x30
mov dword [esp + 0x4c], 0x431750
mov dword [esp + 0x58], esi
mov dword [esp + 0x6c], 0x48fa0c
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
push 1
push 1
push 1
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push 0x48fa0c
push 0x48fa0c
push 0x80080
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 2
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
lea ecx, [esp + 0x7c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [str._q_UAC]
mov eax, dword [0x490670]
push ebp
lea ecx, [esp + 0x180]
push 0x1000
push ecx
mov dword [esp + 0x188], edx
mov dword [esp + 0x18c], eax
call fcn.00470432
add esp, 0xc
push 1
push 0
lea edx, [esp + 0x184]
push edx
lea eax, [esp + 0x84]
push eax
push 0x490664
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x44295d
push 1
call fcn.0046cfc7
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.0046cfc7
push 0x4426b0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x431740
call fcn.0046c141
add esp, 4
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
cmp dword [0x4dce90], 5
mov dword [0x4dce9c], eax
jge 0x4429cc
mov ecx, dword [0x4dce70]
push 0x10
push ecx
push str.UNSUPPORTED_OS
call fcn.0044c960
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.0046cfc7
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0x7c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x442ad0
mov cx, word [esp + 0x10c]
movzx eax, cx
mov dword [0x4dce98], eax
mov eax, dword [0x4dce8c]
sub eax, 7
je 0x442a4c
sub eax, 1
jne 0x442ad0
cmp cx, 1
jae 0x442ad0
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push eax
push str.SystemCurrentControlSetControlminint
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x442a45
push str.LARGE_IDE_WARNING_XP
call fcn.00433d10
add esp, 4
jmp 0x442ad0
mov edx, dword [esp + 0xc]
push edx
jmp 0x442aca
cmp cx, 3
jae 0x442a61
push str.LARGE_IDE_WARNING_2K
call fcn.00433d10
add esp, 4
jmp 0x442ad0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesAtapiParameters
push SysStringLen
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x442ac5
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.EnableBigLba
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x442ab8
cmp dword [esp + 0x10], 1
je 0x442ac5
push str.LARGE_IDE_WARNING_2K_REGISTRY
call fcn.00433d10
add esp, 4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4dced8]
lea edx, [esp + 0x18]
push edx
push str.32770
push eax
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
jne 0x442afd
push eax
call fcn.00434ad0
add esp, 4
push str.INIT_REGISTER
call fcn.00430610
push 0x1f5
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], 0x494b80
mov dword [esp + 0x24], 0x431680
call esi
mov edi, dword [sym.imp.USER32.dll_RegisterClassA]
lea ecx, [esp + 0x18]
mov ebp, 0x1e
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], ebp
call edi
mov word [0x4b96f0], ax
test ax, ax
jne 0x442b65
push 0
call fcn.00434ad0
add esp, 4
push str.INIT_REGISTER
call fcn.00430610
push 0x7f00
push 0
mov dword [esp + 0x44], 0x494b74
mov dword [esp + 0x24], 0x4312e0
call esi
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], ebp
call edi
mov word [0x4d9a3c], ax
test ax, ax
jne 0x442bac
push 0
call fcn.00434ad0
add esp, 4
push str.INIT_REGISTER
call fcn.00430610
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x442bce
push eax
call fcn.00434ad0
add esp, 4
push str.INIT_RICHEDIT
call fcn.00430610
mov eax, dword [0x4dced8]
push 1
push 0x430b70
push 0
push 0x204
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.004317f0
call fcn.004317c0
push eax
call fcn.00447a40
add esp, 4
test eax, eax
jne 0x442c0f
push eax
call fcn.00434ad0
add esp, 4
push 1
call fcn.0046cfc7
mov ecx, dword [esp + 0x117c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0046be7b
add esp, 0x1174
ret