Function at 0x4a8958
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa94
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x44
push 0
lea edx, [ebp - 0x468]
push edx
call fcn.0066c86c
add esp, 0xc
mov dword [ebp - 0x468], 0x44
mov dword [ebp - 0x43c], 0x101
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x42c], eax
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x430], eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x428], eax
mov word [ebp - 0x438], 0
mov ecx, dword [ebp + 0xc]
dec ecx
je 0x4a8ea2
sub ecx, 2
jne 0x4a90b3
mov byte [ebp - 0x56c], 0
mov eax, dword [0x7fe6d4]
dec eax
je 0x4a89ee
mov edx, dword [0x7fe6d4]
cmp edx, 9
jne 0x4a8a9a
push str.vaxscsi
call fcn.0049c8c6
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8a11
push str.Initiator_Id_31
call fcn.0049cccb
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a8a2d
push 0x768a56
push 0x768a45
call fcn.0049d206
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a8a49
push 0x768a6a
push 0x768a59
call fcn.0049d7b5
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 9
jne 0x4a8a7c
push 0x82480b
push str._s__L
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0xc
jmp 0x4a9293
push 0x82480b
push str._s_1:__L
lea ecx, [ebp - 0x56c]
push ecx
call fcn.00670e94
add esp, 0xc
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 2
jne 0x4a8afb
push str.dtscsi
call fcn.0049c8c6
pop ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a8ac7
push str.Initiator_Id_15
call fcn.0049cccb
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8ae3
push 0x768aa4
push str.Initiator_Id_255
call fcn.0049d206
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 5
jne 0x4a8b2c
push str.Initiator_Id_127
call fcn.0049cccb
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 6
je 0x4a8b50
mov edx, dword [0x7fe6d4]
cmp edx, 7
je 0x4a8b50
mov ecx, dword [0x7fe6d4]
cmp ecx, 0xb
jne 0x4a8c0e
push 0x6e7128
push 0x82480b
push 0x768ab8
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a7f30
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8bef
push 0x768ac9
push 0x6e7128
call fcn.0066cbe8
add esp, 8
test eax, eax
jne 0x4a8baf
push 0x768ace
push 0x6e7128
call fcn.0066c9ec
add esp, 8
jmp 0x4a8bc1
push 0x768ad1
push 0x6e7128
call fcn.0066c9ec
add esp, 8
push 0x6e7128
push 0x82480b
push 0x768ad6
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a7f30
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 0xc
jne 0x4a8cda
push 0x6e7128
push 0x82480b
push 0x768ae7
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x10
lea ecx, [ebp - 0x56c]
push ecx
call fcn.004a7f30
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a8cbb
push 0x768af8
push 0x6e7128
call fcn.0066cbe8
add esp, 8
test eax, eax
jne 0x4a8c7b
push 0x768afd
push 0x6e7128
call fcn.0066c9ec
add esp, 8
jmp 0x4a8c8d
push 0x768b00
push 0x6e7128
call fcn.0066c9ec
add esp, 8
push 0x6e7128
push 0x82480b
push str._s__get_count__s
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x10
lea ecx, [ebp - 0x56c]
push ecx
call fcn.004a7f30
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 0xd
jne 0x4a8d2d
push 0x82480b
push str._s__get_count
lea ecx, [ebp - 0x56c]
push ecx
call fcn.00670e94
add esp, 0xc
lea eax, [ebp - 0x56c]
push eax
call fcn.004a7f30
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 0xa
jne 0x4a8dfa
push 0x6e7128
push 0x82480b
push 0x768b24
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a8000
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a8ddb
push 0x768b3f
push 0x6e7128
call fcn.0066cbe8
add esp, 8
test eax, eax
jne 0x4a8d9b
push 0x768b44
push 0x6e7128
call fcn.0066c9ec
add esp, 8
jmp 0x4a8dad
push 0x768b47
push 0x6e7128
call fcn.0066c9ec
add esp, 8
push 0x6e7128
push 0x82480b
push str._s___get_count___type___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
lea edx, [ebp - 0x56c]
push edx
call fcn.004a8000
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x56c], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 3
jne 0x4a8e80
push str.VClone
call fcn.0049c8c6
pop ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x4a9293
call fcn.004a8700
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 4]
push ecx
push 0x768b6e
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x4a9293
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x414]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push str.NumberOfDrives
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4a8e73
movsx eax, byte [ebp - 0x414]
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 8
jne 0x4a9293
push str.vdrive
call fcn.0049c8c6
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
dec ecx
jne 0x4a8ed1
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
inc eax
push eax
push 0x82480b
push 0x768baf
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 9
jne 0x4a8f00
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x82480b
push str._s__d:__M:__s_
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 2
jne 0x4a8f2f
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x82480b
push str._s__mount__d___s_
lea ecx, [ebp - 0x56c]
push ecx
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 5
je 0x4a8f4f
mov edx, dword [0x7fe6d4]
cmp edx, 6
je 0x4a8f4f
mov ecx, dword [0x7fe6d4]
cmp ecx, 7
jne 0x4a8f78
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x6e7128
push 0x82480b
push str._s__mount__s___d___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x18
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 0xc
jne 0x4a8fb1
push dword [ebp + 0x10]
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbbcd81]
push eax
push 0x82480b
push 0x768bf5
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 0xd
jne 0x4a8fef
push dword [ebp + 0x10]
imul eax, dword [ebp + 8], 0x23
movsx edx, byte [eax*8 + 0xbbcd81]
push edx
push 0x6e7128
push 0x82480b
push str._s__mount__s__c___s_
lea ecx, [ebp - 0x56c]
push ecx
call fcn.00670e94
add esp, 0x18
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 0xa
jne 0x4a9027
push dword [ebp + 0x10]
imul edx, dword [ebp + 8], 0x23
movsx ecx, byte [edx*8 + 0xbbcd81]
push ecx
push 0x82480b
push str._s___mount_to___letter___c____path___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 0xb
jne 0x4a9060
push dword [ebp + 0x10]
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbbcd81]
push eax
push 0x82480b
push str._s__mount_to__c___s_
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 8
jne 0x4a908f
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x82480b
push str._s__M:_d___s_
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x82480b
push str._s__d_d___s_
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
dec ecx
jne 0x4a90df
mov eax, dword [ebp + 8]
inc eax
push eax
push 0x82480b
push 0x768c78
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 9
jne 0x4a910b
push dword [ebp + 8]
push 0x82480b
push str._s__d:__U
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 2
jne 0x4a9137
push dword [ebp + 8]
push 0x82480b
push str._s__unmount__d
lea ecx, [ebp - 0x56c]
push ecx
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 5
je 0x4a9157
mov edx, dword [0x7fe6d4]
cmp edx, 6
je 0x4a9157
mov ecx, dword [0x7fe6d4]
cmp ecx, 7
jne 0x4a917d
push dword [ebp + 8]
push 0x6e7128
push 0x82480b
push str._s__unmount__s___d
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x14
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 0xc
jne 0x4a91b3
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbbcd81]
push eax
push 0x82480b
push 0x768cae
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 0xd
jne 0x4a91e9
imul eax, dword [ebp + 8], 0x23
movsx edx, byte [eax*8 + 0xbbcd81]
push edx
push 0x82480b
push 0x768cbd
lea ecx, [ebp - 0x56c]
push ecx
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov eax, dword [0x7fe6d4]
cmp eax, 0xa
jne 0x4a921b
imul edx, dword [ebp + 8], 0x23
movsx ecx, byte [edx*8 + 0xbbcd81]
push ecx
push 0x82480b
push str._s___unmount___letter___c_
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov edx, dword [0x7fe6d4]
cmp edx, 0xb
jne 0x4a924e
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbbcd81]
push eax
push 0x82480b
push str._s__unmount__c
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
mov ecx, dword [0x7fe6d4]
cmp ecx, 8
jne 0x4a9277
push dword [ebp + 8]
push 0x82480b
push str._s__U:_d
lea eax, [ebp - 0x56c]
push eax
call fcn.00670e94
add esp, 0x10
jmp 0x4a9293
push dword [ebp + 8]
push 0x82480b
push str._s__d_d__u
lea edx, [ebp - 0x56c]
push edx
call fcn.00670e94
add esp, 0x10
mov cl, byte [ebp - 0x56c]
test cl, cl
je 0x4a9341
lea eax, [ebp - 0x424]
push eax
lea edx, [ebp - 0x468]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x56c]
push ecx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4a92d1
xor eax, eax
jmp 0x4a9344
push dword [ebp - 0x420]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
mov edx, dword [0x7fe6d4]
dec edx
je 0x4a92f2
mov ecx, dword [0x7fe6d4]
cmp ecx, 9
jne 0x4a931a
push 0xffffffffffffffff
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x4a9336
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x4a9336
push 0xffffffffffffffff
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_WaitForSingleObject
imul ecx, dword [ebp + 8], 0x23
movsx eax, byte [ecx*8 + 0xbbcd81]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x424]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret