Function at 0x405ce0
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x240
mov esi, eax
mov ax, word [0x41d2e0]
mov word [ebp - 0x22e], ax
lea eax, [ebp - 0x22c]
push 0x210
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], 0x212
lea eax, [ebp - 0x10]
push eax
push str.SoftwareSimonTathamPuTTY
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
pop edx
test eax, eax
je 0x405eb6
lea ebx, [ebp - 0x22e]
lea edi, [ebp - 0x1c]
mov ecx, dword [0x422050]
test ecx, ecx
je 0x405f20
mov eax, dword [0x422070]
test eax, eax
je 0x405e00
sub esp, 0xc
push ebx
push 0
push 0
push 0x1c
push 0
call eax
add esp, 0xc
test eax, eax
js 0x405db0
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ecx, edi
lea eax, [ebx + eax]
mov edx, esi
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405c50
test eax, eax
je 0x405db0
mov edx, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push ebx
push 0
push 0
push 0x1a
push 0
call dword [0x422070]
add esp, 0xc
test eax, eax
js 0x405e00
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ecx, edi
lea eax, [ebx + eax]
mov edx, esi
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405c50
test eax, eax
jne 0x405da2
nop
push eax
push 0x212
push ebx
push str.HOMEDRIVE
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edx, 0x212
sub edx, eax
lea eax, [ebx + eax]
push edx
push eax
push str.HOMEPATH
call sub.KERNEL32.dll_GetEnvironmentVariableA
pop ecx
test eax, eax
je 0x405e65
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ecx, edi
lea eax, [ebx + eax]
mov edx, esi
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405c50
test eax, eax
jne 0x405da2
push edx
push edx
push 0x212
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
push eax
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov edx, esi
mov ecx, edi
lea eax, [ebx + eax]
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405c50
or edx, 0xffffffff
test eax, eax
jne 0x405da2
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
lea eax, [ebp - 0x18]
lea ebx, [ebp - 0x22e]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push 0
push str.RandSeedFile
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
test eax, eax
pop ecx
je 0x405f61
mov byte [ebp - 0x22e], 0
sub esp, 0xc
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.DLL_RegCloseKey
lea edi, [ebp - 0x1c]
add esp, 0xc
cmp byte [ebp - 0x22e], 0
je 0x405d3d
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00405c50
test eax, eax
je 0x405d3d
jmp 0x405da2
sub esp, 0xc
push str.shell32.dll
call fcn.00405530
add esp, 0x10
xor edx, edx
mov dword [0x422060], eax
test eax, eax
je 0x405f4c
push edx
push edx
push str.SHGetFolderPathA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edx, eax
pop eax
pop ecx
mov dword [0x422070], edx
mov dword [0x422050], 1
jmp 0x405d4b
cmp dword [ebp - 0x14], 1
jne 0x405ee1
jmp 0x405ee8