Function at 0x494c85
Capabilities:
Contain obfuscated stackstrings
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x42b238]
mov esi, ecx
mov ebx, 0x212
lea edi, [esp + 0x12]
mov dword [esp + 0x224], eax
push ebx
push 0
push edi
call fcn.0049acf0
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [esp + 4], ebx
push eax
push str.SoftwareSimonTathamPuTTY
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x494d09
mov al, byte [0x429f60]
test al, al
je 0x494ce3
mov ecx, dword [0x429f68]
jmp 0x494d73
push str.shell32.dll
call fcn.0048f6f9
add esp, 4
test eax, eax
mov dword [0x429f64], eax
je 0x494d64
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x494d66
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push edi
push ecx
push 0
push str.RandSeedFile
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x494d30
cmp dword [esp + 8], 1
je 0x494d35
mov byte [esp + 0x12], 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x12], 0
je 0x494ccf
mov eax, esp
lea ecx, [esp + 0x12]
mov edx, esi
push eax
call fcn.00495351
add esp, 4
test eax, eax
jne 0x494eb4
jmp 0x494ccf
xor ecx, ecx
mov dword [0x429f68], ecx
mov byte [0x429f60], 1
test ecx, ecx
je 0x494e11
xor ebx, ebx
push edi
push ebx
push ebx
push 0x1c
push ebx
call ecx
test eax, eax
js 0x494dc5
push edi
call fcn.004a7f30
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00495351
add esp, 4
test eax, eax
jne 0x494eb4
push edi
push ebx
push ebx
push 0x1a
push ebx
call dword [0x429f68]
test eax, eax
js 0x494e11
push edi
call fcn.004a7f30
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00495351
add esp, 4
test eax, eax
jne 0x494eb4
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, 0x212
push ebx
push edi
push str.HOMEDRIVE
call ebp
sub ebx, eax
lea eax, [esp + eax + 0x12]
push ebx
push eax
push str.HOMEPATH
call ebp
test eax, eax
je 0x494e70
push edi
call fcn.004a7f30
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00495351
add esp, 4
test eax, eax
jne 0x494eb4
push 0x212
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.004a7f30
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.00495351
add esp, 4
test eax, eax
je 0x494ed0
mov esi, dword [esp]
mov ecx, dword [esp + 0x224]
call fcn.00497c4a
mov eax, esi
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
dec esi
jmp 0x494eb7