Function at 0x402310
Capabilities:
Enumerate files on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov al, byte [0x4824f4]
push ebx
push esi
xor esi, esi
test al, 1
push edi
mov dword [ebp - 4], esi
jne 0x4023d2
mov bl, al
push esi
or bl, 1
mov dword [0x4824e8], 0x46a668
mov byte [0x4824f4], bl
mov dword [0x4824ec], esi
call dword [sym.imp.SpLic.dll_Ordinal_3]
add esp, 4
cmp eax, esi
mov dword [0x482504], eax
je 0x4023c5
mov edi, dword [0x482500]
xor ecx, ecx
mov dword [ebp - 0xc], edi
mov edx, edi
cmp dword [edx], eax
je 0x402379
inc ecx
add edx, 8
cmp ecx, 0x100
jb 0x402369
cmp ecx, 0x100
jne 0x4023c5
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [edi]
push eax
call ebx
test eax, eax
je 0x40239e
inc esi
add edi, 8
cmp esi, 0x100
jb 0x402387
jmp 0x4023c5
mov eax, dword [ebp - 0xc]
mov ecx, dword [0x482504]
mov dword [eax + esi*8], ecx
mov dword [eax + esi*8 + 4], 0
mov edx, dword [eax + esi*8]
push edx
push esi
push str.Reg:__d_____.8X__n
call dword [sym.imp.MSVCRT.dll__cprintf]
add esp, 0xc
push 0x4026b0
call fcn.00402f3e
add esp, 4
lea eax, [ebp - 0x10c]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x10c]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov byte [eax], 0
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str._bin
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SpVirL.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [ebp - 0x10c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40247a
mov byte [eax], 0
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [ebp - 0x10c]
push 0x46e86c
push ecx
lea edx, [ebp - 0x54c]
push 0x46e864
push edx
call ebx
add esp, 0x10
lea eax, [ebp - 0x34c]
lea ecx, [ebp - 0x54c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4024ee
lea edx, [ebp - 0x34c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [ebp - 0x320]
lea ecx, [ebp - 0x10c]
push eax
push ecx
lea edx, [ebp - 0x54c]
push 0x46e85c
push edx
call ebx
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40250b
lea eax, [ebp - 0x10c]
push str.license.lic
push eax
lea ecx, [ebp - 0x54c]
push 0x46e85c
push ecx
call ebx
add esp, 0x10
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
push edx
push 0x20006
push 0
push 0x46e830
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 8]
test edx, edx
je 0x402565
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebp - 0x10c]
push ecx
push eax
push 1
push 0
push str.VIRNTLMD_LICENSE_FILE
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
and edx, 0xff
push edx
call fcn.00403a80
mov esi, dword [ebp + 8]
add esp, 4
lea eax, [ebp - 0x54c]
mov ecx, 0x4824e8
push eax
push esi
mov dword [esi + 0x70], 0x4020f0
call fcn.004016d0
mov edi, eax
mov ax, 0x53
mov bx, 0x55
mov cx, 0x50
mov dx, 0x52
mov eax, 0x45
add eax, ebx
add eax, ecx
add eax, edx
cmp eax, 0
je 0x4025a5
test edi, edi
jne 0x4025c2
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 2
jne 0x40261b
lea ecx, [ebp - 0x34c]
lea edx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x402603
push 0x10
push str.Error
push str.Can_not_find_file:__nSpVirL.exe__nin_current_bin_path._nPlease_be_sure_it_exist.
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x54c]
push eax
push esi
push edi
call fcn.004021a0
add esp, 0xc
mov eax, dword [edi + 0xc]
add eax, 0xfffefffd
cmp eax, 3
ja case.default.0x402628
jmp dword [eax*4 + 0x4026a0]
cmp dword [edi + 0x10], 0x1e
jg 0x40263e
push edi
call fcn.00402100
add esp, 4
mov dword [ebp - 4], 0x10003
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x10], 0x3c
jg 0x40265e
push edi
call fcn.00402100
add esp, 4
mov dword [ebp - 4], 0x10004
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x10], 0x5a
jg 0x40267e
push edi
call fcn.00402100
add esp, 4
mov dword [ebp - 4], 0x10005
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x10006
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret