Function at 0x405719
Capabilities:
Copy file
Create process on windows
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x934
push edi
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x828], 0
mov byte [ebp - 0x414], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x718], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x717]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x81c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x81b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x824], 0x200
mov dword [ebp - 0x820], 0x104
mov dword [ebp - 0x10c], 0
xor eax, eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0x828]
push ecx
push 0xf003f
push 0
push 0x410bdc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x81c]
push ecx
push 0
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x718]
push eax
push 0
mov ecx, dword [ebp - 0x828]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x930], eax
lea edx, [ebp - 0x718]
push edx
push str._ZSetupMain::RemoveSetupSettings__subkey_found___s_n
call fcn.00407a82
add esp, 8
cmp dword [ebp - 0x930], 0
je 0x405856
push str.SOFTWAREZenographicsZSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x110], 1
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x518], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x517]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x92c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x92b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x934]
mov ecx, dword [eax + 0x2b8]
push ecx
push 0x410c54
lea edx, [ebp - 0x92c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x934]
mov ecx, dword [eax + 0x2a0]
push ecx
push str._sZSetupInstaller.dll
lea edx, [ebp - 0x518]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x92c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [ebp - 0x934]
cmp dword [edx + 0x15c], 0
je 0x40591e
push str.TRUE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x405930
push str.FALSE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp - 0x934]
mov ecx, dword [eax + 0x164]
push ecx
mov edx, dword [ebp - 0x934]
mov eax, dword [edx + 0x16c]
push eax
mov ecx, dword [ebp - 0x934]
mov edx, dword [ecx + 0x170]
push edx
push str.ZSETUPINSTALLER.DLL_RemoveSetup___s____s____s____s_
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
mov ecx, dword [ebp - 0x934]
mov edx, dword [ecx + 0x2a0]
push edx
lea eax, [ebp - 0x104]
push eax
push str.Rundll32.exe
push str.OPEN
mov ecx, dword [ebp - 0x934]
mov edx, dword [ecx + 0x280]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x934]
mov dword [eax + 0x15c], 0
mov eax, dword [ebp - 0x110]
pop edi
mov esp, ebp
pop ebp
ret