Function at 0x405a40
Capabilities:
Get common file path
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
mov eax, 0x2e44
call fcn.004044f0
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x4d], ecx
mov dword [esp + 0x1d], eax
mov dword [esp + 0x51], ecx
mov dword [esp + 0x21], eax
mov dword [esp + 0x55], ecx
mov dword [esp + 0x25], eax
mov dword [esp + 0x59], ecx
mov dword [esp + 0x29], eax
mov word [esp + 0x5d], cx
mov word [esp + 0x2d], ax
mov byte [esp + 0x5f], cl
mov dword [esp + 0x39], ecx
mov byte [esp + 0x2f], al
mov dl, byte [0x40c428]
mov dword [esp + 0x61], eax
mov dword [esp + 0x3d], ecx
mov dword [esp + 0x65], eax
mov dword [esp + 0x41], ecx
mov dword [esp + 0x69], eax
mov dword [esp + 0x45], ecx
push ebx
push ebp
mov dword [esp + 0x75], eax
mov word [esp + 0x51], cx
push esi
push edi
mov word [esp + 0x81], ax
mov byte [esp + 0x5b], cl
mov ecx, 0x40
lea edi, [esp + 0x18d]
mov byte [esp + 0x83], al
mov byte [esp + 0x18c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x291]
mov byte [esp + 0x290], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x2c], dl
mov byte [esp + 0x5c], dl
mov byte [esp + 0x70], dl
mov byte [esp + 0x48], dl
mov byte [esp + 0x10], dl
xor edx, edx
stosb byte es:[edi], al
mov eax, dword [esp + 0x2e68]
xor esi, esi
mov word [esp + 0x11], dx
cmp eax, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x44], 4
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], esi
mov byte [esp + 0x16], dl
je 0x405b36
mov dword [eax], esi
mov ebp, dword [esp + 0x2e58]
cmp ebp, 2
jle 0x405b55
cmp ebp, 0xffffffff
jge 0x405b58
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2e44
ret
cmp ebp, 0xffffffff
je 0x405b73
push ebp
call fcn.00405140
add esp, 4
test al, al
jne 0x405bac
cmp dword [esp + 0x2e64], esi
jmp 0x405cde
push esi
call fcn.00405140
push 1
mov bl, al
call fcn.00405140
push 2
mov byte [esp + 0x21], al
call fcn.00405140
add esp, 0xc
test bl, bl
jne 0x405bac
mov cl, byte [esp + 0x15]
test cl, cl
jne 0x405bac
test al, al
jne 0x405bac
cmp dword [esp + 0x2e64], esi
jmp 0x405cde
cmp dword [0x40c444], esi
je 0x405c02
cmp ebp, 0xffffffff
jne 0x405c02
cmp dword [0x40c178], 1
jne 0x405bf5
cmp dword [esp + 0x2e60], esi
je 0x405bf5
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x405bf5
push str.EvaluationMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405bee
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2e44
ret
cmp ebp, 2
je 0x405c12
cmp ebp, 0xffffffff
jne 0x405dd0
xor esi, esi
mov al, byte [0x40c428]
mov ecx, 0x40
mov byte [esp + 0x88], al
xor eax, eax
lea edi, [esp + 0x89]
push 2
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], 1
stosb byte es:[edi], al
mov dword [esp + 0x44], 0x104
call fcn.00405140
add esp, 4
test al, al
je 0x405ccc
lea ecx, [esp + 0x28]
push ecx
push str.Software_farstone_virtualdrive0100
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x405c75
cmp dword [esp + 0x2e64], esi
jmp 0x405cde
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x40]
lea eax, [esp + 0x88]
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push str.ServerPath
push edx
call esi
lea eax, [esp + 0x40]
lea ecx, [esp + 0x88]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.ServerPath
push eax
call esi
mov ecx, dword [esp + 0x28]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x405cf5
cmp ebp, 2
jne 0x405dd0
mov eax, dword [esp + 0x2e64]
test eax, eax
je 0x405ce5
call fcn.00405350
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x2e44
ret
mov edi, str.setup.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x88]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x394]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x8c]
push ecx
call fcn.00406770
add esp, 8
test eax, eax
je 0x405d6b
cmp ebp, 2
jne 0x405dd0
mov eax, dword [esp + 0x2e64]
test eax, eax
je 0x405d5b
call fcn.00405350
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 0x2e44
ret
mov eax, dword [esp + 0x5ac]
test eax, eax
jne 0x405dc7
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x406434
push 0
lea edx, [esp + 0x28]
push 1
push edx
call fcn.00408100
add esp, 0xc
cmp eax, 0x17
je 0x405dab
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x406434
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
cmp eax, 1
jne 0x405dd0
mov byte [esp + 0x16], al
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x405e42
cmp ebp, 0xffffffff
jne 0x405e42
push 0
push 0
push 1
call fcn.004054e0
add esp, 0xc
test eax, eax
je 0x405e04
push 0
push 0
push 2
call fcn.004054e0
add esp, 0xc
test eax, eax
jne 0x405e42
push 0
lea eax, [esp + 0x28]
push 1
push eax
call fcn.00408100
add esp, 0xc
cmp eax, 0x17
je 0x405e2a
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x405e42
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
mov ebx, dword [esp + 0x2e64]
lea ecx, [esp + 0x18c]
push 0x104
push ecx
mov dword [0x40c17c], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str._rtclcmg32.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40c1d8
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x190]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x405eb5
test ebx, ebx
jmp 0x406370
push 2
push 0xfffffdfd
push esi
call sub.MSVCRT.dll_fseek
mov edi, str.g7iwmlp__625___
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2a4]
push 1
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x1c
mov edi, str.g7iwmlp__625___
lea eax, [esp + 0x290]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x405f15
test cl, cl
je 0x405f11
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x405f15
add eax, 2
add edi, 2
test cl, cl
jne 0x405ef1
xor eax, eax
jmp 0x405f1a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405f25
test ebx, ebx
jmp 0x406370
cmp ebp, 0xffffffff
je 0x405faf
mov eax, ebp
sub eax, 0
je 0x405f4d
dec eax
je 0x405f44
dec eax
jne 0x405f5a
push 0
push 0xdc
jmp 0x405f51
push 0
push 0xaf
jmp 0x405f51
push 0
push 0x65
push esi
call sub.MSVCRT.dll_fseek
add esp, 0xc
push esi
push 0x14
lea eax, [esp + 0x34]
push 1
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 0x14
je 0x405f81
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x406370
movzx cx, byte [esp + 0x3c]
movzx dx, byte [esp + 0x3d]
shl ecx, 8
add ecx, edx
push ecx
call fcn.00406700
push 0
push 0x7b8
call fcn.00406610
push 0xf
lea eax, [esp + 0x3c]
jmp 0x4060e2
push 0
push 0x65
push esi
call sub.MSVCRT.dll_fseek
push esi
push 0x14
lea ecx, [esp + 0x70]
push 1
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp eax, 0x14
je 0x405fe0
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x406370
movzx dx, byte [esp + 0x6c]
movzx ax, byte [esp + 0x6d]
shl edx, 8
add edx, eax
push edx
call fcn.00406700
push 0
push 0x7b8
call fcn.00406610
lea ecx, [esp + 0x68]
push 0xf
push ecx
call fcn.00406710
call fcn.004066f0
push 0
push 0xaf
push esi
call sub.MSVCRT.dll_fseek
push esi
push 0x14
lea edx, [esp + 0x98]
push 1
push edx
call sub.MSVCRT.dll_fread
add esp, 0x30
cmp eax, 0x14
je 0x40604b
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x406370
movzx ax, byte [esp + 0x80]
movzx cx, byte [esp + 0x81]
shl eax, 8
add eax, ecx
push eax
call fcn.00406700
push 0
push 0x7b8
call fcn.00406610
lea edx, [esp + 0x7c]
push 0xf
push edx
call fcn.00406710
call fcn.004066f0
push 0
push 0xdc
push esi
call sub.MSVCRT.dll_fseek
push esi
push 0x14
lea eax, [esp + 0x70]
push 1
push eax
call sub.MSVCRT.dll_fread
add esp, 0x30
cmp eax, 0x14
je 0x4060b9
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x406370
movzx cx, byte [esp + 0x58]
movzx dx, byte [esp + 0x59]
shl ecx, 8
add ecx, edx
push ecx
call fcn.00406700
push 0
push 0x7b8
call fcn.00406610
push 0xf
lea eax, [esp + 0x58]
push eax
call fcn.00406710
add esp, 0x14
call fcn.004066f0
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
cmp ebp, 0xffffffff
je 0x40611a
lea ecx, [esp + 0x2c]
push ecx
call fcn.00405390
add esp, 4
test al, al
jne 0x4061c4
test ebx, ebx
jmp 0x406370
push 0
call fcn.00405140
push 1
mov byte [esp + 0x1d], al
call fcn.00405140
push 2
mov bl, al
call fcn.00405140
mov byte [esp + 0x23], al
mov al, byte [esp + 0x21]
add esp, 0xc
test al, al
je 0x406162
test bl, bl
je 0x40615c
lea edx, [esp + 0x70]
lea eax, [esp + 0x5c]
push edx
push eax
call fcn.00405400
add esp, 8
jmp 0x40616e
lea eax, [esp + 0x5c]
jmp 0x40616e
neg bl
sbb ebx, ebx
lea ecx, [esp + 0x70]
and ebx, ecx
mov eax, ebx
mov cl, byte [esp + 0x17]
test cl, cl
je 0x4061a3
test eax, eax
je 0x40618a
lea edx, [esp + 0x48]
push edx
push eax
call fcn.00405400
add esp, 8
jmp 0x4061a3
lea eax, [esp + 0x48]
push eax
call fcn.00405390
add esp, 4
test al, al
je 0x406367
lea eax, [esp + 0x48]
test eax, eax
je 0x406367
mov esi, eax
lea edx, [esp + 0x2c]
xor ecx, ecx
sub esi, edx
lea eax, [esp + ecx + 0x2c]
inc ecx
cmp ecx, 0x14
mov dl, byte [esi + eax]
mov byte [eax], dl
jl 0x4061b5
mov al, byte [esp + 0x16]
test al, al
je 0x4061d3
mov byte [esp + 0x2d], 1
jmp 0x406204
mov al, byte [esp + 0x2d]
test al, al
jne 0x4061fc
pop edi
pop esi
pop ebp
mov dword [0x40c444], 1
mov dword [0x40c178], 0
xor eax, eax
pop ebx
add esp, 0x2e44
ret
cmp al, 1
jne 0x406367
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
and edi, 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406316
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x48]
push edx
push eax
push 0
push str.ritcuck
push ecx
call esi
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push eax
push ecx
push 0
push str.ritcuck
push edx
call esi
test eax, eax
jne 0x40630b
movzx ax, byte [esp + 0x12]
movzx cx, byte [esp + 0x13]
shl eax, 8
add eax, ecx
push eax
call fcn.00406700
push 0
push 0x7b8
call fcn.00406610
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00406710
add esp, 0x14
call fcn.004066f0
mov cl, byte [esp + 0x10]
test cl, cl
je 0x4062ce
mov eax, edi
sub eax, 0
je 0x4062c9
dec eax
je 0x4062c4
dec eax
jne 0x40630b
test cl, 4
jmp 0x4062cc
test cl, 2
jmp 0x4062cc
test cl, 1
je 0x40630b
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x406573
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x406573
push str.MaturityMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40656c
jmp 0x40656a
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x32]
mov ecx, dword [esp + 0x33]
mov edx, dword [esp + 0x34]
and esi, 0xff
mov eax, dword [esp + 0x35]
and ecx, 0xff
shl esi, 8
mov ebx, dword [esp + 0x2c]
add esi, ecx
mov cl, byte [esp + 0x3a]
and edx, 0xff
shl esi, 8
add esi, edx
and eax, 0xff
shl esi, 8
add esi, eax
and ebx, 0xff
cmp edi, 0xffffffff
mov byte [esp + 0x1c], cl
je 0x406387
cmp ebx, edi
je 0x406387
mov eax, dword [esp + 0x2e64]
test eax, eax
je 0x406377
call fcn.00405350
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x2e44
ret
lea edx, [esp + 0x84]
push edx
call sub.MSVCRT.dll_time
mov ecx, dword [esp + 0x88]
mov edi, dword [esp + 0x2e6c]
add esp, 4
sub ecx, esi
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x4063cd
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, esi
and eax, 0xff
sub eax, edx
mov dword [edi], eax
test ecx, ecx
jl 0x406441
mov eax, 0xc22e4507
and esi, 0xff
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, esi
jge 0x406441
mov eax, dword [esp + 0x2e60]
mov edi, 1
test eax, eax
mov dword [0x40c444], edi
je 0x40642e
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40642e
push str.EvaluationMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406427
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x40c178], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2e44
ret
lea edx, [esp + 0x18]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40653e
mov eax, ebx
mov dword [esp + 0x20], 4
sub eax, 0
je 0x406483
dec eax
je 0x40647b
dec eax
jne 0x40648d
mov al, byte [esp + 0x10]
or al, 4
jmp 0x406489
mov al, byte [esp + 0x10]
or al, 2
jmp 0x406489
mov al, byte [esp + 0x10]
or al, 1
mov byte [esp + 0x10], al
push 0
call sub.MSVCRT.dll_time
push eax
call sub.MSVCRT.dll_srand
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x4064ad
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x19], al
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x4064c4
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x1a], al
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x4064db
dec eax
or eax, 0xffffff00
inc eax
movzx cx, byte [esp + 0x1a]
xor dx, dx
mov byte [esp + 0x1b], al
shl ecx, 8
mov dl, al
add ecx, edx
push ecx
call fcn.00406700
push 1
push 0x7b8
call fcn.00406610
lea eax, [esp + 0x24]
push 1
push eax
call fcn.00406710
add esp, 0x1c
call fcn.004066f0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push 4
push 0
push str.ritcuck
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x406573
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x406573
push str.MaturityMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40656c
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2e44
ret