Function at 0x405320
Capabilities:
Get file size
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437d00
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x44cc80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x474], eax
xor ebx, ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x45c], 4
mov dword [ebp - 0x468], 0xffffffff
mov word [ebp - 0x458], bx
push 0x206
push ebx
lea ecx, [ebp - 0x456]
push ecx
call fcn.004250c0
mov word [ebp - 0x250], bx
push 0x206
push ebx
lea edx, [ebp - 0x24e]
push edx
call fcn.004250c0
mov word [ebp - 0x48], bx
push 0x32
push ebx
lea eax, [ebp - 0x46]
push eax
call fcn.004250c0
add esp, 0x24
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x46c]
push ecx
push 0xf003f
push ebx
push str.SoftwareCanonMI
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4053fa
mov dword [ebp - 0x49c], 0x80004005
push 0x4472d0
lea edx, [ebp - 0x49c]
push edx
call fcn.00426b1b
lea eax, [ebp - 0x45c]
push eax
push 0x4519e0
push ebx
push ebx
push str.LOG_USEFILE_CURCOUNT
mov ecx, dword [ebp - 0x46c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405433
mov eax, dword [0x4519e0]
xor edx, edx
div dword [0x4519dc]
mov dword [0x4519e0], edx
jmp 0x405439
mov dword [0x4519e0], ebx
lea ecx, [ebp - 0x458]
call fcn.00405760
test eax, eax
jne 0x405463
mov dword [ebp - 0x48c], 0x80004005
push 0x4472d0
lea edx, [ebp - 0x48c]
push edx
call fcn.00426b1b
mov eax, dword [0x4519e0]
push eax
lea ecx, [ebp - 0x458]
push ecx
push str._sDebugLog__04d.txt
mov eax, 0x104
lea edi, [ebp - 0x250]
call fcn.004049d0
add esp, 0xc
test eax, eax
jge 0x4054a7
mov dword [ebp - 0x494], 0x80004005
push 0x4472d0
lea edx, [ebp - 0x494]
push edx
call fcn.00426b1b
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x468], esi
cmp esi, 0xffffffff
jne 0x4054ec
mov dword [ebp - 0x470], 0x80004005
push 0x4472d0
lea ecx, [ebp - 0x470]
push ecx
call fcn.00426b1b
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x405525
mov byte [ebp - 0x460], 0xff
mov byte [ebp - 0x45f], 0xfe
push ebx
lea edx, [ebp - 0x45c]
push edx
push 2
lea eax, [ebp - 0x460]
push eax
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
call ebx
jmp 0x40552b
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [0x4519d8], eax
jae 0x40565b
mov eax, dword [0x4519e0]
add eax, 1
xor edx, edx
div dword [0x4519dc]
mov dword [0x4519e0], edx
mov dword [ebp - 0x45c], 4
push 4
push 0x4519e0
push 4
push 0
push str.LOG_USEFILE_CURCOUNT
mov ecx, dword [ebp - 0x46c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40559c
mov dword [ebp - 0x490], 0x80004005
push 0x4472d0
lea edx, [ebp - 0x490]
push edx
call fcn.00426b1b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x468], 0xffffffff
mov eax, dword [0x4519e0]
push eax
lea ecx, [ebp - 0x458]
push ecx
push str._sDebugLog__04d.txt
mov eax, 0x104
lea edi, [ebp - 0x250]
call fcn.004049d0
add esp, 0xc
test eax, eax
jge 0x4055f1
mov dword [ebp - 0x488], 0x80004005
push 0x4472d0
lea edx, [ebp - 0x488]
push edx
call fcn.00426b1b
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x468], esi
cmp esi, 0xffffffff
jne 0x405638
mov dword [ebp - 0x498], 0x80004005
push 0x4472d0
lea ecx, [ebp - 0x498]
push ecx
call fcn.00426b1b
mov byte [ebp - 0x464], 0xff
mov byte [ebp - 0x463], 0xfe
push 0
lea edx, [ebp - 0x45c]
push edx
push 2
lea eax, [ebp - 0x464]
push eax
push esi
call ebx
lea ecx, [ebp - 0x484]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x476]
push edx
movzx eax, word [ebp - 0x478]
push eax
movzx ecx, word [ebp - 0x47a]
push ecx
movzx edx, word [ebp - 0x47c]
push edx
movzx eax, word [ebp - 0x47e]
push eax
movzx ecx, word [ebp - 0x482]
push ecx
movzx edx, word [ebp - 0x484]
push edx
push str._04d__02d__02d__02d:_02d:_02d:_04d
mov eax, 0x1a
lea edi, [ebp - 0x48]
call fcn.004049d0
add esp, 0x20
mov dword [ebp - 0x45c], 0
push 0
lea eax, [ebp - 0x45c]
push eax
push 0x32
mov ecx, edi
push ecx
push esi
call ebx
push 0
lea edx, [ebp - 0x45c]
push edx
mov eax, dword [ebp + 0xc]
lea ecx, [eax + eax]
push ecx
mov edx, dword [ebp - 0x474]
push edx
push esi
call ebx
push 0
lea eax, [ebp - 0x45c]
push eax
push 2
push 0x43fdf8
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x405719
test esi, esi
je 0x405724
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x46c]
test eax, eax
je 0x405735
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004237ad
mov esp, ebp
pop ebp
ret 8