Function at 0x40104c
Capabilities:
Create process on windows
Create process suspended
Delete file
Resume thread
Set registry value
Suspend thread
Use process replacement
Write and execute a file
Write file on windows

Disassembly:
push 0x403164
push 0x403120
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push str.cdma_workshop_FULL_Cracked.exe
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x401077
call section..text
push 0xa
push 2
push 0
call sub.kernel32.dll_FindResourceA
mov eax, dword [eax]
add eax, 0x400000
mov dword [0x403194], eax
push 0xa
push 3
push 0
call sub.kernel32.dll_FindResourceA
mov eax, dword [eax]
add eax, 0x400000
mov dword [0x403198], eax
mov dword [0x403190], 1
push 0
push 0x40318c
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareWinlicense
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
or eax, eax
je 0x4010db
call fcn.00401026
push 0x10
push 0x4030f9
push 3
push 0
push str.Password0C88
push dword [0x40318c]
call sub.ADVAPI32.dll_RegSetValueExA
or eax, eax
je 0x4010ff
call fcn.00401026
push dword [0x40318c]
call sub.ADVAPI32.dll_RegCloseKey
or eax, eax
je 0x401113
call fcn.00401026
push 0
push 0x40318c
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareWinlicense
push 0x80000002
call sub.ADVAPI32.dll_RegCreateKeyExA
or eax, eax
je 0x40113f
call fcn.00401026
push 0
push 0x403190
push 4
push 0
push str.CheckIN
push dword [0x40318c]
call sub.ADVAPI32.dll_RegSetValueExA
or eax, eax
je 0x401163
call fcn.00401026
push dword [0x40318c]
call sub.ADVAPI32.dll_RegCloseKey
or eax, eax
je 0x401177
call fcn.00401026
push 0
push 0x22
push 2
push 0
push 0
push 0x10000000
push str.key_workshop.dat
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40119a
call section..text
mov dword [0x40319c], eax
push 0
push 0x403180
push 0x1b8
push dword [0x403198]
push dword [0x40319c]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x4011c5
call section..text
push dword [0x40319c]
call sub.kernel32.dll_CloseHandle
mov dword [0x403184], 0x9ed66e
mov dword [0x403188], 0x4befff
mov dword [0x40317c], 0
jmp 0x4012dc
cmp dword [0x40317c], 0x270f
jne 0x401204
call section..text
push dword [0x403168]
call sub.kernel32.dll_ResumeThread
push 1
call sub.kernel32.dll_Sleep
push dword [0x403168]
call sub.kernel32.dll_SuspendThread
push 0x403180
push 1
push 0x4031a0
push dword [0x403184]
push dword [0x403164]
call sub.kernel32.dll_ReadProcessMemory
or eax, eax
jne 0x401247
call section..text
mov eax, 0x4031a0
cmp byte [eax], 0x5a
jne 0x4012d5
push 0x403180
push 5
push dword [0x403194]
push dword [0x403184]
push dword [0x403164]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x40127c
call section..text
add dword [0x403194], 5
push 0x403180
push 0x110
push dword [0x403194]
push dword [0x403188]
push dword [0x403164]
call sub.kernel32.dll_WriteProcessMemory
or eax, eax
jne 0x4012ad
call section..text
push 0x40
push str.Credits
push str.CDMA_WorkShop_Free__r_nUnpacked_by_AnycallMongolia_
push 0
call sub.USER32.dll_MessageBoxA
push dword [0x403168]
call sub.kernel32.dll_ResumeThread
mov dword [0x40317c], 0x270f
add dword [0x40317c], 1
cmp dword [0x40317c], 0x2710
jne 0x4011f3
mov dword [0x403184], 0x4a94e4
mov dword [0x40317c], 0
jmp 0x401389
cmp dword [0x40317c], 0x13
jne 0x401313
call section..text
push dword [0x403168]
call sub.kernel32.dll_ResumeThread
push 0x3e8
call sub.kernel32.dll_Sleep
push dword [0x403168]
call sub.kernel32.dll_SuspendThread
push 0x403180
push 1
push 0x4031a0
push dword [0x403184]
push dword [0x403164]
call sub.kernel32.dll_ReadProcessMemory
or eax, eax
jne 0x401359
call section..text
mov eax, 0x4031a0
cmp byte [eax], 0x78
jne 0x401382
push str.key_workshop.dat
call sub.kernel32.dll_DeleteFileA
push dword [0x403168]
call sub.kernel32.dll_ResumeThread
mov dword [0x40317c], 0x13
add dword [0x40317c], 1
cmp dword [0x40317c], 0x14
jne 0x401305
push 0
call sub.kernel32.dll_ExitProcess
int3