Function at 0x4055d0
Capabilities:
Delete file
Download url
Get installed programs
Query or enumerate registry value
Read .ini file
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa74
mov eax, dword [0x46da7c]
mov dword [esp + 0xa70], eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x18], esi
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x28], bl
mov ecx, 0x40
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x340], bl
mov ecx, 0x40
lea edi, [esp + 0x341]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x344]
push eax
push ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x340]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x340]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x405650
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x405665
mov edx, dword [str.History.ini]
mov eax, dword [0x457f04]
mov ecx, dword [0x457f08]
mov dword [edi], edx
mov dl, byte [0x457f0c]
mov dword [edi + 4], eax
push ebx
mov dword [edi + 8], ecx
push ebx
lea eax, [esp + 0x30]
mov byte [edi + 0xc], dl
mov edi, dword [ebp + 8]
push eax
push edi
push ebx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jge 0x4056b6
mov dword [esi + 0x7fc], 2
lea eax, [edi - 0x10]
jmp 0x405736
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
mov byte [esp + 0x658], bl
mov ecx, 0x40
lea edi, [esp + 0x659]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push 0x104
lea ecx, [esp + 0x660]
push ecx
push ebx
push 0x457efc
push str.COUNTER
mov dword [esp + 0x34], 0x104
call esi
lea edx, [esp + 0x658]
push edx
call fcn.0042eaf0
add esp, 4
xor edx, edx
cmp eax, ebx
mov dword [esp + 0x24], eax
jg 0x405770
mov eax, dword [esp + 0x18]
mov dword [eax + 0x7fc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x405730
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40574d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xa7c]
mov eax, 1
call fcn.0042d9b6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ecx]
xor eax, eax
mov byte [esp + 0x130], bl
mov ecx, 0x40
lea edi, [esp + 0x131]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x868], bl
mov ecx, 0x40
lea edi, [esp + 0x869]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x448], bl
mov ecx, 0x40
lea edi, [esp + 0x449]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x550], bl
mov ecx, 0x40
lea edi, [esp + 0x551]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x760], bl
mov ecx, 0x40
lea edi, [esp + 0x761]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x970], bl
mov ecx, 0x40
lea edi, [esp + 0x971]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x238], bl
mov ecx, 0x40
lea edi, [esp + 0x239]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [edx + 1]
push eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x134]
push str.CHECK_d
push eax
call fcn.0042eeed
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0x104
lea edx, [esp + 0x870]
push edx
push ebx
push str.HKEY
lea eax, [esp + 0x144]
push eax
call esi
lea ecx, [esp + 0x28]
push ecx
push 0x104
lea edx, [esp + 0x450]
push edx
push ebx
push str.REGPATH
lea eax, [esp + 0x144]
push eax
call esi
lea ecx, [esp + 0x28]
push ecx
push 0x104
lea edx, [esp + 0x558]
push edx
push ebx
push str.REGNAME
lea eax, [esp + 0x144]
push eax
call esi
lea ecx, [esp + 0x28]
push ecx
push 0x104
lea edx, [esp + 0x768]
push edx
push ebx
push str.REGVALUE
lea eax, [esp + 0x144]
push eax
call esi
mov ecx, 0xd
mov esi, str.SOFTWAREMicroSoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x238]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x448]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4058e8
lea edi, [esp + 0x238]
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x405900
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HKLM
lea esi, [esp + 0x868]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov dword [esp + 0x14], ebx
jne 0x40596c
lea eax, [esp + 0x14]
push eax
push 0x2001f
push ebx
lea ecx, [esp + 0x244]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4059a5
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x405962
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
jmp 0x4059a9
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebx
lea eax, [esp + 0x244]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4059a5
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40599d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x974]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x560]
push edx
push esi
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, ebx
je 0x4059e6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x760]
lea esi, [esp + 0x970]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x405a1c
cmp al, bl
je 0x405a18
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x405a1c
add esi, 2
add edi, 2
cmp al, bl
jne 0x4059f4
xor eax, eax
jmp 0x405a21
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x405a38
mov edx, dword [esp + 0x20]
cmp edx, dword [esp + 0x24]
jl 0x405767
jmp 0x405717
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x7fc], 2
je 0x405a60
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x405743