Function at 0x401d30
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub rsp, 0x218
mov rax, qword [0x00405660]
mov qword [rsp + 0x200], rax
cmp dword [0x004056a0], 1
mov qword [rsp + 0x230], rsi
mov esi, ecx
je 0x401ff1
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
movzx eax, word [rsp + 0x58]
movzx r11d, word [rsp + 0x54]
shl r11d, 0x10
lea rdx, [0x004055d8]
mov r9d, 0x20019
or r11d, eax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [0x004056a8], r11d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401df5
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ApMsgFwd_Flags
mov qword [rsp + 0x28], rax
lea rax, [0x004056a4]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, [0x00405600]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e61
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ApMsgFwd_OSVer
mov qword [rsp + 0x28], rax
lea rax, [0x004055c0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x228], rbx
lea rdx, str.SOFTWAREAlpsApoint
mov ebx, 0x104
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x238], rdi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdi, [0x004056b0]
test eax, eax
jne 0x401ef1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.HomeDirectory
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401ee6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401ef1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xf0]
lea rax, [rsp + 0xf0]
mov rdx, rbx
sub rdi, rcx
movzx ecx, byte [rdi + rax]
test cl, cl
je 0x401f1b
mov byte [rax], cl
inc rax
dec rdx
jne 0x401f07
jmp 0x401f20
test rdx, rdx
jne 0x401f23
dec rax
mov rdi, qword [rsp + 0x238]
mov byte [rax], 0
mov rcx, rbx
lea rax, [rsp + 0xf0]
nop
nop
cmp byte [rax], 0
je 0x401f4f
inc rax
dec rcx
jne 0x401f40
jmp 0x401f90
test rcx, rcx
je 0x401f90
mov rax, rbx
sub rax, rcx
sub rbx, rax
lea rcx, [rsp + rax + 0xf0]
je 0x401f90
lea rdx, str.ApMsgFwd.exe
sub rdx, rcx
movzx eax, byte [rdx + rcx]
test al, al
je 0x401f85
mov byte [rcx], al
inc rcx
dec rbx
jne 0x401f71
jmp 0x401f8a
test rbx, rbx
jne 0x401f8d
dec rcx
mov byte [rcx], 0
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x401fd6
mov rax, qword [0x00405698]
xor ebx, ebx
test rax, rax
jne 0x401fdd
cmp ebx, 0x46
jge 0x401fdd
test rax, rax
jne 0x401fcd
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x00405698]
inc ebx
test rax, rax
je 0x401fb1
jmp 0x401fdd
mov rax, qword [0x00405698]
mov rbx, qword [rsp + 0x228]
mov dword [0x004056a0], 1
jmp 0x401ff8
mov rax, qword [0x00405698]
test rax, rax
je 0x40201d
mov ecx, dword [0x004056a4]
bt ecx, esi
jae 0x40201d
mov ecx, dword [0x004055c0]
cmp dword [0x004056a8], ecx
jb 0x40201d
mov eax, 1
jmp 0x40201f
xor eax, eax
mov rsi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x200]
call fcn.00403080
add rsp, 0x218
ret