Function at 0x405198
Capabilities:
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41bdcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x188c
call fcn.0040f040
push ebx
push esi
mov esi, 0x41f508
mov eax, esi
push edi
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4051cd
sub eax, edx
cmp eax, 0x117a58
jne 0x4051f5
call fcn.00406a40
lea eax, [esp + 0x50]
push eax
call fcn.00405792
lea ecx, [esp + 0x50]
call fcn.004057cf
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4051fa
sub eax, edx
cmp eax, 0x93f
jne 0x405265
cmp dword [0x3308094], 0xa95
jne 0x40521e
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
lea eax, [esp + 0x18]
call fcn.00405485
push 0x38
push 0x403320
push 0x403330
push esi
mov dword [esp + 0x18b4], ebx
call fcn.00406f11
push ebx
call fcn.0040719d
add esp, 0x14
push ebx
push ebx
push ebx
call fcn.00407063
or dword [esp + 0x18b0], 0xffffffff
add esp, 0xc
lea edi, [esp + 0x18]
call fcn.004054b2
xor edi, edi
cmp edi, 0x656671
jne 0x405279
call fcn.00405158
mov dword [0x3299f30], eax
inc edi
cmp edi, 0x66d056
jl 0x405267
mov eax, dword [0x41e5f4]
mov dword [0x3308094], eax
call fcn.00405164
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, 0x9536112
jg 0x4052b3
inc edi
mov eax, edi
cdq
cmp edx, 1
jl 0x405293
jg 0x4052b3
cmp eax, 0x54ca73e6
jb 0x405293
push dword [0x3308094]
mov eax, dword [0x41e5e8]
push ebx
mov dword [0x3308098], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edi, edi
mov dword [0x3276fe4], eax
cmp dword [0x3308094], ebx
jbe 0x405313
mov eax, edi
call fcn.00405141
cmp dword [0x3308094], 0xd8c
jne 0x40530a
push ebx
lea eax, [esp + 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push ebx
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc edi
cmp edi, dword [0x3308094]
jb 0x4052d9
xor edi, edi
cmp edi, 0x407a79
jne 0x405349
call fcn.0040517a
push esi
push dword [0x3299f30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push dword [0x3308094]
mov dword [0x43ba34], eax
push dword [0x3276fe4]
call eax
inc edi
cmp edi, 0x28ae5d2
jl 0x405315
call fcn.004050c8
xor esi, esi
mov eax, dword [0x3308094]
add eax, esi
cmp eax, 0x5e
jne 0x4053a6
push ebx
lea eax, [esp + 0x89c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push ebx
call dword [sym.imp.KERNEL32.dll_HeapLock]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
push ebx
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
inc esi
cmp esi, 0x356d83
jl 0x405359
xor esi, esi
cmp dword [0x3308094], 0x23
jne 0x405420
xor eax, eax
mov dword [esp + 0x18], ebx
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x13]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
lea eax, [esp + 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
cmp esi, 0xc
jne 0x40542a
call fcn.0040516f
cmp dword [0x3308094], 0x735
jne 0x405450
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push ebx
lea eax, [esp + 0x109c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FoldStringW]
inc esi
cmp esi, 0x7b
jl 0x4053b1
mov eax, dword [0x3276fe4]
mov dword [0x3299f34], eax
call eax
mov ecx, dword [esp + 0x189c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret