Function at 0x405a20
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x240
mov esi, eax
mov ax, word [0x41c260]
mov word [ebp - 0x22e], ax
lea eax, [ebp - 0x22c]
push 0x210
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], 0x212
lea eax, [ebp - 0x10]
push eax
push str.SoftwareSimonTathamPuTTY
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
pop edx
test eax, eax
je 0x405c16
lea ebx, [ebp - 0x22e]
lea edi, [ebp - 0x1c]
sub esp, 0xc
push str.SHELL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
mov dword [0x421020], eax
test eax, eax
je 0x405aaa
push ecx
push ecx
push str.SHGetFolderPathA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x421030], eax
pop eax
pop edx
mov eax, dword [0x421030]
test eax, eax
je 0x405b60
sub esp, 0xc
push ebx
push 0
push 0
push 0x1c
push 0
call eax
add esp, 0xc
test eax, eax
js 0x405b10
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ecx, edi
lea eax, [ebx + eax]
mov edx, esi
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405990
test eax, eax
je 0x405b10
mov edx, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push ebx
push 0
push 0
push 0x1a
push 0
call dword [0x421030]
add esp, 0xc
test eax, eax
js 0x405b60
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ecx, edi
lea eax, [ebx + eax]
mov edx, esi
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405990
test eax, eax
jne 0x405b01
nop
push eax
push 0x212
push ebx
push str.HOMEDRIVE
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edx, 0x212
sub edx, eax
lea eax, [ebx + eax]
push edx
push eax
push str.HOMEPATH
call sub.KERNEL32.dll_GetEnvironmentVariableA
pop ecx
test eax, eax
je 0x405bc5
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ecx, edi
lea eax, [ebx + eax]
mov edx, esi
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405990
test eax, eax
jne 0x405b01
push edx
push edx
push 0x212
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
push eax
push ebx
call sub.msvcrt.dll_strlen
add esp, 0x10
mov edx, esi
mov ecx, edi
lea eax, [ebx + eax]
mov dword [eax], 0x5455505c
mov dword [eax + 4], 0x522e5954
mov word [eax + 8], 0x444e
mov byte [eax + 0xa], 0
mov eax, ebx
call fcn.00405990
or edx, 0xffffffff
test eax, eax
jne 0x405b01
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
lea eax, [ebp - 0x18]
lea ebx, [ebp - 0x22e]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
push 0
push str.RandSeedFile
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
test eax, eax
pop ecx
je 0x405c80
mov byte [ebp - 0x22e], 0
sub esp, 0xc
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.DLL_RegCloseKey
lea edi, [ebp - 0x1c]
add esp, 0xc
cmp byte [ebp - 0x22e], 0
je 0x405a7d
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00405990
test eax, eax
je 0x405a7d
jmp 0x405b01
cmp dword [ebp - 0x14], 1
jne 0x405c3d
jmp 0x405c44