Function at 0x405c70
Capabilities:
Get common file path
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
mov eax, 0x2e44
call fcn.00404720
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x4d], ecx
mov dword [esp + 0x1d], eax
mov dword [esp + 0x51], ecx
mov dword [esp + 0x21], eax
mov dword [esp + 0x55], ecx
mov dword [esp + 0x25], eax
mov dword [esp + 0x59], ecx
mov dword [esp + 0x29], eax
mov word [esp + 0x5d], cx
mov word [esp + 0x2d], ax
mov byte [esp + 0x5f], cl
mov dword [esp + 0x39], ecx
mov byte [esp + 0x2f], al
mov dl, byte [0x40c428]
mov dword [esp + 0x61], eax
mov dword [esp + 0x3d], ecx
mov dword [esp + 0x65], eax
mov dword [esp + 0x41], ecx
mov dword [esp + 0x69], eax
mov dword [esp + 0x45], ecx
push ebx
push ebp
mov dword [esp + 0x75], eax
mov word [esp + 0x51], cx
push esi
push edi
mov word [esp + 0x81], ax
mov byte [esp + 0x5b], cl
mov ecx, 0x40
lea edi, [esp + 0x18d]
mov byte [esp + 0x83], al
mov byte [esp + 0x18c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x291]
mov byte [esp + 0x290], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x2c], dl
mov byte [esp + 0x5c], dl
mov byte [esp + 0x70], dl
mov byte [esp + 0x48], dl
mov byte [esp + 0x10], dl
xor edx, edx
stosb byte es:[edi], al
mov eax, dword [esp + 0x2e68]
xor esi, esi
mov word [esp + 0x11], dx
cmp eax, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x44], 4
mov byte [esp + 0x13], dl
mov dword [esp + 0x24], esi
mov byte [esp + 0x16], dl
je 0x405d66
mov dword [eax], esi
mov ebp, dword [esp + 0x2e58]
cmp ebp, 2
jle 0x405d85
cmp ebp, 0xffffffff
jge 0x405d88
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2e44
ret
cmp ebp, 0xffffffff
je 0x405da3
push ebp
call fcn.00405370
add esp, 4
test al, al
jne 0x405ddc
cmp dword [esp + 0x2e64], esi
jmp 0x405f0e
push esi
call fcn.00405370
push 1
mov bl, al
call fcn.00405370
push 2
mov byte [esp + 0x21], al
call fcn.00405370
add esp, 0xc
test bl, bl
jne 0x405ddc
mov cl, byte [esp + 0x15]
test cl, cl
jne 0x405ddc
test al, al
jne 0x405ddc
cmp dword [esp + 0x2e64], esi
jmp 0x405f0e
cmp dword [0x40c444], esi
je 0x405e32
cmp ebp, 0xffffffff
jne 0x405e32
cmp dword [0x40c178], 1
jne 0x405e25
cmp dword [esp + 0x2e60], esi
je 0x405e25
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x405e25
push str.EvaluationMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405e1e
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2e44
ret
cmp ebp, 2
je 0x405e42
cmp ebp, 0xffffffff
jne 0x406000
xor esi, esi
mov al, byte [0x40c428]
mov ecx, 0x40
mov byte [esp + 0x88], al
xor eax, eax
lea edi, [esp + 0x89]
push 2
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], 1
stosb byte es:[edi], al
mov dword [esp + 0x44], 0x104
call fcn.00405370
add esp, 4
test al, al
je 0x405efc
lea ecx, [esp + 0x28]
push ecx
push str.Software_farstone_virtualdrive0100
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x405ea5
cmp dword [esp + 0x2e64], esi
jmp 0x405f0e
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x40]
lea eax, [esp + 0x88]
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push str.ServerPath
push edx
call esi
lea eax, [esp + 0x40]
lea ecx, [esp + 0x88]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.ServerPath
push eax
call esi
mov ecx, dword [esp + 0x28]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x405f25
cmp ebp, 2
jne 0x406000
mov eax, dword [esp + 0x2e64]
test eax, eax
je 0x405f15
call fcn.00405580
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x2e44
ret
mov edi, str.setup.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x88]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x394]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x8c]
push ecx
call fcn.004069a0
add esp, 8
test eax, eax
je 0x405f9b
cmp ebp, 2
jne 0x406000
mov eax, dword [esp + 0x2e64]
test eax, eax
je 0x405f8b
call fcn.00405580
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 0x2e44
ret
mov eax, dword [esp + 0x5ac]
test eax, eax
jne 0x405ff7
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x406664
push 0
lea edx, [esp + 0x28]
push 1
push edx
call fcn.00408330
add esp, 0xc
cmp eax, 0x17
je 0x405fdb
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x406664
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
cmp eax, 1
jne 0x406000
mov byte [esp + 0x16], al
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x406072
cmp ebp, 0xffffffff
jne 0x406072
push 0
push 0
push 1
call fcn.00405710
add esp, 0xc
test eax, eax
je 0x406034
push 0
push 0
push 2
call fcn.00405710
add esp, 0xc
test eax, eax
jne 0x406072
push 0
lea eax, [esp + 0x28]
push 1
push eax
call fcn.00408330
add esp, 0xc
cmp eax, 0x17
je 0x40605a
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x406072
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x2e44
ret
mov ebx, dword [esp + 0x2e64]
lea ecx, [esp + 0x18c]
push 0x104
push ecx
mov dword [0x40c17c], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str._rtclcmg32.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40c1d8
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x190]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_fopen
mov esi, eax
add esp, 8
test esi, esi
jne 0x4060e5
test ebx, ebx
jmp 0x4065a0
push 2
push 0xfffffdfd
push esi
call sub.MSVCRT.dll_fseek
mov edi, str.g7iwmlp__625___
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2a4]
push 1
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x1c
mov edi, str.g7iwmlp__625___
lea eax, [esp + 0x290]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x406145
test cl, cl
je 0x406141
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x406145
add eax, 2
add edi, 2
test cl, cl
jne 0x406121
xor eax, eax
jmp 0x40614a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x406155
test ebx, ebx
jmp 0x4065a0
cmp ebp, 0xffffffff
je 0x4061df
mov eax, ebp
sub eax, 0
je 0x40617d
dec eax
je 0x406174
dec eax
jne 0x40618a
push 0
push 0xdc
jmp 0x406181
push 0
push 0xaf
jmp 0x406181
push 0
push 0x65
push esi
call sub.MSVCRT.dll_fseek
add esp, 0xc
push esi
push 0x14
lea eax, [esp + 0x34]
push 1
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, 0x14
je 0x4061b1
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x4065a0
movzx cx, byte [esp + 0x3c]
movzx dx, byte [esp + 0x3d]
shl ecx, 8
add ecx, edx
push ecx
call fcn.00406930
push 0
push 0x7b8
call fcn.00406840
push 0xf
lea eax, [esp + 0x3c]
jmp 0x406312
push 0
push 0x65
push esi
call sub.MSVCRT.dll_fseek
push esi
push 0x14
lea ecx, [esp + 0x70]
push 1
push ecx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp eax, 0x14
je 0x406210
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x4065a0
movzx dx, byte [esp + 0x6c]
movzx ax, byte [esp + 0x6d]
shl edx, 8
add edx, eax
push edx
call fcn.00406930
push 0
push 0x7b8
call fcn.00406840
lea ecx, [esp + 0x68]
push 0xf
push ecx
call fcn.00406940
call fcn.00406920
push 0
push 0xaf
push esi
call sub.MSVCRT.dll_fseek
push esi
push 0x14
lea edx, [esp + 0x98]
push 1
push edx
call sub.MSVCRT.dll_fread
add esp, 0x30
cmp eax, 0x14
je 0x40627b
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x4065a0
movzx ax, byte [esp + 0x80]
movzx cx, byte [esp + 0x81]
shl eax, 8
add eax, ecx
push eax
call fcn.00406930
push 0
push 0x7b8
call fcn.00406840
lea edx, [esp + 0x7c]
push 0xf
push edx
call fcn.00406940
call fcn.00406920
push 0
push 0xdc
push esi
call sub.MSVCRT.dll_fseek
push esi
push 0x14
lea eax, [esp + 0x70]
push 1
push eax
call sub.MSVCRT.dll_fread
add esp, 0x30
cmp eax, 0x14
je 0x4062e9
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
test ebx, ebx
jmp 0x4065a0
movzx cx, byte [esp + 0x58]
movzx dx, byte [esp + 0x59]
shl ecx, 8
add ecx, edx
push ecx
call fcn.00406930
push 0
push 0x7b8
call fcn.00406840
push 0xf
lea eax, [esp + 0x58]
push eax
call fcn.00406940
add esp, 0x14
call fcn.00406920
push esi
call sub.MSVCRT.dll_fclose
add esp, 4
cmp ebp, 0xffffffff
je 0x40634a
lea ecx, [esp + 0x2c]
push ecx
call fcn.004055c0
add esp, 4
test al, al
jne 0x4063f4
test ebx, ebx
jmp 0x4065a0
push 0
call fcn.00405370
push 1
mov byte [esp + 0x1d], al
call fcn.00405370
push 2
mov bl, al
call fcn.00405370
mov byte [esp + 0x23], al
mov al, byte [esp + 0x21]
add esp, 0xc
test al, al
je 0x406392
test bl, bl
je 0x40638c
lea edx, [esp + 0x70]
lea eax, [esp + 0x5c]
push edx
push eax
call fcn.00405630
add esp, 8
jmp 0x40639e
lea eax, [esp + 0x5c]
jmp 0x40639e
neg bl
sbb ebx, ebx
lea ecx, [esp + 0x70]
and ebx, ecx
mov eax, ebx
mov cl, byte [esp + 0x17]
test cl, cl
je 0x4063d3
test eax, eax
je 0x4063ba
lea edx, [esp + 0x48]
push edx
push eax
call fcn.00405630
add esp, 8
jmp 0x4063d3
lea eax, [esp + 0x48]
push eax
call fcn.004055c0
add esp, 4
test al, al
je 0x406597
lea eax, [esp + 0x48]
test eax, eax
je 0x406597
mov esi, eax
lea edx, [esp + 0x2c]
xor ecx, ecx
sub esi, edx
lea eax, [esp + ecx + 0x2c]
inc ecx
cmp ecx, 0x14
mov dl, byte [esi + eax]
mov byte [eax], dl
jl 0x4063e5
mov al, byte [esp + 0x16]
test al, al
je 0x406403
mov byte [esp + 0x2d], 1
jmp 0x406434
mov al, byte [esp + 0x2d]
test al, al
jne 0x40642c
pop edi
pop esi
pop ebp
mov dword [0x40c444], 1
mov dword [0x40c178], 0
xor eax, eax
pop ebx
add esp, 0x2e44
ret
cmp al, 1
jne 0x406597
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
and edi, 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406546
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x48]
push edx
push eax
push 0
push str.ritcuck
push ecx
call esi
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push eax
push ecx
push 0
push str.ritcuck
push edx
call esi
test eax, eax
jne 0x40653b
movzx ax, byte [esp + 0x12]
movzx cx, byte [esp + 0x13]
shl eax, 8
add eax, ecx
push eax
call fcn.00406930
push 0
push 0x7b8
call fcn.00406840
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00406940
add esp, 0x14
call fcn.00406920
mov cl, byte [esp + 0x10]
test cl, cl
je 0x4064fe
mov eax, edi
sub eax, 0
je 0x4064f9
dec eax
je 0x4064f4
dec eax
jne 0x40653b
test cl, 4
jmp 0x4064fc
test cl, 2
jmp 0x4064fc
test cl, 1
je 0x40653b
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x4067a3
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4067a3
push str.MaturityMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40679c
jmp 0x40679a
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x32]
mov ecx, dword [esp + 0x33]
mov edx, dword [esp + 0x34]
and esi, 0xff
mov eax, dword [esp + 0x35]
and ecx, 0xff
shl esi, 8
mov ebx, dword [esp + 0x2c]
add esi, ecx
mov cl, byte [esp + 0x3a]
and edx, 0xff
shl esi, 8
add esi, edx
and eax, 0xff
shl esi, 8
add esi, eax
and ebx, 0xff
cmp edi, 0xffffffff
mov byte [esp + 0x1c], cl
je 0x4065b7
cmp ebx, edi
je 0x4065b7
mov eax, dword [esp + 0x2e64]
test eax, eax
je 0x4065a7
call fcn.00405580
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x2e44
ret
lea edx, [esp + 0x84]
push edx
call sub.MSVCRT.dll_time
mov ecx, dword [esp + 0x88]
mov edi, dword [esp + 0x2e6c]
add esp, 4
sub ecx, esi
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x4065fd
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, esi
and eax, 0xff
sub eax, edx
mov dword [edi], eax
test ecx, ecx
jl 0x406671
mov eax, 0xc22e4507
and esi, 0xff
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edx, esi
jge 0x406671
mov eax, dword [esp + 0x2e60]
mov edi, 1
test eax, eax
mov dword [0x40c444], edi
je 0x40665e
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40665e
push str.EvaluationMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406657
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x40c178], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2e44
ret
lea edx, [esp + 0x18]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40676e
mov eax, ebx
mov dword [esp + 0x20], 4
sub eax, 0
je 0x4066b3
dec eax
je 0x4066ab
dec eax
jne 0x4066bd
mov al, byte [esp + 0x10]
or al, 4
jmp 0x4066b9
mov al, byte [esp + 0x10]
or al, 2
jmp 0x4066b9
mov al, byte [esp + 0x10]
or al, 1
mov byte [esp + 0x10], al
push 0
call sub.MSVCRT.dll_time
push eax
call sub.MSVCRT.dll_srand
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x4066dd
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x19], al
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x4066f4
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x1a], al
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x40670b
dec eax
or eax, 0xffffff00
inc eax
movzx cx, byte [esp + 0x1a]
xor dx, dx
mov byte [esp + 0x1b], al
shl ecx, 8
mov dl, al
add ecx, edx
push ecx
call fcn.00406930
push 1
push 0x7b8
call fcn.00406840
lea eax, [esp + 0x24]
push 1
push eax
call fcn.00406940
add esp, 0x1c
call fcn.00406920
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push 4
push 0
push str.ritcuck
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2e60]
test eax, eax
je 0x4067a3
push str.Chkmes.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4067a3
push str.MaturityMessage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40679c
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2e44
ret