Function at 0x405770
Capabilities:
Check if file exists
Get file attributes
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
push 9
push 6
pop ebx
mov edi, str._ni_d__j_d_n
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
mov esi, str._nx_d__y_d_n
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
lea eax, [esp + 0x24]
push str.SYSTEMCurrentControlSetServices_
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
lea eax, [esp + 0x24]
push str.Uabcdef_Hijklm
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
lea eax, [esp + 0x1c]
xor ebp, ebp
push eax
push 0xf003f
lea eax, [esp + 0x2c]
push ebp
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405972
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
push 9
push ebx
push edi
mov dword [esp + 0x44], 0x104
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
push 0x104
lea eax, [esp + 0x58]
push ebp
push eax
call sub.MSVCRT.dll_memset
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
add esp, 0x48
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push ebp
push str.ImagePath
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40588d
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405972
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405972
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
lea eax, [esp + 0x24]
push ebp
push ebp
push 3
push ebp
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push 9
push ebx
push edi
mov dword [esp + 0x1c], eax
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
cmp dword [esp + 0x10], 0xffffffff
je 0x405972
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
push ebp
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x405968
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x405968
lea ecx, [esp + 0x14]
push ebp
push ecx
push dword [esp + 0x1c]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x405979
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x4059fb
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 9
push ebx
push edi
call sub.MSVCRT.dll_printf
push 0x12
push ebx
push esi
call sub.MSVCRT.dll_printf
add esp, 0x18
push ebp
push dword [esp + 0x130]
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceA]
mov esi, eax
cmp esi, ebp
je 0x4059ef
push dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.DLL_UpdateResourceA]
push dword [esp + 0x1c]
push ebp
push 0x66
push 0xa
push esi
call edi
mov ebx, eax
cmp ebx, ebp
je 0x4059e1
mov ebx, str.Uabcdef_Hijklm
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
push eax
push ebx
push ebp
push 0x65
push 0xa
push esi
call edi
mov ebx, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_EndUpdateResourceA]
test eax, eax
je 0x4059ef
mov ebp, ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret