Function at 0x401000
Capabilities:
Copy file
Create thread
Query or enumerate registry key
Read file on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5cc
push esi
push edi
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x34], 0
push 0
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x120], 0
mov ecx, 6
mov esi, str.xfgxstlxsys
lea edi, [ebp - 0x148]
rep movsd dword es:[edi], dword [esi]
push 0
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x120], 0x1000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x118], eax
push str.edf:_vdx:_lckdDKSX
lea ecx, [ebp - 0x78]
push ecx
call fcn.00405a20
add esp, 8
mov dword [ebp - 0x80], 0x1000
push 4
push 0x1000
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x4010f3
mov dword [ebp - 0x16c], 1
jmp 0x401100
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x160], 0
je 0x40112f
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x170]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp dword [ebp - 0x16c], 0
je 0x401141
mov edx, 1
test edx, edx
je 0x40115f
lea eax, [ebp - 0x11c]
push eax
push 0x65
call fcn.004051c7
add esp, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x160], 0
cmp dword [ebp - 0x168], 0
jne 0x4011b8
mov ecx, dword [ebp - 0x118]
movsx edx, byte [ecx]
cmp edx, 0x45
je 0x4011b8
mov eax, dword [ebp - 0x118]
movsx ecx, byte [eax + 1]
cmp ecx, 0x46
je 0x4011b8
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x174], edx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x164], 0
jbe 0x401204
mov ecx, dword [0x40e038]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x178]
mov dword [edx + 0xf4], eax
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x164], 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x170]
mov dword [ebp - 0x168], eax
push 0x24
push 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.004059c0
add esp, 0xc
mov edx, dword [str.DoftLare]
mov dword [ebp - 0x130], edx
mov eax, dword [0x40e07c]
mov dword [ebp - 0x12c], eax
mov cl, byte [0x40e080]
mov byte [ebp - 0x128], cl
cmp dword [ebp - 0x84], 1
je 0x40124d
mov edx, 1
test edx, edx
je 0x401623
mov dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0xf8], 2
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x17c], 0xfffff
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 0x1a4], 0
jmp 0x4012a0
mov edx, dword [ebp - 0x1a4]
add edx, 1
mov dword [ebp - 0x1a4], edx
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x17c]
jae 0x4012bf
mov ecx, dword [ebp - 0x1a0]
add ecx, 1
mov dword [ebp - 0x1a0], ecx
jmp 0x401291
mov byte [ebp - 0x19c], 0
lea edx, [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
cmp dword [ebp - 0x1a0], 0
jne 0x4012e9
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4012fe
mov dword [ebp - 0x180], 1
mov ecx, dword [ebp - 0x17c]
shl ecx, 1
cmp ecx, dword [ebp - 0x1a0]
jb 0x4015b5
cmp dword [ebp - 0x180], 0
je 0x4015b5
mov byte [ebp - 0x130], 0x53
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
je 0x40138b
mov dword [ebp - 0x1ac], str.Quit
cmp dword [ebp - 0x1a0], 0
jne 0x401368
push 0
push 0
mov edx, dword [ebp - 0x1ac]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x154], eax
push 0xffffffffffffffff
push 0
push 3
push 0
push 0xfffffffffffffff8
push 0xfffffffffffffffc
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffff
je 0x4013cc
mov dword [ebp - 0x1b0], 0
mov ecx, dword [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea edx, [ebp - 0x1b4]
push edx
mov eax, dword [ebp - 0x1b0]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x40158f
mov dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x11c]
jne 0x40142e
mov ecx, dword [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 0x154]
add eax, 2
push eax
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
jmp 0x40145f
lea edx, [ebp - 0x1bc]
push edx
push 0x10
push 0
lea eax, [ebp - 0x130]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x401457
mov byte [ebp - 0x12c], 0x77
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x40e6dc]
mov dword [ebp - 0x1b8], ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x1b8]
mov dword [edx + 0x1d8], eax
lea ecx, [ebp - 0x130]
test ecx, ecx
jne 0x401491
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
lea edx, [ebp - 0x1bc]
push edx
push 0x10
push 0
lea eax, [ebp - 0x130]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x1e0], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x1e0], 0
jne 0x40157c
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x5c8], 0x400
mov eax, dword [ebp - 0x154]
push eax
push 0x48
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp eax, 0x57
jne 0x40157c
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x5c8]
push edx
lea eax, [ebp - 0x5c4]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 5
jne 0x40157c
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x5c4]
push eax
push 0
call fcn.00401ad8
add esp, 0xc
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x170]
mov dword [0x40e520], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x170], 0
jle 0x40157c
mov dword [ebp - 0x164], 1
cmp dword [ebp - 0x1bc], 0
jne 0x40158f
mov dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x164], 1
jae 0x4015ab
mov dword [ebp - 0x2c], 0xff1a
mov dword [ebp - 0x11c], 0xfaf0
jmp 0x4015b3
mov eax, dword [ebp - 0x2c]
jmp 0x40164c
jmp 0x401623
push 0
push 0
push 0
push 0
push 1
push 0x1f03ff
lea ecx, [ebp - 0x78]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x401623
push 0
push 0
push 0
push 0
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x401623
push 4
push 0x1000
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x40161c
push 0
push 0
push 0
push 0x86598
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0xf8], 0
je 0x40164a
cmp dword [ebp - 0x164], 0
jbe 0x40164a
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x128], 0
mov eax, dword [ebp - 0x2c]
jmp 0x40164c
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret