Function at 0x4067f0
Capabilities:
Create process on windows
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x407f24
push eax
mov dword fs:[0], esp
sub esp, 0xd48
push ebx
push ebp
push esi
push edi
call fcn.00405f20
test eax, eax
je 0x4071bb
xor ebp, ebp
push ebp
push str.ReceivemsgForm8A79C0AE_7913_4243_9BB0_27FF30CDFC03
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4071bb
lea eax, [esp + 0x2c]
push eax
push str.SOFTWAREBalaMusicNetworkBalaLive
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4068fb
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x394]
push ecx
push edx
push ebp
push ebp
push str.Path
push eax
mov dword [esp + 0x2c], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x4068af
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + ecx + 0x392]
lea eax, [esp + ecx + 0x394]
mov cl, 0x5c
cmp dl, cl
je 0x40689d
mov byte [eax - 1], cl
mov byte [eax], 0
lea edx, [esp + 0x394]
mov ecx, 0x40a724
push edx
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x4068fb
push str.binBalaLive.exe
lea ecx, [esp + 0x18]
push 0x40a724
push ecx
call sub.MFC42.DLL_operator
mov edx, dword [eax]
push 5
push 0x40a4b0
push 0x40a4b0
push edx
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
jmp 0x4071bb
call fcn.00404f90
lea eax, [esp + 0x298]
push eax
push 0xfa
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea ecx, [esp + 0x298]
push ecx
mov ecx, 0x40a724
call sub.MFC42.DLL_CString::operator_1
push 0x40a72c
lea edx, [esp + 0x18]
push 0x40a724
push edx
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x40a71c]
push 0x40a4b0
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x4069f4
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3f]
mov eax, dword [esp + 0x3e]
and ecx, 0xff
push ecx
mov ecx, dword [esp + 0x41]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x44]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x47]
push ecx
mov ecx, dword [esp + 0x4a]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x4d]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x4e]
push ecx
mov ecx, dword [esp + 0x50]
and edx, 0xff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x50]
and ecx, 0xffff
push eax
push ecx
push edx
push str._08X__08X__08X__02X_02X_02X_02X_02X_02X_02X_02X
push 0x40a71c
call sub.MFC42.DLL_CString::Format
add esp, 0x34
lea ecx, [esp + 0x58]
call fcn.00401050
push ebp
push ebp
push 1
lea ecx, [esp + 0x64]
mov dword [esp + 0xd6c], ebp
call fcn.004036f0
xor edi, edi
push 0x40a728
lea eax, [esp + 0x28]
push 0x40a724
push eax
call sub.MFC42.DLL_operator_1
mov esi, dword [eax]
push 0x40a728
lea ecx, [esp + 0x18]
push 0x40a730
push ecx
mov byte [esp + 0xd6c], 1
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push ebp
push esi
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xd6c], 2
call fcn.00401490
test eax, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xd60], 1
setne bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0xd60], 0
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x406b12
push 0x40a728
lea edx, [esp + 0x14]
push 0x40a724
push edx
call sub.MFC42.DLL_operator_1
mov esi, dword [eax]
push 0x40a728
lea eax, [esp + 0x20]
push 0x40a734
push eax
mov byte [esp + 0xd6c], 3
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push ebp
push esi
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xd6c], 4
call fcn.00401490
test eax, eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd60], 3
setne bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], 0
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x406b12
push 0x1d4c0
inc edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp edi, 5
jl 0x406a13
lea ecx, [esp + 0x48]
call fcn.0040723a
push 0x40a728
lea ecx, [esp + 0x14]
push 0x40a724
push ecx
mov byte [esp + 0xd6c], 5
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push ebp
push pe_nt_image_headers32
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0xd6c], 6
call sub.MFC42.DLL_CFile::Open
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], 5
call sub.MFC42.DLL_CString::CString
mov ecx, 0x1f4
xor eax, eax
lea edi, [esp + 0x588]
lea edx, [esp + 0x588]
rep stosd dword es:[edi], eax
push 0x7d0
push edx
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CFile::Read
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CFile::Close
lea eax, [esp + 0x588]
lea ecx, [esp + 0x20]
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x1f4
xor eax, eax
lea edi, [esp + 0x588]
push 0x7d0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58c]
mov byte [esp + 0xd64], 7
push ecx
push ebp
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x588]
mov ecx, 0x40a584
push edx
call sub.MFC42.DLL_CString::operator_1
push ebp
push 0x40a3fc
mov ecx, 0x40a584
call sub.MFC42.DLL_CString::Find_2
cmp eax, ebp
jl 0x406c48
inc eax
mov ecx, 0x40a584
push eax
push ebp
call sub.MFC42.DLL_CString::Delete
push ebp
push 0x40a3f8
mov ecx, 0x40a584
call sub.MFC42.DLL_CString::Find_2
cmp eax, ebp
jl 0x406c48
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, 0x40a584
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, 0x40a584
mov byte [esp + 0xd64], 8
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], 7
call sub.MFC42.DLL_CString::CString
jmp 0x406c57
push str.Bala
mov ecx, 0x40a584
call sub.MFC42.DLL_CString::operator_1
push str.Kuro22
mov ecx, 0x40a584
call sub.MFC42.DLL_CString::operator_1
push sub.MFC42.DLL_CString::CString
push fcn.004071f2
push 0x64
lea ecx, [esp + 0x114]
push 4
push ecx
call fcn.00407460
mov bl, 9
push ebp
push 0x40a3e4
lea ecx, [esp + 0x28]
mov byte [esp + 0xd68], bl
mov dword [0x40a588], ebp
call sub.MFC42.DLL_CString::Find_2
mov esi, eax
cmp esi, ebp
jl 0x406d10
lea edx, [esi - 1]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::Left
mov ecx, dword [0x40a588]
push eax
mov byte [esp + 0xd64], 0xa
lea ecx, [esp + ecx*4 + 0x10c]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
inc esi
lea ecx, [esp + 0x20]
push esi
push ebp
call sub.MFC42.DLL_CString::Delete
push ebp
push 0x40a3e4
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::Find_2
mov ecx, dword [0x40a588]
mov esi, eax
inc ecx
cmp esi, ebp
mov dword [0x40a588], ecx
jge 0x406ca5
mov eax, dword [0x40a588]
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + eax*4 + 0x10c]
call sub.MFC42.DLL_CString::operator
mov edx, dword [0x40a588]
push 0x40a4b0
inc edx
mov ecx, 0x40a720
mov dword [0x40a588], edx
mov dword [esp + 0x18], ebp
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [0x40a588]
test eax, eax
jle 0x406db3
lea edi, [esp + 0x108]
push 0x40a72c
lea ecx, [esp + 0x14]
push edi
push ecx
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
lea ecx, [esp + 0x58]
push eax
mov byte [esp + 0xd64], 0xb
call fcn.00401a20
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
cmp ebp, esi
jge 0x406d9d
push edi
mov ecx, 0x40a720
mov ebp, esi
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x14]
mov ecx, dword [0x40a588]
inc eax
add edi, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x406d56
mov eax, dword [0x40a720]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x40a4b0
push eax
call esi
add esp, 8
test eax, eax
je 0x406f91
lea eax, [esp + 0x10]
push 1
push eax
mov ecx, 0x40a720
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x40a210
push eax
call esi
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne byte [esp + 0x1b]
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x1b]
test al, al
je 0x406e3e
push 0x40a210
lea ecx, [esp + 0x14]
push 0x40a720
push ecx
call sub.MFC42.DLL_operator
push eax
mov ecx, 0x40a720
mov byte [esp + 0xd64], 0xc
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
call fcn.00406750
cmp eax, 1
jge 0x406f18
push str.setuplog.php_step1word
lea edx, [esp + 0x18]
push 0x40a720
push edx
call sub.MFC42.DLL_operator
push 0x40a71c
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0xd68], 0xd
push eax
call sub.MFC42.DLL_operator_1
push str.co
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0xd6c], 0xe
call sub.MFC42.DLL_operator
push 0x40a584
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0xd6c], 0xf
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
lea ecx, [esp + 0x58]
push eax
mov byte [esp + 0xd64], 0x10
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], 0xf
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd60], 0xe
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0xd60], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x40a3bc
call sub.MFC42.DLL_CString::CString_1
call fcn.004066f0
add esp, 4
push 0x40a72c
lea eax, [esp + 0x20]
push 0x40a724
push eax
call sub.MFC42.DLL_operator_1
mov esi, dword [eax]
push 0x40a72c
lea ecx, [esp + 0x14]
push 0x40a720
push ecx
mov byte [esp + 0xd6c], 0x11
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push 0
push esi
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0xd6c], 0x12
call fcn.00401490
test eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], 0x11
setne byte [esp + 0x1b]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x1b]
test al, al
je 0x406faf
push sub.MFC42.DLL_CString::CString
push 0x64
lea edx, [esp + 0x110]
push 4
mov byte [esp + 0xd6c], 7
push edx
jmp 0x407180
call fcn.00406750
cmp eax, 2
jge 0x407089
push str.setuplog.php_step2word
lea eax, [esp + 0x18]
push 0x40a720
push eax
call sub.MFC42.DLL_operator
push 0x40a71c
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0xd6c], 0x13
call sub.MFC42.DLL_operator_1
push str.co
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0xd6c], 0x14
call sub.MFC42.DLL_operator
push 0x40a584
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0xd68], 0x15
push eax
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
lea ecx, [esp + 0x58]
push eax
mov byte [esp + 0xd64], 0x16
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0xd60], 0x15
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd60], 0x14
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0xd60], 0x13
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x40a2d0
call sub.MFC42.DLL_CString::CString_1
call fcn.004066f0
add esp, 4
push 0x40a39c
lea ecx, [esp + 0x2c]
push 0x40a720
push ecx
call sub.MFC42.DLL_operator
push 0x40a71c
lea edx, [esp + 0x48]
push eax
push edx
mov byte [esp + 0xd6c], 0x17
call sub.MFC42.DLL_operator_1
push 0x40a39c
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0xd68], 0x18
push eax
call sub.MFC42.DLL_operator
push 0x40a584
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0xd6c], 0x19
call sub.MFC42.DLL_operator_1
mov esi, dword [eax]
push 0x40a72c
lea edx, [esp + 0x14]
push 0x40a724
push edx
mov byte [esp + 0xd6c], 0x1a
call sub.MFC42.DLL_operator_1
mov eax, dword [eax]
push 5
push 0x40a4b0
push esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0xd60], 0x19
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0xd60], 0x18
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0xd60], 0x17
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0xd60], bl
call sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString
push 0x64
lea eax, [esp + 0x110]
push 4
mov byte [esp + 0xd6c], 7
push eax
call fcn.004074e2
lea ecx, [esp + 0x20]
mov byte [esp + 0xd60], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0xd60], 0
call sub.MFC42.DLL_CFile::CFile
lea ecx, [esp + 0x58]
mov dword [esp + 0xd60], 0xffffffff
call fcn.004012d0
mov ecx, dword [esp + 0xd58]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xd54
ret