Function at 0x40e2a0
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x428
mov eax, dword [0x429008]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
push 0x208
lea eax, [esp + 0x1c]
mov edi, ecx
push 0
push eax
xor bl, bl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsWindows_Error_Reporting
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e394
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x224]
mov dword [esp + 0x18], 0x104
push eax
lea eax, [esp + 0x14]
push eax
push 0
push str.StorePath
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
jne 0x40e36b
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40e33b
cmp eax, 2
jne 0x40e36b
lea eax, [esp + 0x220]
push eax
push str.StorePath_registry_key_has_value:__ls
push 2
push 0x429048
call fcn.00404d90
add esp, 0x10
lea edx, [esp + 0x18]
lea ecx, [esp + 0x220]
call fcn.0040e130
mov bl, al
jmp 0x40e380
push ecx
push str.StorePath_registry_key_query_result:_failed._Status:__d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40e41b
jmp 0x40e3a9
push eax
push str.Failed_to_open_Windows_Error_Reporting_registry_key._Status:__d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
push 0x104
lea eax, [esp + 0x224]
push eax
push str._ProgramData_MicrosoftWindowsWERReportQueue
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x40e4ba
lea eax, [esp + 0x220]
push eax
push str.Expand_WER_environment_variable_successfully_to:__ls
push 2
push 0x429048
call fcn.00404d90
add esp, 0x10
lea edx, [esp + 0x18]
lea ecx, [esp + 0x220]
call fcn.0040e130
test al, al
je 0x40e4d5
push 0x104
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
test eax, eax
jne 0x40e4d5
mov bl, 1
push str.Temp
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
test eax, eax
je 0x40e441
push eax
xor bl, bl
push str.PathCchAppend_failed_to_append__Temp__to_path._hr:_0x_08X
jmp 0x40e4c6
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.shlwapi.dll_PathFileExistsW]
test eax, eax
je 0x40e4ac
lea esi, [esp + 0x18]
mov edx, 0x104
mov ecx, edi
sub esi, edi
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e47e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40e47e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e460
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
jne 0x40e4d5
xor al, al
mov word [edi], cx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00414600
add esp, 0x428
ret
lea ecx, [esp + 0x18]
xor bl, bl
push ecx
push str.Path_doesnt_exist:__ls
jmp 0x40e4c6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.Expand_WER_environment_varialbe_failed._GetLastError:__d
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
mov ecx, dword [esp + 0x42c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00414600
add esp, 0x428
ret