Function at 0x40c0e0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x464dae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4f8
mov eax, dword [0x477b14]
push ebx
mov dword [esp + 0x4f4], eax
mov eax, dword [0x477160]
push esi
lea ecx, [eax*4]
push edi
push ecx
call fcn.00445884
add esp, 4
mov dword [0x47c0f8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push str.Disable_Performance_Counters
push str.SYSTEMCurrentControlSetServicesTcpipPerformance
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
push edi
mov dword [0x4923c0], eax
call fcn.00421db0
mov eax, dword [0x4912c4]
add esp, 0x10
cmp eax, edi
je 0x40c29b
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
push edx
push 0x20019
push edi
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EB
push SysReAllocString
xor ebx, ebx
mov dword [esp + 0x24], edi
call esi
test eax, eax
jne 0x40c291
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EBInProcServer32
push SysReAllocString
call esi
test eax, eax
jne 0x40c291
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x2f4]
push eax
push edi
push edi
push 0x466680
push ecx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c27d
lea edx, [esp + 0x2f0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c27d
lea eax, [esp + 0x18]
push eax
push 0x20019
push edi
push str.CLSIDBC149E72_D422_4745_B674_01AB3DD160EBVersion
push SysReAllocString
mov dword [esp + 0x2c], edi
call esi
test eax, eax
jne 0x40c27d
mov word [esp + 0x20], di
mov ecx, 0x31
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
push 0x466680
push eax
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c269
lea ecx, [esp + 0x20]
push ecx
call fcn.00445aa5
fcomp qword [0x467218]
add esp, 4
fnstsw ax
test ah, 5
jp 0x40c26e
mov ebx, 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x40c282
mov ebx, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x40c29b
push 1
call fcn.00409990
add esp, 4
mov ebx, dword [0x47c100]
push 0x7f02
inc ebx
push edi
mov dword [0x47c100], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.00420790
mov esi, dword [ebp + 8]
push edi
push 0x477498
push esi
call fcn.0042efe0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [0x47c354], ecx
mov dword [0x47ac04], esi
call fcn.004095a0
cmp dword [0x47c350], edi
je 0x40c2fa
cmp dword [0x49222c], 0x1011
je 0x40c300
mov dword [0x47c51c], edi
push edi
push str.ProgMan
mov dword [0x47be64], 0xff00ff
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
push 5
push eax
call esi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push esi
mov dword [0x47be60], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ebx, ebx
push ebx
call esi
mov edi, 1
push edi
mov dword [0x49223c], eax
call esi
mov dword [0x492240], eax
call fcn.00401180
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [0x47abf8], eax
call fcn.0042eee0
push ebx
push 0x47a25c
push ebx
push 0x30
mov dword [0x477158], edi
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push ebx
push ebx
push ebx
push ebx
push 0x47a24c
call dword [sym.imp.USER32.dll_SetRect]
call fcn.00401390
cmp dword [0x47a958], ebx
mov dword [0x47c37c], ebx
je 0x40c3fb
push 0xf4
mov dword [0x47c37c], edi
call fcn.00444aad
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov dword [esp + 0x50c], ebx
je 0x40c3e2
push 0x1010
mov ecx, eax
call fcn.00401570
jmp 0x40c3e4
xor eax, eax
mov dword [0x47c364], eax
mov edx, dword [eax]
mov ecx, eax
mov dword [esp + 0x50c], 0xffffffff
call dword [edx + 0x28]
push 0x47b848
call fcn.00413b50
lea eax, [esp + 0xec]
push edi
push eax
call fcn.00410220
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
lea ecx, [esp + 0xe8]
push ecx
call esi
test eax, eax
jne 0x40c47e
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x47b848
lea edx, [esp + 0xec]
push str._spackage2.ini
push edx
call edi
add esp, 0xc
lea eax, [esp + 0xe8]
push eax
call esi
test eax, eax
jne 0x40c47e
push 0x47b848
lea ecx, [esp + 0xec]
push str._spackage.ini
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0xe8]
push edx
call esi
test eax, eax
je 0x40c5bb
call fcn.00413860
mov ecx, dword [0x47c0fc]
xor eax, eax
cmp ecx, ebx
jle 0x40c4aa
nop
mov ecx, dword [0x47c0f8]
mov edx, dword [ecx + eax*4]
mov dword [edx + 0x204], ebx
mov ecx, dword [0x47c0fc]
inc eax
cmp eax, ecx
jl 0x40c490
push 1
call fcn.00435e90
mov esi, dword [0x47c51c]
mov ecx, dword [0x477a94]
xor eax, eax
add esp, 4
cmp esi, ebx
setne al
xor esi, esi
dec eax
and eax, ecx
mov dword [0x477ab8], eax
cmp dword [0x47c0fc], ebx
jle 0x40c4f5
lea esp, [esp]
push 1
push esi
call fcn.0040bde0
mov eax, dword [0x47c0fc]
add esp, 8
inc esi
cmp esi, eax
jl 0x40c4e0
push ebx
call fcn.00435e90
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00418250
push 2
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00418250
mov eax, dword [0x477158]
add esp, 0x1c
cmp eax, ebx
jne 0x40c52d
push 0x47a26c
push 0x47a25c
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [0x47c354]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x12c
push ebx
push ecx
call esi
mov edx, dword [0x47c354]
push ebx
push 0xc8
push 0x1850
push edx
mov dword [0x47be6c], eax
call esi
cmp dword [0x47c51c], ebx
je 0x40c576
mov eax, dword [0x47c354]
push ebx
push 0x14
push 0x1544
push eax
call esi
jmp 0x40c57b
call fcn.00423750
cmp dword [0x47abfc], ebx
je 0x40c59d
test byte [0x49222c], 0x10
je 0x40c59d
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x47abfc]
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
dec dword [0x47c100]
mov eax, 1
mov ecx, dword [esp + 0x504]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4fc]
call fcn.00444c27
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret