Function at 0x402020
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x402029
mov eax, dword [ebp - 4]
add esp, 0xfffff9e8
push ebx
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
jmp 0x4024c7
xor edx, edx
mov byte [ebp - 0x200c], 0
xor eax, eax
mov cl, byte [ebx]
mov byte [ebp + eax - 0x100c], cl
xor ecx, ecx
mov cl, byte [ebp + eax - 0x100c]
cmp ecx, 0x3d
jne 0x402076
test edx, edx
jne 0x402076
lea edx, [ebp - 0x100c]
add edx, eax
xor ecx, ecx
mov cl, byte [ebp + eax - 0x100c]
cmp ecx, 0xd
je 0x402092
xor ecx, ecx
mov cl, byte [ebp + eax - 0x100c]
cmp ecx, 0xa
jne 0x40209a
mov byte [ebp + eax - 0x100c], 0
cmp byte [ebp + eax - 0x100c], 0
je 0x4020b0
inc ebx
inc eax
cmp eax, 0x1000
jl 0x402053
jmp 0x4020b0
inc ebx
xor eax, eax
mov al, byte [ebx]
cmp eax, 0xd
je 0x4020af
xor eax, eax
mov al, byte [ebx]
cmp eax, 0xa
je 0x4020af
test edx, edx
je 0x4020dc
mov byte [edx], 0
push 0x1000
lea ecx, [ebp - 0x200c]
push ecx
inc edx
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
cmp byte [ebp + 0x10], 0
je 0x402145
push 0x4060ae
lea eax, [ebp - 0x100c]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4024c7
lea edx, [ebp - 0x2110]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0x2110]
push ecx
call fcn.00401099
pop ecx
lea eax, [ebp - 0x200c]
push eax
lea edx, [ebp - 0x2110]
push edx
call fcn.00405cd0
add esp, 8
lea ecx, [ebp - 0x2110]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x4024c7
push 0x4060b5
lea eax, [ebp - 0x100c]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40216c
lea edx, [ebp - 0x200c]
push edx
call fcn.0040117a
pop ecx
jmp 0x4024c7
push 0x4060ba
lea ecx, [ebp - 0x100c]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x402195
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call sub.USER32.dll_SetWindowTextA
jmp 0x4024c7
push 0x4060c0
lea edx, [ebp - 0x100c]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4022d3
mov byte [ebp - 0x2214], 0
xor ecx, ecx
mov cl, byte [ebp - 0x200c]
cmp ecx, 0x2e
jne 0x4021ea
xor eax, eax
mov al, byte [ebp - 0x200b]
cmp eax, 0x5c
jne 0x4021ea
lea edx, [ebp - 0x200a]
push edx
lea ecx, [ebp - 0x2214]
push ecx
call fcn.00405c23
add esp, 8
jmp 0x4022bd
xor eax, eax
mov al, byte [ebp - 0x200c]
cmp eax, 0x5c
je 0x40220d
cmp byte [ebp - 0x200c], 0
je 0x402228
xor edx, edx
mov dl, byte [ebp - 0x200b]
cmp edx, 0x3a
jne 0x402228
lea ecx, [ebp - 0x200c]
push ecx
lea eax, [ebp - 0x2214]
push eax
call fcn.00405c23
add esp, 8
jmp 0x4022bd
lea edx, [ebp - 4]
push edx
push 1
push 0
push 0x4060c5
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402270
mov dword [ebp - 0xc], 0x104
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x2214]
push eax
lea edx, [ebp - 8]
push edx
push 0
push 0x4060ef
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [ebp - 0x2214], 0
je 0x4022a7
lea ecx, [ebp - 0x2214]
push ecx
call fcn.00405bc3
pop ecx
movzx eax, byte [ebp + eax - 0x2215]
cmp eax, 0x5c
je 0x4022a7
push 0x4060ff
lea edx, [ebp - 0x2214]
push edx
call fcn.00405cd0
add esp, 8
lea ecx, [ebp - 0x200c]
push ecx
lea eax, [ebp - 0x2214]
push eax
call fcn.00405cd0
add esp, 8
lea edx, [ebp - 0x2214]
push edx
push 0x65
push dword [ebp + 8]
call sub.USER32.dll_SetDlgItemTextA
jmp 0x4024c7
push 0x406101
lea ecx, [ebp - 0x100c]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x402303
xor eax, eax
mov al, byte [ebp - 0x200c]
cmp eax, 0x30
je 0x4024c7
mov esi, 1
jmp 0x4024c7
push 0x406108
lea eax, [ebp - 0x100c]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x402377
mov dl, byte [ebp - 0x200c]
sub dl, 1
jb 0x402349
sub dl, 0x2f
je 0x402335
dec dl
je 0x402349
dec dl
je 0x402360
jmp 0x4024c7
xor ecx, ecx
mov dword [0x406748], ecx
xor eax, eax
mov dword [0x40674c], eax
jmp 0x4024c7
xor edx, edx
mov dword [0x406748], edx
mov dword [0x40674c], 1
jmp 0x4024c7
mov dword [0x406748], 1
xor ecx, ecx
mov dword [0x40674c], ecx
jmp 0x4024c7
push 0x406112
lea eax, [ebp - 0x100c]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4023a5
lea edx, [ebp - 0x200c]
push edx
push 0x4070f0
call fcn.00405c23
add esp, 8
jmp 0x4024c7
push 0x406118
lea ecx, [ebp - 0x100c]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4024c7
lea eax, [ebp - 0x2318]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x2318]
push edx
call fcn.00401099
pop ecx
xor esi, esi
push esi
lea eax, [ebp - 0x2318]
push eax
push 0x406121
lea edx, [ebp - 0x241c]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x10
lea ecx, [ebp - 0x241c]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40240e
inc esi
jmp 0x4023de
lea eax, [ebp - 0x241c]
push eax
push 0x65
push dword [ebp + 8]
call sub.USER32.dll_SetDlgItemTextA
cmp byte [ebp - 0x200c], 0
je 0x4024ba
mov byte [ebp - 0x261c], 0
xor esi, esi
jmp 0x402468
xor eax, eax
mov al, byte [ebp + esi - 0x200c]
cmp eax, 0x40
jne 0x402467
lea edx, [ebp - 0x200b]
add edx, esi
push edx
lea ecx, [ebp - 0x261c]
push ecx
call fcn.00405c23
add esp, 8
mov byte [ebp + esi - 0x200c], 0
jmp 0x402472
inc esi
cmp byte [ebp + esi - 0x200c], 0
jne 0x402437
push 0x24
lea eax, [ebp - 0x261c]
push eax
lea edx, [ebp - 0x200c]
push edx
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
je 0x4024ba
cmp dword [0x406030], 0
jle 0x40249f
push ebx
call fcn.00405997
pop ecx
cmp dword [0x4072f8], 0
je 0x4024b3
push dword [0x4072f8]
call sub.GDI32.dll_DeleteObject
push 0
call sub.KERNEL32.DLL_ExitProcess
mov ecx, 1
mov dword [0x406028], ecx
mov esi, ecx
cmp byte [ebx], 0
jne 0x402048
test esi, esi
je 0x4024db
mov byte [0x406034], 1
xor eax, eax
mov dword [0x406008], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret