Function at 0x4013e0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3b8
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
xor ecx, ecx
test eax, eax
sete cl
cmp eax, 1
mov edi, ecx
jne 0x401442
cmp esi, 4
jne 0x401442
test ebx, ebx
jne 0x401442
mov edx, 1
xor ecx, ecx
cmp eax, 2
jne 0x401455
cmp esi, 4
jne 0x401455
test ebx, ebx
jne 0x401455
mov eax, 1
jmp 0x401457
xor edx, edx
cmp eax, 2
jne 0x40142b
cmp esi, 3
ja 0x40142b
mov ecx, 1
jmp 0x401432
xor eax, eax
test edi, edi
jne 0x401676
test edx, edx
jne 0x401676
test ecx, ecx
jne 0x401676
test eax, eax
jne 0x401676
push 0x104
lea edx, [esp + 0x1c4]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x1c0]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401492
mov eax, dword [0x52a9b4]
mov ecx, dword [0x52a9b8]
mov dx, word [0x52a9bc]
mov dword [edi], eax
lea eax, [esp + 0x1c0]
mov dword [edi + 4], ecx
push eax
mov word [edi + 8], dx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4014dc
push eax
push 0x10
push 0x66
call fcn.005084e6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b5610
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4014fd
push 0xffffffffffffffff
push 0x10
push 0x67
call fcn.005084e6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.user32.dll_GetDC]
mov edi, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov esi, eax
push 0xc
push esi
call edi
push 0x58
push esi
mov ebp, eax
call edi
mov edi, dword [sym.imp.user32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x18], eax
call edi
push 1
mov ebx, eax
call edi
push esi
push 0
mov edi, eax
call dword [sym.imp.user32.dll_ReleaseDC]
cmp ebp, 0x10
jge 0x401552
push 0xffffffffffffffff
push 0x10
push 0x69
call fcn.005084e6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x400
jl 0x401661
cmp edi, 0x300
jl 0x401661
cmp dword [esp + 0x14], 0x60
jle 0x40158e
cmp ebx, 0x400
jne 0x40158e
push 0xffffffffffffffff
push 0x10
push 0x6b
call fcn.005084e6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esp + 0xb8], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0xb9]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
stosw word es:[edi], ax
push 0x52a994
push 0x80000002
stosb byte es:[edi], al
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40160f
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x52a988
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
cmp dword [esp + 0x1c], 1
je 0x401604
mov byte [esp + 0xb8], 0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edi, 0x52a984
lea esi, [esp + 0xb8]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40164c
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40164c
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0x10
push 0x6c
call fcn.005084e6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0x10
push 0x6a
call fcn.005084e6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0x10
push 0x65
call fcn.005084e6
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret