Function at 0x4052aa
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x412004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x1fe
mov dword [ebp - 0x428], eax
mov ebx, ecx
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x208]
push 0
push eax
mov dword [ebp - 0x424], edx
call sub.msvcrt.dll_memset
or dword [ebp - 0x414], 0xffffffff
lea eax, [ebp - 0x408]
or dword [ebp - 0x410], 0xffffffff
add esp, 0xc
push 0x1fc
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x418]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x40c], 0xfe
add esp, 0xc
mov dword [ebp - 0x420], ecx
inc edx
mov dword [eax], edx
lea eax, [ebp - 0x208]
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x40533d
push ecx
push edx
mov edx, 0x401108
mov ecx, ebx
call fcn.0040e401
test eax, eax
je 0x405440
mov esi, dword [ebp - 0x424]
mov ecx, esi
call fcn.0040e3f2
test eax, eax
je 0x405377
mov ecx, esi
call fcn.0040ed63
shr eax, 1
jmp 0x40537c
mov eax, 0x100
push dword [ebp + 0x10]
mov edx, esi
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00410116
mov esi, eax
test esi, esi
jne 0x4053b8
push 2
call fcn.00411dc9
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0040d7c6
mov eax, 0xfe
mov byte [edi], 0
inc edi
sub eax, 1
jne 0x4053aa
jmp 0x4056df
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x4c3
je 0x4053ce
cmp eax, 0x50010001
jne 0x4053eb
jmp 0x4053e2
push 2
call fcn.00411dc9
pop ecx
mov edx, 0x20004
mov ecx, eax
call fcn.0040d7c6
mov eax, dword [ebp - 0x418]
and dword [eax], 0
mov esi, 0xfe
mov eax, esi
mov byte [edi], 0
inc edi
sub eax, 1
jne 0x4053f2
mov ecx, ebx
call fcn.0040cc0e
cmp eax, 1
jne 0x40540e
xor esi, esi
jmp 0x4056df
lea eax, [ebp - 0x414]
push eax
push 0x80000002
push ebx
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegConnectRegistryW]
test eax, eax
je 0x405469
call fcn.0040d6a5
push 2
call fcn.00411dc9
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0040d7c6
jmp 0x405407
mov ecx, ebx
call fcn.0040cc0e
cmp eax, 1
je 0x405407
lea eax, [ebp - 0x414]
push eax
push 0x80000002
push 0
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegConnectRegistryW]
test eax, eax
jne 0x405425
mov esi, 0xfe
lea eax, [ebp - 0x410]
push eax
push 1
push 0
push 0x401348
push dword [ebp - 0x414]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x405493
push 0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0x405425
mov eax, dword [ebp - 0x40c]
lea ecx, [eax + eax]
call fcn.0040ebd3
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x4054bf
push 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
call fcn.0040d6a5
jmp 0x405407
mov ecx, edi
call fcn.0040ed63
mov ecx, edi
test eax, eax
je 0x4054d5
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x4054cc
lea eax, [ebp - 0x40c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push 0
push 0x4013a8
push dword [ebp - 0x410]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x405523
lea ecx, [ebp - 0x41c]
call fcn.0040eb2f
mov eax, dword [ebp - 0x40c]
lea ecx, [eax + eax]
call fcn.0040ebd3
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
je 0x4054ad
mov ecx, edi
call fcn.0040ed63
mov ecx, edi
test eax, eax
je 0x405539
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x405530
lea eax, [ebp - 0x40c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push 0
push 0x4013a8
push dword [ebp - 0x410]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x40558f
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
call fcn.0040d6a5
mov ecx, 0x8a
call fcn.0040d995
push 2
mov esi, eax
call fcn.00411dc9
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0040e454
xor esi, esi
jmp 0x4056d0
mov eax, dword [ebp - 0x40c]
xor ecx, ecx
push esi
mov edx, edi
mov word [edi + eax*2 - 2], cx
lea ecx, [ebp - 0x408]
call fcn.0040e35d
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharUpperW]
push 0
push 1
mov edx, 0x401108
mov ecx, ebx
call fcn.0040e401
test eax, eax
je 0x4055f5
push 0x24
pop eax
push edi
mov word [edi + 2], ax
xor eax, eax
push ebx
push 0x4013b8
mov word [edi + 4], ax
lea eax, [ebp - 0x208]
push 0xff
push eax
call fcn.00401be0
add esp, 0x14
jmp 0x40560f
push edi
push 0x4013dc
lea eax, [ebp - 0x208]
push 0xff
push eax
call fcn.00401be0
add esp, 0x10
lea eax, [ebp - 0x208]
push 0x4013f4
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
pop ecx
pop ecx
test eax, eax
je 0x40556b
push eax
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov dword [0x41248c], eax
cmp eax, 0xffffffff
jne 0x405668
call fcn.0040d6a5
push 2
call fcn.00411dc9
pop ecx
mov edx, 0x20001
mov ecx, eax
call fcn.0040d7c6
jmp 0x405588
lea eax, [ebp - 0x208]
push 0x180
push eax
call dword [sym.imp.msvcrt.dll__wchmod]
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x4056ad
lea eax, [ebp - 0x408]
mov ecx, 0x8b
push eax
call fcn.0040d995
push eax
push 1
push 1
push 2
call fcn.00411dc9
pop ecx
push eax
call fcn.0040e6ab
add esp, 0x14
jmp 0x405588
test eax, eax
je 0x4056bb
mov ecx, 0x8b
jmp 0x405570
mov ecx, dword [ebp - 0x428]
lea edx, [ebp - 0x208]
push esi
call fcn.0040e35d
xor esi, esi
inc esi
test edi, edi
je 0x4056df
lea ecx, [ebp - 0x41c]
call fcn.0040eb2f
cmp dword [ebp - 0x410], 0xffffffff
je 0x4056f4
push dword [ebp - 0x410]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x414], 0xffffffff
je 0x405709
push dword [ebp - 0x414]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004117f0
leave
ret 0x10