Function at 0x512640
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call sym.FLAMESLauncher.exe_FOSUtilityGetTimeOfDay
fstp qword [ebp - 0x224]
movsd xmm0, qword [ebp - 0x224]
call fcn.0052cb40
mov edi, eax
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x228]
mov dword [ebp - 0x220], 4
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0xf003f
push 0
push 0x5b7db5
push 0
push str.Console
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x51271a
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.WindowTable
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x21c]
test eax, eax
jne 0x512718
add dword [ebp - 0x218], 0x511950
call ebx
mov ecx, dword [ebp - 0x218]
lea eax, [ecx - 0x15180]
cmp edi, eax
jb 0x5128b1
lea eax, [ecx + 0x15180]
cmp edi, eax
jb 0x51292b
jmp 0x51271a
call ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x214]
push esi
push eax
push 1
xor esi, esi
push esi
push 0x24
push esi
call ebx
test eax, eax
js 0x5128a6
lea eax, [ebp - 0x214]
push eax
call sym.FLAMESLauncher.exe_FOSUtilityDirectoryExists
add esp, 4
test eax, eax
jne 0x512754
xor esi, esi
jmp 0x5128a6
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.005124e0
add esp, 8
test eax, eax
cmovne esi, eax
lea eax, [ebp - 0x10c]
push eax
push 1
push 0
push 0x25
push 0
call ebx
test eax, eax
jns 0x512786
xor esi, esi
jmp 0x5128a6
lea eax, [ebp - 0x10c]
push eax
call sym.FLAMESLauncher.exe_FOSUtilityDirectoryExists
add esp, 4
test eax, eax
jne 0x5127a0
xor esi, esi
jmp 0x5128a6
push str.system
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push 0x5a59f4
push eax
call fcn.004f9620
lea eax, [ebp - 0x10c]
push eax
call sym.FLAMESLauncher.exe_FOSUtilityDirectoryExists
add esp, 0x14
test eax, eax
je 0x5127e6
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.005124e0
add esp, 8
cmp eax, esi
cmova esi, eax
push str.system32
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push 0x5a59f4
push eax
call fcn.004f9620
lea eax, [ebp - 0x10c]
push eax
call sym.FLAMESLauncher.exe_FOSUtilityDirectoryExists
add esp, 0x14
test eax, eax
je 0x51282c
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.005124e0
add esp, 8
cmp eax, esi
cmova esi, eax
push str.SysWOW64
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push 0x5a59f4
push eax
call fcn.004f9620
lea eax, [ebp - 0x10c]
push eax
call sym.FLAMESLauncher.exe_FOSUtilityDirectoryExists
add esp, 0x14
test eax, eax
je 0x512872
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.005124e0
add esp, 8
cmp eax, esi
cmova esi, eax
lea eax, [ebp - 0x214]
mov byte [ebp - 0x212], 0
push eax
call sym.FLAMESLauncher.exe_FOSUtilityDirectoryExists
add esp, 4
test eax, eax
jne 0x512890
xor esi, esi
jmp 0x5128a6
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.005124e0
add esp, 8
cmp eax, esi
cmova esi, eax
lea eax, [esi - 0x15180]
pop esi
cmp edi, eax
jae 0x5128c3
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0xf003f
push 0
push 0x5b7db5
push 0
push str.Console
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x51292b
push 4
lea eax, [edi - 0x511950]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push 4
push 0
push str.WindowTable
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret