Function at 0x1507324
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.01507018
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x150736d
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.01507069
test esi, esi
jne 0x1507377
cmp dword [ebp - 0x10], 0
jne 0x1507380
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x1507382
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x15073d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.01507018
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x1507415
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.01507069
test edi, edi
jne 0x150741f
cmp dword [ebp - 0xc], 0
jne 0x1507448
cmp dword [ebp + 0xc], 0
je 0x1507436
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.01510b98
add esp, 0xc
jmp 0x1507444
push esi
push 0
push dword [ebp + 0x10]
call fcn.01510c08
add esp, 0xc
xor eax, eax
jmp 0x150744b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1507a9c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x400]
mov edx, 0x400
call fcn.01507b14
lea eax, [ebp - 0x400]
call fcn.01501cf8
push ebx
lea edx, [ebp - 0x400]
push edx
call fcn.01510cac
add esp, 8
lea eax, [ebp - 0x400]
call fcn.0150a18c
test eax, eax
je 0x1507af7
push 0
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x1507afb
xor eax, eax
jmp 0x1507b0d
lea edx, [ebp - 0x400]
push edx
push esi
call fcn.01510d88
add esp, 8
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1507b14
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x151ae83
push esi
mov edx, str.TempFolder
mov eax, str.Paths
mov ecx, ebx
call fcn.015071b4
mov byte [ebp - 0x400], 0
cmp byte [ebx], 0
je 0x1507b6b
push 0x400
lea eax, [ebp - 0x400]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x1507b6b
lea edx, [ebp - 0x400]
mov ecx, esi
mov eax, ebx
call fcn.01501a84
cmp byte [ebx], 0
je 0x1507b7b
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x1507b99
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x1507b8b
cmp byte [ebx], 0
jne 0x1507b99
push str._rartemp
push ebx
call fcn.01510d88
add esp, 8
mov eax, ebx
call fcn.01501cf8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret