Function at 0x410e8a
Capabilities:
Check if file exists
Delete registry key
Get file attributes
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7e0]
sub esp, 0x85c
mov eax, dword [0x415010]
xor eax, ebp
mov dword [ebp + 0x7dc], eax
mov eax, dword [ebp + 0x7e8]
push ebx
push esi
mov esi, dword [ebp + 0x7f4]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x7ec]
push edi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x7f0]
mov edi, 0x206
xor ebx, ebx
push edi
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x1c6]
push ebx
push eax
mov dword [ebp - 0x50], esi
mov word [ebp + 0x1c4], bx
call sub.MSVCR80.dll_memset
push edi
lea eax, [ebp + 0x3ce]
push ebx
push eax
mov word [ebp + 0x3cc], bx
call sub.MSVCR80.dll_memset
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x4029ec
lea eax, [ebp - 0x44]
push 0x103
push eax
call fcn.00410830
add esp, 0x14
mov esi, 0x104
push esi
lea eax, [ebp + 0x1c4]
push eax
call fcn.0040f838
lea eax, [ebp - 0x45]
push eax
lea eax, [ebp - 0x46]
push eax
push dword [ebp - 0x50]
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x45], bl
call fcn.0040f544
test eax, eax
jl 0x4110a0
cmp byte [ebp - 0x45], bl
je 0x4110a0
lea eax, [ebp - 0x4c]
push eax
push 0x20006
push ebx
lea eax, [ebp - 0x44]
push eax
push SysReAllocString
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410ff2
push 4
lea eax, [ebp - 0x60]
push eax
push 4
push ebx
push dword [0x41502c]
mov dword [ebp - 0x60], 1
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x58]
push eax
push 4
push ebx
push dword [0x415048]
mov dword [ebp - 0x58], 2
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x410fe9
push 8
lea eax, [ebp - 0x6c]
push eax
push 0xb
push ebx
push dword [0x41504c]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp + 0x5d6]
push ebx
push eax
mov word [ebp + 0x5d4], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp + 0x5d4]
push eax
push dword [ebp - 0x50]
call fcn.0040f875
push 0x4029e4
push 0x406528
lea eax, [ebp + 0x5d4]
push eax
push 0x4029d0
lea eax, [ebp + 0x3cc]
push 0x103
push eax
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x18
push 2
push 0x15
push ebx
call sub.custsat.dll_Ordinal_5
push ebx
push 0x1b
push ebx
call sub.custsat.dll_Ordinal_5
push 1
push 0xf
lea eax, [ebp + 0x3cc]
push eax
push ebx
call sub.custsat.dll_Ordinal_4
lea eax, [ebp + 0x3cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4110af
lea eax, [ebp + 0x3cc]
push eax
lea eax, [ebp + 0x5d4]
push eax
call fcn.0040f927
lea eax, [ebp + 0x3cc]
push eax
push esi
push dword [ebp - 0x5c]
call fcn.00410e2c
jmp 0x4110af
lea eax, [ebp - 0x44]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x54]
lea eax, [ebp + 0x1c4]
push eax
call fcn.00410bad
cmp al, 1
jne 0x41112c
push esi
lea eax, [ebp + 0x5d4]
push ebx
push eax
call fcn.0041084d
add esp, 0xc
lea eax, [ebp + 0x1c4]
push eax
push esi
lea eax, [ebp + 0x5d4]
push eax
call fcn.0040b0b9
lea eax, [ebp + 0x1c4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4110f0
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
cmp ecx, 0x7fffffff
ja 0x41111c
push 0x4028e0
push ecx
lea eax, [ebp + 0x5d4]
push eax
call fcn.0040c808
lea eax, [ebp + 0x5d4]
push eax
push esi
push dword [ebp - 0x64]
call fcn.00410e2c
mov ecx, dword [ebp + 0x7dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fdc4
add ebp, 0x7e0
leave
ret 0x10