Function at 0x401aaa
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor eax, eax
push edi
inc eax
mov esi, 0x40b150
push esi
lea ecx, [ebp - 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
call fcn.0040153b
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push dword [ebp + 8]
xor ebx, ebx
call fcn.00401719
push esi
lea ecx, [ebp - 0x18]
call fcn.0040153b
push esi
lea ecx, [ebp - 4]
call fcn.0040153b
and dword [ebp - 0xc], 0
and dword [ebp - 0x38], 0
mov eax, dword [ebp + 8]
movzx eax, word [eax + ebx*2]
cmp ax, 0x20
je 0x401b0d
cmp ax, 0xd
je 0x401b0d
cmp ax, 0xa
jne 0x401b10
inc ebx
jmp 0x401af4
push ebx
push 0x28
lea ecx, [ebp - 8]
call fcn.00401642
mov esi, eax
cmp esi, 0xffffffff
je 0x402056
cmp ebx, esi
je 0x402056
lea edi, [esi + 1]
push edi
push 0x29
lea ecx, [ebp - 8]
call fcn.00401642
cmp eax, 0xffffffff
mov dword [ebp - 0x3c], eax
je 0x402056
mov eax, esi
sub eax, ebx
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 8]
call fcn.004017c8
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 0x18]
call fcn.00401842
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00401256
mov eax, dword [ebp - 0x3c]
sub eax, esi
dec eax
push eax
push edi
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 8]
call fcn.004017c8
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 4]
call fcn.00401842
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00401256
mov edi, dword [ebp - 0x18]
mov eax, dword [edi - 0xc]
test eax, eax
jl 0x401fb4
cmp word [edi], 0x21
jne 0x401bf5
xor ecx, ecx
inc ecx
dec eax
push eax
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.004017c8
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401842
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00401256
mov edi, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x409348
push edi
call ebx
test eax, eax
jne 0x401d89
mov esi, 0x40b150
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040153b
push esi
lea ecx, [ebp - 0x14]
call fcn.0040153b
push esi
lea ecx, [ebp - 0x10]
call fcn.0040153b
lea eax, [ebp - 0xc]
push eax
mov esi, 0x409344
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 4]
call fcn.00401a00
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401842
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.00401256
cmp dword [ebp - 0xc], 0xffffffff
je 0x401fbe
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 4]
call fcn.00401a00
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 0x14]
call fcn.00401842
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00401256
cmp dword [ebp - 0xc], 0xffffffff
je 0x401fbe
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 4]
call fcn.00401a00
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 0x10]
call fcn.00401842
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00401256
cmp dword [ebp - 0xc], 0xffffffff
je 0x401fbe
mov esi, dword [ebp - 0x1c]
push str.HKLM
push esi
call ebx
test eax, eax
jne 0x401cfd
mov eax, 0x80000002
jmp 0x401d25
push str.HKCU
push esi
call ebx
test eax, eax
jne 0x401d10
mov eax, 0x80000001
jmp 0x401d25
push str.HKCR
push esi
call ebx
test eax, eax
jne 0x401fef
mov eax, 0x80000000
push 0x20019
push dword [ebp - 0x14]
xor ebx, ebx
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.00401177
cmp dword [ebp - 0xc], ebx
jne 0x401d44
xor esi, esi
jmp 0x401d5b
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
lea ecx, [ebp - 0xc]
call fcn.00401160
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401256
jmp 0x401f33
push str.exist_regkey
push edi
call ebx
test eax, eax
jne 0x401ea8
mov esi, 0x40b150
push esi
lea ecx, [ebp - 0x20]
call fcn.0040153b
push esi
lea ecx, [ebp - 0x24]
call fcn.0040153b
lea eax, [ebp - 0xc]
push eax
mov esi, 0x409344
push esi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 4]
call fcn.00401a00
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 0x20]
call fcn.00401842
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
call fcn.00401256
cmp dword [ebp - 0xc], 0xffffffff
je 0x40200a
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 4]
call fcn.00401a00
mov ecx, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
push eax
lea ecx, [ebp - 0x24]
call fcn.00401842
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.00401256
cmp dword [ebp - 0xc], 0xffffffff
je 0x40200a
mov esi, dword [ebp - 0x20]
push str.HKLM
push esi
call ebx
test eax, eax
jne 0x401e45
mov eax, 0x80000002
jmp 0x401e6d
push str.HKCU
push esi
call ebx
test eax, eax
jne 0x401e58
mov eax, 0x80000001
jmp 0x401e6d
push str.HKCR
push esi
call ebx
test eax, eax
jne 0x40201a
mov eax, 0x80000000
mov ebx, dword [ebp - 0x24]
and dword [ebp - 0xc], 0
push 0x20019
push ebx
push eax
lea ecx, [ebp - 0xc]
call fcn.00401177
xor eax, eax
cmp dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
setne al
mov esi, eax
call fcn.00401160
lea ecx, [ebx - 0x10]
call fcn.00401256
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
jmp 0x401f2c
push str.exist_file
push edi
call ebx
test eax, eax
jne 0x401fdf
push 0x40b150
lea ecx, [ebp - 0x28]
call fcn.0040153b
push 0x10e
lea ecx, [ebp - 0x28]
call fcn.004016ef
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00401941
mov ecx, eax
call fcn.0040188f
mov eax, dword [eax]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40201f
mov ebx, dword [ebp - 0x28]
push ebx
call fcn.004012bc
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004012d5
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
neg esi
sbb esi, esi
inc esi
lea ecx, [ebx - 0x10]
call fcn.00401256
xor ebx, ebx
cmp dword [ebp - 0x38], ebx
je 0x401f41
xor eax, eax
cmp esi, ebx
sete al
mov esi, eax
cmp dword [ebp - 0x30], ebx
je 0x401f4b
and dword [ebp - 0x2c], esi
jmp 0x401f4e
or dword [ebp - 0x2c], esi
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebp + 8]
inc ebx
movzx eax, word [eax + ebx*2]
cmp ax, 0x20
je 0x401f51
cmp ax, 0xd
je 0x401f51
cmp ax, 0xa
je 0x401f51
push ebx
lea ecx, [ebp - 8]
call fcn.004016b0
movzx eax, ax
test eax, eax
je 0x40202e
cmp eax, 0x26
je 0x401f8f
cmp eax, 0x7c
jne 0x401fdf
and dword [ebp - 0x30], 0
jmp 0x401f96
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
inc ebx
call fcn.00401256
lea ecx, [edi - 0x10]
call fcn.00401256
mov esi, 0x40b150
jmp 0x401ada
push 0x80070057
call fcn.0040103c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401256
lea ecx, [edi - 0x10]
jmp 0x402067
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401256
lea ecx, [esi - 0x10]
jmp 0x401fda
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x20]
jmp 0x401fd7
mov ecx, dword [ebp - 0x24]
jmp 0x401ffd
push 0
lea ecx, [ebp - 0x28]
call fcn.004012d5
mov ecx, dword [ebp - 0x28]
jmp 0x401fd7
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401256
lea ecx, [edi - 0x10]
call fcn.00401256
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401256
xor eax, eax
cmp dword [ebp - 0x2c], eax
sete al
jmp 0x40207c
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401256
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401256
mov eax, 0x80004005
pop edi
pop esi
pop ebx
leave
ret