Function at 0x53cc10
Capabilities:
Get common file path
Get disk size
Get file version info
Link many functions at runtime
Log keystrokes via polling
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66cc10
push 0x62423c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2268
call fcn.00623680
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.0057a800
xor eax, eax
call fcn.0053e7e0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, 0x800
mov eax, 0xeeeeeeee
lea edi, [ebp - 0x2280]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1280]
mov dword [0x713b34], eax
push 0x713b38
push 1
push 1
mov ecx, eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
call fcn.0053cb90
mov byte [ebp - 0x19], al
mov edi, dword [ebp + 0x10]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x53cc90
sub eax, edx
mov esi, eax
mov dword [ebp - 0x64], esi
lea eax, [esi + 1]
call fcn.00449460
mov dword [ebp - 0x20], eax
cmp esi, ebx
jle 0x53ccbb
mov ecx, edi
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x53ccb1
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], bl
push ebx
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [0x6dcc60], edi
mov dword [0x737dc4], ebx
mov eax, dword [ebp + 8]
mov dword [0x737dc0], eax
mov ecx, dword [ebp + 0x14]
mov dword [0x737dcc], ecx
mov dword [0x737dd0], 0x53d5a0
mov dword [0x737dc8], ebx
mov byte [0x737e55], bl
mov byte [0x737e54], bl
mov eax, dword [str.Halo]
mov dword [0x737dd4], eax
mov cl, byte [0x66aba8]
mov byte [0x737dd8], cl
mov dword [0x737e14], eax
mov byte [0x737e18], cl
push 0x7f00
push ebx
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x6dcc5c], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x4c], 4
lea edx, [ebp - 0x3c]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftMicrosoft_GamesHalo
push closesocket
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x38]
push ecx
push ebx
push ebx
push str.FIRSTRUN
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x38], ebx
jne 0x53cdd5
xor edi, edi
mov dword [ebp - 0x48], edi
push str.eula.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x58], esi
cmp esi, ebx
je 0x53cdc9
push str.EBUEula
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x53cdc2
push 1
push ebx
push 0x6e9f10
push str.SoftwareMicrosoftMicrosoft_GamesHalo
call eax
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x48], edi
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
cmp edi, ebx
jne 0x53cdd5
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
push 0x713ac4
mov edi, dword [ebp - 0x20]
call fcn.0053e060
mov dword [0x713ac0], eax
push str._window
xor edi, edi
call fcn.0053e1d0
add esp, 8
test al, al
jne 0x53ce14
push str._windowed
call fcn.0053e1d0
add esp, 4
test al, al
jne 0x53ce14
xor eax, eax
mov esi, 1
jmp 0x53ce1b
mov esi, 1
mov eax, esi
mov dword [0x70edd8], eax
push str._nosound
xor edi, edi
call fcn.0053e1d0
movzx ecx, al
mov dword [0x70b424], ecx
push str._nonetwork
call fcn.0053e1d0
movzx edx, al
mov dword [0x70b42c], edx
push str._novideo
call fcn.0053e1d0
add esp, 0xc
test al, al
jne 0x53ce6e
push str._connect
call fcn.0053e1d0
add esp, 4
test al, al
jne 0x53ce6e
xor eax, eax
jmp 0x53ce70
mov eax, esi
mov dword [0x70b428], eax
push str._nojoystick
xor edi, edi
call fcn.0053e1d0
movzx eax, al
mov dword [0x704acc], eax
push str._width640
call fcn.0053e1d0
movzx ecx, al
mov dword [0x70b430], ecx
push str._screenshots
call fcn.0053e1d0
add esp, 0xc
test al, al
jne 0x53cec2
push str._screenshot
call fcn.0053e1d0
add esp, 4
test al, al
jne 0x53cec2
xor eax, eax
jmp 0x53cec4
mov eax, esi
mov dword [0x70b420], eax
push str._checkfpu
xor edi, edi
call fcn.0053e1d0
movzx edx, al
mov dword [0x70edd0], edx
push str._timedemo
call fcn.0053e1d0
neg al
sbb eax, eax
neg eax
mov dword [0x70b418], eax
push str._nowinkey
call fcn.0053e1d0
add esp, 0xc
test al, al
jne 0x53cf19
push str._nowindowskey
call fcn.0053e1d0
add esp, 4
test al, al
jne 0x53cf19
xor eax, eax
jmp 0x53cf1b
mov eax, esi
mov dword [0x70b438], eax
mov eax, dword [0x70b434]
cmp eax, ebx
jne 0x53cf44
push str._safemode
xor edi, edi
call fcn.0053e1d0
add esp, 4
movzx eax, al
mov dword [0x70b434], eax
cmp eax, ebx
je 0x53cf62
mov dword [0x70b430], esi
mov dword [0x70b428], esi
mov dword [0x704acc], esi
mov dword [0x70edd8], esi
mov dword [0x70b424], esi
call fcn.005790c0
mov eax, dword [0x7147c8]
cmp eax, 0x80
ja 0x53cf7e
mov word [0x6809b4], 0xc
jmp 0x53cfa3
cmp eax, 0x100
ja 0x53cf90
mov word [0x6809b4], 0x10
jmp 0x53cfa3
cmp eax, 0x200
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [0x6809b4], ax
mov word [0x6809b8], 0x30
push 0x66aae0
xor edi, edi
call fcn.0053e1d0
add esp, 4
test al, al
jne 0x53d425
push str._help
call fcn.0053e1d0
add esp, 4
test al, al
jne 0x53d425
call fcn.00444a10
push str.d3d9.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0x737e64], eax
push str.Direct3DCreate9
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x737e74], eax
cmp dword [0x737e64], ebx
je 0x53d00a
cmp eax, ebx
jne 0x53d01c
push esi
push 0x7a
push 0x6b
call fcn.0057a2d0
add esp, 0xc
mov eax, dword [0x737e74]
push 0x1f
call eax
mov esi, eax
mov dword [ebp - 0x60], esi
cmp esi, ebx
je 0x53d04d
xor ecx, ecx
mov edx, esi
call fcn.00578c50
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x53d045
push ebx
push eax
push 0xffffffffffffffff
call fcn.0057a2d0
add esp, 0xc
mov dword [0x713ac8], esi
jmp 0x53d061
push 1
push 0x82
push 0x81
call fcn.0057a2d0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x17c]
push ecx
mov edx, dword [0x737e64]
push edx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x17c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
mov dword [ebp - 0x68], esi
call fcn.00449460
mov edi, eax
mov dword [ebp - 0x74], edi
push edi
push esi
push ebx
lea edx, [ebp - 0x17c]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0x65af3c
push edi
call sub.VERSION.dll_VerQueryValueA
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0xc]
and eax, 0xffff
cmp eax, dword [0x6e9678]
jae 0x53d0df
push 1
push 0x7a
push 0x6b
call fcn.0057a2d0
add esp, 0xc
mov eax, edi
call fcn.00449470
push 0x11
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ah, ah
jns 0x53d102
push ebx
push 0x7e
push 0x87
call fcn.0057a2d0
add esp, 0xc
push str.DisableD3DSpy
mov ecx, dword [0x737e64]
push ecx
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x5c], eax
cmp eax, ebx
je 0x53d11f
call eax
cmp dword [0x70b424], ebx
je 0x53d13b
mov dword [0x737e5c], ebx
mov dword [0x737e70], ebx
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x53d174
push 0x66a904
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryA]
call edi
mov dword [0x737e5c], eax
push str.DirectSoundCreate8
push eax
call esi
mov dword [0x737e70], eax
cmp dword [0x737e5c], ebx
je 0x53d166
cmp eax, ebx
jne 0x53d174
push 1
push 0x7a
push 0x7b
call fcn.0057a2d0
add esp, 0xc
push str.dinput8.dll
call edi
mov dword [0x737e58], eax
push str.DirectInput8Create
push eax
call esi
mov dword [0x737e68], eax
cmp dword [0x737e58], ebx
je 0x53d199
cmp eax, ebx
jne 0x53d1a7
push 1
push 0x7a
push 0x7c
call fcn.0057a2d0
add esp, 0xc
push str.shfolder.dll
call edi
mov dword [0x737e60], eax
push str.SHGetFolderPathA
push eax
call esi
mov dword [0x737e6c], eax
cmp dword [0x737e60], ebx
je 0x53d1cc
cmp eax, ebx
jne 0x53d1da
push 1
push 0x7e
push 0x7d
call fcn.0057a2d0
add esp, 0xc
call fcn.0057a0b0
test eax, eax
je 0x53d1f0
push ebx
push 0x73
push 0x6a
call fcn.0057a2d0
add esp, 0xc
cmp byte [ebp - 0x19], bl
jmp 0x53d1fb
mov edx, dword [0x6e966c]
add edx, 0xfffffff0
cmp dword [0x7147c8], edx
jae 0x53d219
push ebx
push 0x6e
push 0x65
call fcn.0057a2d0
add esp, 0xc
mov eax, dword [0x7147cc]
cmp eax, dword [0x6e9680]
jae 0x53d259
call fcn.005790c0
mov ecx, dword [0x7147cc]
cmp ecx, dword [0x6e9680]
jae 0x53d259
call fcn.005790c0
mov edx, dword [0x7147cc]
cmp edx, dword [0x6e9680]
jae 0x53d259
push ebx
push 0x6f
push 0x66
call fcn.0057a2d0
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
push ebx
push ebx
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x280]
push edx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
mov eax, dword [0x6e9674]
shl eax, 0x14
xor ecx, ecx
mov edx, dword [ebp - 0x50]
cmp edx, ecx
jg 0x53d2a5
jl 0x53d298
mov ecx, dword [ebp - 0x54]
cmp ecx, eax
jae 0x53d2a5
push ebx
push 0x76
push 0x6d
call fcn.0057a2d0
add esp, 0xc
call fcn.0057ac50
mov dword [0x737da8], eax
cmp byte [eax], bl
jmp 0x53d2c4
call fcn.0053e540
call fcn.0053c760
test al, al
je 0x53d3e1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
mov dword [0x6809a4], 0xffffffff
push str._port
lea edi, [ebp - 0x24]
call fcn.0053e1d0
add esp, 4
test al, al
je 0x53d316
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x53d316
push eax
call fcn.00620fc6
add esp, 4
mov dword [0x691fc0], eax
mov byte [0x70e018], 1
push str._cport
lea edi, [ebp - 0x24]
call fcn.0053e1d0
add esp, 4
test al, al
je 0x53d346
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x53d346
push eax
call fcn.00620fc6
add esp, 4
mov dword [0x691fc4], eax
mov byte [0x70e018], 1
push 0x66aab4
lea edi, [ebp - 0x34]
call fcn.0053e1d0
add esp, 4
mov edi, dword [ebp - 0x34]
test al, al
je 0x53d39a
cmp edi, ebx
je 0x53d39a
push edi
call dword [sym.imp.ws2_32.dll_inet_addr]
mov dword [0x6809a4], eax
cmp eax, 0xffffffff
je 0x53d39a
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shl edx, 8
xor ecx, ecx
mov eax, dword [0x6809a4]
shr eax, 0x10
mov ch, al
or edx, ecx
movzx eax, ah
or edx, eax
mov dword [0x680998], edx
mov byte [ebp - 0x30], bl
xor ecx, ecx
mov dword [ebp - 0x2f], ecx
mov dword [ebp - 0x2b], ecx
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x34
mov byte [ebp - 0x2e], 0x52
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x39
mov byte [ebp - 0x2b], 0x4a
mov byte [ebp - 0x2a], bl
mov edx, dword [0x691fc0]
push edx
lea esi, [ebp - 0x30]
mov eax, str.halor
call fcn.005719c0
add esp, 4
call fcn.004c59e0
call fcn.0053c890
mov eax, dword [ebp - 0x20]
call fcn.00449470
mov eax, dword [0x713ac0]
call fcn.00449470
call fcn.0053e760
mov eax, dword [0x713b34]
cmp eax, ebx
je 0x53d41c
push 0x713b38
mov ecx, dword [0x713b38]
push ecx
push 1
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [0x713b34], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x53d456
push ebx
push str.Halo
push 0x6e9f30
push ebx
call dword [sym.imp.user32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
jmp 0x53d47b
call fcn.0057a270
mov eax, dword [0x713b30]
cmp eax, ebx
je 0x53d47b
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [0x713b30], ebx
mov dword [0x698364], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10