Function at 0x401b85
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.00406010
mov eax, dword [0x41f010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Init_install_path_start
mov edi, ecx
call fcn.0040336d
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x824], ax
xor esi, esi
lea eax, [ebp - 0x822]
push esi
push eax
call fcn.00404f10
xor eax, eax
push ebx
mov word [ebp - 0xc34], ax
lea eax, [ebp - 0xc32]
push esi
push eax
call fcn.00404f10
xor eax, eax
push ebx
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa2a]
push esi
push eax
call fcn.00404f10
xor eax, eax
push ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00404f10
xor eax, eax
push ebx
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.00404f10
add esp, 0x40
xor eax, eax
mov word [ebp - 0x1044], ax
lea eax, [ebp - 0x1042]
push ebx
push esi
push eax
call fcn.00404f10
add esp, 0xc
lea eax, [ebp - 0x824]
push esi
push 0x2b
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x824]
push 0x417320
push eax
call fcn.00405674
mov ebx, 0x417324
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.00405674
lea eax, [ebp - 0x824]
push 0x417320
push eax
call fcn.00405674
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.00405674
lea eax, [ebp - 0x824]
push str..ini
push eax
call fcn.00405674
add esp, 0x28
lea eax, [ebp - 0x824]
push eax
push 0x104
lea eax, [ebp - 0xc34]
push eax
push 0x417220
push str.InstallPath
push str.Globals
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x20c]
push eax
push str.get_program_files_common_szInstallRootPath:_s
call fcn.0040336d
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
test eax, eax
jle 0x401df0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004056a3
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x401df0
xor eax, eax
push 0x206
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push esi
push eax
call fcn.00404f10
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x61c]
push str.WnPicConfig.exe
push eax
call fcn.00405674
add esp, 0x1c
lea eax, [ebp - 0x61c]
push eax
call ebx
test eax, eax
je 0x401df0
cmp word [ebp - 0x20c], si
jne 0x401d93
mov eax, esi
jmp 0x401da0
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x64]
call fcn.00402f3a
cmp word [ebp - 0x414], si
je 0x401dc8
lea eax, [ebp - 0x414]
push eax
call fcn.004056c3
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x414]
add edi, 0x94
push eax
mov ecx, edi
call fcn.00402f3a
cmp dword [edi + 0x14], 8
jb 0x401de5
mov edi, dword [edi]
push edi
push str.checke_config_exe_name:_install_path:_s
jmp 0x402213
xor eax, eax
push 0x206
mov word [ebp - 0xe3c], ax
lea eax, [ebp - 0xe3a]
push esi
push eax
call fcn.00404f10
lea eax, [ebp - 0xe3c]
push str.SOFTWARE_
push eax
call fcn.004056a3
lea eax, [ebp - 0xe3c]
push 0x417324
push eax
call fcn.00405674
add esp, 0x1c
lea eax, [ebp - 0x1048]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xe3c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f89
lea eax, [ebp - 0x104c]
mov dword [ebp - 0x104c], 0x104
push eax
lea eax, [ebp - 0x1044]
push eax
push esi
push esi
push str.InstallPath
push dword [ebp - 0x1048]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401f89
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004056a3
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x401f89
xor eax, eax
push 0x206
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push esi
push eax
call fcn.00404f10
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x61c]
push str.WnPicConfig.exe
push eax
call fcn.00405674
add esp, 0x1c
lea eax, [ebp - 0x61c]
push eax
call ebx
test eax, eax
je 0x401f89
push dword [ebp - 0x1048]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20c], si
jne 0x401f2c
mov eax, esi
jmp 0x401f39
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x64]
call fcn.00402f3a
cmp word [ebp - 0x414], si
je 0x401f61
lea eax, [ebp - 0x414]
push eax
call fcn.004056c3
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x414]
add edi, 0x94
push eax
mov ecx, edi
call fcn.00402f3a
cmp dword [edi + 0x14], 8
jb 0x401f7e
mov edi, dword [edi]
push edi
push str.checke_regedit_soft_install_install_path:_s
jmp 0x402213
push dword [ebp - 0x1048]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0x26
lea eax, [ebp - 0xa2c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xa2c]
push 0x417320
push eax
call fcn.00405674
lea eax, [ebp - 0xa2c]
push 0x417324
push eax
call fcn.00405674
lea eax, [ebp - 0xa2c]
push 0x417320
push eax
call fcn.00405674
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004056a3
add esp, 0x28
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x4020cc
xor eax, eax
push 0x206
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push esi
push eax
call fcn.00404f10
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x61c]
push str.WnPicConfig.exe
push eax
call fcn.00405674
add esp, 0x1c
lea eax, [ebp - 0x61c]
push eax
call ebx
test eax, eax
je 0x4020cc
cmp word [ebp - 0x20c], si
jne 0x40206f
mov eax, esi
jmp 0x40207c
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x64]
call fcn.00402f3a
cmp word [ebp - 0x414], si
je 0x4020a4
lea eax, [ebp - 0x414]
push eax
call fcn.004056c3
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x414]
add edi, 0x94
push eax
mov ecx, edi
call fcn.00402f3a
cmp dword [edi + 0x14], 8
jb 0x4020c1
mov edi, dword [edi]
push edi
push str.checke_CSIDL_PROGRAM_FILES__install_path.....:_s
jmp 0x402213
lea eax, [ebp - 0xc34]
push eax
call fcn.004056c3
pop ecx
test eax, eax
jle 0x402185
lea eax, [ebp - 0xc34]
push eax
call ebx
test eax, eax
je 0x402185
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004056a3
add esp, 0x10
cmp word [ebp - 0x20c], si
jne 0x402128
mov eax, esi
jmp 0x402135
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x64]
call fcn.00402f3a
cmp word [ebp - 0x414], si
je 0x40215d
lea eax, [ebp - 0x414]
push eax
call fcn.004056c3
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x414]
add edi, 0x94
push eax
mov ecx, edi
call fcn.00402f3a
cmp dword [edi + 0x14], 8
jb 0x40217a
mov edi, dword [edi]
push edi
push str.checke_CSIDL_PROGRAM_FILESt_install_install_path:_s
jmp 0x402213
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004056a3
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004056a3
add esp, 0x10
cmp word [ebp - 0x20c], si
jne 0x4021bb
mov eax, esi
jmp 0x4021c8
lea eax, [ebp - 0x20c]
push eax
call fcn.004056c3
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x64]
call fcn.00402f3a
cmp word [ebp - 0x414], si
je 0x4021f0
lea eax, [ebp - 0x414]
push eax
call fcn.004056c3
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x414]
add edi, 0x94
push eax
mov ecx, edi
call fcn.00402f3a
cmp dword [edi + 0x14], 8
jb 0x40220d
mov edi, dword [edi]
push edi
push str.Init_install_path_end_install_path:_s
call fcn.0040336d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405ae3
mov esp, ebp
pop ebp
ret