Function at 0x4036d0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5390cc
mov eax, dword fs:[0]
push eax
sub esp, 0x65c
mov eax, dword [0x589c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x20]
lea eax, [ebp - 0x648]
xor ebx, ebx
push eax
push ecx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x63c], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
call fcn.0041c284
mov edi, dword [eax + 8]
push 0x3ea
push esi
lea edx, [ebp - 0x638]
push edx
lea ecx, [esi + 0x410]
push 0x40000080
mov dword [ebp - 0x638], 0x5f
mov dword [ebp - 0x634], 0x98
mov dword [ebp - 0x630], 0x193
mov dword [ebp - 0x62c], 0xa5
call fcn.0041b787
lea eax, [esi + 0x2c4]
cmp eax, ebx
jne 0x403786
xor eax, eax
jmp 0x403789
mov eax, dword [eax + 4]
push 1
push eax
mov eax, dword [esi + 0x430]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x567e98
push 0x5680cc
lea ecx, [esi + 0x484]
push ecx
mov eax, edi
call fcn.004124e0
push 0x567e98
push str.INSTALL_FILE
lea edx, [esi + 0x48c]
push edx
mov eax, edi
call fcn.004124e0
mov eax, dword [esi + 0x494]
mov eax, dword [eax + 4]
push esi
push 0x66
lea ecx, [esi + 0x494]
push ebx
lea edx, [ebp - 0x638]
push edx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
call eax
mov edx, dword [esi + 0x4dc]
mov edx, dword [edx + 4]
push esi
push 0x67
lea ecx, [esi + 0x4dc]
push ebx
lea eax, [ebp - 0x638]
push eax
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
call edx
mov eax, dword [esi + 0x530]
mov eax, dword [eax + 4]
push esi
push 0x68
lea ecx, [esi + 0x530]
push ebx
lea edx, [ebp - 0x638]
push edx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
call eax
mov edx, dword [esi + 0x494]
mov eax, dword [edx + 8]
push 0x567e98
lea ecx, [esi + 0x494]
push 0x567f44
push edi
call eax
mov edx, dword [esi + 0x494]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x494]
push 0x56810c
call eax
mov edx, dword [esi + 0x4dc]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x4dc]
push 0x568114
call eax
mov edx, dword [esi + 0x530]
mov eax, dword [edx + 0x14]
lea ecx, [esi + 0x530]
push 0x568128
call eax
mov edx, dword [esi + 0x494]
lea ecx, [esi + 0x494]
mov eax, dword [edx + 0x34]
push 0x8e
push 0x1a7
call eax
mov edx, dword [esi + 0x4dc]
mov eax, dword [edx + 0x34]
lea ecx, [esi + 0x4dc]
push 0xcd
push 0x24
call eax
mov edx, dword [esi + 0x530]
mov eax, dword [edx + 0x34]
lea ecx, [esi + 0x530]
push 0xe9
push 0x24
call eax
mov eax, 1
mov dword [esi + 0x524], eax
mov dword [esi + 0x578], eax
call fcn.0041ced4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40393b
push 0x80004005
call fcn.0040ab10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x660], eax
push 0x567f70
push str.WHPATH
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x654], eax
cmp eax, ebx
je 0x4039a8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x654]
push ecx
push edi
mov dword [ebp - 0x650], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 0x650], ebx
je 0x4039a8
cmp eax, ebx
je 0x4039a8
push eax
lea edx, [ebp - 0x660]
push 0x567f8c
push edx
call fcn.0040a810
add esp, 0xc
call fcn.0041ced4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4039c2
push 0x80004005
call fcn.0040ab10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x65c], eax
push 0x567f70
push 0x567f80
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x654], eax
cmp eax, ebx
je 0x403a30
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x654]
push ecx
push edi
mov dword [ebp - 0x650], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 0x650], ebx
je 0x403a30
cmp eax, ebx
je 0x403a30
push eax
lea edx, [ebp - 0x65c]
push 0x567f8c
push edx
call fcn.0040a810
add esp, 0xc
call fcn.0041ced4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x403a4a
push 0x80004005
call fcn.0040ab10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x664], eax
push 0x567f70
push 0x56814c
push edi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x654], eax
cmp eax, ebx
je 0x403ab8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x654]
push ecx
push edi
mov dword [ebp - 0x650], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 0x650], ebx
je 0x403ab8
cmp eax, ebx
je 0x403ab8
push eax
lea edx, [ebp - 0x664]
push 0x567f8c
push edx
call fcn.0040a810
add esp, 0xc
push 0x567f70
push str.WHGAMETYPE
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x654], eax
cmp eax, ebx
je 0x403b03
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x654]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 0x650], ebx
je 0x403b03
cmp eax, ebx
je 0x403b03
mov ecx, dword [eax]
mov dword [esi + 0x9c], ecx
mov ecx, dword [ebp - 0x65c]
mov dword [ebp - 0x654], ebx
cmp dword [ecx - 0xc], ebx
je 0x403c26
push ecx
push 0x568180
push 0xffffffffffffffff
lea edx, [ebp - 0x420]
push 0x104
push edx
mov dword [ebp - 0x64c], ebx
call fcn.005128f5
add esp, 0x14
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x420]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [ebp - 0x64c], ebx
je 0x403c26
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x650], 0x208
mov word [ebp - 0x218], dx
call fcn.00513920
add esp, 0xc
lea ecx, [ebp - 0x650]
push ecx
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x668]
push eax
push ebx
push 0x5681f0
push ecx
mov dword [ebp - 0x658], 0x104
mov dword [ebp - 0x668], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0x218]
push eax
push str.MainShortcut
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov edx, dword [ebp - 0x64c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x650], ebx
je 0x403c26
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0xa0]
call fcn.00409d90
lea ecx, [ebp - 0x628]
push ecx
lea ecx, [esi + 0x410]
call fcn.0041a437
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x664]
cmp dword [eax - 0xc], ebx
je 0x403e41
push eax
push 0x56822c
push 0xffffffffffffffff
lea edx, [ebp - 0x628]
push 0x104
push edx
call fcn.005128f5
add esp, 0x14
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x628]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x650]
cmp eax, ebx
je 0x403e41
lea edx, [ebp - 0x64c]
push edx
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x658]
push edx
push ebx
push 0x568258
push eax
mov dword [ebp - 0x64c], 0x208
mov dword [ebp - 0x658], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x650]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x64c], ebx
je 0x403e41
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [esi + 0x410]
call fcn.0041a437
cmp dword [esi + 0x9c], 1
jne 0x403d30
push ebx
lea ecx, [esi + 0x410]
call fcn.0041a544
mov edx, dword [esi + 0x494]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0x494]
push ebx
call eax
mov edx, dword [esi + 0x4dc]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0x4dc]
push ebx
call eax
mov edx, dword [esi + 0x530]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0x530]
push ebx
call eax
mov dword [esi + 0x524], ebx
mov dword [esi + 0x578], ebx
push 0x567f70
push 0x5682b4
push edi
mov dword [esi + 0x590], ebx
mov dword [esi + 0x594], ebx
mov dword [esi + 0x588], ebx
mov dword [esi + 0x58c], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x658], eax
cmp eax, ebx
je 0x403d9c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x658]
push ecx
push edi
mov dword [ebp - 0x668], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 0x668], ebx
je 0x403d9c
cmp eax, ebx
je 0x403d9c
mov edx, dword [eax]
mov dword [esi + 0x588], edx
mov eax, dword [eax + 4]
mov dword [esi + 0x58c], eax
add dword [esi + 0x588], 0x25a000
adc dword [esi + 0x58c], ebx
call fcn.004041e0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x664]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403dd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x65c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403dfc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x660]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005121e3
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x654], ebx
jne 0x403cd9
cmp dword [esi + 0x9c], 1
jne 0x403e7a
push 0x30
push 0x568270
push 0x568278
mov ecx, esi
call fcn.00415cb0
mov edx, dword [esi]
mov eax, dword [edx + 0x180]
mov ecx, esi
call eax
jmp 0x403db1
mov eax, dword [esi + 0x20]
push ebx
push 0x26
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0041ced4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x403ea8
push 0x80004005
call fcn.0040ab10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x64c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x403ec7
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x64c]
call fcn.00409ca0
push 1
push 0x5682b0
lea ecx, [ebp - 0x64c]
call fcn.0040a410
mov ecx, dword [ebp - 0x660]
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x64c]
call fcn.0040a410
mov edx, dword [ebp - 0x64c]
push edx
lea ecx, [esi + 0x410]
call fcn.0041a437
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403d30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x403d30