Function at 0x410020
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x42b1a8]
push ebx
push ebp
push esi
push edi
mov ecx, 0x42b1a8
xor ebp, ebp
xor edi, edi
call dword [eax + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebp
push str.SOFTWARERisingRav
add eax, 0x10
push SysStringLen
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebp
call esi
cmp eax, ebp
jne 0x410144
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebp
lea ecx, [esp + 0x24]
push ecx
push ebp
push str.installpath
mov edi, eax
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebp
jne 0x410144
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x4100a8
cmp eax, 2
jne 0x410144
mov eax, dword [esp + 0x18]
cmp eax, ebp
mov dword [esp + 0x18], eax
jbe 0x410144
lea edx, [esp + 0x18]
push edx
dec eax
push eax
lea ecx, [esp + 0x18]
call fcn.0040f9f0
push eax
push str.installpath
lea ecx, [esp + 0x20]
call fcn.0040ed70
test eax, eax
jne 0x410144
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], ebp
je 0x410144
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffffe
push ecx
lea ecx, [esp + 0x14]
call fcn.004043a0
cmp al, 0x5c
je 0x410107
push 0x42450c
lea ecx, [esp + 0x14]
call fcn.004052c0
push str.Smartup.exe
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.0040fb60
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [esp + 0x1c]
setne bl
call fcn.00404430
test bl, bl
je 0x410144
push str.Detected_the_confilct_software_Rav.
jmp 0x41025d
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push ebp
push str.SOFTWARERisingRfw
push SysStringLen
mov dword [esp + 0x2c], ebp
call esi
cmp eax, ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x410284
xor eax, eax
cmp edi, ebp
je 0x410176
push edi
call esi
cmp eax, ebp
mov ecx, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x14], edi
jne 0x410284
lea edx, [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x24]
push eax
push ebp
push str.installpath
push ecx
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebp
jne 0x410284
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x4101be
cmp eax, 2
jne 0x410284
mov eax, dword [esp + 0x18]
cmp eax, ebp
mov dword [esp + 0x18], eax
jbe 0x410284
lea ecx, [esp + 0x18]
push ecx
dec eax
push eax
lea ecx, [esp + 0x18]
call fcn.0040f9f0
push eax
push str.installpath
lea ecx, [esp + 0x20]
call fcn.0040ed70
test eax, eax
jne 0x410284
mov edx, dword [esp + 0x10]
cmp dword [edx - 0xc], ebp
je 0x410284
mov eax, dword [esp + 0x18]
add eax, 0xfffffffe
push eax
lea ecx, [esp + 0x14]
call fcn.004043a0
cmp al, 0x5c
je 0x410225
push 0x42450c
lea ecx, [esp + 0x14]
call fcn.004052c0
push str.Smartup.exe
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.0040fb60
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea ecx, [esp + 0x1c]
setne bl
call fcn.00404430
test bl, bl
je 0x410284
push str.Detected_the_confilct_software_Rfw.
call fcn.0040f5e0
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00404430
lea ecx, [esp + 0x14]
call fcn.0040f290
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4102a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp edi, ebp
je 0x4102a9
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret