Function at 0x418cd0
Capabilities:
Get common file path
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x2c4], 0
push edi
lea ecx, [ebp - 0x2c4]
call fcn.00415260
test al, al
je 0x418d9b
push dword [ebp - 0x2c4]
call fcn.004323fa
add esp, 4
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0x220c
call fcn.0043198f
mov edi, eax
add esp, 4
test edi, edi
je 0x418d49
mov dword [edi], vtable.PipeClient.0
mov dword [edi + 4], 0
jmp 0x418d4b
xor edi, edi
lea eax, [ebp - 0x2c8]
mov ecx, edi
push eax
push 0x456900
push 0
push dword [ebp - 0x290]
call fcn.00417640
mov bl, al
test edi, edi
je 0x418d74
mov edx, dword [edi]
mov ecx, edi
push 1
call dword [edx]
test bl, bl
je 0x418d88
push 0
push 0
push dword [esi + 0x40]
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4622b4]
cmp eax, 0xffffffff
jne 0x418e96
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x2b4]
cmp ax, 9
jne 0x418dd9
mov dword [0x4622b4], 1
mov dword [ebp - 0x2c4], 0x45690c
jmp 0x418e09
cmp ax, 6
jne 0x418df5
mov dword [0x4622b4], 1
mov dword [ebp - 0x2c4], 0x45690c
jmp 0x418e09
mov dword [0x4622b4], 0
mov dword [ebp - 0x2c4], 0x456930
lea eax, [ebp - 0x2bc]
xor ebx, ebx
push eax
push 0x20119
push ebx
push 0x456494
push 0x80000002
mov dword [ebp - 0x2bc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp - 0x2bc]
test edi, edi
je 0x418ebe
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], ebx
push eax
push ebx
push ebx
push ebx
push 0x4564f8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418eb7
push dword [ebp - 0x2b8]
call fcn.00432432
add esp, 4
mov dword [ebp - 0x290], eax
test eax, eax
je 0x418eb7
lea ecx, [ebp - 0x2b8]
push ecx
push eax
push ebx
push ebx
push 0x4564f8
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418ead
mov ebx, dword [ebp - 0x290]
jmp 0x418eb7
test eax, eax
je 0x418dff
mov dword [ebp - 0x2c4], 0x45690c
jmp 0x418e09
push 0
call fcn.004323fa
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x45694c
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.0043256a
add esp, 0xc
test ebx, ebx
je 0x418efd
push ebx
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004325c6
push 0x456980
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004325c6
add esp, 0x18
mov edi, dword [ebp - 0x2c4]
lea eax, [ebp - 0x84]
push edi
push 0x40
push eax
call fcn.004325c6
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x28c]
push 0x104
push eax
call fcn.004325c6
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x456988
call fcn.00416f00
add esp, 0x18
lea edi, [esi + 0x68]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x84], 0
jne 0x418f73
push dword [esi + 0x80]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
inc dword [esi + 0x84]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call ebx
push esi
push 0x419040
push dword [esi + 0x2c]
lea edx, [ebp - 0x28c]
push dword [esi + 0x38]
lea ecx, [ebp - 0x84]
call fcn.00417dc0
add esp, 0x10
mov byte [ebp - 0x2bd], al
test al, al
jne 0x418fe4
lea edi, [esi + 0x68]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [esi + 0x84]
jne 0x418fca
push dword [esi + 0x80]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call ebx
mov al, byte [ebp - 0x2bd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov edi, dword [esi + 0x60]
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x418ff7
push eax
call fcn.004323fa
add esp, 4
push 0x4569b4
call fcn.004319e0
mov ecx, dword [edi + 4]
add esp, 4
mov dword [edi + 0x2c], eax
test ecx, ecx
je 0x41901a
push eax
push 0
push 0xc
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x5c]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x2bd]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043183b
mov esp, ebp
pop ebp
ret