Function at 0x414b26
Capabilities:
Check if file exists
Delete registry key
Get file attributes
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7e0]
sub esp, 0x85c
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x7dc], eax
mov eax, dword [ebp + 0x7e8]
push ebx
push esi
mov esi, dword [ebp + 0x7f4]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x7ec]
push edi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x7f0]
mov edi, 0x206
xor ebx, ebx
push edi
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x1c6]
push ebx
push eax
mov dword [ebp - 0x50], esi
mov word [ebp + 0x1c4], bx
call sub.MSVCR80.dll_memset
push edi
lea eax, [ebp + 0x3ce]
push ebx
push eax
mov word [ebp + 0x3cc], bx
call sub.MSVCR80.dll_memset
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x402724
lea eax, [ebp - 0x44]
push 0x103
push eax
call fcn.004144cc
add esp, 0x14
mov esi, 0x104
push esi
lea eax, [ebp + 0x1c4]
push eax
call fcn.0041369f
lea eax, [ebp - 0x45]
push eax
lea eax, [ebp - 0x46]
push eax
push dword [ebp - 0x50]
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x45], bl
call fcn.004133ab
test eax, eax
jl 0x414d3c
cmp byte [ebp - 0x45], bl
je 0x414d3c
lea eax, [ebp - 0x4c]
push eax
push 0x20006
push ebx
lea eax, [ebp - 0x44]
push eax
push SysReAllocStringLen
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414c8e
push 4
lea eax, [ebp - 0x60]
push eax
push 4
push ebx
push dword [0x41902c]
mov dword [ebp - 0x60], 1
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x58]
push eax
push 4
push ebx
push dword [0x419048]
mov dword [ebp - 0x58], 2
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x414c85
push 8
lea eax, [ebp - 0x6c]
push eax
push 0xb
push ebx
push dword [0x41904c]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp + 0x5d6]
push ebx
push eax
mov word [ebp + 0x5d4], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp + 0x5d4]
push eax
push dword [ebp - 0x50]
call fcn.004136dc
push 0x40271c
push 0x407298
lea eax, [ebp + 0x5d4]
push eax
push 0x402708
lea eax, [ebp + 0x3cc]
push 0x103
push eax
call dword [sym.imp.MSVCR80.dll_swprintf_s]
add esp, 0x18
push 2
push 0x15
push ebx
call sub.custsat.dll_Ordinal_5
push ebx
push 0x1b
push ebx
call sub.custsat.dll_Ordinal_5
push 1
push 0xf
lea eax, [ebp + 0x3cc]
push eax
push ebx
call sub.custsat.dll_Ordinal_4
lea eax, [ebp + 0x3cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x414d4b
lea eax, [ebp + 0x3cc]
push eax
lea eax, [ebp + 0x5d4]
push eax
call fcn.0041378e
lea eax, [ebp + 0x3cc]
push eax
push esi
push dword [ebp - 0x5c]
call fcn.00414ac8
jmp 0x414d4b
lea eax, [ebp - 0x44]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x54]
lea eax, [ebp + 0x1c4]
push eax
call fcn.00414849
cmp al, 1
jne 0x414dc8
push esi
lea eax, [ebp + 0x5d4]
push ebx
push eax
call fcn.004144e9
add esp, 0xc
lea eax, [ebp + 0x1c4]
push eax
push esi
lea eax, [ebp + 0x5d4]
push eax
call fcn.0040da3b
lea eax, [ebp + 0x1c4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x414d8c
sub eax, edx
sar eax, 1
mov ecx, esi
sub ecx, eax
cmp ecx, 0x7fffffff
ja 0x414db8
push 0x402614
push ecx
lea eax, [ebp + 0x5d4]
push eax
call fcn.0040f96e
lea eax, [ebp + 0x5d4]
push eax
push esi
push dword [ebp - 0x64]
call fcn.00414ac8
mov ecx, dword [ebp + 0x7dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x7e0
leave
ret 0x10