Function at 0x52cf70
Capabilities:
Check if file exists
Create process on windows
Delete registry key
Get common file path
Get startup folder
Query or enumerate registry key
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e457
mov eax, dword fs:[0]
push eax
sub esp, 0x328
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x334], ecx
lea eax, [ebp - 0x284]
push eax
call fcn.00401c70
mov ecx, eax
call fcn.00401b60
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x52cfc6
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x314]
call fcn.00401ff0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52cff4
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 0x274], 0
call fcn.00401c70
mov ecx, eax
call fcn.00403ec0
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x52d030
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x324]
call fcn.00401ff0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x258]
cmp eax, 8
jb 0x52d05e
inc eax
lea ecx, [ebp - 0x26c]
push eax
push dword [ebp - 0x26c]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], ax
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x25c], 0
call fcn.00401c70
mov ecx, eax
call fcn.00401ba0
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x52d09a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x310]
call fcn.00401ff0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52d0c8
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 0x274], 0
call fcn.00401c70
mov ecx, eax
call fcn.00448b30
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 8
jb 0x52d104
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x320]
call fcn.00401ff0
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x258]
cmp eax, 8
jb 0x52d132
inc eax
lea ecx, [ebp - 0x26c]
push eax
push dword [ebp - 0x26c]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x258], 7
mov word [ebp - 0x26c], ax
lea eax, [ebp - 0x284]
push eax
mov dword [ebp - 0x25c], 0
call fcn.00401c70
mov ecx, eax
call fcn.00448b70
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 8
jb 0x52d16e
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x31c]
call fcn.00401ff0
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52d19c
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 0x274], 0
call fcn.00401c70
mov ecx, eax
call fcn.00403e80
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 8
jb 0x52d1d8
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x300]
call fcn.00401ff0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x258]
cmp eax, 8
jb 0x52d206
inc eax
lea ecx, [ebp - 0x26c]
push eax
push dword [ebp - 0x26c]
call fcn.00403010
mov edx, dword [ebp - 0x314]
xor eax, eax
mov esi, 1
mov word [ebp - 0x26c], ax
mov ecx, esi
mov dword [ebp - 0x258], 7
mov dword [ebp - 0x25c], 0
sub ecx, dword [edx - 4]
mov eax, dword [edx - 8]
or eax, ecx
jge 0x52d24d
push 0
lea ecx, [ebp - 0x314]
call fcn.00402c70
mov edx, dword [ebp - 0x314]
lea ecx, [ebp - 0x2cc]
call fcn.004ccd50
mov byte [ebp - 4], 0x12
mov ecx, esi
mov edx, dword [ebp - 0x324]
sub ecx, dword [edx - 4]
mov eax, dword [edx - 8]
or eax, ecx
jge 0x52d281
push 0
lea ecx, [ebp - 0x324]
call fcn.00402c70
mov edx, dword [ebp - 0x324]
lea ecx, [ebp - 0x2fc]
call fcn.004ccd50
mov edx, 0x5755f8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2e4]
call fcn.004ccd50
mov byte [ebp - 4], 0x14
mov ecx, esi
mov edx, dword [ebp - 0x310]
sub ecx, dword [edx - 4]
mov eax, dword [edx - 8]
or eax, ecx
jge 0x52d2c9
push 0
lea ecx, [ebp - 0x310]
call fcn.00402c70
mov edx, dword [ebp - 0x310]
lea ecx, [ebp - 0x2b4]
call fcn.004ccd50
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], str.QMEmulatorService.exe
mov dword [ebp - 0x250], str.adb.exe
mov dword [ebp - 0x24c], 0x575704
mov dword [ebp - 0x248], str.TUpdate.exe
mov dword [ebp - 0x244], str.AndroidEmulator.exe
mov dword [ebp - 0x240], str.TxGaDcc.exe
mov dword [ebp - 0x23c], str.TBoxHeadless.exe
mov dword [ebp - 0x238], str.TBoxManage.exe
mov dword [ebp - 0x234], str.TBoxBalloonCtrl.exe
mov dword [ebp - 0x230], str.TBoxSVC.exe
mov dword [ebp - 0x22c], str.TBoxNetDHCP.exe
mov dword [ebp - 0x228], str.THypervBox.exe
mov dword [ebp - 0x224], str.AppMarket.exe
mov dword [ebp - 0x220], str.GameLogin.exe
mov dword [ebp - 0x21c], 0x575770
call fcn.004cd720
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0
xor edi, edi
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x258], edi
mov byte [ebp - 4], 0x17
mov edx, esi
mov eax, dword [ebp - 0x300]
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52d3d3
push edi
lea ecx, [ebp - 0x300]
call fcn.00402c70
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push ecx
push 0x20019
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x52d66b
mov edi, dword [ebp - 0x318]
push 0x208
push eax
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x260], edi
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, 1
mov dword [ebp - 0x330], ebx
test eax, eax
jne 0x52d66b
nop
push str.VDI_
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x52d648
call fcn.00401980
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x52d774
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x52d494
lock inc dword [eax + 0x14]
add eax, 8
jmp 0x52d498
mov ecx, eax
call edx
add eax, 0x10
mov dword [ebp - 0x318], eax
mov byte [ebp - 4], 0x18
mov edx, esi
mov eax, dword [ebp - 0x300]
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52d4ca
push 0
lea ecx, [ebp - 0x300]
call fcn.00402c70
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x318]
push 0x575790
push eax
call fcn.004023f0
mov esi, dword [ebp - 0x318]
lea ecx, [ebp - 0x284]
add esp, 0x10
mov edx, esi
call fcn.004ccd50
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x274], 0
sete al
test al, al
jne 0x52d5d3
mov edx, dword [ebp - 0x308]
push ecx
mov ecx, dword [ebp - 0x30c]
call fcn.00406c20
mov eax, dword [ebp - 0x30c]
lea edx, [ebp - 0x30c]
push 0
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x308], eax
call fcn.004cd080
add esp, 8
test eax, eax
jne 0x52d5d3
push 0x5758a0
call fcn.00448be0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x30c]
add esp, 4
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x52d5cd
xor ebx, ebx
mov esi, ebx
nop dword [eax]
cmp dword [ebx + edi + 0x14], 8
lea eax, [ebx + edi]
jb 0x52d58c
mov eax, dword [eax]
push eax
push 0x575878
call fcn.00448bb0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x30c]
inc esi
sub ecx, edi
add esp, 8
imul ecx
add ebx, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x52d580
mov esi, dword [ebp - 0x318]
mov ebx, dword [ebp - 0x330]
mov edi, dword [ebp - 0x260]
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52d5f1
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x270], 7
mov word [ebp - 0x284], ax
add esi, 0xfffffff0
mov dword [ebp - 0x274], 0
or eax, 0xffffffff
mov byte [ebp - 4], 0x17
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x52d643
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x52d641
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x52d643
call edx
mov esi, 1
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc ebx
mov dword [ebp - 0x330], ebx
test eax, eax
je 0x52d450
mov byte [ebp - 4], 0x16
test edi, edi
je 0x52d67a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2a4], 0
sete al
test al, al
jne 0x52d893
push 0x5758bc
lea edx, [ebp - 0x2b4]
lea ecx, [ebp - 0x284]
call fcn.00404640
add esp, 4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x26c]
push 2
xor eax, eax
mov dword [ebp - 0x258], 7
push 0x5758b4
mov dword [ebp - 0x25c], 0
mov word [ebp - 0x26c], ax
call fcn.00405040
push 0x38
lea eax, [ebp - 0x250]
mov dword [ebp - 0x32c], 0
push 0
push eax
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x254], 0x3c
cmp dword [ebp - 0x270], 8
lea eax, [ebp - 0x284]
mov dword [ebp - 0x24c], 0
cmovae eax, dword [ebp - 0x284]
cmp dword [ebp - 0x258], 8
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x26c]
cmovae eax, dword [ebp - 0x26c]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x248], 0x555188
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x250], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x52d77e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x52d79f
push 0x80004005
call fcn.00401b40
push 0xffffffffffffffff
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x258]
cmp eax, 8
jb 0x52d7bd
inc eax
lea ecx, [ebp - 0x26c]
push eax
push dword [ebp - 0x26c]
call fcn.00403010
mov edx, dword [ebp - 0x308]
push ecx
mov ecx, dword [ebp - 0x30c]
call fcn.00406c20
mov eax, dword [ebp - 0x30c]
lea edx, [ebp - 0x30c]
push 0
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x308], eax
call fcn.004cd080
add esp, 8
test eax, eax
jne 0x52d871
push 0x575844
call fcn.00448be0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30c]
add esp, 4
sub ecx, esi
xor ebx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x52d871
xor edi, edi
nop word [eax + eax]
cmp dword [edi + esi + 0x14], 8
lea eax, [edi + esi]
jb 0x52d83c
mov eax, dword [eax]
push eax
push 0x57581c
call fcn.00448bb0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30c]
inc ebx
sub ecx, esi
add esp, 8
imul ecx
add edi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x52d830
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52d893
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
cmp dword [ebp - 0x2bc], 0
sete al
test al, al
jne 0x52d9d3
push 0x575860
lea edx, [ebp - 0x2cc]
lea ecx, [ebp - 0x284]
call fcn.00404640
add esp, 4
push 0x575858
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x1b
call fcn.00404170
push 0
lea edx, [ebp - 0x29c]
lea ecx, [ebp - 0x284]
call fcn.004cddd0
mov eax, dword [ebp - 0x288]
add esp, 4
cmp eax, 8
jb 0x52d906
inc eax
lea ecx, [ebp - 0x29c]
push eax
push dword [ebp - 0x29c]
call fcn.00403010
mov edx, dword [ebp - 0x308]
push ecx
mov ecx, dword [ebp - 0x30c]
call fcn.00406c20
mov eax, dword [ebp - 0x30c]
lea edx, [ebp - 0x30c]
push 0
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x308], eax
call fcn.004cd080
add esp, 8
test eax, eax
jne 0x52d9b1
push str.DelFiles_Failed__r_n
call fcn.00448be0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30c]
add esp, 4
sub ecx, esi
xor ebx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x52d9b1
xor edi, edi
cmp dword [edi + esi + 0x14], 8
lea eax, [edi + esi]
jb 0x52d97c
mov eax, dword [eax]
push eax
push str.Failed_Files:__s__r_n
call fcn.00448bb0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30c]
inc ebx
sub ecx, esi
add esp, 8
imul ecx
add edi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x52d970
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52d9d3
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
cmp dword [ebp - 0x2d4], 0
sete al
test al, al
jne 0x52db33
sub esp, 0x18
mov ecx, esp
push dword [0x59fb74]
call fcn.00404170
call fcn.0052df80
test eax, eax
je 0x52db33
push str.TInst.exe
lea edx, [ebp - 0x2e4]
lea ecx, [ebp - 0x284]
call fcn.00404640
add esp, 4
push 0x57597c
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 0x1c
call fcn.00404170
push 0
lea edx, [ebp - 0x29c]
lea ecx, [ebp - 0x284]
call fcn.004cddd0
mov eax, dword [ebp - 0x288]
add esp, 4
cmp eax, 8
jb 0x52da63
inc eax
lea ecx, [ebp - 0x29c]
push eax
push dword [ebp - 0x29c]
call fcn.00403010
mov edx, dword [ebp - 0x308]
push ecx
mov ecx, dword [ebp - 0x30c]
call fcn.00406c20
mov eax, dword [ebp - 0x30c]
lea edx, [ebp - 0x30c]
push 0
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x308], eax
call fcn.004cd080
add esp, 8
test eax, eax
jne 0x52db11
push 0x5758fc
call fcn.00448be0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30c]
add esp, 4
sub ecx, esi
xor ebx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x52db11
xor edi, edi
nop dword [eax]
cmp dword [edi + esi + 0x14], 8
lea eax, [edi + esi]
jb 0x52dadc
mov eax, dword [eax]
push eax
push 0x5758d4
call fcn.00448bb0
mov ecx, dword [ebp - 0x308]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30c]
inc ebx
sub ecx, esi
add esp, 8
imul ecx
add edi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x52dad0
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x270]
cmp eax, 8
jb 0x52db33
inc eax
lea ecx, [ebp - 0x284]
push eax
push dword [ebp - 0x284]
call fcn.00403010
mov eax, dword [ebp - 0x310]
mov edi, 1
mov edx, edi
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52db5d
push 0
lea ecx, [ebp - 0x310]
call fcn.00402c70
mov eax, dword [ebp - 0x310]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x52db7c
push str.DelReg_AppMarket_Failed__r_n
call fcn.00448be0
add esp, 4
mov eax, dword [ebp - 0x314]
mov edx, edi
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52dba1
push 0
lea ecx, [ebp - 0x314]
call fcn.00402c70
mov eax, dword [ebp - 0x314]
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x52dbba
push str.DelReg_Ui_Failed__r_n
call fcn.00448be0
add esp, 4
mov eax, dword [ebp - 0x320]
mov edx, edi
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52dbdf
push 0
lea ecx, [ebp - 0x320]
call fcn.00402c70
mov eax, dword [ebp - 0x320]
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x52dbf8
push str.DelReg_Update_Failed__r_n
call fcn.00448be0
add esp, 4
mov eax, dword [ebp - 0x31c]
mov edx, edi
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52dc1d
push 0
lea ecx, [ebp - 0x31c]
call fcn.00402c70
mov eax, dword [ebp - 0x31c]
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x52dc36
push str.DelReg_ControlPanelUninstall_Failed__r_n
call fcn.00448be0
add esp, 4
mov eax, dword [ebp - 0x300]
mov edx, edi
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x52dc5b
push 0
lea ecx, [ebp - 0x300]
call fcn.00402c70
mov eax, dword [ebp - 0x300]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
push reloc.WS2_32.dll_bind
call esi
mov eax, dword [ebp - 0x300]
sub edi, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edi
jge 0x52dc8c
push 0
lea ecx, [ebp - 0x300]
call fcn.00402c70
mov eax, dword [ebp - 0x300]
push eax
push reloc.WS2_32.dll_accept
call esi
mov eax, dword [0x59fb74]
cmp dword [eax - 0xc], 0
je 0x52de0d
lea eax, [ebp - 0x2b4]
push eax
call fcn.0052ccb0
lea eax, [ebp - 0x2cc]
push eax
call fcn.0052ccb0
xor eax, eax
mov dword [ebp - 0x270], 7
mov dword [ebp - 0x274], 0
mov word [ebp - 0x284], ax
push 0x208
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x1d
push eax
call fcn.0049e130
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x52de0d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00404170
push 0x575a08
mov edx, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x26c]
call fcn.00404750
add esp, 4
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x288]
cmp eax, 8
jb 0x52dd59
inc eax
lea ecx, [ebp - 0x29c]
push eax
push dword [ebp - 0x29c]
call fcn.00403010
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor eax, eax
cmp dword [ebp - 0x258], 8
mov word [ebp - 0x29c], ax
lea eax, [ebp - 0x26c]
cmovae eax, dword [ebp - 0x26c]
push eax
mov dword [ebp - 0x288], 7
mov dword [ebp - 0x28c], 0
call esi
test eax, eax
je 0x52ddef
push 1
push 0x575a04
lea ecx, [ebp - 0x26c]
call fcn.004043f0
push 6
push 0x5759a4
lea ecx, [ebp - 0x26c]
call fcn.004043f0
cmp dword [ebp - 0x258], 8
lea eax, [ebp - 0x26c]
cmovae eax, dword [ebp - 0x26c]
push eax
call esi
test eax, eax
je 0x52ddef
cmp dword [ebp - 0x258], 8
lea ecx, [ebp - 0x26c]
cmovae ecx, dword [ebp - 0x26c]
call fcn.004cd380
mov eax, dword [ebp - 0x258]
cmp eax, 8
jb 0x52de0d
inc eax
lea ecx, [ebp - 0x26c]
push eax
push dword [ebp - 0x26c]
call fcn.00403010
mov eax, dword [ebp - 0x334]
push 0x40
push 0x57599c
push 0x5759b8
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x30c]
call fcn.004061c0
mov eax, dword [ebp - 0x2a0]
cmp eax, 8
jb 0x52de51
inc eax
lea ecx, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2b4]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x2a0], 7
mov word [ebp - 0x2b4], ax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x2a4], 0
cmp eax, 8
jb 0x52de8c
inc eax
lea ecx, [ebp - 0x2e4]
push eax
push dword [ebp - 0x2e4]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x2d0], 7
mov word [ebp - 0x2e4], ax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2d4], 0
cmp eax, 8
jb 0x52dec7
inc eax
lea ecx, [ebp - 0x2fc]
push eax
push dword [ebp - 0x2fc]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x2e8], 7
mov word [ebp - 0x2fc], ax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2ec], 0
cmp eax, 8
jb 0x52df02
inc eax
lea ecx, [ebp - 0x2cc]
push eax
push dword [ebp - 0x2cc]
call fcn.00403010
xor eax, eax
mov dword [ebp - 0x2b8], 7
lea ecx, [ebp - 0x300]
mov dword [ebp - 0x2bc], 0
mov word [ebp - 0x2cc], ax
call fcn.00402ed0
lea ecx, [ebp - 0x31c]
call fcn.00402ed0
lea ecx, [ebp - 0x320]
call fcn.00402ed0
lea ecx, [ebp - 0x310]
call fcn.00402ed0
lea ecx, [ebp - 0x324]
call fcn.00402ed0
lea ecx, [ebp - 0x314]
call fcn.00402ed0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret