Function at 0x4097c8
Capabilities:
Get common file path
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov edi, dword [0x40c3e8]
xor eax, eax
push ebp
push 0x409f33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40c42c]
mov dword [eax], 0x7a00
mov eax, dword [0x40c42c]
mov eax, dword [eax]
xor edx, edx
call fcn.0040b9d8
mov eax, dword [0x409f44]
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 3
lea eax, [ebp - 4]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
lea eax, [ebp - 0x28]
lea edx, [ebp - 4]
mov ecx, 4
call fcn.004032fc
mov eax, dword [ebp - 0x28]
mov edx, 0x409f50
call fcn.00403438
je 0x409859
push 0x10
push 0x409f54
push 0x409f60
push 0
call sub.user32.dll_MessageBoxA
call fcn.00402fac
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
mov al, byte [ebp - 0xe]
and al, 1
cmp al, 1
sete byte [0x40c3c8]
mov al, byte [ebp - 0xe]
and al, 2
cmp al, 2
sete byte [0x40c3c4]
mov al, byte [ebp - 0xe]
and al, 4
cmp al, 4
sete byte [0x40c3cc]
mov al, byte [ebp - 0xe]
and al, 0x18
sub al, 8
je 0x4098a6
sub al, 8
je 0x4098b2
jmp 0x4098bc
mov dword [0x40c3d0], 0x1f5
jmp 0x4098bc
mov dword [0x40c3d0], 0x1f6
test byte [ebp - 0xe], 0x20
sete byte [0x40c3d8]
mov al, byte [ebp - 0xe]
and al, 0x40
cmp al, 0x40
sete byte [0x40c3d4]
test byte [ebp - 0xe], 0x80
sete byte [0x40c3dc]
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0x1e]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0x1e]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
movzx eax, word [ebp - 0x1e]
mov edx, dword [0x40c42c]
add dword [edx], eax
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xd]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp byte [ebp - 0xd], 0
jbe 0x409957
push 0
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0xd]
push eax
mov eax, dword [0x40d5dc]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [0x40d5dc]
mov byte [edx + eax], 0
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xd]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp byte [ebp - 0xd], 0
seta byte [0x40c3b8]
cmp byte [0x40c3b8], 0
je 0x409ddb
push 0
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0xd]
push eax
mov eax, dword [0x40d5d4]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [0x40d5d4]
mov byte [edx + eax], 0
mov eax, dword [0x40d5d4]
cmp byte [eax], 0x48
jne 0x409c97
mov eax, dword [0x40d5d4]
cmp byte [eax + 1], 0x4b
jne 0x409c97
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dl, 0x7c
mov eax, dword [0x40d5d4]
call fcn.004069b0
mov ebx, eax
inc ebx
test ebx, ebx
je 0x409a05
mov eax, dword [0x40d5d4]
call fcn.0040687c
mov esi, eax
mov eax, ebx
call fcn.0040687c
sub esi, eax
mov eax, dword [0x40d5d4]
mov byte [eax + esi - 1], 0
mov dl, 0x5c
mov eax, dword [0x40d5d4]
call fcn.004069b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x409a39
mov eax, dword [0x40d5d4]
call fcn.0040687c
mov esi, eax
mov eax, dword [ebp - 0x14]
call fcn.0040687c
sub esi, eax
mov eax, dword [0x40d5d4]
mov byte [eax + esi], 0
mov dl, 0x5c
mov eax, dword [0x40d5d4]
call fcn.00406990
mov esi, eax
test esi, esi
je 0x409a69
mov eax, dword [0x40d5d4]
call fcn.0040687c
push eax
mov eax, esi
call fcn.0040687c
pop edx
sub edx, eax
mov eax, dword [0x40d5d4]
mov byte [eax + edx], 0
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
call fcn.00403290
mov eax, dword [ebp - 0x28]
mov edx, 0x409fa8
call fcn.00403438
jne 0x409a92
mov dword [ebp - 0x1c], 0x80000001
jmp 0x409b51
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
call fcn.00403290
mov eax, dword [ebp - 0x28]
mov edx, 0x409fc4
call fcn.00403438
jne 0x409abb
mov dword [ebp - 0x1c], 0x80000001
jmp 0x409b51
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
call fcn.00403290
mov eax, dword [ebp - 0x28]
mov edx, 0x409fd4
call fcn.00403438
jne 0x409ae1
mov dword [ebp - 0x1c], 0x80000002
jmp 0x409b51
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
call fcn.00403290
mov eax, dword [ebp - 0x28]
mov edx, 0x409ff0
call fcn.00403438
jne 0x409b07
mov dword [ebp - 0x1c], 0x80000002
jmp 0x409b51
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
call fcn.00403290
mov eax, dword [ebp - 0x28]
mov edx, 0x40a000
call fcn.00403438
jne 0x409b2d
mov dword [ebp - 0x1c], 0x80000003
jmp 0x409b51
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
call fcn.00403290
mov eax, dword [ebp - 0x28]
mov edx, 0x40a014
call fcn.00403438
jne 0x409b51
mov dword [ebp - 0x1c], 0x80000003
cmp dword [ebp - 0x1c], 0
je 0x409c81
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
inc esi
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x409c81
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov esi, dword [ebp - 0x14]
inc esi
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x409c81
mov eax, dword [ebp - 0xc]
call fcn.004024e8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dl, 0x3b
mov eax, dword [ebp - 0x18]
call fcn.00406990
test eax, eax
je 0x409bea
mov dl, 0x3b
mov eax, dword [ebp - 0x18]
call fcn.00406990
call fcn.0040687c
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040687c
pop edx
sub eax, edx
mov edx, dword [ebp - 0x18]
mov byte [edx + eax], 0
mov eax, dword [ebp - 0x18]
call fcn.0040687c
cmp eax, 0x104
jle 0x409c03
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x105], 0
mov eax, dword [ebp - 0x18]
call fcn.0040687c
mov ecx, eax
inc ecx
mov edx, dword [0x40d5d4]
mov eax, dword [ebp - 0x18]
call fcn.00402608
mov eax, dword [ebp - 0x18]
call fcn.00402500
test ebx, ebx
je 0x409c78
mov eax, ebx
call fcn.0040687c
mov esi, eax
mov eax, dword [0x40d5d4]
call fcn.0040687c
add esi, eax
add esi, 2
cmp esi, 0x104
jge 0x409c78
mov eax, dword [0x40d5d4]
call fcn.0040bda8
mov eax, dword [0x40d5d4]
call fcn.0040687c
mov edx, dword [0x40d5d4]
lea eax, [edx + eax]
push eax
mov eax, ebx
call fcn.0040687c
mov ecx, eax
inc ecx
mov eax, ebx
pop edx
call fcn.00402608
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 0xc], 5
jge 0x409c97
mov eax, dword [0x40d5d4]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [0x40d5d4]
cmp byte [eax], 0x25
jne 0x409ddb
mov esi, 1
lea eax, [ebp - 0x24]
call fcn.004030dc
jmp 0x409cd0
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
mov edx, ebx
call fcn.00403280
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00403330
inc esi
mov eax, dword [0x40d5d4]
mov bl, byte [eax + esi]
cmp bl, 0x25
jne 0x409cb4
mov eax, dword [ebp - 0x24]
call fcn.004034ec
mov edx, 0x40a018
call fcn.00406924
test eax, eax
jne 0x409d35
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push 0x40a024
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
push 0xff
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x40a050
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.004069d4
jmp 0x409d74
mov eax, dword [ebp - 0x24]
mov edx, 0x40a068
call fcn.00403438
jne 0x409d67
mov eax, 0x104
call fcn.004024e8
mov ebx, eax
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004069d4
jmp 0x409d74
lea eax, [ebp - 0x24]
mov edx, 0x40a078
call fcn.00403330
inc esi
jmp 0x409d93
lea eax, [ebp - 0x28]
mov edx, dword [0x40d5d4]
mov edx, ebx
call fcn.00403280
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00403330
inc esi
mov eax, dword [0x40d5d4]
mov bl, byte [eax + esi]
test bl, bl
jne 0x409d77
jmp 0x409dbd
mov edx, dword [ebp - 0x24]
mov eax, 0x40a084
call fcn.004035b4
mov edx, eax
lea eax, [ebp - 0x24]
mov ecx, 1
call fcn.0040356c
mov edx, dword [ebp - 0x24]
mov eax, 0x40a084
call fcn.004035b4
test eax, eax
jg 0x409da1
mov edx, dword [ebp - 0x24]
mov eax, dword [0x40d5d4]
call fcn.00406904
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xd]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp byte [ebp - 0xd], 0
seta byte [0x40c3bc]
cmp byte [0x40c3bc], 0
je 0x409e1d
push 0
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0xd]
push eax
mov eax, dword [0x40d5d8]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [0x40d5d8]
mov byte [edx + eax], 0
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xd]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp byte [ebp - 0xd], 0
seta byte [0x40c3c0]
cmp byte [0x40c3c0], 0
je 0x409e6e
push 0
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0xd]
push eax
mov eax, dword [0x40d5e0]
push eax
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov al, byte [ebp - 0xd]
mov edx, dword [0x40d5e0]
mov byte [edx + eax], 0
cmp byte [0x40c3d8], 0
je 0x409e8b
call fcn.00409624
cmp byte [0x40c3c0], 0
je 0x409f18
mov word [ebp - 0x1e], 0
mov eax, dword [0x40d5e0]
mov al, byte [eax]
dec al
je 0x409eaf
dec al
je 0x409eb7
jmp 0x409ebd
mov word [ebp - 0x1e], 0x41
jmp 0x409ebd
mov word [ebp - 0x1e], 0x24
mov eax, dword [0x40d5e0]
cmp byte [eax], 7
jae 0x409ee4
mov eax, dword [0x40d5e0]
call fcn.0040687c
mov ecx, eax
mov edx, dword [0x40d5e0]
mov eax, dword [0x40d5e0]
inc eax
call fcn.00402608
movzx eax, word [ebp - 0x1e]
push eax
mov eax, dword [0x40d5dc]
push eax
mov eax, dword [0x40d5e0]
push eax
push 0
call sub.user32.dll_MessageBoxA
mov dword [ebp - 8], eax
cmp word [ebp - 0x1e], 0
je 0x409f18
mov eax, dword [ebp - 8]
sub eax, 2
je 0x409f13
sub eax, 5
jne 0x409f18
call fcn.00402fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f3a
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403100
ret