Function at 0x40fae8
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd2c
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0x4ab61c
mov eax, 0x4abb0c
call fcn.0045a304
mov word [ebp - 0x54], 8
lea edx, [esi + 0x113]
lea eax, [ebp - 0xc]
call fcn.00477a1c
inc dword [ebp - 0x48]
lea edx, [ebp - 0xc]
push edx
xor ecx, ecx
mov dword [ebp - 8], ecx
lea eax, [ebp - 8]
inc dword [ebp - 0x48]
call fcn.0044fb04
lea eax, [ebp - 8]
xor edx, edx
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x48]
pop edx
call fcn.00477b2c
lea ecx, [ebp - 0x10]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x41c27c]
call fcn.0040fa10
mov dword [ebp - 0x78], eax
dec dword [ebp - 0x48]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00477ad4
dec dword [ebp - 0x48]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00477ad4
dec dword [ebp - 0x48]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00477ad4
lea ecx, [ebp - 0x68]
lea eax, [esi + 0x120]
push ecx
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyA
mov edi, eax
test eax, eax
jne 0x40fbdd
mov dword [ebp - 0x70], 3
mov dword [ebp - 0x6c], 2
lea edx, [ebp - 0x6c]
lea ecx, [ebx + 0x10c]
push edx
push ecx
lea eax, [ebp - 0x70]
lea edx, [esi + 0x13b]
push eax
push 0
push edx
mov ecx, dword [ebp - 0x68]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, dword [ebp - 0x68]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
test edi, edi
je 0x40fec3
mov word [ebp - 0x54], 0x20
lea edx, [esi + 0x158]
lea eax, [ebp - 0x20]
call fcn.00477a1c
inc dword [ebp - 0x48]
xor ecx, ecx
mov edx, dword [eax]
lea eax, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], ecx
push eax
lea eax, [ebp - 0x1c]
inc dword [ebp - 0x48]
lea edx, [esi + 0x14c]
call fcn.00477a1c
inc dword [ebp - 0x48]
mov edx, dword [eax]
push edx
lea edx, [esi + 0x144]
lea eax, [ebp - 0x18]
call fcn.00477a1c
inc dword [ebp - 0x48]
mov edx, dword [eax]
mov eax, dword [ebp - 0x78]
pop ecx
mov edi, dword [eax]
call dword [edi]
dec dword [ebp - 0x48]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00477ad4
dec dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00477ad4
dec dword [ebp - 0x48]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00477ad4
mov word [ebp - 0x54], 0x14
lea ecx, [ebp - 0x118]
lea eax, [ebp - 0x138]
push ecx
push 0x20
push eax
lea edx, [esi + 0x16d]
push edx
lea ecx, [esi + 0x161]
push ecx
lea eax, [esi + 0x159]
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
jne 0x40fcad
mov dx, word [ebx]
mov word [ebx + 0x10c], dx
jmp 0x40fead
lea ecx, [esi + 0x16e]
push ecx
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fccd
mov word [ebx + 0x10c], 0
lea edx, [esi + 0x173]
push edx
lea ecx, [ebp - 0x138]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fced
mov word [ebx + 0x10c], 0xffff
lea eax, [esi + 0x17b]
push eax
lea edx, [ebp - 0x138]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fd0d
mov word [ebx + 0x10c], 0x404
lea ecx, [esi + 0x184]
push ecx
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fd2d
mov word [ebx + 0x10c], 0x804
lea edx, [esi + 0x18d]
push edx
lea ecx, [ebp - 0x138]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fd4d
mov word [ebx + 0x10c], 0x406
lea eax, [esi + 0x194]
push eax
lea edx, [ebp - 0x138]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fd6d
mov word [ebx + 0x10c], 0x413
lea ecx, [esi + 0x19a]
push ecx
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fd8d
mov word [ebx + 0x10c], 0x40c
lea edx, [esi + 0x1a1]
push edx
lea ecx, [ebp - 0x138]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fdad
mov word [ebx + 0x10c], 0x407
lea eax, [esi + 0x1a8]
push eax
lea edx, [ebp - 0x138]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fdcd
mov word [ebx + 0x10c], 0x410
lea ecx, [esi + 0x1b0]
push ecx
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fded
mov word [ebx + 0x10c], 0x411
lea edx, [esi + 0x1b9]
push edx
lea ecx, [ebp - 0x138]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fe0d
mov word [ebx + 0x10c], 0x412
lea eax, [esi + 0x1c0]
push eax
lea edx, [ebp - 0x138]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fe2d
mov word [ebx + 0x10c], 0x412
lea ecx, [esi + 0x1cb]
push ecx
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fe4d
mov word [ebx + 0x10c], 0x419
lea edx, [esi + 0x1d3]
push edx
lea ecx, [ebp - 0x138]
push ecx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fe6d
mov word [ebx + 0x10c], 0x40a
lea eax, [esi + 0x1db]
push eax
lea edx, [ebp - 0x138]
push edx
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fe8d
mov word [ebx + 0x10c], 0x41d
lea ecx, [esi + 0x1e3]
push ecx
lea eax, [ebp - 0x138]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40fead
mov word [ebx + 0x10c], 0x41e
dec dword [ebp - 0x48]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00477ad4
mov word [ebp - 0x54], 0
mov cx, word [ebx + 0x10c]
mov word [ebx + 0x10e], cx
cmp word [ebx + 0x10c], 0
jne 0x40fee7
mov dword [ebx + 0x108], 1
jmp 0x40feef
xor eax, eax
mov dword [ebx + 0x108], eax
mov word [ebp - 0x54], 0x2c
xor edx, edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov eax, ebx
inc dword [ebp - 0x48]
mov dx, word [ebx + 0x10e]
call fcn.004101f0
lea edx, [ebp - 0x24]
lea eax, [ebx + 0x120]
call fcn.00477b04
dec dword [ebp - 0x48]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00477ad4
mov dword [ebp - 0x1cc], 0x94
lea ecx, [ebp - 0x1cc]
push ecx
call sub.KERNEL32.DLL_GetVersionExA
or edi, 0xffffffff
cmp dword [ebp - 0x1c8], 4
ja 0x40ff72
cmp dword [ebp - 0x1c4], 0x5a
jae 0x40ff72
lea eax, [ebp - 0x68]
lea edx, [esi + 0x1e8]
push eax
push 1
push 0
push edx
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov edi, eax
test edi, edi
jne 0x410006
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x6c], 0x20
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
mov eax, dword [ebp - 0x68]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, dword [ebp - 0x68]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
test edi, edi
jne 0x40ffc7
lea edx, [ebp - 0x94]
push edx
call fcn.004106b0
pop ecx
mov word [ebx + 0x110], ax
mov word [ebp - 0x54], 0x38
xor ecx, ecx
mov eax, ebx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x28]
inc dword [ebp - 0x48]
mov dx, word [ebx + 0x110]
call fcn.004101f0
lea edx, [ebp - 0x28]
lea eax, [ebx + 0x11c]
call fcn.00477b04
dec dword [ebp - 0x48]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00477ad4
jmp 0x410075
lea ecx, [esi + 0x20d]
push ecx
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
test edi, edi
je 0x410038
lea eax, [esi + 0x21a]
push eax
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x74], eax
call dword [ebp - 0x74]
mov word [ebx + 0x112], ax
push edi
call sub.KERNEL32.DLL_FreeLibrary
mov word [ebp - 0x54], 0x44
xor edx, edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
mov eax, ebx
inc dword [ebp - 0x48]
mov dx, word [ebx + 0x112]
call fcn.004101f0
lea edx, [ebp - 0x2c]
lea eax, [ebx + 0x11c]
call fcn.00477b04
dec dword [ebp - 0x48]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00477ad4
push 0x104
lea ecx, [ebp - 0x2d4]
push ecx
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov word [ebp - 0x54], 0x5c
lea edx, [esi + 0x233]
lea eax, [ebp - 0x34]
call fcn.00477a1c
inc dword [ebp - 0x48]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x2d4]
lea eax, [ebp - 0x30]
call fcn.00477a1c
inc dword [ebp - 0x48]
xor ecx, ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
inc dword [ebp - 0x48]
pop edx
call fcn.00477b2c
dec dword [ebp - 0x48]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00477ad4
dec dword [ebp - 0x48]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00477ad4
mov word [ebp - 0x54], 0x50
lea eax, [ebp - 0x2d4]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.0045a018
pop ecx
movsx eax, byte [ebp + eax - 0x2d5]
cmp eax, 0x5c
jne 0x410129
lea edx, [ebp - 0x2d4]
push edx
call fcn.0045a018
pop ecx
mov byte [ebp + eax - 0x2d5], 0
mov word [ebp - 0x54], 0x68
lea edx, [ebp - 0x2d4]
lea eax, [ebp - 0x38]
call fcn.00477a1c
inc dword [ebp - 0x48]
lea edx, [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.00477b04
dec dword [ebp - 0x48]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00477ad4
mov word [ebp - 0x54], 0x74
lea edx, [esi + 0x239]
lea eax, [ebp - 0x3c]
call fcn.00477a1c
inc dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 4]
inc dword [ebp - 0x48]
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x40]
call fcn.00477b2c
lea edx, [ebp - 0x40]
lea edi, [ebx + 0x118]
mov eax, edi
call fcn.00477b04
dec dword [ebp - 0x48]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00477ad4
dec dword [ebp - 0x48]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00477ad4
mov edx, edi
lea eax, [ebx + 0x114]
call fcn.00477b04
mov eax, 1
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x48]
call fcn.00477ad4
pop eax
mov edx, dword [ebp - 0x64]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret