Function at 0x544940
Capabilities:
Get common file path
Get disk size
Get file version info
Link many functions at runtime
Log keystrokes via polling
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612a30
push 0x5cdc5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2268
call fcn.005cd210
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.00582b60
xor ebx, ebx
push ebx
call fcn.00546570
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, 0x800
mov eax, 0xeeeeeeee
lea edi, [ebp - 0x2280]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1280]
mov dword [0x6bd110], eax
push 0x6bd114
push 1
push 1
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.005448c0
mov byte [ebp - 0x19], al
mov edi, dword [ebp + 0x10]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5449c2
sub eax, edx
mov esi, eax
mov dword [ebp - 0x64], esi
lea eax, [esi + 1]
call fcn.00449f00
mov dword [ebp - 0x20], eax
cmp esi, ebx
jle 0x5449ed
mov ecx, edi
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x5449e3
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], bl
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x67e4b8], edi
mov dword [0x6e13c4], ebx
mov eax, dword [ebp + 8]
mov dword [0x6e13c0], eax
mov ecx, dword [ebp + 0x14]
mov dword [0x6e13cc], ecx
mov dword [0x6e13d0], 0x545330
mov dword [0x6e13c8], ebx
mov byte [0x6e1455], bl
mov byte [0x6e1454], bl
mov eax, dword [0x61081c]
mov dword [0x6e13d4], eax
mov cl, byte [0x610820]
mov byte [0x6e13d8], cl
mov dword [0x6e1414], eax
mov byte [0x6e1418], cl
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x67e4b4], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x4c], 4
lea edx, [ebp - 0x3c]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftMicrosoft_GamesHalo_CE
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x38]
push ecx
push ebx
push ebx
push str.FIRSTRUN
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x38], ebx
jne 0x544b07
xor edi, edi
mov dword [ebp - 0x48], edi
push str.eula.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x58], esi
cmp esi, ebx
je 0x544afb
push str.EBUEula
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x544af4
push 1
push ebx
push 0x68b768
push str.SoftwareMicrosoftMicrosoft_GamesHalo_CE
call eax
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x48], edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
jne 0x544b07
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x6bd09c
mov edi, dword [ebp - 0x20]
call fcn.00545df0
mov dword [0x6bd098], eax
push str._devmode
xor edi, edi
call fcn.00545f60
add esp, 8
test al, al
je 0x544b33
mov byte [0x6bd096], 1
push str._window
xor edi, edi
call fcn.00545f60
add esp, 4
test al, al
jne 0x544b60
push str._windowed
call fcn.00545f60
add esp, 4
test al, al
jne 0x544b60
xor eax, eax
mov esi, 1
jmp 0x544b67
mov esi, 1
mov eax, esi
mov dword [0x6b837c], eax
push str._nosound
xor edi, edi
call fcn.00545f60
movzx ecx, al
mov dword [0x6b46ac], ecx
push str._nonetwork
call fcn.00545f60
movzx edx, al
mov dword [0x6b46b4], edx
push str._novideo
call fcn.00545f60
add esp, 0xc
test al, al
jne 0x544bba
push str._connect
call fcn.00545f60
add esp, 4
test al, al
jne 0x544bba
xor eax, eax
jmp 0x544bbc
mov eax, esi
mov dword [0x6b46b0], eax
push str._nojoystick
xor edi, edi
call fcn.00545f60
movzx eax, al
mov dword [0x6adbac], eax
push str._width640
call fcn.00545f60
movzx ecx, al
mov dword [0x6b46b8], ecx
push str._screenshots
call fcn.00545f60
add esp, 0xc
test al, al
jne 0x544c0e
push str._screenshot
call fcn.00545f60
add esp, 4
test al, al
jne 0x544c0e
xor eax, eax
jmp 0x544c10
mov eax, esi
mov dword [0x6b46a8], eax
push str._checkfpu
xor edi, edi
call fcn.00545f60
movzx edx, al
mov dword [0x6b8374], edx
push str._timedemo
call fcn.00545f60
neg al
sbb eax, eax
neg eax
mov dword [0x6b46a0], eax
push str._nowinkey
call fcn.00545f60
add esp, 0xc
test al, al
jne 0x544c65
push str._nowindowskey
call fcn.00545f60
add esp, 4
test al, al
jne 0x544c65
xor eax, eax
jmp 0x544c67
mov eax, esi
mov dword [0x6b46c0], eax
mov eax, dword [0x6b46bc]
cmp eax, ebx
jne 0x544c90
push str._safemode
xor edi, edi
call fcn.00545f60
add esp, 4
movzx eax, al
mov dword [0x6b46bc], eax
cmp eax, ebx
je 0x544cae
mov dword [0x6b46b8], esi
mov dword [0x6b46b0], esi
mov dword [0x6adbac], esi
mov dword [0x6b837c], esi
mov dword [0x6b46ac], esi
call fcn.00581420
mov eax, dword [0x6bddb0]
cmp eax, 0x80
ja 0x544cca
mov word [0x621f88], 0xc
jmp 0x544cef
cmp eax, 0x100
ja 0x544cdc
mov word [0x621f88], 0x10
jmp 0x544cef
cmp eax, 0x200
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [0x621f88], ax
mov word [0x621f8c], 0x30
push 0x610740
xor edi, edi
call fcn.00545f60
add esp, 4
test al, al
jne 0x5451a7
push str._help
call fcn.00545f60
add esp, 4
test al, al
jne 0x5451a7
call fcn.00445400
push str.d3d9.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x6e1464], eax
push str.Direct3DCreate9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6e1474], eax
cmp dword [0x6e1464], ebx
je 0x544d56
cmp eax, ebx
jne 0x544d68
push esi
push 0x7a
push 0x6b
call fcn.00582630
add esp, 0xc
mov eax, dword [0x6e1474]
push 0x1f
call eax
mov esi, eax
mov dword [ebp - 0x60], esi
cmp esi, ebx
je 0x544d99
xor ecx, ecx
mov edx, esi
call fcn.00580fb0
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x544d91
push ebx
push eax
push 0xffffffffffffffff
call fcn.00582630
add esp, 0xc
mov dword [0x6bd0a0], esi
jmp 0x544dad
push 1
push 0x82
push 0x81
call fcn.00582630
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x17c]
push ecx
mov edx, dword [0x6e1464]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x17c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
mov dword [ebp - 0x68], esi
call fcn.00449f00
mov edi, eax
mov dword [ebp - 0x74], edi
push edi
push esi
push ebx
lea edx, [ebp - 0x17c]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0x5fe768
push edi
call sub.VERSION.dll_VerQueryValueA
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0xc]
and eax, 0xffff
cmp eax, dword [0x68aed0]
jae 0x544e2b
push 1
push 0x7a
push 0x6b
call fcn.00582630
add esp, 0xc
mov eax, edi
call fcn.00449f10
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x544e4e
push ebx
push 0x7e
push 0x87
call fcn.00582630
add esp, 0xc
push str.DisableD3DSpy
mov ecx, dword [0x6e1464]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x5c], eax
cmp eax, ebx
je 0x544e6b
call eax
cmp dword [0x6b46ac], ebx
je 0x544e87
mov dword [0x6e145c], ebx
mov dword [0x6e1470], ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x544ec0
push str.dsound.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov dword [0x6e145c], eax
push str.DirectSoundCreate8
push eax
call esi
mov dword [0x6e1470], eax
cmp dword [0x6e145c], ebx
je 0x544eb2
cmp eax, ebx
jne 0x544ec0
push 1
push 0x7a
push 0x7b
call fcn.00582630
add esp, 0xc
push str.dinput8.dll
call edi
mov dword [0x6e1458], eax
push str.DirectInput8Create
push eax
call esi
mov dword [0x6e1468], eax
cmp dword [0x6e1458], ebx
je 0x544ee5
cmp eax, ebx
jne 0x544ef3
push 1
push 0x7a
push 0x7c
call fcn.00582630
add esp, 0xc
push str.shfolder.dll
call edi
mov dword [0x6e1460], eax
push str.SHGetFolderPathA
push eax
call esi
mov dword [0x6e146c], eax
cmp dword [0x6e1460], ebx
je 0x544f18
cmp eax, ebx
jne 0x544f26
push 1
push 0x7e
push 0x7d
call fcn.00582630
add esp, 0xc
call fcn.00582410
test eax, eax
je 0x544f3c
push ebx
push 0x73
push 0x6a
call fcn.00582630
add esp, 0xc
nop
nop
nop
jmp 0x544f5e
mov edx, dword [0x68aec4]
add edx, 0xfffffff0
cmp dword [0x6bddb0], edx
jae 0x544f7c
push ebx
push 0x6e
push 0x65
call fcn.00582630
add esp, 0xc
mov eax, dword [0x6bddb4]
cmp eax, dword [0x68aed8]
jae 0x544fbc
call fcn.00581420
mov ecx, dword [0x6bddb4]
cmp ecx, dword [0x68aed8]
jae 0x544fbc
call fcn.00581420
mov edx, dword [0x6bddb4]
cmp edx, dword [0x68aed8]
jae 0x544fbc
push ebx
push 0x6f
push 0x66
call fcn.00582630
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebx
push ebx
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [0x68aecc]
shl eax, 0x14
xor ecx, ecx
mov edx, dword [ebp - 0x50]
cmp edx, ecx
jg 0x545008
jl 0x544ffb
mov ecx, dword [ebp - 0x54]
cmp ecx, eax
jae 0x545008
push ebx
push 0x76
push 0x6d
call fcn.00582630
add esp, 0xc
call fcn.00582fb0
mov dword [0x6e13a8], eax
cmp byte [eax], bl
jne 0x545027
push 1
push 0x7e
push 0xa0
call fcn.00582630
add esp, 0xc
call fcn.005462d0
jmp 0x545031
call fcn.00544490
test al, al
je 0x54514a
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
mov dword [0x621f74], ebx
push str._port
lea edi, [ebp - 0x24]
call fcn.00545f60
add esp, 4
test al, al
je 0x54507a
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x54507a
push eax
call fcn.005ca906
add esp, 4
mov dword [0x633808], eax
mov byte [0x6b7298], 1
push str._cport
lea edi, [ebp - 0x24]
call fcn.00545f60
add esp, 4
test al, al
je 0x5450aa
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x5450aa
push eax
call fcn.005ca906
add esp, 4
mov dword [0x63380c], eax
mov byte [0x6b7298], 1
push 0x6106f4
lea edi, [ebp - 0x34]
call fcn.00545f60
add esp, 4
mov edi, dword [ebp - 0x34]
test al, al
je 0x545103
cmp edi, ebx
je 0x545103
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x621f74], eax
cmp eax, ebx
je 0x545103
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shl ecx, 8
xor edx, edx
mov eax, dword [0x621f74]
shr eax, 0x10
mov dh, al
or ecx, edx
movzx eax, ah
or ecx, eax
mov dword [0x621f68], ecx
mov dword [0x621f74], ecx
mov byte [ebp - 0x30], bl
xor ecx, ecx
mov dword [ebp - 0x2f], ecx
mov dword [ebp - 0x2b], ecx
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x34
mov byte [ebp - 0x2e], 0x52
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x39
mov byte [ebp - 0x2b], 0x4a
mov byte [ebp - 0x2a], bl
mov edx, dword [0x633808]
push edx
lea esi, [ebp - 0x30]
mov eax, str.halom
call fcn.00579cd0
add esp, 4
call fcn.004caa10
call fcn.005445c0
mov eax, dword [ebp - 0x20]
call fcn.00449f10
mov eax, dword [0x6bd098]
call fcn.00449f10
call fcn.005464f0
mov eax, dword [0x6bd110]
cmp eax, ebx
je 0x545185
push 0x6bd114
mov ecx, dword [0x6bd114]
push ecx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x6bd110], ebx
or esi, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x5451db
push ebx
push 0x61081c
push 0x68b788
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
jmp 0x545202
call fcn.005825d0
mov eax, dword [0x6bd108]
cmp eax, ebx
je 0x545202
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6bd108], ebx
mov dword [0x6399bc], esi
mov dword [0x6bd10c], esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10