Function at 0x4016cd
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4016d7
mov eax, dword [esp + 0x3000]
add esp, 0xfffff9ec
mov edi, edx
mov ebp, 0x40704c
mov dword [esp + 4], ecx
mov dword [esp], eax
test edi, edi
je 0x401c1f
jmp case.default.0x401733
or esi, 0xffffffff
xor ebx, ebx
push dword [ebp + ebx*4]
lea eax, [esp + 0x1c]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x401724
mov esi, ebx
jmp 0x40172a
inc ebx
cmp ebx, 0xb
jl 0x40170e
cmp esi, 0xa
ja case.default.0x401733
jmp dword [esi*4 + 0x40173a]
cmp dword [esp + 4], 1
jne case.default.0x401733
lea eax, [esp + 0x2018]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x2018]
call fcn.004020e4
lea edx, [esp + 0x1018]
lea eax, [esp + 0x2018]
call fcn.004032dc
lea edx, [esp + 0x2018]
push edx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je case.default.0x401733
lea ecx, [esp + 0x2018]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne case.default.0x401733
xor ebx, ebx
push ebx
lea eax, [esp + 0x201c]
push eax
push str._s._d.tmp
lea edx, [esp + 0x2424]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
lea ecx, [esp + 0x2418]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401802
inc ebx
jmp 0x4017cf
lea eax, [esp + 0x2418]
push eax
lea edx, [esp + 0x201c]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je case.default.0x401733
call fcn.00403b18
test eax, eax
je case.default.0x401733
push 4
push 0
lea ecx, [esp + 0x2420]
push ecx
call sub.KERNEL32.DLL_MoveFileExA
jmp case.default.0x401733
cmp dword [esp + 4], 0
jne case.default.0x401733
cmp byte [esp + 8], 0
je 0x401867
lea edx, [esp + 0x1018]
mov al, 1
call fcn.00402220
jmp case.default.0x401733
mov eax, edi
call fcn.00401f72
mov ebx, eax
mov al, 1
mov edx, ebx
call fcn.00402220
mov eax, ebx
call fcn.00402fc0
jmp case.default.0x401733
cmp dword [esp + 4], 0
jne case.default.0x401733
lea edx, [esp + 0x1018]
push edx
push dword [esp + 4]
call sub.USER32.DLL_SetWindowTextA
jmp case.default.0x401733
cmp dword [esp + 4], 0
jne case.default.0x401733
mov byte [esp + 0x2818], 0
xor ecx, ecx
mov cl, byte [esp + 0x1018]
cmp ecx, 0x2e
jne 0x4018ed
xor eax, eax
mov al, byte [esp + 0x1019]
cmp eax, 0x5c
jne 0x4018ed
lea edx, [esp + 0x101a]
lea eax, [esp + 0x2818]
call fcn.0040322c
jmp 0x4019c2
xor edx, edx
mov dl, byte [esp + 0x1018]
cmp edx, 0x5c
je 0x401913
cmp byte [esp + 0x1018], 0
je 0x40192b
xor ecx, ecx
mov cl, byte [esp + 0x1019]
cmp ecx, 0x3a
jne 0x40192b
lea edx, [esp + 0x1018]
lea eax, [esp + 0x2818]
call fcn.0040322c
jmp 0x4019c2
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40197a
mov dword [esp + 0x14], 0x400
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x281c]
push edx
lea ecx, [esp + 0x18]
push ecx
push 0
push str.ProgramFilesDir
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [esp + 0x2818], 0
je 0x4019af
lea eax, [esp + 0x2818]
call fcn.004031ac
xor edx, edx
mov dl, byte [esp + eax + 0x2817]
cmp edx, 0x5c
je 0x4019af
mov edx, 0x4070a4
lea eax, [esp + 0x2818]
call fcn.004032dc
lea edx, [esp + 0x1018]
lea eax, [esp + 0x2818]
call fcn.004032dc
lea ecx, [esp + 0x2818]
push ecx
push 0x65
push dword [esp + 8]
call sub.USER32.DLL_SetDlgItemTextA
jmp case.default.0x401733
xor eax, eax
mov al, byte [esp + 0x1018]
call fcn.00403338
test eax, eax
je case.default.0x401733
xor edx, edx
mov dl, byte [esp + 0x1018]
add edx, 0xffffffd0
mov dword [0x407048], edx
jmp case.default.0x401733
mov cl, byte [esp + 0x1018]
sub cl, 1
jb 0x401a39
sub cl, 0x2f
je 0x401a25
dec cl
je 0x401a39
dec cl
je 0x401a50
jmp case.default.0x401733
xor eax, eax
mov dword [0x407868], eax
xor edx, edx
mov dword [0x40786c], edx
jmp case.default.0x401733
xor ecx, ecx
mov dword [0x407868], ecx
mov dword [0x40786c], 1
jmp case.default.0x401733
mov dword [0x407868], 1
xor eax, eax
mov dword [0x40786c], eax
jmp case.default.0x401733
cmp dword [esp + 4], 3
jne case.default.0x401733
lea eax, [esp + 0x1018]
xor edx, edx
call fcn.00401cde
jmp case.default.0x401733
cmp dword [esp + 4], 0
jne case.default.0x401733
lea ecx, [esp + 0x2c18]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [esp + 0x2c18]
call fcn.004020e4
xor ebx, ebx
push ebx
lea eax, [esp + 0x2c1c]
push eax
push str._sRarSFX_d
lea edx, [esp + 0x3024]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
lea ecx, [esp + 0x3018]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401ae2
inc ebx
jmp 0x401aaf
lea eax, [esp + 0x3018]
push eax
push 0x65
push dword [esp + 8]
call sub.USER32.DLL_SetDlgItemTextA
cmp byte [esp + 0x1018], 0
je 0x401b75
mov byte [esp + 0x3418], 0
xor ebx, ebx
jmp 0x401b35
and eax, 0xff
cmp eax, 0x40
jne 0x401b34
lea edx, [esp + 0x1019]
lea eax, [esp + 0x3418]
add edx, ebx
call fcn.0040322c
mov byte [esp + ebx + 0x1018], 0
jmp 0x401b40
inc ebx
mov al, byte [esp + ebx + 0x1018]
test al, al
jne 0x401b0b
push 0x24
lea edx, [esp + 0x341c]
push edx
lea ecx, [esp + 0x1020]
push ecx
push dword [esp + 0xc]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x401b75
mov dword [0x407864], 1
push 1
push dword [esp + 4]
call sub.USER32.DLL_EndDialog
cmp dword [0x407048], 0
jne 0x401b88
mov dword [0x407048], 1
mov byte [0x40703c], 1
jmp case.default.0x401733
cmp dword [esp + 4], 2
jne case.default.0x401733
cmp byte [esp + 0x1018], 0
je 0x401bb3
lea eax, [esp + 0x1018]
push eax
push dword [esp + 4]
call sub.USER32.DLL_SetWindowTextA
mov eax, edi
call fcn.00401f72
mov ebx, eax
push 0x65
push dword [esp + 4]
call sub.USER32.DLL_GetDlgItem
mov cl, 1
mov edx, ebx
call fcn.00402a6c
mov eax, ebx
call fcn.00402fc0
jmp case.default.0x401733
cmp dword [esp + 4], 4
jne case.default.0x401733
lea eax, [esp + 0x1018]
mov dl, 1
call fcn.00401cde
jmp case.default.0x401733
mov byte [0x40701c], 1
lea ecx, [esp + 8]
mov eax, edi
push ecx
lea ecx, [esp + 0x101c]
lea edx, [esp + 0x1c]
call fcn.00401c2a
mov edi, eax
test eax, eax
jne 0x401709
mov byte [0x40701d], 0
add esp, 0x3618
pop ebp
pop edi
pop esi
pop ebx
ret