Function at 0x424390
Capabilities:
Check if file exists
Get hostname
Get session user name
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x490a15
mov eax, dword fs:[0]
push eax
mov eax, 0x111c
call fcn.00477c10
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x1118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x1130]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1140]
mov ebp, dword [esp + 0x1144]
mov esi, ecx
lea ebx, [esi + 0xdd0]
push ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x50], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0xc5c], 0
mov dword [esp + 0x1138], 0
je 0x4245d2
lea ecx, [esp + 0x34]
call fcn.00421990
lea eax, [esp + 0x34]
push eax
push ebp
mov ecx, esi
mov byte [esp + 0x1140], 1
call fcn.00423b60
mov eax, dword [esi + 0x18]
lea edi, [esi + 8]
mov dword [esp + 0x14], eax
cmp dword [edi + 0xc], eax
jbe 0x424442
call fcn.004789ce
mov ecx, dword [edi]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
cmp ecx, eax
jbe 0x424465
call fcn.004789ce
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0x34]
mov ebx, ecx
cmp ecx, eax
jbe 0x424474
call fcn.004789ce
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push ebp
push ebx
push ecx
push edx
push eax
mov ecx, edi
call fcn.00421eb0
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x424585
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ecx, ebp
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x424574
xor ecx, ecx
mov dword [esp + 0x14], ecx
jmp 0x4244d4
mov ecx, dword [esp + 0x14]
cmp ebx, eax
jb 0x4244e9
call fcn.004789ce
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
cmp dword [edi + ecx + 0x34], 8
jb 0x4244fa
mov edx, dword [edi + ecx + 0x20]
mov dword [esp + 0x1c], edx
jmp 0x424502
lea eax, [edi + ecx + 0x20]
mov dword [esp + 0x1c], eax
sub ebp, edi
mov eax, 0x92492493
imul ebp
add edx, ebp
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x424528
call fcn.004789ce
mov edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
cmp dword [edi + ecx + 0x18], 8
jb 0x424535
mov edi, dword [edi + ecx + 4]
jmp 0x424539
lea edi, [edi + ecx + 4]
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esi + 4]
push edi
call fcn.00426500
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
add dword [esp + 0x14], 0x38
mov ecx, ebp
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
cmp ebx, eax
jb 0x4244d0
mov ecx, dword [esi + 4]
lea edx, [esi + 0x430]
push edx
call fcn.00425f80
xor ebx, ebx
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x4245af
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x40]
push edx
push ecx
push eax
call fcn.00421780
mov edx, dword [esp + 0x50]
push edx
call fcn.00477a90
add esp, 0x14
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call fcn.00477a90
mov ecx, dword [esp + 0x50]
add esp, 4
push ecx
jmp 0x424dab
push ebp
push edi
push str.CInternal::Init
push str._UNO___s__vendor_id_s__tags_s
call fcn.00419c60
mov eax, edi
add esp, 0x10
lea edx, [eax + 2]
jmp 0x4245f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4245f0
sub eax, edx
sar eax, 1
jne 0x424624
push str.CInternal::Init
push str._UNO___s__Product_or_Version_is_not_valid
call fcn.00419c60
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
jmp 0x424db3
cmp dword [esi + 0xc70], 0
jne 0x424684
push 0x58
call fcn.00478bdb
add esp, 4
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1138], 2
test eax, eax
je 0x424652
push 1
mov ecx, eax
call fcn.00426880
jmp 0x424654
xor eax, eax
mov byte [esp + 0x1138], 0
mov dword [esi + 0xc70], eax
test eax, eax
jne 0x424677
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x80004003
jmp 0x424db3
push esi
push 0x424180
mov ecx, eax
call fcn.004268e0
mov ecx, dword [esi + 0xc70]
push 0xffffffffffffffff
call fcn.00426dd0
test eax, eax
jl 0x424613
mov ecx, dword [esi + 0xc70]
push 0xffffffffffffffff
push 1
call fcn.00426bd0
mov ecx, esi
call fcn.0041a7a0
cmp eax, 1
jne 0x4246c3
mov ecx, dword [esi + 0xc70]
push 0xffffffffffffffff
push 3
call fcn.00426bd0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xd26]
push eax
mov word [esp + 0xd28], dx
call fcn.00477c40
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x104
lea ecx, [esp + 0xd20]
push ecx
push 0
call ebp
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea edx, [esp + 0xd1c]
push edx
lea ebx, [esi + 0x840]
call edi
push eax
push 0x495010
push ebx
call fcn.00401570
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x512]
push ecx
mov word [esp + 0x514], ax
call fcn.00477c40
add esp, 0x18
push 0x104
lea edx, [esp + 0x500]
push edx
push 0x400000
call ebp
lea eax, [esp + 0x4fc]
push eax
lea ebp, [esi + 0xa48]
call edi
push eax
push 0x495010
push ebp
call fcn.00401570
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ebx
push ecx
lea ebp, [esi + 0x20]
push ebp
mov ecx, esi
call fcn.0041a4f0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebp
call edi
test eax, eax
jne 0x424795
push ebp
mov ecx, esi
call fcn.0041a6c0
mov edx, dword [esp + 0x14]
push str.ToGo
lea eax, [esi + 0x228]
push edx
push eax
mov ecx, esi
call fcn.0041a4f0
lea eax, [esi + 0x228]
push eax
call edi
test eax, eax
jne 0x4247c8
lea eax, [esi + 0x228]
push eax
mov ecx, esi
call fcn.0041a6c0
push str.UNO.ini
push ebp
lea edi, [esi + 0x638]
push 0x49a034
push edi
call fcn.00401570
add esp, 0x10
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424807
push edi
push 0x492aa0
push 0x49b054
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push edi
call fcn.00424fb0
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
push 1
push str.init
push 0x49b054
call ebp
push edi
push 0xb4
push str.interval
push 0x49b054
mov dword [esi + 0xc54], eax
call ebp
push edi
push 5
push str.init_interval
push 0x49b054
mov dword [esi + 0xdac], eax
call ebp
push edi
push 0x400
push str.size
push 0x49b054
mov dword [esi + 0xdb0], eax
call ebp
mov ecx, dword [esi + 0xdb0]
mov edx, dword [esi + 0xc54]
push eax
mov dword [esi + 0xdb4], eax
mov eax, dword [esi + 0xdac]
push eax
push ecx
push edx
push str.CInternal::Init
push str._UNO___s__FirstUse_d__First_Interval_d__Interval_d__Size_Limit_d
call fcn.00419c60
xor eax, eax
xor ebp, ebp
push ebp
mov word [esp + 0xe8], ax
mov dword [esp + 0xea], eax
mov dword [esp + 0xee], eax
mov dword [esp + 0xf2], eax
mov dword [esp + 0xf6], eax
mov dword [esp + 0xfa], eax
mov dword [esp + 0xfe], eax
mov dword [esp + 0x102], eax
mov word [esp + 0x106], ax
call fcn.00479571
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.0047a84b
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
push edx
mov edx, dword [eax + 0x10]
lea ecx, [ecx + ecx*2]
lea eax, [edx + ecx*4 - 0x54b]
push eax
push 0x49a4b4
lea ecx, [esp + 0xf8]
push str._s.0._d_.2d
push ecx
call fcn.00401570
add esp, 0x34
lea edx, [esp + 0xcc]
push edx
lea ecx, [esi + 0xc74]
call fcn.0041ff70
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esi + 0xcac]
call fcn.0041ff70
push 0x206
lea edx, [esp + 0xf2]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0xf8], cx
call fcn.00477c40
add esp, 0xc
lea eax, [esp + 0xec]
push eax
mov ecx, esi
call fcn.0041c8b0
lea ecx, [esp + 0xec]
push ecx
lea ecx, [esi + 0xc90]
call fcn.0041ff70
push 0x204
lea edx, [esp + 0x914]
push ebp
push edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x918], ebp
call fcn.00477c40
add esp, 0xc
lea eax, [esp + 0x30]
push eax
push 0x20119
push ebp
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x104
cmp eax, ebp
jne 0x4249fc
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x910]
push edx
lea eax, [esp + 0x1c]
push eax
push ebp
push str.MachineGuid
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x90c]
push eax
lea ecx, [esi + 0xcc8]
call fcn.0041ff70
push 0x206
lea edx, [esp + 0x2fa]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0x300], cx
call fcn.00477c40
push 0x206
lea ecx, [esp + 0x716]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x71c], ax
call fcn.00477c40
add esp, 0x18
lea edx, [esp + 0x704]
push edx
lea eax, [esp + 0x2f8]
push eax
mov ecx, esi
call fcn.00420970
lea ecx, [esp + 0x2f4]
push ecx
lea ecx, [esi + 0xce4]
call fcn.0041ff70
lea edx, [esp + 0x704]
push edx
lea ecx, [esi + 0xd00]
call fcn.0041ff70
push 0x206
lea ecx, [esp + 0xb1a]
xor eax, eax
push ebp
push ecx
mov dword [esp + 0x38], edi
mov word [esp + 0xb20], ax
call fcn.00477c40
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0xb18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0xb14]
push ecx
lea ecx, [esi + 0xd1c]
call fcn.0041ff70
push 0x206
lea eax, [esp + 0xf2a]
xor edx, edx
push ebp
push eax
mov dword [esp + 0x38], edi
mov word [esp + 0xf30], dx
call fcn.00477c40
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xf28]
push edx
push 2
call sub.Secur32.dll_GetUserNameExW
lea eax, [esp + 0xf24]
push eax
lea ecx, [esi + 0xd38]
call fcn.0041ff70
lea ecx, [esp + 0x58]
call fcn.00421990
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x58]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x1140], 3
call fcn.00423b60
lea edi, [esi + 8]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0041eba0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea eax, [esp + 0x14]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x2c], edx
call fcn.0041eba0
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x5c]
mov ebp, eax
call fcn.0041eb70
mov edx, dword [ebp + 4]
mov ecx, dword [ebp]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov ecx, edi
call fcn.00422c00
mov ebp, 7
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xac], ebp
mov dword [esp + 0xa8], eax
mov word [esp + 0x98], cx
mov dword [esp + 0xc8], ebp
mov dword [esp + 0xc4], eax
mov word [esp + 0xb4], dx
push str.exe_name
lea ecx, [esp + 0x98]
mov byte [esp + 0x113c], 4
call fcn.0041ff70
push ebx
lea ecx, [esp + 0xb4]
call fcn.0041ff70
push ebx
push str.CInternal::Init
push str._UNO___s__exe_name_s
call fcn.00419c60
add esp, 0xc
lea eax, [esp + 0x94]
push eax
mov ecx, edi
call fcn.004236c0
push str.dll_name
lea ecx, [esp + 0x98]
call fcn.0041ff70
lea ebx, [esi + 0xa48]
push ebx
lea ecx, [esp + 0xb4]
call fcn.0041ff70
push ebx
push str.CInternal::Init
push str._UNO___s__dll_name_s
call fcn.00419c60
add esp, 0xc
lea ecx, [esp + 0x94]
push ecx
mov ecx, edi
call fcn.004236c0
xor edx, edx
mov dword [esp + 0x90], ebp
mov dword [esp + 0x8c], 0
mov word [esp + 0x7c], dx
mov byte [esp + 0x1138], 5
lea ecx, [esp + 0x78]
call fcn.00415680
lea eax, [esp + 0x78]
push eax
mov ecx, esi
call fcn.00420bf0
test eax, eax
je 0x424cb0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esi + 0xd54]
call fcn.00415420
lea ecx, [esp + 0x78]
call fcn.00415680
lea edx, [esp + 0x78]
push edx
mov ecx, esi
call fcn.00420e70
test eax, eax
je 0x424ce0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x80]
push eax
lea ecx, [esi + 0xd8c]
call fcn.00415420
lea ecx, [esp + 0x78]
call fcn.00415680
lea ecx, [esp + 0x78]
push ecx
mov ecx, esi
call fcn.004210f0
test eax, eax
je 0x424d10
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x80]
push edx
lea ecx, [esi + 0xd70]
call fcn.00415420
mov ecx, esi
call fcn.0041c8e0
lea edi, [esi + 0xdb8]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], 0x41cc60
cmp dword [esi + 0xc54], 0
lea ebp, [edi + 4]
je 0x424d4d
mov ebx, dword [esi + 0xdb0]
imul ebx, ebx, 0x3e8
cmp dword [ebp], 0
jne 0x424d7e
push 0
lea eax, [edi + 8]
push eax
jmp 0x424d65
mov ebx, dword [esi + 0xdac]
imul ebx, ebx, 0x3e8
cmp dword [ebp], 0
jne 0x424d7e
push 0
lea ecx, [edi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x20
push ebx
push ebx
push edi
push 0x41a2e0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
lea ecx, [esp + 0x78]
mov dword [esi + 0xc5c], 1
call fcn.004151c0
lea ecx, [esp + 0x94]
call fcn.0041ea00
lea ecx, [esp + 0x58]
call fcn.004227d0
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x1130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1118]
xor ecx, esp
call fcn.00477bf8
add esp, 0x1128
ret 8