Function at 0x4c83d4
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push esi
and eax, 0xfffffffc
push edi
cmp eax, 0xc
jne 0x4c84f0
xor edi, edi
mov esi, ebx
call fcn.004c8ebb
push eax
mov ecx, 0x5fa200
call fcn.0042c9d0
test eax, eax
jne 0x4c84f0
inc edi
call fcn.004c8ebb
lea esi, [ebp - 4]
call fcn.00492ad0
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], 0
jne 0x4c842f
lea eax, [ebp - 4]
jmp 0x4c86dc
lea esi, [ebp - 4]
call fcn.00410540
push eax
call fcn.004f8ab7
mov dword [ebp - 0xc], eax
pop ecx
or eax, 0xffffffff
call fcn.00444a00
cmp dword [ebp - 0xc], 0
jl 0x4c8427
push 2
pop edi
mov esi, ebx
call fcn.004c8ebb
lea esi, [ebp - 8]
call fcn.00492ad0
push 0x103
xor edi, edi
lea eax, [ebp - 0x11b]
push edi
push eax
mov byte [ebp - 0x11c], 0
call fcn.004fe380
add esp, 0xc
push edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x11c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4c84ae
xor esi, esi
lea eax, [ebp - 8]
call fcn.004b8a70
lea eax, [ebp - 4]
call fcn.004b8a70
mov eax, esi
jmp 0x4c86e3
lea esi, [ebp - 8]
call fcn.00410540
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
or eax, 0xffffffff
call fcn.00444a00
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4c8495
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x11c]
call fcn.00410580
xor esi, esi
inc esi
jmp 0x4c8497
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
and eax, 0xfffffffc
cmp eax, 0x14
jne 0x4c86e3
xor edi, edi
mov esi, ebx
call fcn.004c8ebb
push eax
mov ecx, 0x5fa204
call fcn.0042c9d0
test eax, eax
jne 0x4c86e3
inc edi
call fcn.004c8ebb
lea esi, [ebp - 8]
call fcn.00492ad0
push 2
pop edi
mov esi, ebx
call fcn.004c8ebb
lea esi, [ebp - 0xc]
call fcn.00492ad0
mov eax, dword [ebp - 8]
xor esi, esi
cmp dword [eax - 0xc], esi
je 0x4c86c1
mov eax, dword [ebp - 0xc]
cmp dword [eax - 0xc], esi
je 0x4c86c1
lea esi, [ebp - 8]
call fcn.00410540
push eax
call fcn.004f8ab7
mov edi, eax
pop ecx
or eax, 0xffffffff
call fcn.00444a00
cmp edi, 8
ja case.default.0x4c857a
jmp dword [edi*4 + 0x4c86e8]
mov dword [ebp - 4], bind
jmp 0x4c85d0
mov dword [ebp - 4], reloc.WS2_32.dll_accept
jmp 0x4c85d0
mov dword [ebp - 4], reloc.WS2_32.dll_bind
jmp 0x4c85d0
mov dword [ebp - 4], reloc.WS2_32.dll_closesocket
jmp 0x4c85d0
mov dword [ebp - 4], reloc.WS2_32.dll_connect
jmp 0x4c85d0
mov dword [ebp - 4], 0x80000050
jmp 0x4c85d0
mov dword [ebp - 4], WSAAsyncSelect
jmp 0x4c85d0
mov dword [ebp - 4], htons
jmp 0x4c85d0
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysStringLen
push 3
pop edi
mov esi, ebx
call fcn.004c8ebb
lea esi, [ebp - 0x10]
call fcn.00492ad0
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x11c], 0
call fcn.004fe380
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], 0x104
call fcn.00410540
push eax
lea esi, [ebp - 0xc]
call fcn.00410540
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4c86b7
lea eax, [ebp - 0x11c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c8641
sub eax, edx
je 0x4c86b7
or eax, 0xffffffff
lea esi, [ebp - 0xc]
call fcn.00444a00
push 4
pop edi
mov esi, ebx
call fcn.004c8ebb
lea esi, [ebp - 4]
call fcn.00492ad0
call fcn.00410540
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
or eax, 0xffffffff
call fcn.00444a00
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4c86af
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x11c]
call fcn.00410580
mov eax, esi
call fcn.004b8a70
xor esi, esi
inc esi
jmp 0x4c86b9
lea eax, [ebp - 4]
call fcn.004b8a70
xor esi, esi
lea eax, [ebp - 0x10]
call fcn.004b8a70
lea eax, [ebp - 0xc]
call fcn.004b8a70
lea eax, [ebp - 8]
jmp 0x4c84a2
lea eax, [ebp - 0xc]
call fcn.004b8a70
lea eax, [ebp - 8]
call fcn.004b8a70
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret