Function at 0x401622
Capabilities:
Query environment variable
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x318]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
test eax, eax
jbe 0x401792
cmp dword [ebx + 0x18], 0
je 0x4016f5
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.00401a6f
lea eax, [ebp - 0x214]
push eax
call fcn.00401aa4
add esp, 0x10
test eax, eax
jbe 0x4016f5
lea ecx, [ebp - 0x214]
dec ecx
mov dword [ebp - 0xc], ecx
jmp 0x40169b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
jmp 0x40169b
test eax, eax
jbe 0x4016a3
dec eax
cmp byte [ecx + eax], 0x5c
jne 0x401696
test eax, eax
je 0x4016f5
dec eax
mov dword [ebp - 4], eax
mov byte [ebp + eax - 0x214], 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.00401a6f
push dword [ebx + 0x18]
lea eax, [ebp - 0x41c]
push edi
push eax
call fcn.00401574
push dword [ebp + 8]
lea esi, [ebp - 0x41c]
push edi
call fcn.004015e3
add esp, 0x20
test al, al
jne 0x401776
cmp dword [ebp - 4], 0
ja 0x40168e
cmp dword [ebx + 0x14], 0
je 0x401792
mov eax, dword [ebp - 8]
mov ecx, 0x108
sub ecx, eax
push str..ini
push ecx
lea eax, [ebp + eax - 0x31c]
push eax
call fcn.00401a6f
add esp, 0xc
lea eax, [ebp - 0x318]
push eax
push edi
lea eax, [ebp - 0x110]
push eax
push 0x40a4c0
push str.DLLPath
push dword [ebx + 0x14]
mov byte [ebp - 0x110], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
call fcn.00401aa4
pop ecx
test eax, eax
je 0x401792
push dword [ebp + 8]
lea esi, [ebp - 0x110]
push edi
call fcn.004015e3
pop ecx
pop ecx
test al, al
je 0x401792
lea eax, [ebp - 0x110]
jmp 0x40177c
lea eax, [ebp - 0x41c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401a6f
add esp, 0xc
xor eax, eax
jmp 0x401a0e
push edi
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 8], eax
test eax, eax
jbe 0x4017e1
cmp byte [ebp + eax - 0x111], 0x5c
je 0x4017c4
lea ecx, [ebp - 0x110]
dec ecx
dec eax
cmp byte [ecx + eax], 0x5c
jne 0x4017ba
mov dword [ebp - 8], eax
push dword [ebp + 8]
lea esi, [ebp - 0x110]
push edi
mov byte [ebp + eax - 0x111], 0
call fcn.004015e3
pop ecx
pop ecx
test al, al
jne 0x40176e
cmp dword [ebx], 0
je 0x4019f8
mov eax, dword [ebx + 0x10]
and dword [ebp - 4], 0
test eax, eax
je 0x4018d2
push eax
mov esi, 0xc8
lea eax, [ebp - 0x1d8]
push esi
push eax
call fcn.00401a6f
push dword [ebx]
lea eax, [ebp - 0x1d8]
push esi
push eax
call fcn.00401574
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
lea eax, [ebp - 0x1d8]
push eax
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018c1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4018c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 2
mov dword [ebp - 4], esi
jne 0x4018a6
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x318]
push edi
push eax
call fcn.00401a6f
add esp, 0xc
push edi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
push dword [ebp + 8]
lea esi, [ebp - 0x110]
push edi
call fcn.004015e3
pop ecx
pop ecx
test al, al
jne 0x40176e
xor esi, esi
cmp dword [ebp - 4], esi
je 0x4018cf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
mov eax, dword [ebx + 4]
test eax, eax
je 0x401925
push edi
lea ecx, [ebp - 0x110]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
dec eax
cmp eax, 0x102
ja 0x401925
cmp byte [ebp - 0x110], 0x25
je 0x401925
push dword [ebx]
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.00401574
push dword [ebp + 8]
lea esi, [ebp - 0x110]
push edi
call fcn.004015e3
add esp, 0x14
test al, al
jne 0x40176e
xor esi, esi
cmp dword [ebx + 0xc], esi
je 0x4019ba
lea eax, [ebp - 4]
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019aa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push esi
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4019aa
push dword [ebx]
lea eax, [ebp - 0x110]
push edi
push dword [ebx + 0xc]
push edi
push eax
call fcn.00401574
add esp, 0xc
push eax
call fcn.00401574
push dword [ebp + 8]
lea esi, [ebp - 0x110]
push edi
call fcn.004015e3
add esp, 0x14
test al, al
je 0x4019aa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40176e
xor esi, esi
cmp dword [ebp - 4], esi
je 0x4019ba
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 8]
cmp eax, esi
je 0x4019f8
push eax
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.00401a6f
push dword [ebx]
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.00401574
push dword [ebp + 8]
lea esi, [ebp - 0x110]
push edi
call fcn.004015e3
add esp, 0x20
test al, al
jne 0x40176e
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401a6f
add esp, 0xc
mov eax, 0x485
pop edi
pop esi
pop ebx
leave
ret