Function at 0x5ba81bf6
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x5bb70c3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x820]
push eax
call fcn.5ba7c07a
test eax, eax
jl 0x5ba81f4d
push ebx
push esi
push edi
lea eax, [ebp - 0x824]
push eax
xor ebx, ebx
push 0x20019
push 0x5ba4c8c0
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x838], ebx
mov byte [ebp - 0x20c], bl
call fcn.5ba6c9c3
test eax, eax
jne 0x5ba81d79
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x830]
push eax
push ebx
push 0x5ba4dd4c
push dword [ebp - 0x824]
mov edi, 0x104
mov dword [ebp - 0x818], edi
call esi
test eax, eax
jne 0x5ba81d6d
cmp dword [ebp - 0x830], 2
jne 0x5ba81cd5
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [ebp - 0x414]
mov dword [ebp - 0x828], edi
jmp 0x5ba81cdb
mov edi, dword [ebp - 0x828]
push edi
call sub.SHLWAPI.dll_PathFileExistsA
test eax, eax
je 0x5ba81d6a
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x830]
push eax
push 0
push 0x5ba4dd5c
push dword [ebp - 0x824]
mov edi, 0x200
mov dword [ebp - 0x818], edi
call esi
test eax, eax
jne 0x5ba81d2b
inc eax
cmp dword [ebp - 0x818], eax
jbe 0x5ba81d2b
mov dword [ebp - 0x834], eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x830]
push eax
push 0
push 0x5ba4dd68
push dword [ebp - 0x824]
mov dword [ebp - 0x818], edi
call esi
test eax, eax
jne 0x5ba81d6d
inc eax
cmp dword [ebp - 0x818], eax
jbe 0x5ba81d6d
mov dword [ebp - 0x838], eax
jmp 0x5ba81d6d
mov byte [edi], 0
push dword [ebp - 0x824]
call dword [entry0]
mov eax, dword [0x5bb73820]
mov ecx, dword [eax]
lea edx, [ebp - 0x83c]
push edx
push 0xe
push eax
call dword [ecx + 0x14]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov esi, 0x101
jl 0x5ba81e68
cmp dword [ebp - 0x81c], 0
je 0x5ba81db1
test ebx, ebx
jne 0x5ba81e53
mov eax, dword [ebp - 0x83c]
mov ecx, dword [eax]
lea edx, [ebp - 0x82c]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x5ba81e53
mov eax, dword [ebp - 0x82c]
test eax, eax
je 0x5ba81e53
cmp dword [ebp - 0x81c], 0
jne 0x5ba81e10
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x108]
push edx
push 0x143003f0
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x5ba81e10
lea eax, [ebp - 0x108]
push eax
call sub.MSOERT2.dll_FIsEmptyA
test eax, eax
jne 0x5ba81e10
mov dword [ebp - 0x81c], 1
test ebx, ebx
jne 0x5ba81e42
mov eax, dword [ebp - 0x82c]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x310]
push edx
push 0x143203f0
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x5ba81e42
lea eax, [ebp - 0x310]
push eax
call sub.MSOEACCT.dll_ValidEmailAddress
test eax, eax
jl 0x5ba81e42
inc ebx
mov eax, dword [ebp - 0x82c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x5ba81da0
mov eax, dword [ebp - 0x83c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x81c], 0
jne 0x5ba81e7d
push esi
lea eax, [ebp - 0x108]
push eax
push 0x172a
push dword [0x5bb73708]
call edi
cmp dword [ebp - 0x834], 0
jne 0x5ba81e9f
push 0x200
lea eax, [ebp - 0x614]
push eax
push 0x1731
push dword [0x5bb73708]
call edi
cmp dword [ebp - 0x838], 0
jne 0x5ba81ec1
push 0x200
lea eax, [ebp - 0x814]
push eax
push 0x1732
push dword [0x5bb73708]
call edi
mov ecx, dword [ebp - 0x820]
neg ebx
sbb ebx, ebx
lea eax, [ebp - 0x310]
push 1
and ebx, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.5ba7c9d2
test eax, eax
jl 0x5ba81f3f
mov ecx, dword [ebp - 0x820]
xor esi, esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x614]
push eax
call fcn.5ba7c9d2
test eax, eax
jl 0x5ba81f3f
call fcn.5ba5d2cf
test eax, eax
mov eax, 0x5ba41cb0
jne 0x5ba81f19
mov eax, 0x5ba41ca4
push eax
push dword [ebp - 0x828]
push dword [ebp - 0x820]
push dword [ebp - 0x840]
call fcn.5ba81f5e
test eax, eax
jl 0x5ba81f3f
push esi
push esi
push esi
push 0x39
call fcn.5ba5d268
mov ecx, dword [ebp - 0x820]
call fcn.5ba6ed36
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.5bb3f314
leave
ret 4