Function at 0x4511b0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b439
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5898bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov edx, dword [0x5916f0]
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edx, edx
jne 0x45124f
push 0x588310
call ebx
cmp dword [0x5916f0], 0
jne 0x45123a
push 0x1c
call fcn.004436d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x220], esi
test esi, esi
je 0x451232
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x451234
xor esi, esi
mov dword [0x5916f0], esi
push 0x588310
call edi
mov edx, dword [0x5916f0]
test edx, edx
jne 0x45124f
xor eax, eax
jmp 0x4512b7
cmp dword [0x5916ec], 0
jne 0x4512b2
mov eax, dword [edx]
push edx
call dword [eax]
cmp dword [0x5916ec], 0
jne 0x4512a1
push 0x64
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x45128c
mov ecx, eax
call fcn.00421cf0
mov ecx, eax
jmp 0x45128e
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
xchg dword [ebp - 0x228], eax
mov dword [0x5916ec], ecx
mov eax, dword [0x5916f0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [0x5916f0]
mov eax, dword [0x5916ec]
cmp dword [eax + 0x50], 0
je 0x4513fa
push str.delay_active_by___delay_active
call fcn.0044a720
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b2720
mov eax, dword [0x592c14]
add esp, 0x10
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 0x104
test al, 1
jne 0x451310
or eax, 1
mov dword [0x592c10], 0
mov dword [0x592c14], eax
mov byte [ebp - 0x219], 0
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 1
push eax
call fcn.00472b55
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 2
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x219]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x238]
push eax
push 0x44d070
push 0x592c10
call fcn.00473b2b
add esp, 0x10
test eax, eax
je 0x451436
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 3
push eax
call fcn.00472b8f
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x53ec84
push 0x592c18
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4513f4
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4513f4
push str.ComputerZ.set
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push 0x53f6cc
push 0x5431e8
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [0x5916f0]
test edx, edx
jne 0x451477
push 0x588310
call ebx
cmp dword [0x5916f0], 0
jne 0x451462
push 0x1c
call fcn.004436d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x220], esi
test esi, esi
je 0x45145a
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x45145c
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 4
push eax
call fcn.00472bd1
add esp, 4
mov byte [ebp - 4], 2
test al, al
je 0x451855
jmp 0x45183f
xor esi, esi
mov dword [0x5916f0], esi
push 0x588310
call edi
mov edx, dword [0x5916f0]
test edx, edx
jne 0x451477
xor eax, eax
jmp 0x4514df
cmp dword [0x5916ec], 0
jne 0x4514da
mov eax, dword [edx]
push edx
call dword [eax]
cmp dword [0x5916ec], 0
jne 0x4514c9
push 0x64
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x4514b4
mov ecx, eax
call fcn.00421cf0
mov ecx, eax
jmp 0x4514b6
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
xchg dword [ebp - 0x22c], eax
mov dword [0x5916ec], ecx
mov eax, dword [0x5916f0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [0x5916f0]
mov eax, dword [0x5916ec]
cmp dword [eax + 0x40], 0
je 0x45150e
push str.no_ldshelper.
call fcn.0044a720
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00498678
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x451567
push 0x588310
call ebx
cmp dword [0x5916f0], 0
jne 0x451552
push 0x1c
call fcn.004436d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x220], esi
test esi, esi
je 0x45154a
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x45154c
xor esi, esi
mov dword [0x5916f0], esi
push 0x588310
call edi
mov edx, dword [0x5916f0]
test edx, edx
jne 0x451567
xor ecx, ecx
jmp 0x4515ca
cmp dword [0x5916ec], 0
jne 0x4515c4
mov eax, dword [edx]
push edx
call dword [eax]
cmp dword [0x5916ec], 0
jne 0x4515b9
push 0x64
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 7
test eax, eax
je 0x4515a4
mov ecx, eax
call fcn.00421cf0
mov ecx, eax
jmp 0x4515a6
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
xchg dword [ebp - 0x22c], eax
mov dword [0x5916ec], ecx
mov eax, dword [0x5916f0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [0x5916ec]
call fcn.00422730
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040b110
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
mov edi, dword [esi - 0xc]
mov dword [ebp - 4], 8
test edi, edi
js 0x45185a
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x45161b
push edi
lea ecx, [ebp - 0x228]
call fcn.0040a590
mov esi, dword [ebp - 0x228]
lea eax, [edi + 1]
push eax
push esi
call fcn.004dfa9f
add esp, 8
cmp edi, dword [esi - 8]
jg 0x45185a
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
cmp dword [esi - 0xc], eax
jl 0x45165e
push str.zhushou
push esi
call fcn.004b2b73
add esp, 8
test eax, eax
je 0x45165e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x45170e
mov eax, dword [0x592ca0]
test al, 1
jne 0x451679
or eax, 1
mov dword [0x592c9c], 0
mov dword [0x592ca0], eax
mov byte [ebp - 0x219], 0
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 9
push eax
call fcn.00472b55
lea eax, [ebp - 0x224]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x219]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x238]
push eax
push 0x44ce70
push 0x592c9c
call fcn.00473b2b
add esp, 0x10
test eax, eax
je 0x451823
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xb
push eax
call fcn.00472b8f
add esp, 4
mov byte [ebp - 4], 8
cmp dword [esi - 0xc], 0
jl 0x451701
push 0x592ca4
push esi
call fcn.004b2b73
add esp, 8
test eax, eax
je 0x451701
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x45170e
call fcn.0041ed20
test eax, eax
jne 0x4517ee
mov ecx, dword [0x5916f0]
test ecx, ecx
jne 0x451771
push 0x588310
call ebx
cmp dword [0x5916f0], 0
jne 0x451758
push 0x1c
call fcn.004436d0
mov edi, eax
add esp, 4
mov dword [ebp - 0x220], edi
test edi, edi
je 0x451750
lea ecx, [edi + 4]
mov dword [edi], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x451752
xor edi, edi
mov dword [0x5916f0], edi
push 0x588310
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x5916f0]
test ecx, ecx
jne 0x451771
xor eax, eax
jmp 0x4517cd
mov eax, dword [0x5916ec]
test eax, eax
jne 0x4517cd
mov eax, dword [ecx]
push ecx
call dword [eax]
cmp dword [0x5916ec], 0
jne 0x4517bd
push 0x64
call fcn.004436d0
add esp, 4
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x4517ab
mov ecx, eax
call fcn.00421cf0
mov ecx, eax
jmp 0x4517ad
xor ecx, ecx
mov byte [ebp - 4], 8
xchg dword [ebp - 0x220], eax
mov dword [0x5916ec], ecx
mov eax, dword [0x5916f0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [0x5916ec]
cmp dword [eax + 0x44], 0
jne 0x451816
call fcn.00448f40
mov edi, eax
lea ecx, [ebp - 0x219]
push 0
mov ebx, dword [edi]
call fcn.0044e4b0
push eax
push edi
call dword [ebx + 0x44]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4514f2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4514f2
mov ecx, dword [ebp - 0x230]
call fcn.00450ec0
jmp 0x4517ee
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xc
push eax
call fcn.00472bd1
add esp, 4
mov byte [ebp - 4], 0xa
jmp 0x45144d
sub esp, 8
lea eax, [ebp - 0x224]
mov ecx, esp
push eax
call fcn.00408860
call fcn.0040ae00
call fcn.00473bfc
push 0x80070057
call fcn.00408fc0
int3