Function at 0x406a77
Capabilities:
Check if file exists
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4164d0]
push ebx
mov ebx, dword [0x40d2c8]
push esi
push edi
push 0
mov esi, ecx
push 0xc
mov dword [ebp - 0x10], eax
call ebx
push eax
push 0xb
call ebx
push eax
mov edi, 0x80
push 1
push edi
push dword [ebp - 0x10]
call dword [0x40d2c4]
push eax
push 1
push edi
push dword [esi + 4]
call dword [0x40d2c0]
mov eax, dword [0x4164d0]
push 0
push 0x32
mov dword [ebp - 0x10], eax
call ebx
push eax
push 0x31
call ebx
push eax
push 1
push edi
push dword [ebp - 0x10]
call dword [0x40d2c4]
lea ebx, [esi + 0x3f4]
push eax
mov ecx, ebx
call fcn.004082fc
push dword [ebx]
xor ebx, ebx
push ebx
push edi
push dword [esi + 4]
call dword [0x40d2c0]
call dword [0x40d0d8]
push eax
mov ecx, 0x4164c8
call fcn.004072fd
mov ecx, esi
lea edx, [esi + 0x3e8]
neg ecx
sbb ecx, ecx
and ecx, edx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [eax + 4]
call fcn.00407296
push 0x3fc
push dword [esi + 4]
call dword [0x40d29c]
lea ecx, [esi + 0x4a8]
push eax
call fcn.0040870a
call fcn.004010f9
push dword [eax + 4]
mov edi, dword [0x40d258]
call edi
test eax, eax
je 0x406b7e
call fcn.004010f9
mov eax, dword [eax + 4]
push 0x10
mov dword [ebp - 0x10], eax
call fcn.0040b1e4
cmp eax, ebx
je 0x406b76
push ebx
mov ecx, eax
push dword [ebp - 0x10]
call fcn.004084c0
jmp 0x406b78
xor eax, eax
mov dword [esi + 0x484], eax
call fcn.004010f9
push dword [eax + 8]
call edi
test eax, eax
je 0x406bb2
call fcn.004010f9
mov edi, dword [eax + 8]
push 0x10
call fcn.0040b1e4
cmp eax, ebx
je 0x406baa
push ebx
push edi
mov ecx, eax
call fcn.004084c0
jmp 0x406bac
xor eax, eax
mov dword [esi + 0x488], eax
lea eax, [ebp - 0x50]
push ebx
push eax
push 0x10
push 0x30
call dword [0x40d274]
mov ecx, dword [esi + 0x484]
lea edi, [esi + 0x484]
call fcn.00408557
mov ecx, dword [edi]
mov dword [ebp - 8], eax
call fcn.00408533
mov edi, dword [ebp - 0x48]
push dword [esi + 4]
mov ebx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 8]
sub edi, ebx
mov dword [ebp - 0x10], eax
call dword [0x40d278]
push 0
push dword [ebp - 8]
push ebx
push dword [ebp - 0x10]
push edi
push 0xffffffffffffffff
push dword [esi + 4]
call dword [0x40d27c]
push 0x14
push ebx
lea eax, [ebx - 0x32]
push 0
push eax
lea eax, [esi + 0x3f8]
push eax
call dword [0x40d280]
push 1
push dword [esi + 4]
call dword [0x40d29c]
lea edi, [esi + 0x408]
push eax
mov ecx, edi
call fcn.0040870a
test eax, eax
je 0x406c44
mov ecx, edi
call fcn.004080ec
call fcn.004092d5
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
call fcn.004092d5
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x20]
sub ecx, 0x14
mov dword [ebp - 0x10], ecx
call fcn.004092d5
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
call fcn.004092d5
mov ecx, dword [eax + 0x1c]
sub ebx, dword [ebp - 0x28]
push 4
mov eax, dword [eax + 0x20]
push dword [ebp - 8]
sub ebx, 0x19
mov dword [ebp - 0x2c], eax
push ecx
push dword [ebp - 0x10]
push ebx
push 0
push dword [esi + 0x40c]
call dword [0x40d27c]
mov dword [esi + 0x428], 0x11
call fcn.004092d5
mov ecx, eax
call fcn.0040944e
push dword [eax]
mov ecx, edi
call fcn.004073a6
and dword [edi + 0x28], 0
and dword [edi + 0x34], 0
push 1
mov dword [edi + 0x2c], 2
pop ebx
mov dword [edi + 0x30], ebx
call fcn.004092d5
mov eax, dword [eax + 4]
push ebx
push eax
push 0x30
push dword [esi + 0x40c]
call dword [0x40d2c0]
mov ebx, dword [0x40d284]
mov eax, 0xb387d
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
push dword [esi + 0x494]
push dword [esi + 0x40c]
call ebx
call fcn.004092d5
mov eax, dword [eax + 0xc]
lea edi, [esi + 0x4a8]
lea ecx, [edi + 0x24]
push ecx
push 0x5c
push eax
call dword [0x40d058]
mov ecx, edi
call fcn.0040824f
lea eax, [edi + 0x80]
mov ecx, 0xa91616
cmp dword [eax], ecx
je 0x406d5c
push 0x105
push 0
push 0
mov dword [eax], ecx
push dword [edi + 4]
call dword [0x40d288]
push 1
push 1
mov ecx, edi
call fcn.00407737
mov ecx, eax
call fcn.00407785
push dword [esi + 0x498]
push dword [esi + 0x4ac]
call ebx
and dword [ebp - 0x40], 0
xor eax, eax
lea edi, [ebp - 0x3c]
push dword [esi + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x5a
stosd dword es:[edi], eax
call dword [0x40d28c]
mov ebx, eax
test ebx, ebx
je 0x406dcc
mov edi, dword [esi + 0x498]
lea eax, [ebp - 0x40]
push 0x400
push eax
push edi
call dword [0x40d214]
pop ecx
push eax
push edi
push ebx
call dword [0x40d290]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
cmp eax, 0x5a
jl 0x406dcc
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x49c]
push 0x411bc4
push eax
call dword [0x40d210]
pop ecx
test eax, eax
pop ecx
jne 0x406df6
call fcn.004092d5
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x30], ecx
push 0x44
jmp 0x406e09
call fcn.004092d5
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x30], ecx
push 0x84
push 0x12
push dword [ebp - 8]
cdq
push 3
pop ecx
idiv ecx
add eax, dword [ebp - 0x10]
push eax
push 0x21
push 0
push dword [esi + 0x4ac]
call dword [0x40d27c]
push 4
and dword [ebp - 4], 0
pop eax
mov ebx, str.Software_se_wdtc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov edi, 0x80000001
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
push str.ShowTipCount
push ebx
push edi
call dword [0x40d260]
inc dword [ebp - 4]
lea eax, [ebp - 4]
push 4
push eax
push 4
push str.ShowTipCount
push ebx
push edi
call dword [0x40d254]
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
call dword [0x40d1e8]
pop ecx
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push str.LastTimeCheck
push ebx
push edi
call dword [0x40d254]
push 1
pop edi
push edi
push edi
call fcn.0040ac76
mov ecx, eax
call fcn.0040ad7a
call fcn.004092d5
mov eax, dword [eax]
push edi
push eax
push 0x30
push dword [esi + 4]
call dword [0x40d2c0]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10