Function at 0x4016e4
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4016ee
mov eax, dword [esp + 0x3000]
add esp, 0xfffff9ec
mov edi, edx
mov ebp, 0x407050
mov dword [esp + 4], ecx
mov dword [esp], eax
test edi, edi
je 0x401c41
jmp case.default.0x40174a
or esi, 0xffffffff
xor ebx, ebx
push dword [ebp + ebx*4]
lea eax, [esp + 0x1c]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x40173b
mov esi, ebx
jmp 0x401741
inc ebx
cmp ebx, 0xb
jl 0x401725
cmp esi, 0xa
ja case.default.0x40174a
jmp dword [esi*4 + 0x401751]
cmp dword [esp + 4], 1
jne case.default.0x40174a
lea eax, [esp + 0x2018]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x2018]
call fcn.00402104
lea edx, [esp + 0x1018]
lea eax, [esp + 0x2018]
call fcn.0040331c
lea edx, [esp + 0x2018]
push edx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je case.default.0x40174a
lea ecx, [esp + 0x2018]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
jne case.default.0x40174a
xor ebx, ebx
push ebx
lea eax, [esp + 0x201c]
push eax
push str._s._d.tmp
lea edx, [esp + 0x2424]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
lea ecx, [esp + 0x2418]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401819
inc ebx
jmp 0x4017e6
lea eax, [esp + 0x2418]
push eax
lea edx, [esp + 0x201c]
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je case.default.0x40174a
call fcn.00403b58
test eax, eax
je case.default.0x40174a
push 4
push 0
lea ecx, [esp + 0x2420]
push ecx
call sub.KERNEL32.DLL_MoveFileExA
jmp case.default.0x40174a
cmp dword [esp + 4], 0
jne case.default.0x40174a
cmp byte [esp + 8], 0
je 0x40187e
lea edx, [esp + 0x1018]
mov al, 1
call fcn.00402240
jmp case.default.0x40174a
mov eax, edi
call fcn.00401f94
mov ebx, eax
mov al, 1
mov edx, ebx
call fcn.00402240
mov eax, ebx
call fcn.00403000
jmp case.default.0x40174a
cmp dword [esp + 4], 0
jne case.default.0x40174a
lea edx, [esp + 0x1018]
push edx
push dword [esp + 4]
call sub.USER32.DLL_SetWindowTextA
jmp case.default.0x40174a
cmp dword [esp + 4], 0
jne case.default.0x40174a
mov byte [esp + 0x2818], 0
xor ecx, ecx
mov cl, byte [esp + 0x1018]
cmp ecx, 0x2e
jne 0x401904
xor eax, eax
mov al, byte [esp + 0x1019]
cmp eax, 0x5c
jne 0x401904
lea edx, [esp + 0x101a]
lea eax, [esp + 0x2818]
call fcn.0040326c
jmp 0x4019d9
xor edx, edx
mov dl, byte [esp + 0x1018]
cmp edx, 0x5c
je 0x40192a
cmp byte [esp + 0x1018], 0
je 0x401942
xor ecx, ecx
mov cl, byte [esp + 0x1019]
cmp ecx, 0x3a
jne 0x401942
lea edx, [esp + 0x1018]
lea eax, [esp + 0x2818]
call fcn.0040326c
jmp 0x4019d9
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x401991
mov dword [esp + 0x14], 0x400
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x281c]
push edx
lea ecx, [esp + 0x18]
push ecx
push 0
push str.ProgramFilesDir
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [esp + 0x2818], 0
je 0x4019c6
lea eax, [esp + 0x2818]
call fcn.004031ec
xor edx, edx
mov dl, byte [esp + eax + 0x2817]
cmp edx, 0x5c
je 0x4019c6
mov edx, 0x4070a8
lea eax, [esp + 0x2818]
call fcn.0040331c
lea edx, [esp + 0x1018]
lea eax, [esp + 0x2818]
call fcn.0040331c
lea ecx, [esp + 0x2818]
push ecx
push 0x65
push dword [esp + 8]
call sub.USER32.DLL_SetDlgItemTextA
jmp case.default.0x40174a
xor eax, eax
mov al, byte [esp + 0x1018]
call fcn.00403378
test eax, eax
je 0x401a1a
xor edx, edx
mov dl, byte [esp + 0x1018]
add edx, 0xffffffd0
mov dword [0x407048], edx
jmp case.default.0x40174a
mov dword [0x407048], 2
jmp case.default.0x40174a
mov cl, byte [esp + 0x1018]
sub cl, 1
jb 0x401a5b
sub cl, 0x2f
je 0x401a47
dec cl
je 0x401a5b
dec cl
je 0x401a72
jmp case.default.0x40174a
xor eax, eax
mov dword [0x407e60], eax
xor edx, edx
mov dword [0x407e64], edx
jmp case.default.0x40174a
xor ecx, ecx
mov dword [0x407e60], ecx
mov dword [0x407e64], 1
jmp case.default.0x40174a
mov dword [0x407e60], 1
xor eax, eax
mov dword [0x407e64], eax
jmp case.default.0x40174a
cmp dword [esp + 4], 3
jne case.default.0x40174a
lea eax, [esp + 0x1018]
xor edx, edx
call fcn.00401d00
jmp case.default.0x40174a
cmp dword [esp + 4], 0
jne case.default.0x40174a
lea ecx, [esp + 0x2c18]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [esp + 0x2c18]
call fcn.00402104
xor ebx, ebx
push ebx
lea eax, [esp + 0x2c1c]
push eax
push str._sRarSFX_d
lea edx, [esp + 0x3024]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
lea ecx, [esp + 0x3018]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401b04
inc ebx
jmp 0x401ad1
lea eax, [esp + 0x3018]
push eax
push 0x65
push dword [esp + 8]
call sub.USER32.DLL_SetDlgItemTextA
cmp byte [esp + 0x1018], 0
je 0x401b97
mov byte [esp + 0x3418], 0
xor ebx, ebx
jmp 0x401b57
and eax, 0xff
cmp eax, 0x40
jne 0x401b56
lea edx, [esp + 0x1019]
lea eax, [esp + 0x3418]
add edx, ebx
call fcn.0040326c
mov byte [esp + ebx + 0x1018], 0
jmp 0x401b62
inc ebx
mov al, byte [esp + ebx + 0x1018]
test al, al
jne 0x401b2d
push 0x24
lea edx, [esp + 0x341c]
push edx
lea ecx, [esp + 0x1020]
push ecx
push dword [esp + 0xc]
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
je 0x401b97
mov dword [0x407e5c], 1
push 1
push dword [esp + 4]
call sub.USER32.DLL_EndDialog
cmp dword [0x407048], 0
jne 0x401baa
mov dword [0x407048], 1
mov byte [0x40703c], 1
jmp case.default.0x40174a
cmp dword [esp + 4], 2
jne case.default.0x40174a
cmp byte [esp + 0x1018], 0
je 0x401bd5
lea eax, [esp + 0x1018]
push eax
push dword [esp + 4]
call sub.USER32.DLL_SetWindowTextA
mov eax, edi
call fcn.00401f94
mov ebx, eax
push 0x65
push dword [esp + 4]
call sub.USER32.DLL_GetDlgItem
mov cl, 1
mov edx, ebx
call fcn.00402aac
mov eax, ebx
call fcn.00403000
jmp case.default.0x40174a
cmp dword [esp + 4], 4
jne case.default.0x40174a
lea eax, [esp + 0x1018]
mov dl, 1
call fcn.00401d00
jmp case.default.0x40174a
mov byte [0x40701c], 1
lea ecx, [esp + 8]
mov eax, edi
push ecx
lea ecx, [esp + 0x101c]
lea edx, [esp + 0x1c]
call fcn.00401c4c
mov edi, eax
test eax, eax
jne 0x401720
mov byte [0x40701d], 0
add esp, 0x3618
pop ebp
pop edi
pop esi
pop ebx
ret