Function at 0x401420
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f8
mov eax, dword [0x454004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x8f0], edx
cmp eax, 0x80000002
mov dword [ebp - 0x8f4], eax
mov ecx, 0x44fc50
mov ebx, 0x44fc44
cmovne ebx, ecx
lea ecx, [ebp - 0x8ec]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x8e0], ebx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40148f
push ebx
push 0x44fc60
call fcn.00401220
add esp, 8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403ff2
mov esp, ebp
pop ebp
ret
imul ebx, dword [0x4560ac], 0x424
xor ecx, ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x8e8], ecx
add ebx, 0x4560b0
cmp dword [0x4560ac], 0x64
mov dword [ebp - 0x8cc], ebx
jae 0x401a0d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 8
lea eax, [ebp - 0x14]
push eax
push ecx
push dword [ebp - 0x8ec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4019d0
push 7
lea eax, [ebp - 0x14]
push eax
push 8
push ebx
call fcn.00424bdb
push 0x2d
push ebx
call fcn.004053b7
mov esi, eax
add esp, 0x18
test esi, esi
je 0x401542
mov edx, 0x44fd48
mov ecx, esi
nop dword [eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x401536
test ax, ax
je 0x401532
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x401536
add ecx, 4
add edx, 4
test ax, ax
jne 0x401510
xor eax, eax
jmp 0x40153b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401542
mov word [esi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x8f0]
lea eax, [ebp - 0xc4]
push 0x44fd50
push 0xffffffffffffffff
push 0x58
push eax
call fcn.004011a0
add esp, 0x18
lea eax, [ebp - 0x8d4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc4]
push 0
push eax
push dword [ebp - 0x8f4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4015ca
push 0
push 0x400
lea ecx, [ebp - 0x8c4]
push ecx
push 0x400
push eax
push 0
push 0x1200
call edi
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x8e0]
push 0x44fd78
call fcn.00401220
add esp, 0x10
jmp 0x4019ae
lea eax, [ebp - 0x8c8]
mov dword [ebp - 0x8c8], 0x207
push eax
lea esi, [ebx + 0x14]
xor edi, edi
push esi
lea eax, [ebp - 0x8d8]
mov dword [ebp - 0x8d0], edi
push eax
push edi
push 0x44fd94
push dword [ebp - 0x8d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401619
cmp dword [ebp - 0x8d8], 1
jne 0x401619
cmp dword [ebp - 0x8c8], edi
jne 0x4016a8
lea eax, [ebp - 0x8c8]
mov dword [ebp - 0x8c8], 0x207
push eax
push esi
lea eax, [ebp - 0x8d8]
mov edi, 1
push eax
push 0
push 0
push dword [ebp - 0x8d4]
mov dword [ebp - 0x8d0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4016a8
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea ecx, [ebp - 0x8c4]
push 0
push 0x400
push ecx
push 0x400
push eax
push 0
push 0x1200
call edi
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0x8e0]
push 0x44fdc4
call fcn.00401220
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
push dword [ebp - 0x8d4]
call esi
jmp 0x4019b4
push dword [ebp - 0x8d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8d8], 1
jne 0x4019a8
mov ecx, dword [ebp - 0x8c8]
shr ecx, 1
dec ecx
mov dword [ebp - 0x8c8], ecx
cmp word [ebx + ecx*2 + 0x12], 0x5c
jne 0x4016df
dec ecx
mov dword [ebp - 0x8c8], ecx
cmp dword [0x454ae0], 0
mov edx, 0x454ae0
mov dword [ebp - 0x8e4], edx
je 0x4019a8
test edi, edi
je 0x40171f
push 0x44fde0
push dword [edx]
mov eax, 0x104
sub eax, ecx
add ecx, 0xa
push 0x44fdf8
push eax
push eax
lea eax, [ebx + ecx*2]
push eax
call fcn.004011a0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x8dc], eax
cmp eax, 0xffffffff
jne 0x40176f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x400
lea ecx, [ebp - 0x8c4]
push ecx
push 0x400
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x8c4]
push eax
push esi
push 0x44fe08
call fcn.00401220
jmp 0x401986
test al, 0x10
je 0x401784
push eax
push esi
push 0x44fe50
call fcn.00401220
jmp 0x401986
xor ebx, ebx
mov edi, 0x4560b0
cmp dword [0x4560ac], ebx
jbe 0x4017b3
lea eax, [edi + 0x14]
push eax
push esi
call fcn.00420ee4
add esp, 8
test eax, eax
je 0x4017bf
inc ebx
add edi, 0x424
cmp ebx, dword [0x4560ac]
jb 0x401793
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4017e2
mov dword [esi - 4], eax
jmp 0x401836
test edi, edi
je 0x4017b3
push esi
push 0x44feb0
call fcn.00401220
mov ebx, dword [ebp - 0x8cc]
add esp, 8
mov edi, dword [ebp - 0x8d0]
jmp 0x401989
lea eax, [ebp - 0x8dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
jne 0x401813
push esi
push 0x44ff08
call fcn.00401220
add esp, 8
cmp dword [esi - 4], 0
jne 0x401836
mov eax, dword [ebp - 0x8dc]
jmp 0x40196e
mov eax, dword [ebp - 0x8dc]
cmp eax, 6
jne 0x401827
mov dword [esi - 4], 0x40
jmp 0x401836
test eax, eax
jne 0x401967
mov dword [esi - 4], 0x20
cmp dword [ebp + 0x10], 0
je 0x401863
push 0x5c
push esi
call fcn.004053b7
add esp, 8
test eax, eax
je 0x401863
add eax, 2
push eax
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00421d98
add esp, 0xc
push 0x20
push esi
call fcn.00405085
add esp, 8
test eax, eax
je 0x4018cb
cmp word [esi + 0x208], 0
lea ebx, [esi + 0x208]
jne 0x401891
push esi
push 0x104
push ebx
call fcn.00421d98
add esp, 0xc
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401896
sub edi, ecx
sar edi, 1
lea eax, [edi + edi]
push eax
lea eax, [ebx - 0x206]
push esi
push eax
call fcn.0040eaf0
mov eax, dword [ebp - 0x8cc]
mov ecx, 0x22
mov word [esi], cx
add esp, 0xc
mov dword [eax + edi*2 + 0x16], ecx
push dword [esi - 4]
push esi
push 0x44ffc0
call fcn.00401220
mov eax, dword [esi - 4]
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x8f8], eax
mov edi, 0x4560b0
cmp dword [0x4560ac], ebx
jbe 0x401921
cmp eax, dword [edi + 0x10]
jne 0x401912
push edi
push dword [ebp - 0x8cc]
call fcn.00420ee4
add esp, 8
test eax, eax
je 0x401951
mov eax, dword [ebp - 0x8f8]
inc ebx
add edi, 0x424
cmp ebx, dword [0x4560ac]
jb 0x4018f4
mov eax, dword [0x4560ac]
add esi, 0x424
mov ebx, dword [ebp - 0x8cc]
inc eax
add ebx, 0x424
mov dword [0x4560ac], eax
mov dword [ebp - 0x8cc], ebx
cmp eax, 0x64
jae 0x4019a8
mov edi, dword [ebp - 0x8d0]
jmp 0x401989
push dword [esi - 4]
mov ebx, dword [ebp - 0x8cc]
push ebx
push 0x450028
call fcn.00401220
jmp 0x401980
mov dword [esi - 4], 0
push eax
push esi
push 0x44ff50
call fcn.00401220
mov ebx, dword [ebp - 0x8cc]
mov edi, dword [ebp - 0x8d0]
add esp, 0xc
mov edx, dword [ebp - 0x8e4]
add edx, 4
mov dword [ebp - 0x8e4], edx
cmp dword [edx], 0
je 0x4019a8
mov ecx, dword [ebp - 0x8c8]
jmp 0x4016f7
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x8e8]
inc ecx
cmp dword [0x4560ac], 0x64
mov dword [ebp - 0x8e8], ecx
jb 0x4014c8
jmp 0x401a0c
cmp eax, 0x103
je 0x401a0c
push 0
push 0x400
lea ecx, [ebp - 0x8c4]
push ecx
push 0x400
push eax
push 0
push 0x1200
call edi
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x44fce0
call fcn.00401220
add esp, 0xc
pop edi
push dword [ebp - 0x8ec]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ff2
mov esp, ebp
pop ebp
ret