Function at 0x15070b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.01506dac
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x1507101
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.01506dfd
test esi, esi
jne 0x150710b
cmp dword [ebp - 0x10], 0
jne 0x1507114
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x1507116
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1507168
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.01506dac
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x15071a9
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.01506dfd
test edi, edi
jne 0x15071b3
cmp dword [ebp - 0xc], 0
jne 0x15071dc
cmp dword [ebp + 0xc], 0
je 0x15071ca
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.01510334
add esp, 0xc
jmp 0x15071d8
push esi
push 0
push dword [ebp + 0x10]
call fcn.015103a4
add esp, 0xc
xor eax, eax
jmp 0x15071df
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1507830
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x400]
mov edx, 0x400
call fcn.015078a8
lea eax, [ebp - 0x400]
call fcn.01501ca8
push ebx
lea edx, [ebp - 0x400]
push edx
call fcn.01510448
add esp, 8
lea eax, [ebp - 0x400]
call fcn.01509efc
test eax, eax
je 0x150788b
push 0
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x150788f
xor eax, eax
jmp 0x15078a1
lea edx, [ebp - 0x400]
push edx
push esi
call fcn.01510524
add esp, 8
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x15078a8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x151ae63
push esi
mov edx, str.TempFolder
mov eax, str.Paths
mov ecx, ebx
call fcn.01506f48
mov byte [ebp - 0x400], 0
cmp byte [ebx], 0
je 0x15078ff
push 0x400
lea eax, [ebp - 0x400]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x15078ff
lea edx, [ebp - 0x400]
mov ecx, esi
mov eax, ebx
call fcn.01501a84
cmp byte [ebx], 0
je 0x150790f
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x150792d
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x150791f
cmp byte [ebx], 0
jne 0x150792d
push str._rartemp
push ebx
call fcn.01510524
add esp, 8
mov eax, ebx
call fcn.01501ca8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret