Function at 0x449de0
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4645c8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 0x23c]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], 0
mov edx, dword [ebp - 0x23c]
mov dword [edx + 8], 0
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.0042a350
add esp, 0xc
mov dword [ebp - 0x21c], 0
jmp 0x449e59
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
cmp dword [ebp - 0x21c], 0xa
jae 0x449ebe
push 0x103
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax*4 + 0x465230]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
je 0x449ebc
mov eax, dword [ebp - 0x220]
and eax, 0x10
jne 0x449ebc
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], 1
xor eax, eax
jmp 0x44a070
jmp 0x449e4a
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0xf003f
push 0
mov eax, dword [str.SYSTEMCurrentControlSetControlLsa]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44a05f
mov dword [ebp - 0x22c], 0x410
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.0042df29
add esp, 4
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 0
push 0x45c1fc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xea
jne 0x449fab
mov eax, dword [ebp - 0x22c]
shl eax, 1
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
call fcn.0042dfec
add esp, 8
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x230], eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x228]
push edx
push 0
push 0
push 0x45c22c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x224], eax
jmp 0x449f40
cmp dword [ebp - 0x224], 0
jne 0x44a03d
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x234], ecx
cmp dword [ebp - 0x234], 0
je 0x44a03d
mov edx, dword [ebp - 0x234]
movzx eax, word [edx]
test eax, eax
je 0x44a03d
push 0x45c124
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.0042b8f5
add esp, 8
test eax, eax
jne 0x44a000
mov edx, dword [ebp - 0x23c]
mov dword [edx], 1
jmp 0x44a03d
push 0
mov eax, dword [ebp - 0x234]
push eax
call fcn.00403c60
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x44a02f
mov ecx, dword [ebp - 0x238]
add ecx, 2
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x234], edx
jmp 0x449fc4
cmp dword [ebp - 0x228], 0
je 0x44a055
mov eax, dword [ebp - 0x228]
push eax
call fcn.0042acb1
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x23c]
cmp dword [edx], 0
je 0x44a06e
xor eax, eax
jmp 0x44a070
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042a8b5
mov esp, ebp
pop ebp
ret