Function at 0x5414e0
Capabilities:
Get common file path
Get disk size
Get file version info
Link many functions at runtime
Log keystrokes via polling
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6732f8
push 0x62903c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2268
call fcn.00628480
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.0057f3d0
xor ebx, ebx
push ebx
call fcn.005430f0
add esp, 4
mov dword [ebp - 4], ebx
mov ecx, 0x800
mov eax, 0xeeeeeeee
lea edi, [ebp - 0x2280]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1280]
mov dword [0x721e30], eax
push 0x721e34
push 1
push 1
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00541460
mov byte [ebp - 0x19], al
mov edi, dword [ebp + 0x10]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x541562
sub eax, edx
mov esi, eax
mov dword [ebp - 0x64], esi
lea eax, [esi + 1]
call fcn.004494e0
mov dword [ebp - 0x20], eax
cmp esi, ebx
jle 0x54158d
mov ecx, edi
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x541583
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], bl
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x6e34e8], edi
mov dword [0x7460e4], ebx
mov eax, dword [ebp + 8]
mov dword [0x7460e0], eax
mov ecx, dword [ebp + 0x14]
mov dword [0x7460ec], ecx
mov dword [0x7460f0], 0x541eb0
mov dword [0x7460e8], ebx
mov byte [0x746175], bl
mov byte [0x746174], bl
mov eax, dword [0x6710e0]
mov dword [0x7460f4], eax
mov cl, byte [0x6710e4]
mov byte [0x7460f8], cl
mov dword [0x746134], eax
mov byte [0x746138], cl
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x6e34e4], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x4c], 4
lea edx, [ebp - 0x3c]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftMicrosoft_GamesHalo
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x38]
push ecx
push ebx
push ebx
push str.FIRSTRUN
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x38], ebx
jne 0x5416a7
xor edi, edi
mov dword [ebp - 0x48], edi
push str.eula.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x58], esi
cmp esi, ebx
je 0x54169b
push str.EBUEula
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x541694
push 1
push ebx
push 0x6f0798
push str.SoftwareMicrosoftMicrosoft_GamesHalo
call eax
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x48], edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
jne 0x5416a7
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x721dbc
mov edi, dword [ebp - 0x20]
call fcn.00542970
mov dword [0x721db8], eax
push str._window
xor edi, edi
call fcn.00542ae0
add esp, 8
test al, al
jne 0x5416e6
push str._windowed
call fcn.00542ae0
add esp, 4
test al, al
jne 0x5416e6
xor eax, eax
mov esi, 1
jmp 0x5416ed
mov esi, 1
mov eax, esi
mov dword [0x71d0d4], eax
push str._nosound
xor edi, edi
call fcn.00542ae0
movzx ecx, al
mov dword [0x71960c], ecx
push str._nonetwork
call fcn.00542ae0
movzx edx, al
mov dword [0x719614], edx
push str._novideo
call fcn.00542ae0
add esp, 0xc
test al, al
jne 0x541740
push str._connect
call fcn.00542ae0
add esp, 4
test al, al
jne 0x541740
xor eax, eax
jmp 0x541742
mov eax, esi
mov dword [0x719610], eax
push str._nojoystick
xor edi, edi
call fcn.00542ae0
movzx eax, al
mov dword [0x712b54], eax
push str._width640
call fcn.00542ae0
movzx ecx, al
mov dword [0x719618], ecx
push str._screenshots
call fcn.00542ae0
add esp, 0xc
test al, al
jne 0x541794
push str._screenshot
call fcn.00542ae0
add esp, 4
test al, al
jne 0x541794
xor eax, eax
jmp 0x541796
mov eax, esi
mov dword [0x719608], eax
push str._checkfpu
xor edi, edi
call fcn.00542ae0
movzx edx, al
mov dword [0x71d0cc], edx
push str._timedemo
call fcn.00542ae0
neg al
sbb eax, eax
neg eax
mov dword [0x719600], eax
push str._nowinkey
call fcn.00542ae0
add esp, 0xc
test al, al
jne 0x5417eb
push str._nowindowskey
call fcn.00542ae0
add esp, 4
test al, al
jne 0x5417eb
xor eax, eax
jmp 0x5417ed
mov eax, esi
mov dword [0x719620], eax
mov eax, dword [0x71961c]
cmp eax, ebx
jne 0x541816
push str._safemode
xor edi, edi
call fcn.00542ae0
add esp, 4
movzx eax, al
mov dword [0x71961c], eax
cmp eax, ebx
je 0x541834
mov dword [0x719618], esi
mov dword [0x719610], esi
mov dword [0x712b54], esi
mov dword [0x71d0d4], esi
mov dword [0x71960c], esi
call fcn.0057dc90
mov eax, dword [0x722ad0]
cmp eax, 0x80
ja 0x541850
mov word [0x6869c8], 0xc
jmp 0x541875
cmp eax, 0x100
ja 0x541862
mov word [0x6869c8], 0x10
jmp 0x541875
cmp eax, 0x200
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [0x6869c8], ax
mov word [0x6869cc], 0x30
push 0x671010
xor edi, edi
call fcn.00542ae0
add esp, 4
test al, al
jne 0x541d2d
push str._help
call fcn.00542ae0
add esp, 4
test al, al
jne 0x541d2d
call fcn.004449f0
push str.d3d9.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x746184], eax
push str.Direct3DCreate9
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x746194], eax
cmp dword [0x746184], ebx
je 0x5418dc
cmp eax, ebx
jne 0x5418ee
push esi
push 0x7a
push 0x6b
call fcn.0057eea0
add esp, 0xc
mov eax, dword [0x746194]
push 0x1f
call eax
mov esi, eax
mov dword [ebp - 0x60], esi
cmp esi, ebx
je 0x54191f
xor ecx, ecx
mov edx, esi
call fcn.0057d820
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x541917
push ebx
push eax
push 0xffffffffffffffff
call fcn.0057eea0
add esp, 0xc
mov dword [0x721dc0], esi
jmp 0x541933
push 1
push 0x82
push 0x81
call fcn.0057eea0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x17c]
push ecx
mov edx, dword [0x746184]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x17c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
mov dword [ebp - 0x68], esi
call fcn.004494e0
mov edi, eax
mov dword [ebp - 0x74], edi
push edi
push esi
push ebx
lea edx, [ebp - 0x17c]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
push ecx
push 0x660190
push edi
call sub.VERSION.dll_VerQueryValueA
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0xc]
and eax, 0xffff
cmp eax, dword [0x6eff00]
jae 0x5419b1
push 1
push 0x7a
push 0x6b
call fcn.0057eea0
add esp, 0xc
mov eax, edi
call fcn.004494f0
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x5419d4
push ebx
push 0x7e
push 0x87
call fcn.0057eea0
add esp, 0xc
push str.DisableD3DSpy
mov ecx, dword [0x746184]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x5c], eax
cmp eax, ebx
je 0x5419f1
call eax
cmp dword [0x71960c], ebx
je 0x541a0d
mov dword [0x74617c], ebx
mov dword [0x746190], ebx
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x541a46
push str.dsound.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov dword [0x74617c], eax
push str.DirectSoundCreate8
push eax
call esi
mov dword [0x746190], eax
cmp dword [0x74617c], ebx
je 0x541a38
cmp eax, ebx
jne 0x541a46
push 1
push 0x7a
push 0x7b
call fcn.0057eea0
add esp, 0xc
push str.dinput8.dll
call edi
mov dword [0x746178], eax
push str.DirectInput8Create
push eax
call esi
mov dword [0x746188], eax
cmp dword [0x746178], ebx
je 0x541a6b
cmp eax, ebx
jne 0x541a79
push 1
push 0x7a
push 0x7c
call fcn.0057eea0
add esp, 0xc
push str.shfolder.dll
call edi
mov dword [0x746180], eax
push str.SHGetFolderPathA
push eax
call esi
mov dword [0x74618c], eax
cmp dword [0x746180], ebx
je 0x541a9e
cmp eax, ebx
jne 0x541aac
push 1
push 0x7e
push 0x7d
call fcn.0057eea0
add esp, 0xc
call fcn.0057ec80
test eax, eax
je 0x541ac2
push ebx
push 0x73
push 0x6a
call fcn.0057eea0
add esp, 0xc
jmp 0x541ae4
mov edx, dword [0x6efef4]
add edx, 0xfffffff0
cmp dword [0x722ad0], edx
jae 0x541b02
push ebx
push 0x6e
push 0x65
call fcn.0057eea0
add esp, 0xc
mov eax, dword [0x722ad4]
cmp eax, dword [0x6eff08]
jae 0x541b42
call fcn.0057dc90
mov ecx, dword [0x722ad4]
cmp ecx, dword [0x6eff08]
jae 0x541b42
call fcn.0057dc90
mov edx, dword [0x722ad4]
cmp edx, dword [0x6eff08]
jae 0x541b42
push ebx
push 0x6f
push 0x66
call fcn.0057eea0
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebx
push ebx
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [0x6efefc]
shl eax, 0x14
xor ecx, ecx
mov edx, dword [ebp - 0x50]
cmp edx, ecx
jg 0x541b8e
jl 0x541b81
mov ecx, dword [ebp - 0x54]
cmp ecx, eax
jae 0x541b8e
push ebx
push 0x76
push 0x6d
call fcn.0057eea0
add esp, 0xc
call fcn.0057f820
mov dword [0x7460c8], eax
cmp byte [eax], bl
jne 0x541bad
push 1
push 0x7e
push 0xa0
call fcn.0057eea0
add esp, 0xc
call fcn.00542e50
jmp 0x541bb7
call fcn.00541030
test al, al
je 0x541cd0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
mov dword [0x6869b4], ebx
push str._port
lea edi, [ebp - 0x24]
call fcn.00542ae0
add esp, 4
test al, al
je 0x541c00
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x541c00
push eax
call fcn.00625b76
add esp, 4
mov dword [0x698218], eax
mov byte [0x71c1f8], 1
push str._cport
lea edi, [ebp - 0x24]
call fcn.00542ae0
add esp, 4
test al, al
je 0x541c30
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x541c30
push eax
call fcn.00625b76
add esp, 4
mov dword [0x69821c], eax
mov byte [0x71c1f8], 1
push 0x670fc4
lea edi, [ebp - 0x34]
call fcn.00542ae0
add esp, 4
mov edi, dword [ebp - 0x34]
test al, al
je 0x541c89
cmp edi, ebx
je 0x541c89
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x6869b4], eax
cmp eax, ebx
je 0x541c89
mov ecx, eax
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shl ecx, 8
xor edx, edx
mov eax, dword [0x6869b4]
shr eax, 0x10
mov dh, al
or ecx, edx
movzx eax, ah
or ecx, eax
mov dword [0x6869a8], ecx
mov dword [0x6869b4], ecx
mov byte [ebp - 0x30], bl
xor ecx, ecx
mov dword [ebp - 0x2f], ecx
mov dword [ebp - 0x2b], ecx
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x34
mov byte [ebp - 0x2e], 0x52
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x39
mov byte [ebp - 0x2b], 0x4a
mov byte [ebp - 0x2a], bl
mov edx, dword [0x698218]
push edx
lea esi, [ebp - 0x30]
mov eax, str.halor
call fcn.00576510
add esp, 4
call fcn.004c7690
call fcn.00541160
mov eax, dword [ebp - 0x20]
call fcn.004494f0
mov eax, dword [0x721db8]
call fcn.004494f0
call fcn.00543070
mov eax, dword [0x721e30]
cmp eax, ebx
je 0x541d0b
push 0x721e34
mov ecx, dword [0x721e34]
push ecx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x721e30], ebx
or esi, 0xffffffff
mov dword [ebp - 4], esi
jmp 0x541d61
push ebx
push 0x6710e0
push 0x6f07b8
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0xffffffff
jmp 0x541d88
call fcn.0057ee40
mov eax, dword [0x721e28]
cmp eax, ebx
je 0x541d88
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x721e28], ebx
mov dword [0x69eac4], esi
mov dword [0x721e2c], esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10