Function at 0x4444b0
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x464cde
push eax
mov eax, 0x1ae0
mov dword fs:[0], esp
call fcn.00454ff0
mov ecx, dword [ecx + 4]
push ebx
xor ebx, ebx
push ebp
push esi
cmp ecx, ebx
push edi
je 0x444e90
mov edx, dword [esp + 0x1b00]
call fcn.0040b460
cmp eax, ebx
je 0x444e90
lea ebp, [eax + 0x10]
cmp ebp, ebx
je 0x444e90
mov ecx, 0x3a2
mov esi, ebp
lea edi, [esp + 0xc68]
lea eax, [ebp + 0x6a4]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp + 0x99c], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x444536
mov eax, 1
mov dword [ebp + 0x99c], eax
jmp 0x444e92
lea ecx, [esp + 0xcf4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444585
mov edi, dword [esp + 0x1b04]
mov dword [ebp + 0x99c], 1
cmp edi, ebx
je 0x444e05
lea esi, [ebp + 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov eax, 1
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x444e92
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x1848]
push eax
call esi
test eax, eax
je 0x444e90
mov eax, dword [esp + 0x1614]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp eax, ebx
je 0x444712
lea ecx, [esp + 0x1618]
push ecx
call esi
test eax, eax
je 0x444712
lea edx, [esp + 0x34]
lea eax, [esp + 0x448]
push edx
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x1828]
push ecx
lea eax, [esp + 0x1624]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 1
mov dword [esp + 0x4c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x444712
mov cl, byte [esp + 0x23]
mov dword [esp + 0x28], ebx
mov byte [esp + 0x24], cl
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
lea edx, [esp + 0x24]
lea eax, [esp + 0x1848]
push edx
push eax
mov dword [esp + 0x1b00], ebx
call fcn.004023f0
mov eax, dword [esp + 0x30]
add esp, 8
cmp eax, ebx
je 0x4446eb
mov ecx, dword [esp + 0x2c]
sub ecx, eax
sar ecx, 2
je 0x4446eb
mov eax, dword [eax]
lea edx, [esp + 0x448]
push eax
lea eax, [esp + 0x3c]
push edx
push eax
call edi
test eax, eax
je 0x4446e7
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4446e7
lea edx, [esp + 0x38]
lea esi, [ebp + 0x8c]
push edx
push 0x104
push esi
call fcn.004088b0
lea edi, [ebp + 0x49c]
push esi
push 0x104
push edi
call fcn.004088b0
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x2c]
mov dword [ebp + 0x99c], 1
mov dword [esp + 0x1b00], 0xffffffff
call fcn.00408780
mov edx, dword [esp + 0x28]
push edx
call fcn.004535f0
add esp, 4
mov eax, 1
jmp 0x444e92
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1af8], 0xffffffff
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00408780
mov edx, dword [esp + 0x28]
push edx
call fcn.004535f0
add esp, 4
lea eax, [esp + 0x1a78]
push eax
call esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x444aad
mov eax, dword [0x46f42c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1af8], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push 0
lea ecx, [esp + 0x44c]
push 2
mov bl, 3
push ecx
push 0
mov byte [esp + 0x1b08], bl
call esi
test eax, eax
je 0x4448ad
lea edx, [esp + 0x1a78]
lea eax, [esp + 0x448]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
test eax, eax
je 0x4448ad
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00407200
call fcn.00403400
add esp, 0x10
test eax, eax
je 0x4448ad
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4448ad
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
lea edi, [ebp + 0x8c]
push esi
push 0x104
push edi
mov byte [esp + 0x1b04], 4
call fcn.004088b0
push esi
mov byte [esp + 0x1afc], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [ebp + 0x49c]
push edi
push 0x104
push esi
call fcn.004088b0
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [ebp + 0x99c], 1
mov ecx, dword [0x46f430]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x444856
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444856
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444881
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444881
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e05
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444e05
mov edx, dword [esp + 0x10]
jmp 0x444df9
push 0
lea eax, [esp + 0x244]
push 0x17
push eax
push 0
call esi
test eax, eax
je 0x444a11
lea ecx, [esp + 0x1a78]
lea edx, [esp + 0x240]
push ecx
lea eax, [esp + 0x654]
push edx
push eax
call edi
test eax, eax
je 0x444a11
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x660]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00407200
call fcn.00403400
add esp, 0x10
test eax, eax
je 0x444a11
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444a11
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
lea edi, [ebp + 0x8c]
push esi
push 0x104
push edi
mov byte [esp + 0x1b04], 5
call fcn.004088b0
push esi
mov byte [esp + 0x1afc], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [ebp + 0x49c]
push edi
push 0x104
push esi
call fcn.004088b0
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [ebp + 0x99c], 1
mov ecx, dword [0x46f430]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4449ba
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4449ba
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4449e5
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4449e5
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e05
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444e05
mov edx, dword [esp + 0x10]
jmp 0x444df9
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444a44
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x444a4a
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.004535f0
add esp, 4
jmp 0x444a4a
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esp + 0x18]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444a75
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x444a75
mov edx, dword [esp + 0x18]
lea eax, [edx - 0xc]
push eax
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
mov dword [esp + 0x1af8], 0xffffffff
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444ab3
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x444ab3
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.004535f0
add esp, 4
jmp 0x444ab3
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esp + 0x1ab4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x444e90
mov eax, dword [0x46f42c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1af8], 6
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0
lea ecx, [esp + 0x654]
push 0x10
mov bl, 8
push ecx
push 0
mov byte [esp + 0x1b08], bl
call esi
test eax, eax
je 0x444c6f
lea edx, [esp + 0x1ab4]
lea eax, [esp + 0x650]
push edx
lea ecx, [esp + 0x244]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x444c6f
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
push ecx
lea edx, [esp + 0x250]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00407200
call fcn.00403400
add esp, 0x10
test eax, eax
je 0x444c6f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444c6f
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
lea edi, [ebp + 0x8c]
push esi
push 0x104
push edi
mov byte [esp + 0x1b04], 9
call fcn.004088b0
push esi
mov byte [esp + 0x1afc], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea esi, [ebp + 0x49c]
push edi
push 0x104
push esi
call fcn.004088b0
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x99c], 1
mov ecx, dword [0x46f430]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x444c01
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444c07
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
jmp 0x444c07
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444c32
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444c32
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e05
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444e05
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, 1
jmp 0x444e92
push 0
lea eax, [esp + 0x85c]
push 0x19
push eax
push 0
call esi
test eax, eax
je 0x444e0f
lea ecx, [esp + 0x1ab4]
lea edx, [esp + 0x858]
push ecx
lea eax, [esp + 0xa64]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x444e0f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xa70]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00407200
call fcn.00403400
add esp, 0x10
test eax, eax
je 0x444e0f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444e0f
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea esi, [ebp + 0x8c]
mov edi, eax
mov ebx, 0x104
mov ecx, esi
sub edi, esi
mov dx, word [ecx + edi]
test dx, dx
je 0x444d23
mov word [ecx], dx
add ecx, 2
dec ebx
jne 0x444d0f
jmp 0x444d27
test ebx, ebx
jne 0x444d2a
sub ecx, 2
push eax
mov word [ecx], 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp + 0x49c]
mov edi, 0x104
mov eax, ecx
sub esi, ecx
mov dx, word [eax + esi]
test dx, dx
je 0x444d59
mov word [eax], dx
add eax, 2
dec edi
jne 0x444d45
jmp 0x444d5d
test edi, edi
jne 0x444d60
sub eax, 2
push ecx
mov word [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x99c], 1
mov ecx, dword [0x46f430]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x444da9
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444daf
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
jmp 0x444daf
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444dda
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444dda
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e05
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x444e05
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, 1
jmp 0x444e92
mov eax, dword [esp + 0x18]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e3a
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x444e3a
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e65
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x444e65
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x444e90
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x444e90
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1af0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1aec
ret 8