Function at 0x429430
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x80
mov eax, 0x5bbbd8
call fcn.0058f985
mov esi, dword [ebp + 0x214]
mov edi, ecx
push str.Running_AppSearch
mov dword [ebp - 0x34], edi
call fcn.004437b6
pop ecx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x38]
call fcn.0040141e
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040141e
mov byte [ebp - 4], 1
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x70]
call fcn.0040141e
mov byte [ebp - 4], 2
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040141e
mov byte [ebp - 4], 3
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x44]
call fcn.0040141e
mov byte [ebp - 4], 4
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x30]
call fcn.0040141e
mov ecx, dword [edi + 0xd8]
lea eax, [ebp - 0x38]
push eax
push esi
add ecx, 0x1b0
mov byte [ebp - 4], 5
mov byte [ebp - 0x25], 1
call fcn.004a29f8
mov eax, dword [ebp - 0x38]
cmp dword [eax - 0xc], ebx
jne 0x429501
mov eax, str.empty
push eax
push esi
push str.___Looking_up_the_suite_property__s__and_retrieved_the_value:__s
call fcn.004437b6
mov eax, dword [ebp - 0x38]
add esp, 0xc
cmp dword [eax - 0xc], ebx
jne 0x429566
mov esi, 0x490
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401019
mov eax, esi
jmp 0x429b91
push ebx
push 0x5db020
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0044507b
add esp, 0x10
test eax, eax
je 0x429af6
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42958e
xor ebx, ebx
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], ebx
je 0x429af6
mov esi, 0x5d45c0
push esi
lea ecx, [ebp - 0x18]
call fcn.004039d7
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.004039d7
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.004039d7
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.004039d7
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.004039d7
mov byte [ebp - 4], 0xa
mov esi, 0x5d4e28
jmp 0x42965c
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
je 0x429677
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 0xc], ecx
jne 0x429602
lea ecx, [ebp - 0x1c]
jmp 0x429653
mov edx, dword [ebp - 0x10]
cmp dword [edx - 0xc], ecx
jne 0x42963b
mov ecx, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00426cdb
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call fcn.0040227d
mov ecx, dword [ebp - 0x8c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.00401019
jmp 0x42965c
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], ecx
jne 0x429648
lea ecx, [ebp - 0x14]
jmp 0x429653
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], ecx
jne 0x42965c
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
call fcn.0040227d
push 0
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0044507b
add esp, 0x10
test eax, eax
jne 0x4295e7
push 0x5e42fc
lea ecx, [ebp - 0x1c]
call fcn.00401bc4
test eax, eax
je 0x429bb6
push 0x5e42f4
lea ecx, [ebp - 0x1c]
call fcn.00401bc4
test eax, eax
jne 0x4296ba
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040227d
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040227d
jmp 0x429a9c
push 0x5e42ec
lea ecx, [ebp - 0x1c]
call fcn.00401bc4
test eax, eax
jne 0x4296e3
push 0x5d5cd0
lea ecx, [ebp - 0x10]
call fcn.00401bc4
test eax, eax
setne byte [ebp - 0x25]
jmp 0x429a9c
push 0x5e42e4
lea ecx, [ebp - 0x1c]
call fcn.00401bc4
test eax, eax
jne 0x4298f4
xor ebx, ebx
push ebx
push 0x5d4dc0
lea ecx, [ebp - 0x10]
call fcn.00401d2f
mov esi, eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402192
push esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.00401f0b
push str.HKLM
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xd
call fcn.00401ba2
test eax, eax
jne 0x429749
mov dword [ebp - 0x54], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x429799
push str.HKCU
lea ecx, [ebp - 0x24]
call fcn.00401ba2
test eax, eax
jne 0x429763
mov dword [ebp - 0x54], SysReAllocStringLen
jmp 0x429799
push str.HKCR
lea ecx, [ebp - 0x24]
call fcn.00401ba2
test eax, eax
jne 0x42977d
mov dword [ebp - 0x54], SysReAllocStringLen
jmp 0x429799
push 0x5e42b8
lea ecx, [ebp - 0x24]
call fcn.00401ba2
test eax, eax
jne 0x4298d1
mov dword [ebp - 0x54], MsiConfigureFeatureFromDescriptorA
mov esi, dword [ebp - 0x6c]
lea eax, [ebp - 0x40]
push eax
push 0x20019
push ebx
push esi
push dword [ebp - 0x54]
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x42980b
call fcn.00446344
test eax, eax
je 0x429802
lea eax, [ebp - 0x40]
push eax
push 0x20119
push 0
push esi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42980b
push eax
push esi
push str.___The_registry_key_was_not_found_on_x86_or_x64:__s_error:__d
call fcn.004437b6
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401019
lea ecx, [esi - 0x10]
call fcn.00401019
jmp 0x429a9c
push ebx
push esi
push str.___The_registry_key_was_not_found_on_x86:__s_error:__d
jmp 0x4297e2
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp dword [eax - 0xc], edx
je 0x429c49
mov ecx, dword [ebp - 0x20]
cmp dword [ecx - 0xc], edx
jne 0x429835
push eax
push str.___ERROR:_The_test_type__s_was_specified_but_not_the_test_value.
call fcn.004437b6
pop ecx
pop ecx
push dword [ebp - 0x40]
call edi
jmp 0x4297ea
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x58]
push eax
push edx
push ecx
push dword [ebp - 0x40]
mov dword [ebp - 0x88], 0x104
mov dword [ebp - 0x58], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x429873
push eax
push dword [ebp - 0x20]
push str.___There_was_an_error_reading_the_registry_key__s_error:__d
call fcn.004437b6
add esp, 0xc
jmp 0x42982e
push str.REG_SZ
lea ecx, [ebp - 0x14]
call fcn.00401ba2
test eax, eax
jne 0x42988e
cmp dword [ebp - 0x58], 1
je 0x429c26
push str.REG_EXPAND_SZ
lea ecx, [ebp - 0x14]
call fcn.00401ba2
test eax, eax
jne 0x4298a9
cmp dword [ebp - 0x58], 2
je 0x429c26
push str.REG_DWORD
lea ecx, [ebp - 0x14]
call fcn.00401ba2
test eax, eax
jne 0x4298c4
cmp dword [ebp - 0x58], 4
je 0x429c34
push dword [ebp - 0x58]
push str.___ERROR:_The_registry_value_was_an_unsupported_type:__d
jmp 0x429827
mov esi, dword [ebp - 0x24]
push esi
push str.___ERROR:_An_incorrect_hive_was_passed_in:__s
call fcn.004437b6
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
jmp 0x4297f8
push 0x5e3f98
lea ecx, [ebp - 0x1c]
call fcn.00401bc4
test eax, eax
jne 0x429a8d
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x429923
push dword [ebp - 0x10]
push str.___The_file__s_could_not_be_found
jmp 0x429a95
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp - 0x20]
xor esi, esi
cmp ecx, esi
je 0x42993b
cmp dword [eax - 0xc], esi
je 0x429940
cmp ecx, esi
jne 0x42995c
cmp dword [eax - 0xc], esi
je 0x42994f
push str.___ERROR:_The_test_type_does_not_have_a_matching_test_value
call fcn.004437b6
jmp 0x429a9b
cmp ecx, esi
jne 0x42995c
cmp dword [eax - 0xc], esi
je 0x429ce0
or dword [ebp - 0x74], 0xffffffff
or dword [ebp - 0x5c], 0xffffffff
mov ecx, vtable.CVersionInfo.0
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x68], ecx
xor ecx, ecx
xor edx, edx
mov word [ebp - 0x5e], cx
mov word [ebp - 0x60], cx
mov word [ebp - 0x62], cx
mov word [ebp - 0x64], cx
push eax
lea ecx, [ebp - 0x80]
mov word [ebp - 0x76], dx
mov word [ebp - 0x78], dx
mov word [ebp - 0x7a], dx
mov word [ebp - 0x7c], dx
call fcn.0044578f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.0044555c
push 0x5e3ed0
lea ecx, [ebp - 0x14]
call fcn.00401bc4
test eax, eax
jne 0x429a18
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x68]
call dword [eax]
test eax, eax
jle 0x429d5d
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.00445a16
mov esi, eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x14
call fcn.00445a16
push dword [esi]
mov byte [ebp - 4], 0x15
push dword [eax]
push str.___The_file_version__s_was_greater_than_the_test_version__s
call fcn.004437b6
mov ecx, dword [ebp - 0x84]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x48]
jmp 0x4298ec
push 0x5e3e44
lea ecx, [ebp - 0x14]
call fcn.00401bc4
test eax, eax
jne 0x429a83
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x68]
call dword [eax]
test eax, eax
jge 0x429d85
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x80]
call fcn.00445a16
mov esi, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x18
call fcn.00445a16
push dword [esi]
mov byte [ebp - 4], 0x19
push dword [eax]
push str.___The_file_version__s_was_less_than_the_test_version__s
call fcn.004437b6
mov ecx, dword [ebp - 0x50]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x4c]
jmp 0x4298ec
push dword [ebp - 0x14]
push str.___ERROR:_An_invalid_test_type_was_passed_in:__s
jmp 0x429a95
push dword [ebp - 0x1c]
push str.___ERROR:_An_invalid_search_type_was_passed_in:__s
call fcn.004437b6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401019
push 0
push 0x5db020
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0044507b
add esp, 0x10
test eax, eax
jne 0x42958c
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x50], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x1a
call fcn.00401db5
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x48], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x1b
call fcn.00401db5
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.0041f859
push 0x5e3c80
call fcn.004437b6
pop ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x70]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00401019
movzx eax, byte [ebp - 0x25]
neg eax
sbb eax, eax
and eax, 0x490
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x20c
leave
ret 4
xor esi, esi
mov edi, 0x5e3c7c
jmp 0x429bd2
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], esi
je 0x429be8
mov ecx, dword [ebp - 0x34]
push eax
call fcn.00429430
mov ebx, eax
push esi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044507b
add esp, 0x10
test eax, eax
jne 0x429bbf
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
mov esi, ebx
jmp 0x42951d
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x44]
call fcn.00401287
jmp 0x429c49
lea eax, [ebp]
push eax
lea eax, [ebp - 0x44]
push 0x5db490
push eax
call fcn.00401518
add esp, 0xc
push dword [ebp - 0x40]
call edi
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x50], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0xe
call fcn.00401db5
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x48], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0xf
call fcn.00401db5
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 0xd
call fcn.0041f859
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401019
lea ecx, [esi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
xor esi, esi
jmp 0x42951d
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x50], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x10
call fcn.00401db5
mov byte [ebp - 4], 0x11
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x48], esp
mov ecx, esp
push eax
call fcn.00401db5
mov ecx, dword [ebp - 0x34]
mov byte [ebp - 4], 0xa
call fcn.0041f859
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401019
jmp 0x42951d
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x50], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x12
call fcn.00401db5
mov byte [ebp - 4], 0x13
jmp 0x429d06
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esp
mov ecx, esp
push eax
call fcn.00401db5
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x50], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x16
call fcn.00401db5
mov byte [ebp - 4], 0x17
jmp 0x429d06