Function at 0x43de77
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x808
lea ebp, [esp - 4]
mov eax, dword [0x4ed820]
xor eax, ebp
mov dword [ebp + 0x808], eax
push 0x48
mov eax, 0x4ab149
call fcn.004711ef
mov esi, dword [ebp + 0x814]
mov eax, dword [ebp + 0x818]
xor edi, edi
cmp dword [esi + 8], edi
mov dword [ebp - 0x3c], eax
sete al
test al, al
sete al
mov dword [ebp - 0x40], esi
test al, al
je 0x43decd
cmp dword [esi + 4], edi
sete al
test al, al
sete al
test al, al
jne 0x43def4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x808]
xor ecx, ebp
call fcn.0047021a
add ebp, 0x80c
leave
ret 8
push str.Check
lea ecx, [ebp - 0x10]
call fcn.00402953
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0043de00
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp ecx, edi
je 0x43df23
call fcn.004029ec
cmp dword [ebp - 0x28], edi
sete al
test al, al
sete al
test al, al
je 0x43df41
cmp dword [ebp - 0x2c], edi
sete al
test al, al
sete al
test al, al
jne 0x43df52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402aa4
jmp 0x43decd
mov esi, 0x4f39f8
push esi
lea ecx, [ebp - 0x18]
call fcn.004028e9
push str.HKEY
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402953
push str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00411280
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
cmp ecx, edi
je 0x43df9a
call fcn.004029ec
lea eax, [ebp - 0x18]
push eax
call fcn.0043ddd4
pop ecx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call fcn.004028e9
push str.SubKey
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00402953
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00411280
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
cmp ecx, edi
je 0x43dfe6
call fcn.004029ec
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], edi
jne 0x43e006
lea ecx, [eax - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040290e
jmp 0x43df41
push 0x4d21d4
push 0x4d02dc
lea ecx, [ebp - 0x1c]
call fcn.0041d7af
push esi
lea ecx, [ebp - 0x20]
call fcn.004028e9
push str.Value
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.00402953
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.00411280
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, edi
je 0x43e057
call fcn.004029ec
push 0x808
lea eax, [ebp]
push edi
push eax
call fcn.004701a0
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0x7a4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43e0a8
lea ecx, [edi - 0x10]
call fcn.0040290e
lea ecx, [ebx - 0x10]
jmp 0x43dff1
push esi
lea ecx, [ebp - 0x10]
call fcn.004028e9
push str.EntryFile
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.00402953
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.00411280
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x43e0e8
call fcn.004029ec
push 0x4d21d4
push 0x4d02dc
lea ecx, [ebp - 0x10]
call fcn.0041d7af
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x43e10e
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43e154
lea ecx, [esi - 0x10]
call fcn.0040290e
lea ecx, [edi - 0x10]
call fcn.0040290e
lea ecx, [ebx - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040290e
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402aa4
mov eax, esi
jmp 0x43decf
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43e18a
lea ecx, [esi - 0x10]
call fcn.0040290e
lea ecx, [edi - 0x10]
call fcn.0040290e
lea ecx, [ebx - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040290e
xor esi, esi
inc esi
jmp 0x43e141
lea eax, [ebp]
push 0
push eax
call fcn.00402346
pop ecx
pop ecx
push 0x4b61dc
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x44], eax
call fcn.00402953
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0xb
call fcn.0043de00
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x43e1cb
call fcn.004029ec
push 0x4b61d0
lea ecx, [ebp - 0x14]
call fcn.00402953
push 0
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.00411280
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x43e1f9
call fcn.004029ec
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 9
call fcn.00402aa4
lea ecx, [esi - 0x10]
call fcn.0040290e
lea ecx, [edi - 0x10]
call fcn.0040290e
lea ecx, [ebx - 0x10]
call fcn.0040290e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040290e
mov esi, dword [ebp - 0x44]
jmp 0x43e141