Function at 0x429900
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x444
mov eax, 0x5535d4
call fcn.0052faf2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x444], eax
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x440], edi
call fcn.0042b589
push eax
lea ecx, [ebp - 0x438]
call fcn.0040217f
mov byte [ebp - 4], 1
call fcn.0042b589
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040217f
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], edi
je 0x429e56
push edi
push 0x58b144
lea ecx, [ebp + 0xc]
call fcn.00406fa0
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax - 0xc]
push ebx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp + 0xc]
call fcn.00403286
push eax
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 3
call fcn.00401ee1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.004021a7
sub esi, ebx
dec esi
push esi
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp + 0xc]
call fcn.00406fff
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 4
call fcn.00401ee1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.004021a7
mov esi, dword [ebp - 0x438]
cmp dword [esi - 0xc], edi
je 0x429c22
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 0xc], edi
je 0x429c22
call fcn.0042b589
push eax
lea ecx, [ebp - 0x428]
call fcn.0040217f
mov byte [ebp - 4], 5
call fcn.0042b589
push eax
lea ecx, [ebp - 0x430]
call fcn.0040217f
push edi
push 0x5881b8
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 6
call fcn.00406fa0
mov esi, dword [esi - 0xc]
mov ebx, eax
push ebx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x438]
call fcn.00403286
push eax
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 7
call fcn.00401ee1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.004021a7
sub esi, ebx
dec esi
push esi
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x438]
call fcn.00406fff
push eax
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 8
call fcn.00401ee1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.004021a7
mov ebx, dword [ebp - 0x428]
cmp dword [ebx - 0xc], edi
je 0x429e40
mov eax, dword [ebp - 0x430]
cmp dword [eax - 0xc], edi
je 0x429e40
push eax
mov esi, 0x587d38
lea eax, [ebp - 0x420]
xor ecx, ecx
push esi
push eax
mov word [ebp - 0x218], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.HKEY_USERS
lea ecx, [ebp - 0x428]
call fcn.00408932
test eax, eax
jne 0x429aff
mov dword [ebp - 0x434], VariantCopy
jmp 0x429b60
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x428]
call fcn.00408932
test eax, eax
jne 0x429b1f
mov dword [ebp - 0x434], SysReAllocString
jmp 0x429b60
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x428]
call fcn.00408932
test eax, eax
jne 0x429b3f
mov dword [ebp - 0x434], VariantCopy
jmp 0x429b60
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x428]
call fcn.00408932
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 0x434], eax
call fcn.0042b589
push eax
lea ecx, [ebp - 0x43c]
call fcn.0040217f
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x420]
push eax
mov byte [ebp - 4], 9
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x429c03
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push dword [ebp - 0x42c]
mov dword [ebp - 0x434], 0x208
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429c03
mov ecx, dword [ebp - 0x434]
mov word [ebp + ecx*2 - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429c03
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x444]
call fcn.004034f1
add esp, 0xc
mov dword [ebp - 0x440], 1
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x43c]
add ecx, 0xfffffff0
call fcn.004021a7
jmp 0x429e40
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 0xc], edi
je 0x429e56
call fcn.0042b589
push eax
lea ecx, [ebp - 0x428]
call fcn.0040217f
mov byte [ebp - 4], 0xa
call fcn.0042b589
push eax
lea ecx, [ebp - 0x430]
call fcn.0040217f
push edi
push 0x5881b8
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0xb
call fcn.00406fa0
mov ebx, eax
mov eax, dword [ebp - 0x42c]
mov esi, dword [eax - 0xc]
push ebx
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00403286
push eax
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 0xc
call fcn.00401ee1
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x43c]
add ecx, 0xfffffff0
call fcn.004021a7
sub esi, ebx
dec esi
push esi
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00406fff
push eax
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0xd
call fcn.00401ee1
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x43c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ebx, dword [ebp - 0x428]
cmp dword [ebx - 0xc], edi
je 0x429e40
mov eax, dword [ebp - 0x430]
cmp dword [eax - 0xc], edi
je 0x429e40
push eax
mov esi, 0x587d38
lea eax, [ebp - 0x420]
xor ecx, ecx
push esi
push eax
mov word [ebp - 0x218], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.HKEY_USERS
lea ecx, [ebp - 0x428]
call fcn.00408932
test eax, eax
jne 0x429d3d
mov eax, SysStringLen
jmp 0x429d8e
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x428]
call fcn.00408932
test eax, eax
jne 0x429d58
mov eax, SysReAllocString
jmp 0x429d8e
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x428]
call fcn.00408932
test eax, eax
jne 0x429d73
mov eax, VariantCopy
jmp 0x429d8e
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x428]
call fcn.00408932
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x448], edi
push 0x20019
lea ecx, [ebp - 0x420]
push ecx
push eax
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0xe
call fcn.004164fe
test eax, eax
jne 0x429e2a
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x587cac
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x424], 0x104
call fcn.00416438
mov ecx, dword [ebp - 0x424]
xor eax, eax
mov word [ebp + ecx*2 - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429e2a
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x444]
call fcn.004034f1
add esp, 0xc
mov dword [ebp - 0x440], 1
lea ecx, [ebp - 0x450]
call fcn.0041654d
lea ecx, [ebp - 0x450]
call fcn.0041654d
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.004021a7
lea ecx, [ebx - 0x10]
call fcn.004021a7
mov ecx, dword [ebp - 0x42c]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.004021a7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004021a7
mov eax, dword [ebp - 0x440]
call fcn.0052fb75
ret