Function at 0x417cd0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x488
mov eax, dword [0x43d504]
xor eax, esp
mov dword [esp + 0x484], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [esp + 8]
push eax
push 0x20019
xor edi, edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], edi
call esi
test eax, eax
je 0x417d2c
lea ecx, [esp + 8]
push ecx
push 0x20019
push edi
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x417f31
mov esi, dword [esp + 8]
cmp esi, edi
je 0x417f31
push ebx
push 0x410
lea edx, [esp + 0x82]
push edi
push edx
xor bl, bl
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], edi
mov word [esp + 0x88], di
call fcn.0041a390
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
push edi
push str.UninstallString
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x417db2
cmp dword [esp + 0x10], 0x208
jae 0x417db2
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
push str.UninstallString
push edx
call esi
test eax, eax
jne 0x417db2
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
pop ebx
je 0x417f31
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0x44]
call fcn.004014af
cmp dword [esp + 0x54], edi
je 0x417e55
push edi
lea ecx, [esp + 0x44]
call fcn.00402541
cmp word [eax], 0x22
jne 0x417e0d
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x44]
call fcn.00401886
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x4c]
call fcn.00405920
mov eax, dword [esp + 0x54]
cmp eax, edi
je 0x417e55
add eax, 0xffffffff
push eax
lea ecx, [esp + 0x44]
call fcn.00402541
cmp word [eax], 0x22
jne 0x417e55
mov ecx, dword [esp + 0x54]
add ecx, 0xffffffff
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x4c]
call fcn.00402569
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x4c]
call fcn.0040176b
lea ecx, [esp + 0x24]
call fcn.004014f7
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x417e64
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [esp + 0x40]
je 0x417f2c
lea eax, [esp + 0x5c]
push eax
push ecx
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], edi
mov word [esp + 0x68], di
call fcn.00402d59
add esp, 8
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x4c]
call fcn.0040176b
mov eax, dword [esp + 0x54]
cmp eax, edi
je 0x417ed1
add eax, 0xffffffff
push eax
lea ecx, [esp + 0x44]
call fcn.00402541
cmp word [eax], 0x5c
je 0x417ed1
push 0x435cfc
lea ecx, [esp + 0x44]
call fcn.004030aa
push 0x4365b0
lea ecx, [esp + 0x44]
call fcn.004030aa
lea eax, [esp + 0x40]
push eax
call fcn.004034ec
add esp, 4
cmp edx, edi
ja 0x417ef4
cmp eax, edi
jbe 0x417f1f
lea ecx, [esp + 0x5c]
call fcn.004014f7
lea ecx, [esp + 0x40]
call fcn.004014f7
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x484]
xor ecx, esp
call fcn.0041a372
add esp, 0x488
ret
lea ecx, [esp + 0x5c]
call fcn.004014f7
lea ecx, [esp + 0x40]
call fcn.004014f7
mov ecx, dword [esp + 0x48c]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.0041a372
add esp, 0x488
ret