Function at 0x438a70
Capabilities:
Check if file exists
Get common file path
Get disk information
Get disk size
Get file attributes
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x49dacb
mov eax, dword fs:[0]
push eax
sub esp, 0x9e0
mov eax, dword [0x4c1bd8]
xor eax, esp
mov dword [esp + 0x9dc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1bd8]
xor eax, esp
push eax
lea eax, [esp + 0x9f4]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa04]
mov edi, ecx
cmp dword [edi + 0x3c], 0
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], 0
je 0x438ae3
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
call fcn.0040d530
add esp, 4
add eax, 0x10
mov dword [esi], eax
jmp 0x439252
lea eax, [edi + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jle 0x438b08
add eax, 0xfffffff0
push eax
call fcn.0040d530
add esp, 4
add eax, 0x10
mov dword [esi], eax
jmp 0x439252
push 0x4b6cbc
lea ecx, [esp + 0x20]
call fcn.004190e0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x4a]
push ecx
mov dword [esp + 0xa08], 0
mov word [esp + 0x4c], ax
call fcn.00454ce0
mov eax, dword [edi + 0x64]
mov ebp, dword [eax]
mov ebx, dword [edi + 0x50]
add esp, 0xc
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
jmp 0x438b50
mov esi, dword [edi + 0x64]
mov eax, dword [edi + 0x50]
test ebx, ebx
je 0x438b5e
cmp ebx, eax
je 0x438b63
call fcn.004541b9
cmp ebp, esi
je 0x438db9
mov dword [esp + 0x20], 0
test ebx, ebx
jne 0x438c3b
call fcn.004541b9
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x438b8c
call fcn.004541b9
lea edx, [esp + 0x20]
push edx
push 1
push 0
lea esi, [ebp + 8]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [esp + 0x20], 0
je 0x438c1e
xor eax, eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x38], 0x208
mov word [esp + 0x40], ax
test ebx, ebx
jne 0x438c42
call fcn.004541b9
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x438bd7
call fcn.004541b9
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x30]
push eax
push 0
add esi, 0x208
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esp + 0x40], 0
je 0x438c1e
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
test esi, esi
jne 0x438c4a
test ebx, ebx
jne 0x438c46
call fcn.004541b9
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x438c33
call fcn.004541b9
mov ebp, dword [ebp]
jmp 0x438b50
mov eax, dword [ebx]
jmp 0x438b82
mov eax, dword [ebx]
jmp 0x438bcd
mov eax, dword [ebx]
jmp 0x438c29
push 4
lea ecx, [esp + 0x44]
push 0x4a5148
push ecx
mov dword [esp + 0x24], ebp
call fcn.004560b5
add esp, 0xc
test eax, eax
je 0x438c7e
push 4
lea edx, [esp + 0x44]
push 0x4a513c
push edx
call fcn.004560b5
add esp, 0xc
test eax, eax
jne 0x438cb2
cmp word [esp + 0x48], 0
lea ecx, [esp + 0x40]
je 0x438cad
lea eax, [esp + 0x48]
mov edi, edi
mov dx, word [eax]
mov word [ecx], dx
add eax, 2
lea edx, [esp + 0x246]
add ecx, 2
cmp eax, edx
jae 0x438cad
cmp word [eax], 0
jne 0x438c90
xor eax, eax
mov word [ecx], ax
lea ecx, [esp + 0x40]
push 0x5c
push ecx
call fcn.004541d4
add esp, 8
mov edi, eax
test esi, 0x10
jne 0x438cd5
xor edx, edx
mov word [edi], dx
jmp 0x438d76
lea ecx, [esp + 0x14]
call fcn.00436450
cmp word [eax + 0x410], 0
je 0x438d76
lea ecx, [esp + 0x14]
call fcn.00436450
add eax, 0x410
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438d00
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esp + 0x40]
lea edx, [eax + 2]
jmp 0x438d20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x438d20
sub eax, edx
sar eax, 1
cmp eax, esi
jb 0x438d59
lea ecx, [esp + 0x14]
call fcn.00436450
add eax, 0x410
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x438d59
xor ecx, ecx
mov word [eax + esi*2], cx
jmp 0x438d76
inc esi
push esi
lea ecx, [esp + 0x18]
call fcn.00436450
add eax, 0x410
push eax
add edi, 2
push edi
call fcn.00455578
add esp, 0xc
test ebx, ebx
jne 0x438db5
call fcn.004541b9
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x438d8b
call fcn.004541b9
lea edx, [esp + 0x40]
push edx
add ebp, 8
push ebp
push str._Setup__s_s
call fcn.0040cd20
add esp, 0xc
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x20]
call fcn.0040ee40
mov edi, dword [esp + 0x24]
jmp 0x438dbd
mov eax, dword [ebx]
jmp 0x438d81
mov dword [esp + 0x18], ebp
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 0xc]
test eax, eax
jne 0x438e5c
lea eax, [esp + 0x40]
push eax
xor edx, edx
push 0x104
mov ecx, edi
mov word [esp + 0x48], dx
call fcn.00435d50
test eax, eax
je 0x438df8
mov ecx, dword [edi + 0x10]
push ecx
lea edx, [esp + 0x44]
push edx
push 0x4a1680
jmp 0x438e3d
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x252]
push edx
mov word [esp + 0x254], cx
call fcn.00454ce0
add esp, 0xc
push 0x104
lea eax, [esp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [edi + 0x10]
movzx edx, word [esp + 0x248]
push ecx
push edx
push str._cProgram_Files_s
lea eax, [esp + 0x28]
push eax
call fcn.0040e7e0
mov ecx, dword [esp + 0x2c]
add esp, 0x10
push ecx
push 0x4a50ac
call fcn.0040cd20
add esp, 8
push 0x206
xor esi, esi
lea eax, [esp + 0x456]
xor edx, edx
push esi
push eax
mov word [esp + 0x45c], dx
call fcn.00454ce0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ax, word [esp + 0x450]
mov ecx, 0xffdf
and ax, cx
xor edx, edx
mov word [esp + 0x450], ax
movzx edi, ax
mov eax, dword [esp + 0x1c]
mov word [esp + 0x456], dx
cmp dword [eax - 0xc], esi
jle 0x439200
push eax
push 0x208
lea edx, [esp + 0x48]
push edx
call fcn.0040d2b0
mov ax, word [esp + 0x40]
mov ecx, 0xffdf
and ax, cx
mov word [esp + 0x40], ax
cmp ax, di
jne 0x439200
movzx ebx, di
push ebx
push str._Setup__c
call fcn.0040cd20
add esp, 8
push esi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x45c]
push ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x439200
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, ecx
mov ebp, eax
shrd edx, ebp, 0x14
shrd ecx, eax, 0x1e
push edx
push ecx
push ebx
push 0x4a5058
shr ebp, 0x14
shr eax, 0x1e
call fcn.0040cd20
add esp, 0x10
cmp dword [esp + 0x18], 1
ja 0x439200
jb 0x438f75
cmp dword [esp + 0x14], 0x80000000
jae 0x439200
push 0x4a5018
call fcn.0040cd20
mov ecx, dword [esp + 0x454]
add esp, 4
lea eax, [esp + 0x20]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.004349c0
test eax, eax
je 0x439200
mov edx, dword [0x4a5010]
mov eax, dword [0x4a5014]
push 0x18e
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x866]
xor ecx, ecx
push esi
push edx
mov dword [esp + 0x48], eax
mov word [esp + 0x86c], cx
call fcn.00454ce0
add esp, 0xc
lea eax, [esp + 0x860]
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, esi
je 0x439200
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea esi, [esp + 0x860]
jmp 0x439000
push esi
push 0x4a4ff0
call fcn.0040cd20
mov ecx, 0xffdf
and word [esi], cx
movzx eax, word [esi]
add esp, 8
mov word [esp + 0x38], ax
cmp ax, 0x43
jb 0x439056
cmp ax, di
je 0x439056
lea edx, [esp + 0x38]
push edx
call ebp
cmp eax, 3
jne 0x439056
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.004349c0
test eax, eax
je 0x439056
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x28], edx
je 0x43906b
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x439056
cmp word [esi], ax
jne 0x439000
jmp 0x4391db
mov ecx, dword [esp + 0x20]
movzx edx, word [esp + 0x38]
push ecx
push ebx
push edx
push str._Setup__c_c__u
call fcn.0040cd20
add esp, 0x10
xor ebx, ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4391db
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push ebx
push 0x12d000
push esi
push edi
call fcn.00455510
movzx edx, word [esp + 0x38]
shrd edi, esi, 0x1e
push eax
push edi
push edx
push 0x4a4f84
shr esi, 0x1e
call fcn.0040cd20
add esp, 0x10
cmp dword [esp + 0x18], ebx
ja 0x4390ed
cmp dword [esp + 0x14], 0xc0000000
jbe 0x4391db
push 0x206
lea ecx, [esp + 0x24e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x254], ax
call fcn.00454ce0
push 0x206
lea eax, [esp + 0x66a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x670], dx
call fcn.00454ce0
mov edi, dword [esp + 0x3c]
add esp, 0x18
lea ecx, [esp + 0x658]
push ecx
push 0x104
mov ecx, edi
call fcn.00435d50
mov eax, dword [edi + 0x10]
mov dx, word [esp + 0x38]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
lea eax, [esp + 0x65c]
push eax
lea ecx, [esp + 0x250]
push ecx
mov word [esp + 0x664], dx
call esi
mov eax, dword [edi + 4]
push eax
lea edx, [esp + 0x24c]
push edx
lea eax, [esp + 0x660]
push eax
call esi
lea ecx, [esp + 0x658]
push ecx
push 0x4a4f64
call fcn.0040cd20
add esp, 8
lea edx, [esp + 0x658]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4391db
lea eax, [esp + 0x248]
push eax
push 0x208
lea ecx, [esp + 0x48]
push ecx
call fcn.0040d2b0
lea edx, [esp + 0x40]
push edx
push 0x4a4f40
call fcn.0040cd20
add esp, 8
mov dword [edi + 0xf8], 1
lea eax, [esp + 0x40]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4391e2
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x24]
call fcn.0040df70
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
call fcn.0040e240
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
push eax
call fcn.0040d530
mov esi, dword [esp + 0x38]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x9fc], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439252
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x9f4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9dc]
xor ecx, esp
call fcn.00454cc7
add esp, 0x9ec
ret 4