Function at 0x436358
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x494
mov eax, 0x565a5a
call fcn.0053d749
mov eax, dword [ebp + 8]
mov dword [ebp - 0x494], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48c], ebx
call fcn.00438329
push eax
lea ecx, [ebp - 0x480]
call fcn.00402a28
mov byte [ebp - 4], 1
call fcn.00438329
push eax
lea ecx, [ebp - 0x47c]
call fcn.00402a28
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
je 0x43699b
push ebx
push 0x59d78c
lea ecx, [ebp + 0xc]
call fcn.0040f22e
mov edi, eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax - 0xc]
push edi
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040a89f
push eax
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 3
call fcn.0040279f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x478]
add ecx, 0xfffffff0
call fcn.00402a50
sub esi, edi
dec esi
push esi
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040f28d
push eax
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 4
call fcn.0040279f
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x478]
add ecx, 0xfffffff0
call fcn.00402a50
mov esi, dword [ebp - 0x480]
cmp dword [esi - 0xc], ebx
je 0x436770
mov eax, dword [ebp - 0x47c]
cmp dword [eax - 0xc], ebx
je 0x436770
call fcn.00438329
push eax
lea ecx, [ebp - 0x474]
call fcn.00402a28
mov byte [ebp - 4], 5
call fcn.00438329
push eax
lea ecx, [ebp - 0x490]
call fcn.00402a28
push ebx
push 0x599c28
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 6
call fcn.0040f22e
mov esi, dword [esi - 0xc]
mov edi, eax
push edi
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x480]
call fcn.0040a89f
push eax
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 7
call fcn.0040279f
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x478]
add ecx, 0xfffffff0
call fcn.00402a50
sub esi, edi
dec esi
push esi
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x480]
call fcn.0040f28d
push eax
lea ecx, [ebp - 0x490]
mov byte [ebp - 4], 8
call fcn.0040279f
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x478]
add ecx, 0xfffffff0
call fcn.00402a50
mov eax, dword [ebp - 0x474]
cmp dword [eax - 0xc], ebx
je 0x436754
mov eax, dword [ebp - 0x490]
cmp dword [eax - 0xc], ebx
je 0x436754
push eax
lea eax, [ebp - 0x420]
xor ecx, ecx
push 0x599768
push eax
mov word [ebp - 0x218], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.HKEY_USERS
lea ecx, [ebp - 0x474]
call fcn.0041107e
test eax, eax
jne 0x436551
mov esi, SysStringLen
jmp 0x4365a5
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x474]
call fcn.0041107e
test eax, eax
jne 0x43656c
mov esi, SysReAllocString
jmp 0x4365a5
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x474]
call fcn.0041107e
test eax, eax
jne 0x436587
mov esi, VariantCopy
jmp 0x4365a5
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x474]
call fcn.0041107e
mov esi, eax
neg esi
sbb esi, esi
neg esi
add esi, 0x80000001
call fcn.00438329
push eax
lea ecx, [ebp - 0x484]
call fcn.00402a28
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
mov byte [ebp - 4], 9
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43673a
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push dword [ebp - 0x47c]
mov dword [ebp - 0x488], 0x208
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43673a
push 0x2f
mov edi, str...CommonUtility.cpp
push edi
call fcn.00538fb0
pop ecx
pop ecx
test eax, eax
je 0x436622
push 0x2f
jmp 0x436632
push 0x5c
push edi
call fcn.00538fb0
pop ecx
pop ecx
test eax, eax
je 0x43663d
push 0x5c
push edi
call fcn.00538fb0
pop ecx
pop ecx
inc eax
jmp 0x43663f
mov eax, edi
push 1
push 0x3fd
push eax
lea esi, [ebp - 0x470]
call fcn.00404e75
lea ecx, [ebp - 0x218]
push ecx
push str.Trace:_Open_Reg:__s
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.00404f53
mov esi, eax
call fcn.0040cf26
pop ecx
pop ecx
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 9
call fcn.00404ee1
mov ecx, dword [ebp - 0x488]
xor eax, eax
mov word [ebp + ecx*2 - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43673a
lea eax, [ebp - 0x218]
push eax
push 0x599768
push dword [ebp - 0x494]
call fcn.0040ab0a
xor esi, esi
push 0x2f
inc esi
push edi
mov dword [ebp - 0x48c], esi
call fcn.00538fb0
add esp, 0x14
test eax, eax
je 0x4366db
push 0x2f
jmp 0x4366eb
push 0x5c
push edi
call fcn.00538fb0
pop ecx
pop ecx
test eax, eax
je 0x4366f6
push 0x5c
push edi
call fcn.00538fb0
pop ecx
pop ecx
inc eax
jmp 0x4366f8
mov eax, edi
push esi
push 0x408
push eax
lea esi, [ebp - 0x470]
call fcn.00404e75
lea ecx, [ebp - 0x218]
push ecx
push str.Trace:_App_Found:__s
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.00404f53
mov esi, eax
call fcn.0040cf26
pop ecx
pop ecx
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 9
call fcn.00404ee1
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.00402a50
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.00402a50
mov ecx, dword [ebp - 0x474]
add ecx, 0xfffffff0
jmp 0x436996
mov esi, dword [ebp - 0x47c]
cmp dword [esi - 0xc], ebx
je 0x43699b
call fcn.00438329
push eax
lea ecx, [ebp - 0x474]
call fcn.00402a28
mov byte [ebp - 4], 0xc
call fcn.00438329
push eax
lea ecx, [ebp - 0x478]
call fcn.00402a28
push ebx
push 0x599c28
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0xd
call fcn.0040f22e
mov esi, dword [esi - 0xc]
mov edi, eax
push edi
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x47c]
call fcn.0040a89f
push eax
lea ecx, [ebp - 0x474]
mov byte [ebp - 4], 0xe
call fcn.0040279f
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.00402a50
sub esi, edi
dec esi
push esi
lea eax, [ebp - 0x484]
push eax
lea ecx, [ebp - 0x47c]
call fcn.0040f28d
push eax
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 0xf
call fcn.0040279f
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x484]
add ecx, 0xfffffff0
call fcn.00402a50
mov esi, dword [ebp - 0x474]
mov edi, dword [ebp - 0x478]
cmp dword [esi - 0xc], ebx
je 0x43698b
cmp dword [edi - 0xc], ebx
je 0x43698b
xor eax, eax
push edi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x420]
push 0x599768
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.HKEY_USERS
lea ecx, [ebp - 0x474]
call fcn.0041107e
test eax, eax
jne 0x436884
mov eax, SysStringLen
jmp 0x4368d5
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x474]
call fcn.0041107e
test eax, eax
jne 0x43689f
mov eax, SysReAllocString
jmp 0x4368d5
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x474]
call fcn.0041107e
test eax, eax
jne 0x4368ba
mov eax, VariantCopy
jmp 0x4368d5
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x474]
call fcn.0041107e
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
push 0x20019
lea ecx, [ebp - 0x420]
push ecx
push eax
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x10
call fcn.00420e2a
test eax, eax
jne 0x436975
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x599168
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 0x488], 0x104
call fcn.00420d64
mov ecx, dword [ebp - 0x488]
xor eax, eax
mov word [ebp + ecx*2 - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436975
lea eax, [ebp - 0x218]
push eax
push 0x599768
push dword [ebp - 0x494]
call fcn.0040ab0a
add esp, 0xc
mov dword [ebp - 0x48c], 1
lea ecx, [ebp - 0x4a0]
call fcn.00420e79
lea ecx, [ebp - 0x4a0]
call fcn.00420e79
lea ecx, [edi - 0x10]
call fcn.00402a50
lea ecx, [esi - 0x10]
call fcn.00402a50
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
call fcn.00402a50
mov ecx, dword [ebp - 0x480]
add ecx, 0xfffffff0
call fcn.00402a50
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402a50
mov eax, dword [ebp - 0x48c]
call fcn.0053d7cc
ret