Function at 0x43ff30
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov word [ebp - 0x420], 0
push 0x40e
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.HTTP_shellopencommand
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4401a7
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x420]
push eax
push 0
push 0
push 0x4732e4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4401a7
push 0x4732e8
lea edx, [ebp - 0x420]
push edx
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jle 0x440015
lea eax, [ebp - 0x420]
push eax
call fcn.0043e520
add esp, 4
push 0x488d00
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x440015
push 0x488d00
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x440015
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4401b6
push str.firefox.exe
lea edx, [ebp - 0x420]
push edx
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jle 0x44007b
lea eax, [ebp - 0x420]
push eax
call fcn.0043e520
add esp, 4
push 0x488d00
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x44007b
push 0x488d00
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44007b
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4401b6
push str.Maxthon.exe
lea edx, [ebp - 0x420]
push edx
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jle 0x4400e1
lea eax, [ebp - 0x420]
push eax
call fcn.0043e520
add esp, 4
push 0x488d00
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x4400e1
push 0x488d00
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4400e1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
jmp 0x4401b6
push 0x473334
lea edx, [ebp - 0x420]
push edx
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jle 0x440144
lea eax, [ebp - 0x420]
push eax
call fcn.0043e520
add esp, 4
push 0x488d00
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x440144
push 0x488d00
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x440144
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x4401b6
push str.chrome.exe
lea edx, [ebp - 0x420]
push edx
call fcn.0043d3a0
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jle 0x4401a7
lea eax, [ebp - 0x420]
push eax
call fcn.0043e520
add esp, 4
push 0x488d00
call fcn.00414d31
add esp, 4
test eax, eax
jbe 0x4401a7
push 0x488d00
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4401a7
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x4401b6
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 5
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret