Function at 0x403870
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x46ad0c]
push esi
push edi
mov dword [esp + 0x114], eax
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4037e3
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
push eax
push str.UninstallString
push edx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4036bd
push 0x5c
push esi
call fcn.0044c359
add esp, 8
mov byte [eax + 1], 0
push ebx
push str.wnwg
mov ecx, esi
call fcn.00403290
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edi, 1
jne 0x4036f7
push esi
lea eax, [esp + 0x18]
push str._swnwbwnwb.exe
push eax
call fcn.0044b73f
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
je 0x4036fd
mov dword [esi + 0x208], edi
push str.wnnz
mov ecx, esi
call fcn.00403290
test eax, eax
jne 0x40372b
push esi
lea edx, [esp + 0x18]
push str._swnimedll32wn.ime
push edx
call fcn.0044b73f
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x403731
mov dword [esi + 0x20c], edi
push str.wnie
mov ecx, esi
call fcn.00403290
test eax, eax
jne 0x40375f
push esi
lea ecx, [esp + 0x18]
push str._swniewnie.exe
push ecx
call fcn.0044b73f
add esp, 0xc
lea edx, [esp + 0x14]
push edx
call ebx
test eax, eax
je 0x403765
mov dword [esi + 0x210], edi
push str.wnpy
mov ecx, esi
call fcn.00403290
test eax, eax
jne 0x403793
push esi
lea eax, [esp + 0x18]
push str._swnpydll32wnpy.ime
push eax
call fcn.0044b73f
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
je 0x403799
mov dword [esi + 0x214], edi
push str.wnsrf
mov ecx, esi
call fcn.00403290
test eax, eax
jne 0x4037c7
push esi
lea edx, [esp + 0x18]
push str._swnsrfdll32wnsrf.ime
push edx
call fcn.0044b73f
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x4037cd
mov dword [esi + 0x218], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
call fcn.0044b7c8
add esp, 0x110
ret
push str.wnwg
mov ecx, esi
call fcn.00403290
test eax, eax
mov edi, 1
je 0x4037fe
mov dword [esi + 0x208], edi
push str.wnnz
mov ecx, esi
call fcn.00403290
test eax, eax
je 0x403814
mov dword [esi + 0x20c], edi
push str.wnie
mov ecx, esi
call fcn.00403290
test eax, eax
je 0x40382a
mov dword [esi + 0x210], edi
push str.wnpy
mov ecx, esi
call fcn.00403290
test eax, eax
je 0x403840
mov dword [esi + 0x214], edi
push str.wnsrf
mov ecx, esi
call fcn.00403290
test eax, eax
je 0x4037ce
mov ecx, dword [esp + 0x114]
mov dword [esi + 0x218], edi
pop edi
pop esi
call fcn.0044b7c8
add esp, 0x110
ret
push ebx
push esi
push edi
push 0x45c46f
mov ebx, ecx
push 0x45c28c
push ebx
call fcn.0044b73f
push 0x45c46f
lea esi, [ebx + 0x104]
push 0x45c28c
push esi
call fcn.0044b73f
add esp, 0x18
push 0
push 0x2b
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
dec esi
lea esp, [esp]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4038b0
mov eax, dword [str.Shiqiang_]
mov edi, esi
mov dword [edi], eax
mov ecx, dword [0x45d428]
mov dword [edi + 4], ecx
mov dx, word [0x45d42c]
mov word [edi + 8], dx
mov al, byte [0x45d42e]
mov byte [edi + 0xa], al
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp 0x403650