Function at 0x409450
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.0043d750
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push edi
push 0x800
mov ebx, ecx
mov dword [ebp - 0x102c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x100c], ebx
push 0
push eax
mov edi, edx
movlpd qword [ebp - 0x1020], xmm0
call fcn.00423950
add esp, 0xc
lea eax, [ebp - 0x808]
push ebx
push 0x46fe48
push 0x400
push eax
call fcn.00409f70
add esp, 0x10
mov dword [esi], 0x13
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1024], 0
push eax
push 0x101
push 0
lea eax, [ebp - 0x808]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4096de
push 0x800
push eax
lea eax, [ebp - 0x1008]
mov dword [esi], 0x14
push eax
call fcn.00423950
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1028]
add esp, 0xc
mov dword [ebp - 0x1028], 8
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push 0
push str.DatabaseInstallTimeStamp
push dword [ebp - 0x1024]
call ebx
test eax, eax
jne 0x4096d2
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1028], 0x800
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push str.DatabasePath
push dword [ebp - 0x1024]
call ebx
test eax, eax
jne 0x4096d2
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4096de
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1024], 0
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCustom
push closesocket
mov bl, 1
mov dword [esi], 0x15
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4096de
push str..sdb
push dword [ebp - 0x100c]
lea eax, [ebp - 0x218]
push 0x46ffcc
push 0x105
push eax
call fcn.00409fa0
mov esi, dword [ebp + 8]
add esp, 0x14
test esi, esi
je 0x4096bf
nop dword [eax + eax]
test bl, bl
je 0x4096bf
mov eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1028], 0
mov dword [eax], 0x16
lea eax, [ebp - 0x1028]
push eax
push 1
push 0
push dword [edi]
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40963f
xor bl, bl
jmp 0x4096b3
mov eax, dword [ebp - 0x102c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1018], xmm0
mov dword [ebp - 0x100c], 8
mov dword [eax], 0x17
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1018]
push eax
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x1028]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4096a5
mov eax, dword [ebp - 0x1018]
cmp eax, dword [ebp - 0x1020]
jne 0x4096a5
mov eax, dword [ebp - 0x1014]
cmp eax, dword [ebp - 0x101c]
je 0x4096a7
xor bl, bl
push dword [ebp - 0x1028]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 4
sub esi, 1
jne 0x409600
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret