Function at 0x42b410
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fdac
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x42b455
push edi
call fcn.0042c380
mov ecx, eax
call fcn.00421a20
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
mov dword [ebp - 0x840], 1
lea eax, [ebp - 0x838]
mov dword [ebp - 0x83c], 0x104
lea ecx, [ebp - 0x831]
push eax
call fcn.0042a1e0
mov edx, dword [ebp - 0x838]
add edx, 0xfffffff0
mov ebx, dword [eax]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42b4b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x840]
push eax
push 0x535c84
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42b63e
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004a99f0
add esp, 0xc
lea eax, [ebp - 0x628]
push str.birdwp.exe
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
jne 0x42b566
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x831]
call fcn.0042a980
push dword [eax]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x838]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42b566
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
je 0x42b63e
call fcn.0042c380
mov ecx, eax
call fcn.004212e0
push eax
call fcn.0041c940
mov ecx, eax
call fcn.00416fb0
push str.bizhi
call fcn.0041c940
mov ecx, eax
call fcn.00417070
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x57fc98]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0041c940
mov ecx, eax
call fcn.00416f20
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.exist_wp
mov dword [ebp - 4], 0
call fcn.0041c940
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00416b10
test esi, esi
je 0x42b84d
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x42b84d
push str.exist
push eax
push esi
call fcn.004c53f7
add esp, 0xc
jmp 0x42b84d
call fcn.0042c380
mov ecx, eax
call fcn.004228b0
test eax, eax
jne 0x42b72b
push 1
call fcn.0041df40
add esp, 4
test eax, eax
jne 0x42b72b
call fcn.0042c380
mov ecx, eax
call fcn.004212e0
push eax
call fcn.0041c940
mov ecx, eax
call fcn.00416fb0
push str.bizhi
call fcn.0041c940
mov ecx, eax
call fcn.00417070
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x57fc98]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0041c940
mov ecx, eax
call fcn.00416f20
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.giveup
mov dword [ebp - 4], 1
call fcn.0041c940
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00416b10
test esi, esi
je 0x42b84d
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x42b84d
push str.giveup
push eax
push esi
call fcn.004c53f7
add esp, 0xc
jmp 0x42b84d
cmp dword [0x57fd58], 0
jne 0x42b84d
push 0xa
push edi
push 0
push dword [0x57fc98]
mov dword [0x57fd58], 1
call fcn.0042daa0
add esp, 0x10
test esi, esi
je 0x42b84d
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x42b84d
call fcn.0042c380
mov ecx, eax
call fcn.004212e0
push eax
call fcn.0041c940
mov ecx, eax
call fcn.00416fb0
push str.bizhi
call fcn.0041c940
mov ecx, eax
call fcn.00417070
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
lea eax, [ebp - 0x830]
push 0x104
push eax
push dword [0x57fc98]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x830]
push eax
call fcn.0041c940
mov ecx, eax
call fcn.00416f20
cmp dword [0x57b27c], 0
jne 0x42b80c
push 0x539c60
push edi
push esi
call fcn.004c53f7
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 2
push 0x539c60
jmp 0x42b83a
push str.fail
push edi
push esi
call fcn.004c53f7
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 3
push str.fail
call fcn.0041c940
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00416b10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret 0xc