Function at 0x42c86c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
xor ecx, ecx
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x36c], eax
push edi
lea edi, [ecx + 1]
mov dword [ebp - 0x364], ebx
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x354], ebx
test ecx, ecx
je 0x42d2e5
movzx edx, word [ecx + 2]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42c8bd
push 0x3a
pop eax
sub ecx, esi
sar ecx, 1
cmp ax, dx
push 2
pop edx
jne 0x42cc5d
lea ebx, [ecx + 1]
xor ecx, ecx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov esi, eax
mov eax, dword [ebp - 0x36c]
pop ecx
mov dword [ebp - 0x378], esi
mov ecx, dword [eax + 0x34]
movzx eax, word [ecx]
cmp eax, 0x52
je 0x42c914
cmp eax, 0x72
jne 0x42d2d4
test esi, esi
je 0x42d2e5
lea eax, [ecx + 4]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0040c010
push 0x2c
pop ebx
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x42d2d4
and dword [ebp - 0x36c], 0
xor ecx, ecx
push 2
mov word [eax], cx
pop ecx
add eax, ecx
push ebx
push eax
mov dword [ebp - 0x360], eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x42c9ac
xor eax, eax
push 2
mov word [edi], ax
pop eax
add edi, eax
push ebx
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x42c9ac
xor ecx, ecx
mov word [eax], cx
push 2
pop ecx
add eax, ecx
je 0x42c99e
mov ecx, eax
call fcn.0041ee6a
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x374], edx
jmp 0x42c9ac
and dword [ebp - 0x364], 0
and dword [ebp - 0x374], 0
push 0x405770
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42c9c5
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x42c9d1
mov edx, SysReAllocStringLen
mov ecx, esi
call fcn.004227a7
lea ecx, [ebp - 0x36c]
xor esi, esi
push ecx
push 1
push esi
push dword [ebp - 0x360]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42cc30
lea eax, [ebp - 0x368]
mov dword [ebp - 0x360], 1
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x368], 0x80
push eax
lea eax, [ebp - 0x360]
push eax
push esi
push edi
push dword [ebp - 0x36c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42cc24
cmp dword [ebp - 0x360], 1
jne 0x42cc24
mov dword [ebp - 0x354], esi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x35c], esi
mov dword [ebp - 0x370], esi
jmp 0x42ca62
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42ca5e
mov eax, esi
sub eax, 1
je 0x42cb98
sub eax, 1
je 0x42cb6c
sub eax, 1
je 0x42cb39
lea eax, [ebp - 0x88]
test esi, esi
je 0x42caaf
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x35c], eax
jmp 0x42cbbb
inc esi
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42caab
sub esi, 1
je 0x42cb24
sub esi, 1
je 0x42cb08
sub esi, 1
je 0x42cae5
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x354], eax
jmp 0x42cbbb
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404340
jmp 0x42cb5a
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404360
jmp 0x42cb86
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404378
jmp 0x42cbab
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x4042f8
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x42cbbb
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404318
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x42cbbb
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404330
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x358]
mov esi, dword [ebp - 0x370]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x35c]
shl eax, 0x10
add esi, eax
mov eax, ecx
shr eax, 0x10
cdq
mov ebx, eax
mov edi, edx
shld edi, ebx, 0x10
movzx eax, cx
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
mov eax, esi
shr eax, 0x10
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
movzx eax, si
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
mov dword [ebp - 0x358], ebx
xor esi, esi
mov dword [ebp - 0x354], edi
push dword [ebp - 0x36c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x374]
cmp eax, dword [ebp - 0x354]
ja 0x42cc56
jb 0x42cc4e
mov eax, dword [ebp - 0x364]
cmp eax, dword [ebp - 0x358]
ja 0x42cc56
xor edi, edi
inc edi
jmp 0x42d2d4
mov edi, esi
jmp 0x42d2d4
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x368], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov ebx, eax
mov dword [ebp - 0x378], ebx
pop ecx
test ebx, ebx
je 0x42d2e5
mov eax, dword [ebp - 0x36c]
xor ecx, ecx
mov edx, dword [ebp - 0x368]
xor esi, esi
mov dword [ebp - 0x35c], ecx
mov ecx, ebx
push dword [eax + 0x34]
call fcn.0040c010
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov dword [ebp - 0x360], eax
pop ecx
pop ecx
test eax, eax
je 0x42cccd
xor ecx, ecx
mov word [eax], cx
push 2
pop ecx
add eax, ecx
mov dword [ebp - 0x360], eax
mov ecx, ebx
call fcn.0041ee6a
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x370], edx
test eax, eax
je 0x42cd00
push 0x406e10
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42d2d4
xor edx, edx
lea ecx, [ebp - 0x290]
call fcn.0041fda0
mov edi, 0x104
test eax, eax
je 0x42cd71
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ecx
lea eax, [ebp - 0x368]
mov edx, edi
push eax
lea ecx, [ebp - 0x290]
call fcn.0040c131
test eax, eax
js 0x42cd5b
mov eax, dword [ebp - 0x368]
mov edx, edi
push ecx
push 0x402478
push ecx
lea ecx, [ebp - 0x290]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42cd71
test al, 0x10
je 0x42cddd
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42d274
push ecx
lea eax, [ebp - 0x368]
mov edx, edi
push eax
lea ecx, [ebp - 0x290]
call fcn.0040c131
test eax, eax
js 0x42cdbf
mov eax, dword [ebp - 0x368]
sub edi, eax
push ecx
push 0x40473c
push ecx
lea ecx, [ebp - 0x290]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040c197
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42d274
test al, 0x10
jne 0x42d274
lea eax, [ebp - 0x368]
xor edi, edi
push eax
lea eax, [ebp - 0x290]
mov dword [ebp - 0x368], edi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x42cfea
lea ecx, [ebp - 0x290]
call fcn.0041f47f
test eax, eax
je 0x42d274
push edi
push 0x80
push 3
push edi
push 1
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42d274
lea eax, [ebp - 0x38c]
push eax
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42cfda
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x42cfda
push 0xac
lea eax, [ebp - 0x350]
push edi
push eax
call sub.msvcrt.dll_memset
movzx esi, word [ebp - 0x29e]
add esp, 0xc
movzx eax, word [ebp - 0x29a]
movzx ecx, word [ebp - 0x2a0]
shl esi, 0x10
or esi, eax
mov dword [ebp - 0x35c], ecx
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x42cfdf
mov ecx, dword [ebp - 0x350]
test ecx, ecx
jle 0x42cec8
movzx eax, cx
jmp 0x42cecf
mov eax, ecx
neg eax
movzx eax, ax
xor edx, edx
movzx eax, ax
mov dword [ebp - 0x360], 0x3c
div dword [ebp - 0x360]
cmp ecx, 1
mov cx, word [ebp - 0x29a]
movzx edx, ax
mov ax, word [ebp - 0x298]
jge 0x42ceff
add ax, dx
jmp 0x42cf23
cmp ax, dx
jae 0x42cf20
mov dword [ebp - 0x360], 0xffff
add cx, word [ebp - 0x360]
add ax, 0x18
mov word [ebp - 0x29a], cx
sub ax, dx
mov word [ebp - 0x298], ax
cmp ax, 0x17
jbe 0x42cf7c
mov edx, 0xffe8
add ax, dx
inc cx
mov word [ebp - 0x298], ax
mov word [ebp - 0x29a], cx
cmp cx, 0x20
jne 0x42cf7c
mov ax, word [ebp - 0x29e]
xor ecx, ecx
inc ecx
inc ax
mov word [ebp - 0x29a], cx
mov word [ebp - 0x29e], ax
cmp ax, 0xd
jne 0x42cf7c
inc word [ebp - 0x2a0]
mov word [ebp - 0x29e], cx
fldz
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x2a0]
push eax
fstp qword [ebp - 0x380]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x42cfdf
fld qword [ebp - 0x380]
lea eax, [ebp - 0x2a0]
push eax
push ecx
push ecx
fstp qword [esp]
call dword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x42cfdf
movzx esi, word [ebp - 0x29e]
movzx ecx, word [ebp - 0x2a0]
movzx eax, word [ebp - 0x29a]
shl esi, 0x10
mov dword [ebp - 0x35c], ecx
or esi, eax
jmp 0x42cfdf
mov edi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x42d05e
push ebx
call fcn.0044183a
mov edi, eax
pop ecx
test edi, edi
je 0x42d274
push edi
push ebx
xor ebx, ebx
mov dword [ebp - 0x360], 0x80004005
push ebx
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42d051
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x364]
push eax
push 0x4043e0
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42d051
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x360], ebx
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x35c], ecx
push edi
call fcn.00441807
mov edi, dword [ebp - 0x360]
pop ecx
test edi, edi
js 0x42d278
mov ecx, dword [ebp - 0x35c]
mov edi, 0x4042f8
movzx eax, si
push eax
movzx eax, cx
shr esi, 0x10
push esi
push eax
shr ecx, 0x10
lea eax, [ebp - 0x290]
push ecx
push edi
push 0x103
push eax
call fcn.0040c0b5
add esp, 0x1c
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x358], ebx
lea eax, [ebp - 0x290]
mov dword [ebp - 0x35c], ebx
mov esi, ebx
mov dword [ebp - 0x364], ebx
jmp 0x42d0bc
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42d0b8
mov eax, esi
sub eax, 1
je 0x42d1f4
sub eax, 1
je 0x42d1c8
sub eax, 1
je 0x42d199
lea eax, [ebp - 0x290]
test esi, esi
jne 0x42d189
push 0x2c
pop ebx
jmp 0x42d0ff
inc esi
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42d0fb
sub esi, 1
je 0x42d174
sub esi, 1
je 0x42d158
sub esi, 1
je 0x42d135
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x354], eax
jmp 0x42d217
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404340
jmp 0x42d1b6
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404360
jmp 0x42d1e2
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404378
jmp 0x42d207
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x35c], eax
jmp 0x42d217
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x42d217
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404318
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x42d217
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404330
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x358]
mov esi, dword [ebp - 0x364]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x35c]
shl eax, 0x10
add esi, eax
mov eax, ecx
shr eax, 0x10
cdq
mov ebx, eax
mov edi, edx
shld edi, ebx, 0x10
movzx eax, cx
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
mov eax, esi
shr eax, 0x10
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
movzx eax, si
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
jmp 0x42d280
mov ebx, esi
jmp 0x42d27e
mov ebx, dword [ebp - 0x358]
mov edi, ebx
cmp edi, dword [ebp - 0x370]
jb 0x42d296
ja 0x42d2cb
mov esi, dword [ebp - 0x374]
cmp ebx, esi
jb 0x42d29c
jmp 0x42d2cb
mov esi, dword [ebp - 0x374]
mov eax, dword [ebp - 0x36c]
xor edi, edi
mov eax, dword [eax + 0x54]
test eax, eax
je 0x42d2d4
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x42d2b9
call fcn.0041ee6a
jmp 0x42d2bd
xor eax, eax
xor edx, edx
cmp edx, dword [ebp - 0x370]
jb 0x42d2d2
ja 0x42d2cb
cmp eax, esi
jb 0x42d2d2
xor eax, eax
lea edi, [eax + 1]
jmp 0x42d2d4
xor edi, edi
mov eax, dword [ebp - 0x378]
test eax, eax
je 0x42d2e5
push eax
call fcn.00441807
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret