Function at 0x42c3c6
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get file version info
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
xor ecx, ecx
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x370], eax
push edi
lea edi, [ecx + 1]
mov dword [ebp - 0x368], ebx
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x354], ebx
test ecx, ecx
je 0x42ce2d
movzx edx, word [ecx + 2]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42c417
push 0x3a
pop eax
sub ecx, esi
sar ecx, 1
cmp ax, dx
push 2
pop edx
jne 0x42c7b9
lea ebx, [ecx + 1]
xor ecx, ecx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov esi, eax
mov eax, dword [ebp - 0x370]
pop ecx
mov dword [ebp - 0x364], esi
mov ecx, dword [eax + 0x34]
movzx eax, word [ecx]
cmp eax, 0x52
je 0x42c46e
cmp eax, 0x72
jne 0x42ce22
test esi, esi
je 0x42ce2d
lea eax, [ecx + 4]
mov edx, ebx
push eax
mov ecx, esi
call fcn.0040c040
push 0x2c
pop ebx
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x42ce22
xor ecx, ecx
xor edi, edi
push 2
mov word [eax], cx
pop ecx
add eax, ecx
mov dword [ebp - 0x370], edi
push ebx
push eax
mov dword [ebp - 0x360], eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42c505
xor eax, eax
push 2
mov word [esi], ax
pop eax
add esi, eax
push ebx
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x42c505
xor ecx, ecx
mov word [eax], cx
push 2
pop ecx
add eax, ecx
je 0x42c4f9
mov ecx, eax
call fcn.0041ec22
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x378], edx
jmp 0x42c505
mov dword [ebp - 0x368], edi
mov dword [ebp - 0x378], edi
mov edi, dword [ebp - 0x364]
push 0x405780
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42c524
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x42c530
mov edx, SysReAllocStringLen
mov ecx, edi
call fcn.004224d8
lea ecx, [ebp - 0x370]
xor edi, edi
push ecx
push 1
push edi
push dword [ebp - 0x360]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42c78b
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x360], 1
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x36c], 0x80
push eax
lea eax, [ebp - 0x360]
push eax
push edi
push esi
push dword [ebp - 0x370]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42c77f
cmp dword [ebp - 0x360], 1
jne 0x42c77f
mov dword [ebp - 0x354], edi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x358], edi
mov esi, edi
mov dword [ebp - 0x35c], edi
mov dword [ebp - 0x374], edi
jmp 0x42c5c3
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42c5bf
mov eax, esi
sub eax, 1
je 0x42c6f9
sub eax, 1
je 0x42c6cd
sub eax, 1
je 0x42c69a
lea eax, [ebp - 0x88]
test esi, esi
je 0x42c610
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x35c], eax
jmp 0x42c71c
inc esi
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42c60c
sub esi, 1
je 0x42c685
sub esi, 1
je 0x42c669
sub esi, 1
je 0x42c646
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x354], eax
jmp 0x42c71c
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404350
jmp 0x42c6bb
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404370
jmp 0x42c6e7
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404388
jmp 0x42c70c
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404308
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x42c71c
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404328
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x42c71c
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404340
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x354]
xor edi, edi
mov ecx, dword [ebp - 0x358]
mov esi, dword [ebp - 0x374]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x35c]
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
add esi, eax
shld edi, ebx, 0x10
movzx eax, cx
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
mov eax, esi
shl ebx, 0x10
shr eax, 0x10
or ebx, eax
movzx eax, si
shld edi, ebx, 0x10
cdq
shl ebx, 0x10
or edi, edx
or ebx, eax
mov dword [ebp - 0x354], edi
mov dword [ebp - 0x358], ebx
xor edi, edi
push dword [ebp - 0x370]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x354]
ja 0x42ce1c
jb 0x42c7b1
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x358]
ja 0x42ce1c
xor edi, edi
inc edi
jmp 0x42ce1c
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x36c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov ebx, eax
mov dword [ebp - 0x364], ebx
pop ecx
test ebx, ebx
je 0x42ce2d
mov eax, dword [ebp - 0x370]
xor ecx, ecx
mov edx, dword [ebp - 0x36c]
xor esi, esi
mov dword [ebp - 0x35c], ecx
mov ecx, ebx
push dword [eax + 0x34]
call fcn.0040c040
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x42c81f
xor eax, eax
mov word [ebx], ax
push 2
pop eax
add ebx, eax
mov ecx, dword [ebp - 0x364]
call fcn.0041ec22
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], edx
test ebx, ebx
je 0x42c850
push 0x406e20
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42ce1c
xor edx, edx
lea ecx, [ebp - 0x290]
call fcn.0041fb21
mov edi, 0x104
test eax, eax
je 0x42c8c1
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ecx
lea eax, [ebp - 0x36c]
mov edx, edi
push eax
lea ecx, [ebp - 0x290]
call fcn.0040c15d
test eax, eax
js 0x42c8ab
mov eax, dword [ebp - 0x36c]
mov edx, edi
push ecx
push 0x402488
push ecx
lea ecx, [ebp - 0x290]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42c8c1
test al, 0x10
je 0x42c92d
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42cdbe
push ecx
lea eax, [ebp - 0x36c]
mov edx, edi
push eax
lea ecx, [ebp - 0x290]
call fcn.0040c15d
test eax, eax
js 0x42c90f
mov eax, dword [ebp - 0x36c]
sub edi, eax
push ecx
push 0x40474c
push ecx
lea ecx, [ebp - 0x290]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42cdbe
test al, 0x10
jne 0x42cdbe
lea eax, [ebp - 0x36c]
xor edi, edi
push eax
lea eax, [ebp - 0x290]
mov dword [ebp - 0x36c], edi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x42cb3a
lea ecx, [ebp - 0x290]
call fcn.0041f21e
test eax, eax
je 0x42cdbe
push edi
push 0x80
push 3
push edi
push 1
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cdbe
lea eax, [ebp - 0x38c]
push eax
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42cb2a
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x42cb2a
push 0xac
lea eax, [ebp - 0x350]
push edi
push eax
call sub.msvcrt.dll_memset
movzx esi, word [ebp - 0x29e]
add esp, 0xc
movzx eax, word [ebp - 0x29a]
movzx ecx, word [ebp - 0x2a0]
shl esi, 0x10
or esi, eax
mov dword [ebp - 0x35c], ecx
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x42cb2f
mov ecx, dword [ebp - 0x350]
test ecx, ecx
jle 0x42ca18
movzx eax, cx
jmp 0x42ca1f
mov eax, ecx
neg eax
movzx eax, ax
xor edx, edx
movzx eax, ax
mov dword [ebp - 0x360], 0x3c
div dword [ebp - 0x360]
cmp ecx, 1
mov cx, word [ebp - 0x29a]
movzx edx, ax
mov ax, word [ebp - 0x298]
jge 0x42ca4f
add ax, dx
jmp 0x42ca73
cmp ax, dx
jae 0x42ca70
mov dword [ebp - 0x360], 0xffff
add cx, word [ebp - 0x360]
add ax, 0x18
mov word [ebp - 0x29a], cx
sub ax, dx
mov word [ebp - 0x298], ax
cmp ax, 0x17
jbe 0x42cacc
mov edx, 0xffe8
add ax, dx
inc cx
mov word [ebp - 0x298], ax
mov word [ebp - 0x29a], cx
cmp cx, 0x20
jne 0x42cacc
mov ax, word [ebp - 0x29e]
xor ecx, ecx
inc ecx
inc ax
mov word [ebp - 0x29a], cx
mov word [ebp - 0x29e], ax
cmp ax, 0xd
jne 0x42cacc
inc word [ebp - 0x2a0]
mov word [ebp - 0x29e], cx
fldz
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x2a0]
push eax
fstp qword [ebp - 0x380]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x42cb2f
fld qword [ebp - 0x380]
lea eax, [ebp - 0x2a0]
push eax
push ecx
push ecx
fstp qword [esp]
call dword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
test eax, eax
je 0x42cb2f
movzx esi, word [ebp - 0x29e]
movzx ecx, word [ebp - 0x2a0]
movzx eax, word [ebp - 0x29a]
shl esi, 0x10
mov dword [ebp - 0x35c], ecx
or esi, eax
jmp 0x42cb2f
mov edi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x42cbae
push ebx
call fcn.00440dea
mov edi, eax
pop ecx
test edi, edi
je 0x42cdbe
push edi
push ebx
xor ebx, ebx
mov dword [ebp - 0x360], 0x80004005
push ebx
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x42cba1
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x368]
push eax
push 0x4043f0
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42cba1
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x360], ebx
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x35c], ecx
push edi
call fcn.00440db7
mov edi, dword [ebp - 0x360]
pop ecx
test edi, edi
js 0x42cdc2
mov ecx, dword [ebp - 0x35c]
mov edi, 0x404308
movzx eax, si
push eax
movzx eax, cx
shr esi, 0x10
push esi
push eax
shr ecx, 0x10
lea eax, [ebp - 0x290]
push ecx
push edi
push 0x103
push eax
call fcn.0040c0e1
add esp, 0x1c
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x358], ebx
lea eax, [ebp - 0x290]
mov dword [ebp - 0x35c], ebx
mov esi, ebx
mov dword [ebp - 0x368], ebx
jmp 0x42cc0c
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42cc08
mov eax, esi
sub eax, 1
je 0x42cd44
sub eax, 1
je 0x42cd18
sub eax, 1
je 0x42cce9
lea eax, [ebp - 0x290]
test esi, esi
jne 0x42ccd9
push 0x2c
pop ebx
jmp 0x42cc4f
inc esi
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42cc4b
sub esi, 1
je 0x42ccc4
sub esi, 1
je 0x42cca8
sub esi, 1
je 0x42cc85
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x354], eax
jmp 0x42cd67
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404350
jmp 0x42cd06
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404370
jmp 0x42cd32
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404388
jmp 0x42cd57
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x35c], eax
jmp 0x42cd67
lea eax, [ebp - 0x368]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push edi
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x42cd67
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404328
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x42cd67
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x354]
push eax
push 0x404340
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x354]
xor edi, edi
mov ecx, dword [ebp - 0x358]
mov esi, dword [ebp - 0x368]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x35c]
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
add esi, eax
shld edi, ebx, 0x10
movzx eax, cx
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
mov eax, esi
shl ebx, 0x10
shr eax, 0x10
or ebx, eax
movzx eax, si
shld edi, ebx, 0x10
cdq
shl ebx, 0x10
or ebx, eax
or edi, edx
jmp 0x42cdca
mov ebx, esi
jmp 0x42cdc8
mov ebx, dword [ebp - 0x358]
mov edi, ebx
cmp edi, dword [ebp - 0x374]
jb 0x42cde5
ja 0x42cdde
mov esi, dword [ebp - 0x378]
cmp ebx, esi
jb 0x42cdeb
xor eax, eax
lea edi, [eax + 1]
jmp 0x42ce1c
mov esi, dword [ebp - 0x378]
mov eax, dword [ebp - 0x370]
xor edi, edi
mov eax, dword [eax + 0x54]
test eax, eax
je 0x42ce1c
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x42ce08
call fcn.0041ec22
jmp 0x42ce0c
xor eax, eax
xor edx, edx
cmp edx, dword [ebp - 0x374]
jb 0x42ce1a
ja 0x42cdde
cmp eax, esi
jae 0x42cdde
xor edi, edi
mov esi, dword [ebp - 0x364]
test esi, esi
je 0x42ce2d
push esi
call fcn.00440db7
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret