Function at 0x41b260
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x394
mov eax, dword [0x498f90]
xor eax, esp
mov dword [esp + 0x390], eax
push ebx
mov ebx, dword [esp + 0x39c]
mov eax, 0x49a750
push ebp
mov ebp, dword [esp + 0x3a4]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41b290
sub eax, edx
jne 0x41b4a4
push esi
push edi
mov ecx, 0xa
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersion
lea edi, [esp + 0x168]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x174]
push ecx
push reloc.WS2_32.dll_bind
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
pop esi
jne 0x41b359
mov edx, dword [str.CommonFilesDir]
mov ecx, dword [0x468c84]
mov eax, dword [0x468c80]
mov dword [esp + 0x150], edx
mov dx, word [0x468c88]
mov dword [esp + 0x158], ecx
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
mov word [esp + 0x160], dx
lea edx, [esp + 0x294]
push edx
mov dword [esp + 0x15c], eax
mov al, byte [0x468c8a]
push 0
mov byte [esp + 0x16a], al
push 0
lea eax, [esp + 0x160]
push eax
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41b374
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [esp + 0x398]
pop ebp
pop ebx
xor ecx, esp
call fcn.0043ec69
add esp, 0x394
ret 8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ecx
mov byte [esp + eax + 0x294], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x290]
mov byte [esp + eax + 0x18c], cl
add eax, 1
test cl, cl
jne 0x41b390
lea eax, [esp + 0x18c]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x41b3b0
mov edx, dword [str.IAR_Systems]
mov ecx, dword [0x468c70]
mov dword [eax], edx
mov edx, dword [0x468c74]
mov dword [eax + 4], ecx
mov cl, byte [0x468c78]
mov dword [eax + 8], edx
lea edx, [esp + 0x18c]
push edx
mov byte [eax + 0xc], cl
call fcn.0044160d
add esp, 4
test eax, eax
je 0x41b3ff
call fcn.004415c9
cmp dword [eax], 0x11
jne 0x41b359
lea eax, [esp + 0x18c]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x41b410
mov ecx, dword [str.License]
mov edx, dword [0x468c64]
mov dword [eax], ecx
mov cl, byte [0x468c68]
mov dword [eax + 4], edx
lea edx, [esp + 0x18c]
push edx
mov byte [eax + 8], cl
call fcn.0044160d
add esp, 4
test eax, eax
je 0x41b456
call fcn.004415c9
cmp dword [eax], 0x11
jne 0x41b359
xor eax, eax
jmp 0x41b460
mov cl, byte [esp + eax + 0x18c]
mov byte [eax + 0x49a750], cl
add eax, 1
test cl, cl
jne 0x41b460
mov eax, 0x49a750
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x41b480
mov ecx, dword [str.Lms.log]
mov edx, dword [0x468c58]
mov dword [eax], ecx
mov cl, byte [0x468c5c]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
lea edx, [esp + 0x10]
push edx
push 0x49a750
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x41b4c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41b4e9
jmp 0x41b359
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x2c], 0
jne 0x41b359
cmp dword [esp + 0x30], 0xf4240
ja 0x41b359
push ebx
push 0x49a750
call fcn.00440279
xor ecx, ecx
add esp, 8
test eax, eax
setne cl
mov dword [ebp], eax
mov al, cl
jmp 0x41b35b