Function at 0x43fba1
Capabilities:
Get common file path
Get file size
Query or enumerate registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x754
mov eax, dword [0x46700c]
xor eax, esp
mov dword [esp + reloc.ADVAPI32.dll_TraceMessage], eax
cmp dword [0x468604], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x43fbe4
cmp ebx, dword [0x468608]
jg 0x44000d
cmp dword [reloc.ADVAPI32.dll_TraceMessage], 0xffffffff
jne 0x44000d
lea eax, [esp + 0x1c]
push eax
xor ecx, ecx
xor edi, edi
inc edi
push edi
push ecx
push 0x41cf00
push 0x80000001
mov dword [esp + 0x30], ecx
mov dword [esp + 0x24], ecx
mov esi, ecx
mov dword [0x468604], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fd1a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], edi
xor edi, edi
push edi
push 0x41cf40
push dword [esp + 0x30]
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fcc8
cmp dword [esp + 0x18], 1
jne 0x43fcc8
push eax
push 0x8000080
push 3
push eax
push eax
mov byte [esp + 0x147], al
push 0x80000000
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, reloc.ADVAPI32.dll_TraceMessage
je 0x43fc99
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x43fc87
xor eax, eax
mov ecx, 0x7a120
cmp ecx, eax
sbb esi, esi
push edi
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xor edi, edi
test esi, esi
sete al
push edi
push 0x8000080
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0x40000000
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push edi
push 0x41cf50
push dword [esp + 0x30]
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fd00
cmp dword [esp + 0x18], 4
jne 0x43fd00
mov eax, dword [esp + 0x10]
jmp 0x43fd06
mov eax, edi
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
movzx eax, ax
mov dword [0x468608], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43fd1c
xor edi, edi
mov eax, dword [reloc.ADVAPI32.dll_TraceMessage]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x43fea3
mov eax, dword [0x468608]
test eax, eax
jne 0x43fd3b
push 4
pop eax
mov dword [0x468608], eax
cmp ebx, eax
jg 0x44000d
push 0x104
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x43fe95
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [esp + 0x30]
test eax, eax
je 0x43fd6c
push eax
call ebx
push str.wmsetup.log
lea eax, [esp + 0x34]
push eax
mov eax, 0x104
call fcn.0043f50c
test eax, eax
js 0x43fe95
push edi
push 0x8000080
push 3
push edi
push edi
push 0x80000000
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, reloc.ADVAPI32.dll_TraceMessage
je 0x43fdcb
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x43fdb9
xor eax, eax
mov ecx, 0x7a120
cmp ecx, eax
sbb esi, esi
push edi
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [reloc.ADVAPI32.dll_TraceMessage]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x43fea3
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x43fe95
lea eax, reloc.ADVAPI32.dll_TraceMessage
test eax, eax
je 0x43fe03
push eax
call ebx
push 0x41cf6c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov eax, edi
call fcn.0043f50c
test eax, eax
js 0x43fe95
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
push eax
push 0x8000080
push 3
push eax
push eax
push 0x80000000
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call ebx
mov edi, eax
cmp edi, reloc.ADVAPI32.dll_TraceMessage
je 0x43fe65
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jne 0x43fe53
xor eax, eax
mov ecx, 0x7a120
cmp ecx, eax
sbb esi, esi
push edi
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
sete al
push 0
push 0x8000080
lea eax, [eax*2 + 2]
push eax
push 0
push 1
push 0x40000000
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call ebx
mov dword [reloc.ADVAPI32.dll_TraceMessage], eax
jmp 0x43fe9a
mov eax, dword [reloc.ADVAPI32.dll_TraceMessage]
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x44000d
test esi, esi
jne 0x43feb2
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [0x468608]
movzx eax, word [esp + 0x30]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x34]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x38]
push eax
mov esi, 0x104
push 0x41cf78
mov ecx, esi
lea eax, [esp + 0x50]
call fcn.0043f5a4
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x20
test eax, eax
js 0x43ff33
and dword [esp + 0x10], 0
lea ecx, [esp + 0x30]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ff15
push 0
lea eax, [esp + 0x14]
push eax
sub ecx, edx
push ecx
lea eax, [esp + 0x3c]
push eax
push dword [0x467874]
call ebx
push 0x7f
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00440d23
push edx
push eax
call fcn.00440787
call fcn.00441a0a
push 0x103
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push edx
push eax
call fcn.00440787
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push esi
lea edi, reloc.ADVAPI32.dll_TraceMessage
mov dword [esp + 0x18], eax
call fcn.00444a99
test eax, eax
je 0x44000d
call fcn.00440e9b
mov esi, 0x41cfd4
test eax, eax
jne 0x43ff97
mov esi, 0x41cfd8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov eax, dword [esp + 0x1c]
movzx eax, ax
push eax
push ecx
call fcn.0043fb1b
pop ecx
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
push 0x41cfe0
mov ecx, 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0043f5a4
add esp, 0x1c
test eax, eax
js 0x44000d
and dword [esp + 0x10], 0
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43ffec
push 0
lea eax, [esp + 0x14]
push eax
sub ecx, edx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [0x467874]
call ebx
mov ecx, dword [esp + reloc.ADVAPI32.dll_TraceMessage]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004655f1
mov esp, ebp
pop ebp
ret