Function at 0x43d23a
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x5498bc
call fcn.0043d7d4
xor edi, edi
mov dword [ebp - 0x660], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x65c], reloc.gdiplus.dll_Ordinal_1
mov esi, edi
mov dword [ebp - 0x628], edi
call fcn.00402cbd
push eax
lea ecx, [ebp - 0x620]
call fcn.00402161
push 0x20019
push str.SoftwareWOW6432NodeClientsStartMenuInternet
push dword [ebp + esi*4 - 0x660]
lea ecx, [ebp - 0x66c]
mov dword [ebp - 0x66c], edi
mov dword [ebp - 0x668], edi
mov dword [ebp - 0x664], edi
call fcn.0043dd98
test eax, eax
je 0x43d2e6
push 0x20019
push 0x528be0
push dword [ebp + esi*4 - 0x660]
lea ecx, [ebp - 0x66c]
call fcn.0043dd98
test eax, eax
je 0x43d2e6
mov ebx, dword [ebp - 0x66c]
jmp 0x43d5d8
mov ebx, dword [ebp - 0x66c]
mov dword [ebp - 0x658], 0x104
lea eax, [ebp - 0x678]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43d5d6
lea eax, [ebp - 0x414]
inc edi
push eax
push 0x528be0
lea eax, [ebp - 0x620]
mov dword [ebp - 0x654], edi
push 0x528c88
push eax
call fcn.004023f1
add esp, 0x10
mov dword [ebp - 0x624], 0x104
xor eax, eax
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x630], eax
push 0x20019
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], eax
push dword [ebp + esi*4 - 0x660]
call fcn.0043dd98
test eax, eax
jne 0x43d5a4
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0x51ca10
lea ecx, [ebp - 0x634]
call fcn.0043dca3
test eax, eax
jne 0x43d5a4
mov ecx, str._shellopencommand
call fcn.0040208a
push eax
push str._shellopencommand
lea ecx, [ebp - 0x620]
call fcn.00402366
push 0x20019
push dword [ebp - 0x620]
lea ecx, [ebp - 0x634]
mov dword [ebp - 0x624], 0x104
push dword [ebp + esi*4 - 0x660]
call fcn.0043dd98
test eax, eax
jne 0x43d5a4
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x51ca10
lea ecx, [ebp - 0x634]
call fcn.0043dca3
test eax, eax
jne 0x43d5a4
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x670]
call fcn.00401f21
mov esi, dword [ebp - 0x670]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.004033d1
lea eax, [ebp - 0x20c]
push eax
cmp edi, 0xffffffff
je 0x43d4ce
lea ecx, [ebp - 0x640]
call fcn.00401f21
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x63c]
call fcn.00401f21
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x638]
call fcn.00401f21
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x638]
push eax
call fcn.0043d0e6
mov ecx, dword [ebp - 0x638]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 0x63c]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 0x640]
lea ecx, [ecx - 0x10]
call fcn.004033d1
jmp 0x43d598
lea ecx, [ebp - 0x644]
call fcn.00401f21
push 0x44
call fcn.004b3df0
mov ecx, eax
call fcn.0043c5d0
mov esi, eax
lea eax, [ebp - 0x644]
push eax
mov ecx, esi
call fcn.0043cd68
mov ecx, dword [ebp - 0x644]
add ecx, 0xfffffff0
mov dword [ebp - 0x624], esi
call fcn.004033d1
lea eax, [ebp - 0x648]
mov ecx, esi
push eax
call fcn.0043ca23
mov esi, dword [ebp - 0x648]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43d585
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x650]
call fcn.00401f21
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x64c]
call fcn.00401f21
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.0043d0e6
mov ecx, dword [ebp - 0x64c]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 0x650]
lea ecx, [ecx - 0x10]
call fcn.004033d1
lea ecx, [esi - 0x10]
call fcn.004033d1
lea ecx, [ebp - 0x624]
call fcn.0043d722
mov edi, dword [ebp - 0x654]
mov esi, dword [ebp - 0x628]
cmp dword [ebp - 0x634], 0
mov dword [ebp - 0x658], 0x104
je 0x43d5ca
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x634], 0
and dword [ebp - 0x630], 0
jmp 0x43d2f6
xor edi, edi
test ebx, ebx
je 0x43d5e9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x66c], edi
mov ecx, dword [ebp - 0x620]
mov dword [ebp - 0x668], edi
lea ecx, [ecx - 0x10]
call fcn.004033d1
inc esi
mov dword [ebp - 0x628], esi
cmp esi, 2
jb 0x43d278
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret