Function at 0x43e315
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x808
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x808], eax
push 0x48
mov eax, 0x4b049c
call fcn.004764c0
mov esi, dword [ebp + 0x814]
mov eax, dword [ebp + 0x818]
xor edi, edi
cmp dword [esi + 8], edi
mov dword [ebp - 0x3c], eax
sete al
test al, al
sete al
mov dword [ebp - 0x40], esi
test al, al
je 0x43e36b
cmp dword [esi + 4], edi
sete al
test al, al
sete al
test al, al
jne 0x43e392
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x808]
xor ecx, ebp
call fcn.0047549a
add ebp, 0x80c
leave
ret 8
push str.Check
lea ecx, [ebp - 0x10]
call fcn.0040285b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0043e29e
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp ecx, edi
je 0x43e3c1
call fcn.004028f4
cmp dword [ebp - 0x28], edi
sete al
test al, al
sete al
test al, al
je 0x43e3df
cmp dword [ebp - 0x2c], edi
sete al
test al, al
sete al
test al, al
jne 0x43e3f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004029ac
jmp 0x43e36b
mov esi, 0x4f9e00
push esi
lea ecx, [ebp - 0x18]
call fcn.004027fb
push str.HKEY
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040285b
push str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.004112c8
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
cmp ecx, edi
je 0x43e438
call fcn.004028f4
lea eax, [ebp - 0x18]
push eax
call fcn.0043e272
pop ecx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call fcn.004027fb
push str.SubKey
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0040285b
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.004112c8
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
cmp ecx, edi
je 0x43e484
call fcn.004028f4
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], edi
jne 0x43e4a4
lea ecx, [eax - 0x10]
call fcn.00402820
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402820
jmp 0x43e3df
push 0x4d749c
push 0x4d55a8
lea ecx, [ebp - 0x1c]
call fcn.0041db98
push esi
lea ecx, [ebp - 0x20]
call fcn.004027fb
push str.Value
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.0040285b
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.004112c8
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, edi
je 0x43e4f5
call fcn.004028f4
push 0x808
lea eax, [ebp]
push edi
push eax
call fcn.00475420
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0x7a4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43e546
lea ecx, [edi - 0x10]
call fcn.00402820
lea ecx, [ebx - 0x10]
jmp 0x43e48f
push esi
lea ecx, [ebp - 0x10]
call fcn.004027fb
push str.EntryFile
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.0040285b
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.004112c8
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x43e586
call fcn.004028f4
push 0x4d749c
push 0x4d55a8
lea ecx, [ebp - 0x10]
call fcn.0041db98
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x43e5ac
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43e5f2
lea ecx, [esi - 0x10]
call fcn.00402820
lea ecx, [edi - 0x10]
call fcn.00402820
lea ecx, [ebx - 0x10]
call fcn.00402820
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402820
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004029ac
mov eax, esi
jmp 0x43e36d
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43e628
lea ecx, [esi - 0x10]
call fcn.00402820
lea ecx, [edi - 0x10]
call fcn.00402820
lea ecx, [ebx - 0x10]
call fcn.00402820
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402820
xor esi, esi
inc esi
jmp 0x43e5df
lea eax, [ebp]
push 0
push eax
call fcn.0040224e
pop ecx
pop ecx
push 0x4bb288
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x44], eax
call fcn.0040285b
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0xb
call fcn.0043e29e
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x43e669
call fcn.004028f4
push 0x4bb27c
lea ecx, [ebp - 0x14]
call fcn.0040285b
push 0
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.004112c8
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x43e697
call fcn.004028f4
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 9
call fcn.004029ac
lea ecx, [esi - 0x10]
call fcn.00402820
lea ecx, [edi - 0x10]
call fcn.00402820
lea ecx, [ebx - 0x10]
call fcn.00402820
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402820
mov esi, dword [ebp - 0x44]
jmp 0x43e5df