Function at 0x1001418f
Capabilities:
Check if file exists
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x100598e8]
xor eax, ebp
mov dword [ebp + 0x7b4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
mov dword [ebp - 0x70], ecx
call fcn.10031310
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x1004c864
mov edi, 0x1005bb14
push edi
lea eax, [ebp - 0x6c]
push eax
call esi
test eax, eax
je 0x100141ff
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100141ff
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x4ac], 1
mov eax, dword [ebp - 0x70]
cmp dword [eax + 0x4ac], 0
je 0x10014409
xor eax, eax
push ebx
push eax
mov word [ebp + 0x5ac], ax
lea eax, [ebp + 0x5ae]
push eax
call fcn.10031310
add esp, 0xc
push 0x1004c83c
push edi
lea eax, [ebp + 0x5ac]
push eax
call esi
test eax, eax
je 0x1001429c
push dword [0x1005cb6c]
lea eax, [ebp + 0x5ac]
push eax
call fcn.1000f01b
pop ecx
pop ecx
test eax, eax
je 0x1001429c
lea eax, [ebp + 0x5ac]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x80], eax
test eax, eax
je 0x1001429c
push 0x1004c82c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10014293
push 9
call eax
cmp eax, 4
je 0x10014293
cmp eax, 9
je 0x10014293
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x4a4], 1
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x70]
cmp dword [eax + 0x4a4], 0
je 0x10014409
xor eax, eax
push ebx
push eax
mov word [ebp + 0x19c], ax
lea eax, [ebp + 0x19e]
push eax
call fcn.10031310
add esp, 0xc
push 0x1004c72c
push edi
lea eax, [ebp + 0x19c]
push eax
call esi
test eax, eax
je 0x100142f7
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100142f7
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x4a8], 1
mov eax, dword [ebp - 0x70]
cmp dword [eax + 0x4a8], 0
je 0x10014409
and dword [ebp - 0x74], 0
push 4
pop eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x1004c810
push 0x1004c7dc
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10014373
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
push 4
push 0x1004c7c4
push 0x1004c770
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 0x74], 0
je 0x10014409
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x4a0], 1
jmp 0x10014409
cmp eax, 2
jne 0x10014409
xor eax, eax
push ebx
push eax
mov word [ebp + 0x3a4], ax
lea eax, [ebp + 0x3a6]
push eax
call fcn.10031310
add esp, 0xc
push 0x1004c74c
push edi
lea eax, [ebp + 0x3a4]
push eax
call esi
test eax, eax
je 0x10014409
lea eax, [ebp + 0x3a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10014409
mov edi, dword [ebp - 0x70]
mov ecx, edi
call fcn.100140d9
push dword [ebp - 0x78]
test eax, eax
lea eax, [ebp - 0x74]
push eax
push 4
push 0x1004c7c4
push 0x1004c770
push 0x80000002
je 0x100143ff
xor esi, esi
inc esi
mov dword [ebp - 0x74], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, edi
call fcn.10014027
test eax, eax
je 0x10014409
mov dword [edi + 0x4a0], esi
jmp 0x10014409
and dword [ebp - 0x74], 0
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp + 0x7b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031770
add ebp, 0x7b8
leave
ret