Function at 0x43e2aa
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x808
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x808], eax
push 0x48
mov eax, 0x4b0400
call fcn.004764b0
mov esi, dword [ebp + 0x814]
mov eax, dword [ebp + 0x818]
xor edi, edi
cmp dword [esi + 8], edi
mov dword [ebp - 0x3c], eax
sete al
test al, al
sete al
mov dword [ebp - 0x40], esi
test al, al
je 0x43e300
cmp dword [esi + 4], edi
sete al
test al, al
sete al
test al, al
jne 0x43e327
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x808]
xor ecx, ebp
call fcn.0047548a
add ebp, 0x80c
leave
ret 8
push str.Check
lea ecx, [ebp - 0x10]
call fcn.004029a8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0043e233
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp ecx, edi
je 0x43e356
call fcn.00402a41
cmp dword [ebp - 0x28], edi
sete al
test al, al
sete al
test al, al
je 0x43e374
cmp dword [ebp - 0x2c], edi
sete al
test al, al
sete al
test al, al
jne 0x43e385
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402af9
jmp 0x43e300
mov esi, 0x4f9e00
push esi
lea ecx, [ebp - 0x18]
call fcn.0040293e
push str.HKEY
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004029a8
push str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.004112c7
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
cmp ecx, edi
je 0x43e3cd
call fcn.00402a41
lea eax, [ebp - 0x18]
push eax
call fcn.0043e207
pop ecx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call fcn.0040293e
push str.SubKey
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.004029a8
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.004112c7
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
cmp ecx, edi
je 0x43e419
call fcn.00402a41
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], edi
jne 0x43e439
lea ecx, [eax - 0x10]
call fcn.00402963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402963
jmp 0x43e374
push 0x4d7494
push 0x4d55a0
lea ecx, [ebp - 0x1c]
call fcn.0041db5c
push esi
lea ecx, [ebp - 0x20]
call fcn.0040293e
push str.Value
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.004029a8
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.004112c7
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, edi
je 0x43e48a
call fcn.00402a41
push 0x808
lea eax, [ebp]
push edi
push eax
call fcn.00475410
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0x7a4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43e4db
lea ecx, [edi - 0x10]
call fcn.00402963
lea ecx, [ebx - 0x10]
jmp 0x43e424
push esi
lea ecx, [ebp - 0x10]
call fcn.0040293e
push str.EntryFile
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004029a8
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.004112c7
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x43e51b
call fcn.00402a41
push 0x4d7494
push 0x4d55a0
lea ecx, [ebp - 0x10]
call fcn.0041db5c
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x43e541
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43e587
lea ecx, [esi - 0x10]
call fcn.00402963
lea ecx, [edi - 0x10]
call fcn.00402963
lea ecx, [ebx - 0x10]
call fcn.00402963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402963
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402af9
mov eax, esi
jmp 0x43e302
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43e5bd
lea ecx, [esi - 0x10]
call fcn.00402963
lea ecx, [edi - 0x10]
call fcn.00402963
lea ecx, [ebx - 0x10]
call fcn.00402963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402963
xor esi, esi
inc esi
jmp 0x43e574
lea eax, [ebp]
push 0
push eax
call fcn.0040239b
pop ecx
pop ecx
push 0x4bb260
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x44], eax
call fcn.004029a8
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0xb
call fcn.0043e233
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x43e5fe
call fcn.00402a41
push 0x4bb254
lea ecx, [ebp - 0x14]
call fcn.004029a8
push 0
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.004112c7
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x43e62c
call fcn.00402a41
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 9
call fcn.00402af9
lea ecx, [esi - 0x10]
call fcn.00402963
lea ecx, [edi - 0x10]
call fcn.00402963
lea ecx, [ebx - 0x10]
call fcn.00402963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402963
mov esi, dword [ebp - 0x44]
jmp 0x43e574