Function at 0x423570
Capabilities:
Check if file exists
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5737a2
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x21c], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x214]
push eax
push 0x598834
mov dword [ebp - 0x218], 1
mov dword [edi + 4], 0x208
call fcn.00422c20
test eax, eax
je 0x42384b
cmp dword [ebp - 0x214], 0
je 0x42384b
cmp dword [ebp + 0xc], 0
je 0x423654
cmp dword [edi + 0xa0], 0
jne 0x423632
cmp dword [edi + 0x4c], 8
lea eax, [edi + 0x38]
jb 0x42361f
mov eax, dword [eax]
push 0x598834
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x423654
cmp dword [edi + 0xb8], 8
lea eax, [edi + 0xa4]
jb 0x423643
mov eax, dword [eax]
push 0x598710
push 0x598834
push eax
call dword [sym.imp.WININET.dll_InternetSetCookieW]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call fcn.0053e230
add esp, 8
lea eax, [ebp - 0x110]
mov ecx, edi
push eax
push str.chkupdate
call fcn.00422d40
test eax, eax
je 0x42384b
cmp word [ebp - 0x110], 0
je 0x42384b
cmp dword [ebp + 0xc], 0
je 0x4236e7
cmp dword [edi + 0xa0], 0
jne 0x4236c5
cmp dword [edi + 0x4c], 8
lea eax, [edi + 0x38]
jb 0x4236b2
mov eax, dword [eax]
push str.chkupdate
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x4236e7
cmp dword [edi + 0xb8], 8
lea eax, [edi + 0xa4]
jb 0x4236d6
mov eax, dword [eax]
push 0x598710
push str.chkupdate
push eax
call dword [sym.imp.WININET.dll_InternetSetCookieW]
mov ecx, edi
call fcn.00421880
mov edi, eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42384b
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x8e]
push eax
call fcn.0053e230
add esp, 8
lea edx, [ebp - 0x90]
mov ecx, edi
call fcn.004141d0
lea ecx, [ebp - 0x90]
add esp, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423733
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x5be674
call fcn.0053db60
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0053e230
add esp, 0x14
lea eax, [ebp - 0x210]
mov edx, 0xf0
mov ecx, 0x5be650
push eax
call fcn.004140d0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0053ede2
add esp, 0x10
test eax, eax
jne 0x42384b
push 0x7e
push eax
mov word [ebp - 0x190], ax
lea eax, [ebp - 0x18e]
push eax
call fcn.0053e230
push 0x3f
lea edx, [ebp - 0x190]
mov ecx, edi
call fcn.00411900
add esp, 0x10
test eax, eax
je 0x42384b
cmp word [0x5c2d08], 0
jne 0x423810
cmp word [0x5c2d90], 0
jne 0x4237fc
push 0x103
push 0x5c2d90
push dword [0x5c33bc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x3f
mov edx, 0x5c2d08
mov ecx, 0x5c2d90
call fcn.00411900
add esp, 4
lea edx, [ebp - 0x190]
mov ecx, 0x5c2d08
call fcn.004175a0
test eax, eax
jns 0x42384b
cmp word [edi], 0
jne 0x42382e
xor ecx, ecx
jmp 0x423842
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423833
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00420490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 8