Function at 0x47f3bc
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x2b0]
sub esp, 0x330
mov eax, dword [0x4ffeb0]
xor eax, ebp
mov dword [ebp + 0x2ac], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x7c]
push eax
mov esi, ecx
push esi
lea eax, [ebp - 0x80]
push eax
push 0x4e0bc8
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x207
mov dword [ebp - 0x80], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
push 0x4e198c
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.0041b220
add esp, 0x10
lea ebx, [esi + 0x618]
mov edi, 0x4e0c80
push edi
mov ecx, ebx
call fcn.004045f0
lea ecx, [esi + 0x620]
push edi
call fcn.004045f0
lea ecx, [esi + 0x624]
push edi
call fcn.004045f0
lea ecx, [esi + 0x62c]
push edi
call fcn.004045f0
lea ecx, [esi + 0x630]
push 0x4e35dc
call fcn.004045f0
lea ecx, [esi + 0x628]
push edi
call fcn.004045f0
push esi
lea ecx, [ebp - 0x78]
call fcn.00404030
push 0x4d7a54
lea ecx, [ebp - 0x78]
call fcn.004053a0
lea eax, [ebp - 0x78]
push eax
call fcn.00429930
pop ecx
push esi
lea ecx, [ebp - 0x74]
call fcn.00404030
lea eax, [ebp - 0x74]
push eax
call fcn.00429950
pop ecx
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.00404d60
call fcn.00429980
cmp dword [esi + 0x63c], 1
jne 0x47f4f3
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x22]
push eax
call fcn.004a0bd0
add esp, 0xc
push 0x64
lea eax, [ebp - 0x24]
push eax
call fcn.004c4e20
test eax, eax
je 0x47f4f3
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call fcn.004045f0
lea eax, [esi + 0x61c]
push eax
call fcn.00429a20
xor eax, eax
mov dword [esp], 0x206
push eax
mov word [ebp + 0xa4], ax
lea eax, [ebp + 0xa6]
push eax
call fcn.004a0bd0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x4d7a40
push esi
lea eax, [ebp + 0xa4]
push eax
call ebx
lea eax, [ebp + 0xa4]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00475052
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x620]
call fcn.004044f0
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.00404d60
lea eax, [ebp + 0xa4]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0047f284
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x634]
call fcn.004044f0
mov ecx, dword [ebp - 0x74]
add ecx, 0xfffffff0
call fcn.00404d60
xor eax, eax
push 0x206
push eax
mov word [ebp + 0xa4], ax
lea eax, [ebp + 0xa6]
push eax
call fcn.004a0bd0
add esp, 0xc
push 0x4d2ca8
push esi
lea eax, [ebp + 0xa4]
push eax
call ebx
lea eax, [ebp + 0xa4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47f68c
lea eax, [ebp + 0xa4]
push eax
mov ebx, 0x3e8
push ebx
push ebx
lea ecx, [esi + 0x624]
call fcn.00404af0
push eax
push 0x4e2370
push str.language
push 0x4e45fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [esi + 0x624]
call fcn.00404990
lea eax, [ebp + 0xa4]
push eax
push ebx
push ebx
lea ecx, [esi + 0x62c]
call fcn.00404af0
push eax
push edi
push str.channel
push 0x4e45fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [esi + 0x62c]
call fcn.00404990
lea eax, [ebp + 0xa4]
push eax
push ebx
push ebx
lea ebx, [esi + 0x630]
mov ecx, ebx
call fcn.00404af0
push eax
push edi
push 0x4d7a2c
push 0x4e45fc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00404990
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x47f680
push 0x4d7a28
mov ecx, ebx
call fcn.004050f0
test eax, eax
jne 0x47f68c
push 0x4e35dc
mov ecx, ebx
call fcn.004045f0
push 0x110
xor ebx, ebx
lea eax, [ebp - 0x6c]
push ebx
push eax
xor edi, edi
mov dword [ebp - 0x70], 0x114
call fcn.004a0bd0
push 0x118
lea eax, [ebp + 0x194]
push edi
push eax
mov dword [ebp + 0x190], 0x11c
call fcn.004a0bd0
add esp, 0x18
push edi
lea eax, [ebp + 0x190]
push eax
mov ecx, 0x506f10
call fcn.0049a5a6
test eax, eax
je 0x47f6e9
mov edi, dword [ebp + 0x194]
mov ebx, dword [ebp + 0x198]
jmp 0x47f6fd
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47f6fd
mov edi, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x68]
push 0x1e
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
mov eax, 0x4d7a20
jne 0x47f713
mov eax, 0x4d7a18
push eax
push ebx
push edi
lea eax, [esi + 0x628]
push 0x4d7a04
push eax
call fcn.00404ba0
add esp, 0x14
push esi
lea eax, [esi + 0x410]
push 0x104
xor ecx, ecx
push eax
mov word [eax], cx
call fcn.00406240
call fcn.00429970
push eax
lea ecx, [esi + 0x640]
call fcn.004268a0
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.00404d60
mov ecx, dword [ebp + 0x2ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a0e91
add ebp, 0x2b0
leave
ret