Function at 0x430e70
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535dfc
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x5917ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x430eb4
push edi
call fcn.00431ba0
mov ecx, eax
call fcn.00425f10
call fcn.00431ba0
mov ecx, eax
call fcn.00426cd0
test eax, eax
jne 0x431065
push 0x208
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.004c0d00
add esp, 0xc
mov dword [ebp - 0x840], 1
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x83c], 0x104
lea ecx, [ebp - 0x831]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x840]
push eax
push 0x54d334
call fcn.0042f9b0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x431065
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x628]
push str.birdwp.exe
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x430f89
lea ecx, [ebp - 0x831]
call fcn.0042fd30
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431065
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.exist_wp
mov dword [ebp - 4], 0
call fcn.00420f40
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041a530
test esi, esi
je 0x431274
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x431274
push str.exist
push eax
push esi
call fcn.004dc51b
add esp, 0xc
jmp 0x431274
call fcn.00431ba0
mov ecx, eax
call fcn.00426e70
test eax, eax
jne 0x431152
push 1
call fcn.004222e0
add esp, 4
test eax, eax
jne 0x431152
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.giveup
mov dword [ebp - 4], 1
call fcn.00420f40
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041a530
test esi, esi
je 0x431274
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x431274
push str.giveup
push eax
push esi
call fcn.004dc51b
add esp, 0xc
jmp 0x431274
cmp dword [0x595510], 0
jne 0x431274
push 0xa
push edi
push 0
push dword [0x59544c]
mov dword [0x595510], 1
call fcn.00433110
add esp, 0x10
test esi, esi
je 0x431274
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x431274
call fcn.00431ba0
mov ecx, eax
call fcn.00425870
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a9d0
push str.bizhi
call fcn.00420f40
mov ecx, eax
call fcn.0041aa90
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.004c0d00
add esp, 0xc
lea eax, [ebp - 0x830]
push 0x104
push eax
push dword [0x59544c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x830]
push eax
call fcn.00420f40
mov ecx, eax
call fcn.0041a940
cmp dword [0x590204], 0
jne 0x431233
push 0x551408
push edi
push esi
call fcn.004dc51b
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 2
push 0x551408
jmp 0x431261
push str.fail
push edi
push esi
call fcn.004dc51b
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 3
push str.fail
call fcn.00420f40
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041a530
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b8b8
mov esp, ebp
pop ebp
ret 0xc