Function at 0x43e1a3
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x808
lea ebp, [esp - 4]
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x808], eax
push 0x48
mov eax, 0x4b0533
call fcn.00476610
mov esi, dword [ebp + 0x814]
mov eax, dword [ebp + 0x818]
xor edi, edi
cmp dword [esi + 8], edi
mov dword [ebp - 0x3c], eax
sete al
test al, al
sete al
mov dword [ebp - 0x40], esi
test al, al
je 0x43e1f9
cmp dword [esi + 4], edi
sete al
test al, al
sete al
test al, al
jne 0x43e220
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x808]
xor ecx, ebp
call fcn.004755ea
add ebp, 0x80c
leave
ret 8
push str.Check
lea ecx, [ebp - 0x10]
call fcn.004028ab
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0043e12c
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp ecx, edi
je 0x43e24f
call fcn.00402944
cmp dword [ebp - 0x28], edi
sete al
test al, al
sete al
test al, al
je 0x43e26d
cmp dword [ebp - 0x2c], edi
sete al
test al, al
sete al
test al, al
jne 0x43e27e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004029fc
jmp 0x43e1f9
mov esi, 0x4f9e18
push esi
lea ecx, [ebp - 0x18]
call fcn.0040284b
push str.HKEY
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004028ab
push str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00411227
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
cmp ecx, edi
je 0x43e2c6
call fcn.00402944
lea eax, [ebp - 0x18]
push eax
call fcn.0043e100
pop ecx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call fcn.0040284b
push str.SubKey
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.004028ab
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00411227
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
cmp ecx, edi
je 0x43e312
call fcn.00402944
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], edi
jne 0x43e332
lea ecx, [eax - 0x10]
call fcn.00402870
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
jmp 0x43e26d
push 0x4d81e4
push 0x4d62f0
lea ecx, [ebp - 0x1c]
call fcn.0041da5c
push esi
lea ecx, [ebp - 0x20]
call fcn.0040284b
push str.Value
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.004028ab
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.00411227
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, edi
je 0x43e383
call fcn.00402944
push 0x808
lea eax, [ebp]
push edi
push eax
call fcn.00475570
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0x7a4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43e3d4
lea ecx, [edi - 0x10]
call fcn.00402870
lea ecx, [ebx - 0x10]
jmp 0x43e31d
push esi
lea ecx, [ebp - 0x10]
call fcn.0040284b
push str.EntryFile
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004028ab
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.00411227
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x43e414
call fcn.00402944
push 0x4d81e4
push 0x4d62f0
lea ecx, [ebp - 0x10]
call fcn.0041da5c
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x43e43a
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43e480
lea ecx, [esi - 0x10]
call fcn.00402870
lea ecx, [edi - 0x10]
call fcn.00402870
lea ecx, [ebx - 0x10]
call fcn.00402870
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004029fc
mov eax, esi
jmp 0x43e1fb
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43e4b6
lea ecx, [esi - 0x10]
call fcn.00402870
lea ecx, [edi - 0x10]
call fcn.00402870
lea ecx, [ebx - 0x10]
call fcn.00402870
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
xor esi, esi
inc esi
jmp 0x43e46d
lea eax, [ebp]
push 0
push eax
call fcn.0040229e
pop ecx
pop ecx
push 0x4bc228
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x44], eax
call fcn.004028ab
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0xb
call fcn.0043e12c
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x43e4f7
call fcn.00402944
push 0x4bc21c
lea ecx, [ebp - 0x14]
call fcn.004028ab
push 0
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.00411227
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x43e525
call fcn.00402944
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 9
call fcn.004029fc
lea ecx, [esi - 0x10]
call fcn.00402870
lea ecx, [edi - 0x10]
call fcn.00402870
lea ecx, [ebx - 0x10]
call fcn.00402870
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402870
mov esi, dword [ebp - 0x44]
jmp 0x43e46d