Function at 0x44c94d
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x2ac]
sub esp, 0x32c
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x2a8], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x80]
push eax
mov esi, ecx
push esi
lea eax, [ebp - 0x7c]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], 0x207
mov dword [ebp - 0x7c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
push 0x499a54
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00405560
add esp, 0x10
lea ebx, [esi + 0x618]
mov edi, 0x4991c8
push edi
mov ecx, ebx
call fcn.00404f90
lea ecx, [esi + 0x61c]
push edi
call fcn.00404f90
lea ecx, [esi + 0x620]
push edi
call fcn.00404f90
lea ecx, [esi + 0x628]
push edi
call fcn.00404f90
lea ecx, [esi + 0x624]
push edi
call fcn.00404f90
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x26]
push eax
call fcn.00464d20
add esp, 0xc
push 0x64
lea eax, [ebp - 0x28]
push eax
call fcn.00485560
test eax, eax
je 0x44ca28
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.00404f90
xor eax, eax
push 0x206
push eax
mov word [ebp + 0xa0], ax
lea eax, [ebp + 0xa2]
push eax
call fcn.00464d20
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push 0x493ea8
push esi
lea eax, [ebp + 0xa0]
push eax
call ebx
lea eax, [ebp + 0xa0]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004441ea
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x61c]
call fcn.00404e20
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.004016d0
lea eax, [ebp + 0xa0]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0044436e
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x62c]
call fcn.00404e20
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.004016d0
xor eax, eax
push 0x206
push eax
mov word [ebp + 0xa0], ax
lea eax, [ebp + 0xa2]
push eax
call fcn.00464d20
add esp, 0xc
push 0x48fdc4
push esi
lea eax, [ebp + 0xa0]
push eax
call ebx
lea eax, [ebp + 0xa0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44cb58
lea eax, [ebp + 0xa0]
push eax
mov ebx, 0x3e8
push ebx
push ebx
lea ecx, [esi + 0x620]
call fcn.00401ea0
push eax
push 0x49064c
push str.language
push 0x48fda8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [esi + 0x620]
call fcn.004018c0
lea eax, [ebp + 0xa0]
push eax
push ebx
push ebx
lea ebx, [esi + 0x628]
mov ecx, ebx
call fcn.00401ea0
push eax
push edi
push str.channel
push 0x48fda8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004018c0
xor edi, edi
xor ebx, ebx
call fcn.00443fcd
push 0x110
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x74], 0x114
call fcn.00464d20
push 0x118
lea eax, [ebp + 0x190]
push ebx
push eax
mov dword [ebp + 0x18c], 0x11c
call fcn.00464d20
add esp, 0x18
push ebx
lea eax, [ebp + 0x18c]
push eax
mov ecx, 0x4b7ff8
call fcn.0046152d
test eax, eax
je 0x44cbba
mov edi, dword [ebp + 0x190]
mov ebx, dword [ebp + 0x194]
jmp 0x44cbce
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44cbce
mov edi, dword [ebp - 0x70]
mov ebx, dword [ebp - 0x6c]
cmp dword [0x4b6a90], 0
mov eax, 0x493ea0
jne 0x44cbe1
mov eax, 0x493e98
push eax
push ebx
push edi
lea eax, [esi + 0x624]
push 0x493e84
push eax
call fcn.004028a0
add esp, 0x14
push esi
lea eax, [esi + 0x410]
push 0x104
xor ecx, ecx
push eax
mov word [eax], cx
call fcn.004015b0
push esi
lea ecx, [ebp - 0x78]
call fcn.00404be0
lea eax, [ebp - 0x78]
push eax
call fcn.00405350
pop ecx
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.004016d0
push esi
lea ecx, [ebp - 0x78]
call fcn.00404be0
lea eax, [ebp - 0x78]
push eax
call fcn.00405370
pop ecx
mov ecx, dword [ebp - 0x78]
add ecx, 0xfffffff0
call fcn.004016d0
call fcn.00405390
push eax
lea ecx, [esi + 0x634]
call fcn.004030f0
mov ecx, dword [ebp + 0x2a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x2ac
leave
ret