Function at 0x3f7960
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4196e7
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x470cb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x354], ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x34c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x350], 0x3d1524
call fcn.003f53b2
mov dword [ebp - 0x350], 0x3d14c0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
push 0
push 0xf003f
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x350]
push dword [esi]
push edi
call fcn.003f9520
test eax, eax
js 0x42438b
mov edi, dword [ebp - 0x354]
xor ebx, ebx
mov dword [ebp - 0x364], ebx
push 0
mov dword [ebp - 0x388], 0x100
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 0x2b4]
test eax, eax
je 0x4243b2
lea ecx, [ebp - 0x3c4]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x388]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push ebx
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x3f8224
lea ebx, [eax + 1]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 0x103
je 0x3f828e
test ebx, ebx
je 0x42439c
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a4], 0x41
mov dword [ebp - 0x2a8], eax
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov word [ebp - 0x29c], ax
mov dword [ebp - fcn.003fbe10], 0x3d1028
mov dword [ebp - 0x2b0], 0x3d14c0
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
push eax
push 0xf003f
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x2b0]
call fcn.003f9520
test eax, eax
js 0x42459f
mov eax, dword [0x471724]
mov dword [ebp - 0x3bc], 0x3d154c
mov esi, dword [eax + 0xc]
cmp esi, fcn.003f8b50
jne 0x4243c1
mov ecx, 0x471724
call fcn.003f8b50
add eax, 0x10
mov dword [ebp - 0x3b8], eax
mov eax, dword [0x471724]
mov esi, dword [eax + 0xc]
cmp esi, fcn.003f8b50
jne 0x4243d5
mov ecx, 0x471724
call fcn.003f8b50
add eax, 0x10
mov dword [ebp - 0x3b4], eax
mov byte [ebp - 4], 2
mov eax, dword [0x471724]
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x37c], 0
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x378], 0
cmp esi, fcn.003f8b50
jne 0x4243e9
mov ecx, 0x471724
call fcn.003f8b50
add eax, 0x10
mov dword [ebp - 0x374], eax
mov eax, dword [0x471724]
mov esi, dword [eax + 0xc]
cmp esi, fcn.003f8b50
jne 0x4243fd
mov ecx, 0x471724
call fcn.003f8b50
add eax, 0x10
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x384]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x3bc]
call fcn.003f6fb0
test eax, eax
js 0x3f7f7c
mov esi, dword [edi]
xor eax, eax
mov ebx, dword [ebp - 0x380]
mov dword [ebp - 0x358], eax
cmp esi, dword [edi + 0x14]
je 0x3f7cdb
test eax, eax
jne 0x424429
cmp ebx, dword [esi + 4]
je 0x3f7c1e
seta al
test al, al
jne 0x3f7ee5
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x3f7c8a
mov esi, dword [esi + 0x54]
mov edi, dword [ebp - 0x354]
mov eax, dword [ebp - 0x358]
jmp 0x3f7be5
xor edi, edi
test ebx, ebx
je 0x3f7c06
mov edx, dword [ebp - 0x384]
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jae 0x42458b
cmp edi, dword [esi + 4]
jae 0x42458b
mov eax, dword [esi]
lea ecx, [eax + edi*8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x360], ecx
cmp eax, dword [ecx + 4]
jne 0x3f811e
test eax, eax
jne 0x3f7c77
push dword [ecx]
push dword [edx]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x3f80a0
mov edx, dword [ebp - 0x35c]
inc edi
add edx, 8
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jb 0x3f7c38
jmp 0x3f7c06
xor edi, edi
test eax, eax
je 0x42441c
cmp edi, eax
jae 0x42458b
mov eax, dword [esi]
cmp dword [eax + edi*8 + 4], 0
jne 0x3f8181
mov ecx, dword [ebp - 0x384]
cmp edi, ebx
jae 0x42458b
push dword [ecx + edi*8]
push dword [eax + edi*8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x3f7c0d
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jb 0x3f7c9c
jmp 0x42441c
test eax, eax
jne 0x424429
cmp dword [edi + 8], 0
je 0x3f81bd
mov esi, dword [edi + 8]
lea eax, [ebp - 0x384]
push eax
mov ecx, esi
mov dword [ebp - 0x360], esi
call fcn.003f8dd0
lea eax, [ebp - 0x3bc]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x20]
call fcn.003f6dd0
mov byte [ebp - 4], 3
lea ebx, [esi + 0x58]
mov dword [esi + 0x4c], 1
mov ecx, edi
mov dword [ebx], 0
mov eax, dword [edi + 8]
mov dword [ebp - 0x390], ebx
mov eax, dword [eax + 0x50]
mov dword [edi + 8], eax
lea eax, [esi + 0x50]
push eax
mov dword [esi + 0x4c], 0
call fcn.003f8d80
lea eax, [esi + 0x54]
mov ecx, edi
push eax
call fcn.003f8d80
push ebx
mov ecx, edi
call fcn.003f8d80
inc dword [edi + 4]
xor eax, eax
mov esi, dword [edi]
mov ebx, dword [ebp - 0x380]
mov dword [ebp - 0x358], eax
cmp esi, dword [edi + 0x14]
je 0x3f7e5d
mov dword [ebp - 0x358], esi
cmp ebx, dword [esi + 4]
je 0x3f7da3
seta al
test al, al
jne 0x3f7ef3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x3f7e0c
mov esi, dword [esi + 0x54]
mov edi, dword [ebp - 0x354]
jmp 0x3f7d72
xor edi, edi
test ebx, ebx
je 0x3f7d91
mov edx, dword [ebp - 0x384]
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jae 0x42458b
cmp edi, dword [esi + 4]
jae 0x42458b
mov eax, dword [esi]
lea ecx, [eax + edi*8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x38c], ecx
cmp eax, dword [ecx + 4]
jne 0x3f812b
test eax, eax
jne 0x3f7dfc
push dword [ecx]
push dword [edx]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x3f80c6
mov edx, dword [ebp - 0x35c]
inc edi
add edx, 8
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jb 0x3f7dbd
jmp 0x3f7d91
xor edi, edi
test eax, eax
je 0x424497
cmp edi, eax
jae 0x42458b
mov eax, dword [esi]
cmp dword [eax + edi*8 + 4], 0
jne 0x3f819f
mov ecx, dword [ebp - 0x384]
cmp edi, ebx
jae 0x42458b
push dword [ecx + edi*8]
push dword [eax + edi*8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x3f7d98
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jb 0x3f7e1e
jmp 0x424497
mov ecx, dword [ebp - 0x390]
mov eax, dword [ebp - 0x358]
mov dword [ecx], eax
test eax, eax
je 0x3f8281
push eax
lea ecx, [ebp - 0x384]
call fcn.003f9980
mov edx, dword [ebp - 0x358]
test al, al
jne 0x3f7eda
mov eax, dword [edx + 4]
cmp eax, ebx
jne 0x3f7efb
xor esi, esi
test eax, eax
je 0x3f7eda
cmp esi, eax
jae 0x42458b
mov eax, dword [edx]
cmp dword [eax + esi*8 + 4], 0
jne 0x3f8206
mov ecx, dword [ebp - 0x384]
cmp esi, ebx
jae 0x42458b
push dword [ecx + esi*8]
push dword [eax + esi*8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov edx, dword [ebp - 0x358]
add esp, 8
test eax, eax
jne 0x3f7efb
mov eax, dword [edx + 4]
inc esi
cmp esi, eax
jb 0x3f7e9e
mov ebx, dword [ebp - 0x360]
mov dword [edx + 0x50], ebx
jmp 0x3f7f04
mov esi, dword [esi + 0x50]
mov eax, dword [ebp - 0x358]
jmp 0x3f7be5
mov esi, dword [esi + 0x50]
jmp 0x3f7d72
mov ebx, dword [ebp - 0x360]
mov dword [edx + 0x54], ebx
mov dword [ebx + 0x4c], 0
mov eax, dword [edi]
cmp ebx, eax
je 0x3f7f61
mov ecx, dword [ebx + 0x58]
cmp dword [ecx + 0x4c], 0
jne 0x3f7f61
mov edx, dword [ecx + 0x58]
mov eax, dword [edx + 0x50]
cmp ecx, eax
je 0x3f8138
test eax, eax
je 0x3f80ec
cmp dword [eax + 0x4c], 0
jne 0x3f80ec
mov dword [ecx + 0x4c], 1
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
mov ebx, dword [eax + 0x58]
mov eax, dword [edi]
cmp ebx, eax
jne 0x3f7f11
mov dword [eax + 0x4c], 1
mov ecx, dword [edi]
add ecx, 0x58
mov byte [ebp - 4], 5
je 0x424595
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
mov ebx, dword [ebp - 0x364]
or eax, 0xffffffff
mov byte [ebp - 4], 2
inc ebx
mov ecx, dword [ebp - 0x370]
mov dword [ebp - 0x364], ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x4244d7
mov ecx, dword [ebp - 0x374]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x4244f6
mov edx, dword [ebp - 0x384]
test edx, edx
je 0x3f800b
xor esi, esi
cmp dword [ebp - 0x380], esi
jbe 0x3f8001
mov ecx, dword [edx + esi*8]
or eax, 0xffffffff
sub ecx, 0x10
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x424515
inc esi
cmp esi, dword [ebp - 0x380]
jb 0x3f7fd5
mov edi, dword [ebp - 0x354]
mov ebx, dword [ebp - 0x364]
push edx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3b4]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x424534
mov ecx, dword [ebp - 0x3b8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x424553
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x2b0], 0x3d14c0
test eax, eax
je 0x3f806b
cmp dword [ebp - 0x218], 0
je 0x3f806b
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2b0], 0x3d1524
mov dword [ebp - fcn.003fbe10], 0x3d1028
test eax, eax
je 0x3f7a01
lea ecx, [ebp - 0x29c]
cmp eax, ecx
je 0x3f7a01
jmp 0x424572
mov eax, dword [ebp - 0x360]
push dword [eax]
mov eax, dword [ebp - 0x35c]
push dword [eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jns 0x3f7c06
jmp 0x424411
mov eax, dword [ebp - 0x38c]
push dword [eax]
mov eax, dword [ebp - 0x35c]
push dword [eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jns 0x3f7d91
jmp 0x424497
cmp ebx, dword [ecx + 0x50]
je 0x4244c8
mov eax, dword [ebx + 0x58]
mov ecx, edi
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
push dword [eax + 0x58]
call fcn.003f9a39
jmp 0x3f7f5b
test eax, eax
jne 0x3f7c06
jmp 0x424411
test eax, eax
jne 0x3f7d91
jmp 0x424497
mov eax, dword [edx + 0x54]
test eax, eax
je 0x3f8149
cmp dword [eax + 0x4c], 0
je 0x4244a2
cmp ebx, dword [ecx + 0x54]
jne 0x3f8158
mov ebx, ecx
mov ecx, edi
push ebx
call fcn.003f9a39
mov eax, dword [ebx + 0x58]
mov ecx, edi
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
push dword [eax + 0x58]
call fcn.003fa0ce
jmp 0x3f7f5b
cmp edi, ebx
jae 0x42458b
mov ecx, dword [ebp - 0x384]
cmp dword [ecx + edi*8 + 4], 0
jne 0x3f7cce
jmp 0x3f7caf
cmp edi, ebx
jae 0x42458b
mov ecx, dword [ebp - 0x384]
cmp dword [ecx + edi*8 + 4], 0
jne 0x3f7e50
jmp 0x3f7e31
cmp dword [edi + 0x14], 0
je 0x3f8232
mov edx, dword [edi + 0x10]
lea ecx, [edi + 0xc]
push 0x5c
call fcn.003fa55c
mov edx, eax
test edx, edx
je 0x424581
mov ecx, dword [edi + 0x10]
add edx, 0xffffffa8
imul eax, ecx, 0x5c
add edx, eax
add ecx, 0xffffffff
js 0x3f7ced
mov edi, edi
mov eax, dword [edi + 8]
mov dword [edx + 0x50], eax
mov dword [edi + 8], edx
sub edx, 0x5c
sub ecx, 1
jns 0x3f81f0
jmp 0x3f7ced
cmp esi, ebx
jae 0x42458b
mov ecx, dword [ebp - 0x384]
cmp dword [ecx + esi*8 + 4], 0
jne 0x3f7ed2
jmp 0x3f7eb1
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
jmp 0x3f7a4f
push 0x5c
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
je 0x424581
push 0x5c
push 0
push eax
call fcn.0040cfd6
mov eax, dword [edi + 0x14]
add esp, 0xc
mov dword [eax + 0x4c], 1
mov eax, dword [edi + 0x14]
mov dword [eax + 0x54], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx + 0x54]
mov dword [ecx + 0x50], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx + 0x50]
mov dword [ecx + 0x58], eax
mov eax, dword [edi + 0x14]
mov dword [edi], eax
jmp 0x3f81c3
mov ebx, dword [ebp - 0x360]
mov dword [edi], ebx
jmp 0x3f7f04
xor esi, esi
lea ecx, [ebp - 0x350]
call fcn.003f535f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040b590
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x3f828e
test esi, esi
jle 0x3f8290
movzx esi, si
or esi, 0x80070000
jmp 0x3f8290
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
jmp 0x3f7a4f
mov ecx, esi
call dword [0x473670]
mov ecx, 0x471724
call esi
jmp 0x3f7b06
mov ecx, esi
call dword [0x473670]
mov ecx, 0x471724
call esi
jmp 0x3f7b2d
mov ecx, esi
call dword [0x473670]
mov ecx, 0x471724
call esi
jmp 0x3f7b80
mov ecx, esi
call dword [0x473670]
mov ecx, 0x471724
call esi
jmp 0x3f7ba7
mov edi, dword [ebp - 0x354]
jmp 0x3f7ee5
mov edi, dword [ebp - 0x354]
mov eax, esi
jmp 0x3f7bdf
push eax
mov ecx, edi
call fcn.00405c83
mov esi, eax
test esi, esi
je 0x424451
push esi
lea ecx, [ebp - 0x384]
call fcn.00405c12
test al, al
je 0x424451
mov eax, esi
mov dword [ebp - 0x358], eax
jmp 0x424429
mov esi, dword [ebp - 0x358]
test esi, esi
je 0x3f7ce3
mov ecx, dword [esi + 0x28]
sub ecx, 0x10
mov dword [esi + 0x20], 0x3d154c
call fcn.003f9900
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
call fcn.003f9900
lea eax, [ebp - 0x3bc]
mov dword [esi + 0x20], 0x3d3060
push eax
lea ecx, [esi + 0x20]
call fcn.003f6dd0
jmp 0x3f7f7c
mov edi, dword [ebp - 0x354]
jmp 0x3f7ef3
mov dword [ecx + 0x4c], 1
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
mov ebx, dword [eax + 0x58]
jmp 0x3f7f5b
mov ebx, ecx
mov ecx, edi
push ebx
call fcn.003fa0ce
jmp 0x3f80f5
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x3f7fa7
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x3f7fc1
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x473670]
mov ecx, ebx
call edi
mov edx, dword [ebp - 0x384]
jmp 0x3f7fec
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x3f8029
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x473670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x3f8043
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
jmp 0x3f7a01
mov ecx, 0x8007000e
call fcn.0042fefb
mov ecx, 0x80070057
call fcn.0042fefb
mov ecx, 0x80004005
call fcn.0042fefb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4245b4
movzx esi, si
or esi, 0x80070000
lea ecx, [ebp - 0x2b0]
call fcn.003f535f
jmp 0x3f8290