Function at 0x43e069
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x808
lea ebp, [esp - 4]
mov eax, dword [0x4f2be0]
xor eax, ebp
mov dword [ebp + 0x808], eax
push 0x48
mov eax, 0x4afa33
call fcn.00475a5f
mov esi, dword [ebp + 0x814]
mov eax, dword [ebp + 0x818]
xor edi, edi
cmp dword [esi + 8], edi
mov dword [ebp - 0x3c], eax
sete al
test al, al
sete al
mov dword [ebp - 0x40], esi
test al, al
je 0x43e0bf
cmp dword [esi + 4], edi
sete al
test al, al
sete al
test al, al
jne 0x43e0e6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x808]
xor ecx, ebp
call fcn.00474a8a
add ebp, 0x80c
leave
ret 8
push str.Check
lea ecx, [ebp - 0x10]
call fcn.00402a0f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0043dff2
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp ecx, edi
je 0x43e115
call fcn.00402aa8
cmp dword [ebp - 0x28], edi
sete al
test al, al
sete al
test al, al
je 0x43e133
cmp dword [ebp - 0x2c], edi
sete al
test al, al
sete al
test al, al
jne 0x43e144
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402b60
jmp 0x43e0bf
mov esi, 0x4f8ce0
push esi
lea ecx, [ebp - 0x18]
call fcn.004029af
push str.HKEY
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402a0f
push str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00411357
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
cmp ecx, edi
je 0x43e18c
call fcn.00402aa8
lea eax, [ebp - 0x18]
push eax
call fcn.0043dfc6
pop ecx
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
call fcn.004029af
push str.SubKey
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00402a0f
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00411357
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
cmp ecx, edi
je 0x43e1d8
call fcn.00402aa8
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], edi
jne 0x43e1f8
lea ecx, [eax - 0x10]
call fcn.004029d4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004029d4
jmp 0x43e133
push 0x4d710c
push 0x4d5218
lea ecx, [ebp - 0x1c]
call fcn.0041dc03
push esi
lea ecx, [ebp - 0x20]
call fcn.004029af
push str.Value
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.00402a0f
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.00411357
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, edi
je 0x43e249
call fcn.00402aa8
push 0x808
lea eax, [ebp]
push edi
push eax
call fcn.00474a10
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0x7a4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x43e29a
lea ecx, [edi - 0x10]
call fcn.004029d4
lea ecx, [ebx - 0x10]
jmp 0x43e1e3
push esi
lea ecx, [ebp - 0x10]
call fcn.004029af
push str.EntryFile
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.00402a0f
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.00411357
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x43e2da
call fcn.00402aa8
push 0x4d710c
push 0x4d5218
lea ecx, [ebp - 0x10]
call fcn.0041dc03
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x43e300
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43e346
lea ecx, [esi - 0x10]
call fcn.004029d4
lea ecx, [edi - 0x10]
call fcn.004029d4
lea ecx, [ebx - 0x10]
call fcn.004029d4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004029d4
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402b60
mov eax, esi
jmp 0x43e0c1
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43e37c
lea ecx, [esi - 0x10]
call fcn.004029d4
lea ecx, [edi - 0x10]
call fcn.004029d4
lea ecx, [ebx - 0x10]
call fcn.004029d4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004029d4
xor esi, esi
inc esi
jmp 0x43e333
lea eax, [ebp]
push 0
push eax
call fcn.00402402
pop ecx
pop ecx
push 0x4bae28
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x44], eax
call fcn.00402a0f
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0xb
call fcn.0043dff2
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x43e3bd
call fcn.00402aa8
push 0x4bae1c
lea ecx, [ebp - 0x14]
call fcn.00402a0f
push 0
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xe
call fcn.00411357
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x43e3eb
call fcn.00402aa8
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 9
call fcn.00402b60
lea ecx, [esi - 0x10]
call fcn.004029d4
lea ecx, [edi - 0x10]
call fcn.004029d4
lea ecx, [ebx - 0x10]
call fcn.004029d4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004029d4
mov esi, dword [ebp - 0x44]
jmp 0x43e333