Function at 0x41b430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dae8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREBandizip
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b4ba
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 4
push eax
push ebx
push str.bCheckUpdateMinor
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove ebx, dword [ebp - 0x14]
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x44e870]
cmp eax, dword [esi + 4]
jle 0x41b515
push 0x44e870
call fcn.0041dba8
add esp, 4
cmp dword [0x44e870], 0xffffffff
jne 0x41b515
push 0x78
push 0
push 0x44e878
call fcn.0041fc70
add esp, 0xc
call fcn.00417d50
push 0x43df10
call fcn.0041df04
add esp, 4
push 0x44e870
call fcn.0041db5e
add esp, 4
cmp dword [0x44e87c], 0
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
call fcn.004034e0
mov ecx, eax
test ecx, ecx
je 0x41b8be
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41b8c8
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [0x44e870]
cmp eax, dword [esi + 4]
jle 0x41b5aa
push 0x44e870
call fcn.0041dba8
add esp, 4
cmp dword [0x44e870], 0xffffffff
jne 0x41b5aa
push 0x78
push 0
push 0x44e878
call fcn.0041fc70
add esp, 0xc
call fcn.00417d50
push 0x43df10
call fcn.0041df04
add esp, 4
push 0x44e870
call fcn.0041db5e
add esp, 4
push dword [0x44e8a0]
lea eax, [ebp - 0x14]
push 0x446240
push eax
call fcn.004030e0
mov esi, dword [ebp - 0x14]
add esp, 0xc
push esi
push str.__gCMainWindow::DoCheck_____url:_s
call fcn.004011c0
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0041fc70
xorps xmm0, xmm0
mov dword [ebp - 0x58], vtable.XMemoryWriteStream.0
add esp, 0x14
mov dword [ebp - 0x54], 0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0x6400000
mov dword [ebp - 0x2c], 0
push 0
push 0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004187a0
push ecx
mov edi, esp
mov byte [ebp - 4], 3
mov ebx, dword [eax]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x60], ecx
call fcn.00402ee0
add eax, 0x10
lea ecx, [ebp - 0x58]
mov edx, ebx
mov dword [edi], eax
call fcn.0040d3e0
add esp, 0xc
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x24]
test eax, eax
sete byte [ebp - 0x59]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41b68d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41b8cf
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp - 0x59], 0
je 0x41b6a5
push 0x446290
call fcn.004011c0
add esp, 4
jmp 0x41b81c
mov ebx, dword [ebp - 0x64]
push dword [ebp - 0x48]
push dword [ebp - 0x54]
lea ecx, [ebx + 0xf0]
call fcn.0041cca0
test eax, eax
jne 0x41b6c7
push str.updater___ini
jmp 0x41b811
mov eax, dword [ebx + 0x164]
cmp dword [eax - 0xc], 0
jne 0x41b6e9
mov eax, dword [ebx + 0x168]
cmp dword [eax - 0xc], 0
jne 0x41b6e9
push 0x4462f0
jmp 0x41b811
push ecx
push 0
push str.BuildNo
push str.Version
lea ecx, [ebx + 0xa8]
call fcn.00407860
mov esi, eax
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0x41b80c
test esi, esi
je 0x41b80c
push esi
push eax
push str.version__svr:_d_local:_d
call fcn.004011c0
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
lea ecx, [ebx + 0xa8]
push 0x444368
push str.BuildNo
push str.Version
push eax
call fcn.00407960
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41b788
lea ecx, [ebx + 0xf8]
push eax
call fcn.00402740
test eax, eax
js 0x41b788
push dword [ebp - 0x18]
mov dword [ebx + 0x9c], 1
push dword [ebx + 0xf8]
push 0x44638c
call fcn.004011c0
add esp, 0xc
cmp dword [ebx + 0x9c], 0
jne 0x41b7c9
cmp dword [ebp - 0x20], 0
je 0x41b7b0
cmp dword [ebx + 0xf4], esi
jg 0x41b7c9
push str.updater__
call fcn.004011c0
add esp, 4
xor esi, esi
jmp 0x41b7ce
cmp dword [ebx + 0xf0], esi
jg 0x41b7c9
push 0x4463e8
call fcn.004011c0
add esp, 4
xor esi, esi
jmp 0x41b7ce
mov esi, 1
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x18]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41b81e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41b8d6
mov eax, dword [edx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [eax + 4]
call edi
jmp 0x41b824
push 0x446328
call fcn.004011c0
add esp, 4
or ebx, 0xffffffff
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], vtable.XMemoryWriteStream.0
test eax, eax
je 0x41b841
cmp dword [ebp - 0x38], 0
je 0x41b841
push eax
call fcn.0042198f
add esp, 4
mov edx, dword [ebp - 0x60]
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x58], vtable.XWriteStream.0
mov byte [ebp - 4], 0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41b892
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41b8df
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call edi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41b8a0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d9da
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004039b0
call edx
jmp 0x41b54d
call esi
jmp 0x41b68d
mov ecx, edx
call edi
jmp 0x41b81e
call ebx
jmp 0x41b892