Function at 0x405ed0
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
sub esp, 0x390
mov eax, dword [0x47305c]
xor eax, esp
mov dword [esp + 0x38c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x19a]
push ebx
push eax
mov ebp, ecx
mov word [esp + 0x1a0], bx
call fcn.00439b80
add esp, 0xc
push 0x104
lea ecx, [esp + 0x198]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x31
lea edx, [esp + 0x61]
push ebx
push edx
call fcn.00439b80
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x198]
push ecx
mov dword [esp + 0x64], 0x303030
mov dword [esp + 0x30], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x406015
push esi
call fcn.0041c0ce
add esp, 4
mov edi, eax
push edi
push esi
push ebx
lea edx, [esp + 0x1a0]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40600c
lea eax, [esp + 0x10]
push eax
push 0x474688
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40600c
push 0x103
lea ecx, [esp + 0x95]
push ebx
push ecx
mov byte [esp + 0x9c], bl
call fcn.00439b80
mov eax, dword [0x474688]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
lea ecx, [esp + 0xa4]
push str.StringFileInfo_04x_04xSpecialBuild
push ecx
call fcn.00439ce6
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x98]
push ecx
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40600c
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x5c]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x406000
push edi
call fcn.0041c0d3
add esp, 4
cmp byte [esp + 0x5c], bl
je 0x406032
lea eax, [esp + 0x5c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x406022
sub eax, edx
cmp eax, 3
jbe 0x40603a
mov dword [esp + 0x5c], 0x303030
lea edx, [esp + 0x14]
push edx
mov eax, 2
push str.SoftwarePowerShadow
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 3
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4060e9
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push 0x45bfb0
push edx
mov dword [esp + 0x28], 4
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push str.LITTER
push edx
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push str.Mini
push edx
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push str.SpecialVer
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov dword [esp + 0x55], eax
mov ecx, 7
mov esi, str.0000000000000000000000000000
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x3c]
push eax
push 0x73c30
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], 0x21
call fcn.0041b5d0
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x70]
push edx
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push eax
push 0x45bf58
push 0x45bf54
push str.PID_sLAN_sMAJ_02dMIN_02d_02dSUB_02dDIS_sCID_s
add ebp, 0x898
push ebp
call fcn.00439ce6
mov ecx, dword [esp + 0x3d4]
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439b33
add esp, 0x390
ret