Function at 0x4fceb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x240
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x23c], eax
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x248]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
call fcn.004d96c0
test eax, eax
je 0x4fcf1f
call fcn.004d96c0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4fcf03
lea edx, [esp + 0x10]
push edx
jmp 0x4fcf2a
lea eax, [esp + 0x10]
push eax
push 0x101
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fadc0
jmp 0x4fcf39
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
push esi
call edi
cmp esi, ebx
jne 0x4fd12a
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push str.InstallDate
mov esi, 4
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4fcf7f
cmp dword [esp + 0x14], ebx
jne 0x4fcfe0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call fcn.004d96c0
test eax, eax
je 0x4fcfdc
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4fcfa3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x10]
push edx
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov esi, eax
push esi
call edi
cmp esi, ebx
jne 0x4fcfdc
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push str.InstallDate
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [esp + 0x14], ebx
jbe 0x4fd11b
push 0x61bf44
call fcn.004f4be0
mov edi, eax
cmp edi, ebx
je 0x4fd11b
push str.RtlSecondsSince1970ToTime
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x4fd114
push 0x103
lea eax, [esp + 0x14d]
push ebx
push eax
mov byte [esp + 0x154], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x55]
push ebx
push ecx
mov byte [esp + 0x5c], bl
call fcn.005dfd60
mov eax, dword [esp + 0x2c]
add esp, 0x18
lea edx, [esp + 0x2c]
push edx
push eax
call esi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x4fd0a2
push esi
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
lea ecx, [esp + 0x14c]
push ecx
push 0x648190
push esi
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x104
lea edx, [esp + 0x48]
push edx
push 0x61f70c
push esi
jmp 0x4fd0e9
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
lea edx, [esp + 0x14c]
push edx
push 0x648190
lea eax, [esp + 0x40]
push eax
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x104
lea ecx, [esp + 0x48]
push ecx
push 0x61f70c
lea edx, [esp + 0x40]
push edx
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14c]
push ecx
push 0x61cdf0
push edx
call fcn.005dfb23
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4fd12a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x240
ret