Function at 0x40c610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488f36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x524
push ebx
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x21e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x220], ax
call fcn.00420e90
push 0x206
lea eax, [ebp - 0x52e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x530], dx
call fcn.00420e90
add esp, 0x18
push 0x4a2564
mov edx, SysReAllocString
mov eax, 0x82
lea ecx, [ebp - 0x220]
call fcn.0040bc60
mov ecx, 0x4b48d8
call fcn.0043153d
mov edx, 0x82
lea ecx, [ebp - 0x220]
lea esp, [esp]
cmp word [ecx], bx
je 0x40c6ad
add ecx, 2
dec edx
jne 0x40c6a0
jmp 0x40c6d1
cmp edx, ebx
je 0x40c6d1
push eax
mov ecx, 0x82
sub ecx, edx
mov eax, 0x82
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x220]
mov edx, SysReAllocString
call fcn.0040bc60
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea edx, [ebp - 0x220]
push edx
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
je 0x40c772
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x530]
push edx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push str.Version
push eax
mov dword [ebp - 0x10], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x40c8b6
mov eax, 1
cmp dword [ebp - 0x18], eax
jne 0x40c8b6
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x530]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40c744
sub eax, edx
lea edx, [ebp - 0x530]
sar eax, 1
push edx
push 0x4b4eac
mov ebx, eax
call fcn.0040a880
xor ebx, ebx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4b4eac]
cmp dword [ecx - 0xc], ebx
jne 0x40c8ff
xor eax, eax
jmp 0x40c790
movzx ecx, word [eax + str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_]
mov word [ebp + eax - 0x220], cx
add eax, 2
cmp cx, bx
jne 0x40c790
push 0x4a25ec
lea edx, [ebp - 0x328]
push edx
mov ecx, 0x4b46b8
call fcn.00431879
push 0x4b3db0
lea ecx, [ebp - 0x2a4]
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00431850
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0043153d
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40c7e0
push edi
lea edi, [ebp - 0x220]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40c800
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x40c800
push esi
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], bl
call fcn.004313e9
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], 0xffffffff
call fcn.004313e9
lea edi, [ebp - 0x220]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40c846
lea edx, [ebp - 0x14]
push edx
push 0x20219
push ebx
lea eax, [ebp - 0x220]
push eax
mov ecx, 8
mov esi, str.DisplayVersion
push reloc.OLEAUT32.dll_SysReAllocString
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c8eb
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x530]
push edx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x4a2620
push ecx
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c8b2
mov esi, 1
cmp dword [ebp - 0x10], esi
je 0x40c8be
xor esi, esi
jmp 0x40c8ce
mov dword [ebp - 0x10], ebx
jmp 0x40c768
lea edx, [ebp - 0x530]
mov edi, 0x4b4eac
call fcn.0040a730
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret