Function at 0x43e180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ca7ef
mov eax, dword fs:[0]
push eax
sub esp, 0xc68
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc70], 0
mov dword [ebp - 0xc58], eax
mov dword [ebp - 0xc74], eax
mov dword [ebp - 0xc6c], 0
mov dword [ebp - 0xc68], 0
mov dword [ebp - 0xc64], 0
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov dword [ebp - 4], 1
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xc54], esi
mov ecx, dword [0x521340]
mov byte [ebp - 4], 2
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 8
jne 0x43e231
push 4
call fcn.004a6c5d
mov ecx, dword [0x521340]
add esp, 4
mov dword [eax], ecx
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0xc60], edi
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xc6c]
mov byte [ebp - 4], 3
call fcn.0040bf80
mov ebx, 0xf
test eax, eax
je 0x43e2fc
mov edx, dword [0x521340]
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
idiv ebx
cmp edx, 8
jne 0x43e293
call fcn.004a8009
mov dword [0x521340], eax
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xc6c]
call fcn.0040bf80
test eax, eax
jne 0x43e53c
call fcn.0043f090
test al, al
jne 0x43e2fc
push 0x28
call fcn.004a63b0
add esp, 4
mov edi, eax
xor ebx, ebx
lea esp, [esp]
call fcn.004a8009
add eax, dword [0x521340]
inc ebx
mov dword [edi + ebx*4 - 4], eax
cmp ebx, 0xa
jl 0x43e2d0
mov eax, dword [edi + 0x24]
push edi
mov dword [0x521340], eax
call fcn.004a8200
mov edi, dword [ebp - 0xc60]
add esp, 4
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004a8550
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xc4c]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 0xc6c]
mov dword [ebp - 0xc5c], 0x800
call ebx
test eax, eax
jne 0x43e519
mov eax, dword [ebp - 0xc4c]
cmp eax, 1
je 0x43e36a
cmp eax, 2
jne 0x43e519
mov eax, dword [ebp - 0xc5c]
test eax, eax
je 0x43e38e
test al, 1
jne 0x43e519
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x43e397
jmp 0x43e519
xor eax, eax
mov word [ebp - 0x810], ax
lea edx, [ebp - 0x810]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x43e3a0
sub edx, esi
sar edx, 1
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xc54]
call fcn.004097a0
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc50], eax
mov eax, 0x4df288
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x43e409
movzx esi, ax
push 0
push esi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x43e41b
push esi
push eax
lea ecx, [ebp - 0xc50]
call fcn.004075c0
jmp 0x43e41b
push 1
push 0x4df288
lea ecx, [ebp - 0xc50]
call fcn.004097a0
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xc48]
push eax
push 0
push str.CurrentBuild
push dword [ebp - 0xc6c]
mov byte [ebp - 4], 5
mov dword [ebp - 0xc44], 0x800
call ebx
test eax, eax
jne 0x43e484
mov eax, dword [ebp - 0xc48]
cmp eax, 1
je 0x43e461
cmp eax, 2
jne 0x43e484
mov eax, dword [ebp - 0xc44]
test eax, eax
je 0x43e590
test al, 1
jne 0x43e484
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x43e599
or ebx, 0xffffffff
call fcn.0043f0c0
test al, al
jne 0x43e4f0
movd xmm4, dword [0x521340]
movsd xmm3, qword [0x4da448]
movsd xmm6, qword [0x4da450]
movsd xmm5, qword [0x4da440]
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
jmp 0x43e4c0
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x43e4da
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x43e4c0
mov edx, dword [ebp - 0xc50]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e513
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xc54]
mov eax, dword [ebp - 0xc6c]
test eax, eax
je 0x43e532
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0xc6c], eax
mov dword [ebp - 0xc68], 0
mov eax, dword [0x522488]
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0xc50], 0
mov dword [ebp - 0xc48], 0
test eax, eax
jne 0x43e669
push str.Version.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x43e65c
push str.GetFileVersionInfoSizeW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x522488], eax
jmp 0x43e661
xor eax, eax
mov word [ebp - 0x810], ax
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e5a2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xc50]
call fcn.004097a0
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0xc44]
push 0x4df3a0
push eax
call fcn.0040b870
push 0x4da2c0
push eax
lea eax, [ebp - 0xc48]
push eax
mov byte [ebp - 4], 6
call fcn.0040b790
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xc54]
push dword [eax - 0xc]
mov byte [ebp - 4], 7
push eax
call fcn.0040b9f0
mov edx, dword [ebp - 0xc48]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e630
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc44]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e487
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x43e487
mov eax, dword [0x522488]
test eax, eax
je 0x43e76e
lea ecx, [ebp - 0xc44]
push ecx
push str.kernel32.dll
call eax
mov dword [ebp - 0xc5c], eax
test eax, eax
je 0x43e76e
push eax
call fcn.004a63b0
mov ebx, dword [0x521340]
mov dword [ebp - 0xc4c], eax
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0x15
idiv ecx
add esp, 4
cmp edx, 1
jne 0x43e6c0
test ebx, ebx
mov eax, edx
cmove ebx, eax
mov dword [0x521340], ebx
mov ebx, dword [ebp - 0xc4c]
push ebx
push dword [ebp - 0xc5c]
push dword [ebp - 0xc44]
push str.kernel32.dll
call fcn.0041d650
push eax
call fcn.00426c30
test eax, eax
je 0x43e765
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0xc48]
push eax
push 0x4da458
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43e765
cmp dword [ebp - 0xc50], 0
je 0x43e744
mov eax, dword [ebp - 0xc48]
cmp dword [eax], 0xfeef04bd
jne 0x43e744
movzx edx, word [eax + 0x12]
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x16]
push eax
push ecx
push edx
lea eax, [ebp - 0xc60]
push 0x4df28c
push eax
call fcn.004060e0
mov edi, dword [ebp - 0xc60]
add esp, 0x14
mov ecx, dword [0x521340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 0x15
jne 0x43e765
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push ebx
call fcn.004a8200
add esp, 4
mov eax, dword [0x521340]
imul eax, eax
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 2
jne 0x43e7e8
xor ebx, ebx
call fcn.004a8009
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc ebx
movsd qword [ebp + ebx*8 - 0xc48], xmm0
cmp ebx, 0x86
jb 0x43e785
xor ecx, ecx
mov eax, 0x85
cmp ecx, eax
jge 0x43e7df
nop
movsd xmm0, qword [ebp + eax*8 - 0xc40]
movsd xmm1, qword [ebp + eax*8 - 0xc48]
comisd xmm0, xmm1
jbe 0x43e7da
movsd qword [ebp + eax*8 - 0xc40], xmm1
movsd qword [ebp + eax*8 - 0xc48], xmm0
dec eax
cmp eax, ecx
jg 0x43e7b0
inc ecx
cmp ecx, 0x86
jl 0x43e7a6
mov ecx, dword [esi - 0x10]
lea ebx, [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x43e80f
cmp ecx, dword [ebx]
jne 0x43e80f
mov ecx, ebx
mov eax, 1
lock xadd dword [edx], eax
jmp 0x43e858
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0xc4c], edx
test edx, edx
jne 0x43e829
call fcn.0040c350
mov eax, dword [ebx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebx + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a8205
mov ecx, dword [ebp - 0xc4c]
add esp, 0x10
mov edx, dword [ebp - 0xc58]
lea eax, [ecx + 0x10]
mov dword [edx], eax
xor eax, eax
test edi, edi
setne al
mov dword [ebp - 0xc70], 1
test eax, eax
jne 0x43e882
push 0x80004005
call fcn.004044c0
mov eax, edi
mov cx, word [esi]
cmp cx, word [eax]
jne 0x43e8aa
test cx, cx
je 0x43e8a6
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x43e8aa
add esi, 4
add eax, 4
test cx, cx
jne 0x43e884
xor eax, eax
jmp 0x43e8af
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x43e9c0
cmp dword [edi - 0xc], 0
jl 0x43e9c0
push 0x4df2a4
push edi
call fcn.004a87ef
add esp, 8
test eax, eax
je 0x43e9c0
sub eax, edi
sar eax, 1
jne 0x43e9c0
mov edx, dword [ebp - 0xc58]
lea esi, [edi - 0x10]
mov eax, dword [edx]
sub eax, 0x10
mov dword [ebp - 0xc44], eax
cmp esi, eax
je 0x43e9c0
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 0xc48], ecx
jl 0x43e9b5
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x43e9b5
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x43e93f
cmp ecx, dword [esi]
jne 0x43e93f
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
jmp 0x43e988
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0xc4c], edx
test edx, edx
jne 0x43e959
call fcn.0040c350
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a8205
mov esi, dword [ebp - 0xc4c]
add esp, 0x10
mov ecx, dword [ebp - 0xc48]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43e9a8
mov edx, dword [ebp - 0xc44]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc58]
lea eax, [esi + 0x10]
mov dword [ecx], eax
jmp 0x43e9c0
push dword [edi - 0xc]
mov ecx, edx
push edi
call fcn.004097a0
add edi, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 2
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e9e0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x43e9f8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc6c]
test eax, eax
je 0x43ea09
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret