Function at 0x4ab930
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x55ec40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call fcn.004a1f70
mov ebx, edx
mov edi, eax
push ebx
push edi
call fcn.004a1c40
add esp, 8
test eax, eax
je 0x4ab96d
mov eax, edi
mov edx, ebx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
push esi
push str.Windows
call fcn.004a1ff0
push edx
push eax
push str.name
push ebx
push edi
call fcn.004a20e0
add esp, 0x18
push 0
push str.ntoskrnl.exe
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x30], eax
test eax, eax
je 0x4ab9ca
push eax
call fcn.004a3040
add esp, 4
mov esi, eax
push esi
push dword [ebp - 0x30]
push 0
push str.ntoskrnl.exe
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4ab9c6
push esi
call fcn.004a3030
add esp, 4
jmp 0x4ab9ca
test esi, esi
jne 0x4ab9e1
push str.kernel32.dll
call fcn.004abbf0
mov esi, eax
add esp, 4
test esi, esi
je 0x4abbc4
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x521d38
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4abbc4
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + 0x18]
and dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + 8]
mov edx, eax
movzx eax, ax
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0xc]
mov ecx, eax
movzx eax, ax
push eax
shr ecx, 0x10
push ecx
push dword [ebp - 0x34]
shr edx, 0x10
push edx
push str._u._u._u._lu
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
push 0x20
push eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x40], ecx
call fcn.00412b40
lea eax, [ebp - 0x24]
push eax
call fcn.004a1ff0
push edx
push eax
push str.kernel_version
push ebx
push edi
call fcn.004a20e0
push esi
call fcn.004a3030
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [ebp - 0x28]
add esp, 0x38
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x10
push str.CurrentMajorVersionNumber
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
mov dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x38]
cmove eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x10
push str.CurrentMinorVersionNumber
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
mov dword [ebp - 0x28], 0x20
mov eax, dword [ebp - 0x34]
cmove eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 2
push str.CurrentBuild
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4abb13
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004a59c0
add esp, 8
fstp qword [ebp - 0x44]
movsd xmm0, qword [ebp - 0x44]
call fcn.004cf1c0
mov esi, eax
jmp 0x4abb16
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x10
push 0x521dd4
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
push esi
push dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x38]
cmove eax, dword [ebp - 0x2c]
push str._u._u._u
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00412b40
lea eax, [ebp - 0x24]
push eax
call fcn.004a1ff0
push edx
push eax
push str.version
push ebx
push edi
call fcn.004a20e0
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push 0x521de4
push 0x20
push eax
call fcn.00412b40
add esp, 0x40
lea eax, [ebp - 0x24]
push eax
call fcn.004a1ff0
push edx
push eax
push str.build
push ebx
push edi
call fcn.004a20e0
push ebx
push edi
call fcn.004a19b0
add esp, 0x20
mov eax, edi
mov edx, ebx
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cefd7
mov esp, ebp
pop ebp
ret
push esi
call fcn.004a3030
push ebx
push edi
call fcn.004a18d0
add esp, 0xc
call fcn.004a1f60
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004cefd7
mov esp, ebp
pop ebp
ret