Function at 0x53e760
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5bfd00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call fcn.00524f80
mov ebx, edx
mov edi, eax
push ebx
push edi
call fcn.00524710
add esp, 8
test eax, eax
je 0x53e79d
mov eax, edi
mov edx, ebx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret
push esi
push str.Windows
call fcn.005251a0
push edx
push eax
push str.name
push ebx
push edi
call fcn.005256b0
add esp, 0x18
push 0
push str.ntoskrnl.exe
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x30], eax
test eax, eax
je 0x53e7fa
push eax
call fcn.00529210
add esp, 4
mov esi, eax
push esi
push dword [ebp - 0x30]
push 0
push str.ntoskrnl.exe
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x53e7f6
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
jmp 0x53e7fa
test esi, esi
jne 0x53e811
push str.kernel32.dll
call fcn.0053ea20
mov esi, eax
add esp, 4
test esi, esi
je 0x53e9f4
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x598bf4
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x53e9f4
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + 0x18]
and dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ecx + 8]
mov edx, eax
movzx eax, ax
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0xc]
mov ecx, eax
movzx eax, ax
push eax
shr ecx, 0x10
push ecx
push dword [ebp - 0x34]
shr edx, 0x10
push edx
push str._u._u._u._lu
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
push 0x20
push eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x40], ecx
call fcn.0041d900
lea eax, [ebp - 0x24]
push eax
call fcn.005251a0
push edx
push eax
push str.kernel_version
push ebx
push edi
call fcn.005256b0
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [ebp - 0x28]
add esp, 0x38
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x10
push str.CurrentMajorVersionNumber
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
mov dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x38]
cmove eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x10
push str.CurrentMinorVersionNumber
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
mov dword [ebp - 0x28], 0x20
mov eax, dword [ebp - 0x34]
cmove eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 2
push str.CurrentBuild
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x53e943
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00534950
add esp, 8
fstp qword [ebp - 0x44]
movsd xmm0, qword [ebp - 0x44]
call fcn.00563c20
mov esi, eax
jmp 0x53e946
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x10
push 0x598c90
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
push esi
push dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x38]
cmove eax, dword [ebp - 0x2c]
push str._u._u._u
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.0041d900
lea eax, [ebp - 0x24]
push eax
call fcn.005251a0
push edx
push eax
push str.version
push ebx
push edi
call fcn.005256b0
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push 0x598ca0
push 0x20
push eax
call fcn.0041d900
add esp, 0x40
lea eax, [ebp - 0x24]
push eax
call fcn.005251a0
push edx
push eax
push str.build
push ebx
push edi
call fcn.005256b0
push ebx
push edi
call fcn.005243b0
add esp, 0x20
mov eax, edi
mov edx, ebx
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00563360
mov esp, ebp
pop ebp
ret
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push ebx
push edi
call fcn.005242d0
add esp, 0xc
call fcn.00524f70
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00563360
mov esp, ebp
pop ebp
ret