Function at 0x4053b0
Capabilities:
Check os version
Get common file path
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abeeb
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebx], 0
push str.ntdll.dll
mov dword [ebp - 0x544], edi
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x405430
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40541d
lea ecx, [ebp - 0x540]
push ecx
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebx], 0
jbe 0x405430
mov al, 1
jmp 0x405759
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x216]
push eax
mov word [ebp - 0x218], dx
call fcn.00493520
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40550e
push str.kernel32.dll
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40550e
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x40550e
push esi
call fcn.0048f5d8
add esp, 4
mov edi, eax
push edi
push esi
xor esi, esi
push esi
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4054fd
lea edx, [ebp - 0x540]
push edx
lea eax, [ebp - 0x538]
push eax
push 0x4ba360
push edi
mov dword [ebp - 0x540], esi
mov dword [ebp - 0x538], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4054fd
mov eax, dword [ebp - 0x538]
movzx ecx, word [eax + 0x12]
mov dword [ebx], ecx
movzx edx, word [eax + 0x10]
mov eax, dword [ebp - 0x544]
mov dword [eax], edx
push edi
call fcn.0048f7ae
add esp, 4
cmp dword [ebx], esi
ja 0x405429
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x540]
push ecx
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x53c]
push eax
push str.CurrentMajorVersionNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x540], edi
mov dword [ebp - 0x53c], edi
call esi
mov ecx, dword [ebp - 0x538]
lea edx, [ebp - 0x53c]
push edx
lea eax, [ebp - 0x538]
push eax
mov dword [ebx], ecx
lea ecx, [ebp - 0x540]
push ecx
push str.CurrentMinorVersionNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x53c], edi
mov dword [ebp - 0x540], edi
call esi
mov eax, dword [ebp - 0x538]
mov edx, dword [ebp - 0x544]
mov dword [edx], eax
cmp dword [ebx], 0
jne 0x405756
test eax, eax
jne 0x405753
lea eax, [ebp - 0x534]
push eax
mov dword [ebp - 0x534], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4055da
xor al, al
jmp 0x405759
cmp dword [ebp - 0x530], 6
jne 0x40573d
cmp dword [ebp - 0x52c], 2
jne 0x40573d
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x41e]
push edx
mov word [ebp - 0x420], cx
call fcn.00493520
push str.CurrentVersion
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x420]
call fcn.00405260
add esp, 0x18
test al, al
je 0x40573d
mov ecx, 0x4ba358
lea eax, [ebp - 0x420]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405664
test dx, dx
je 0x405660
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405664
add eax, edi
add ecx, edi
test dx, dx
jne 0x405640
xor eax, eax
jmp 0x405669
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40573d
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402b20
mov ecx, 0x2e
lea esi, [ebp - 0x538]
mov dword [ebp - 4], 0
call fcn.00405960
mov ecx, dword [ebp - 0x538]
push 0x2e
push ecx
mov esi, eax
call fcn.00490c12
add esp, 8
test eax, eax
jne 0x4056b6
or eax, 0xffffffff
jmp 0x4056be
sub eax, dword [ebp - 0x538]
sar eax, 1
test esi, esi
jle 0x405732
cmp esi, eax
jne 0x405732
mov eax, esi
lea ecx, [ebp - 0x53c]
lea edx, [ebp - 0x538]
call fcn.00405a30
mov eax, dword [eax]
push eax
call fcn.00490d26
add esp, 4
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x530], eax
call fcn.00402760
mov edx, dword [ebp - 0x538]
mov eax, dword [edx - 0xc]
lea edx, [ebp - 0x538]
sub eax, esi
push edx
dec eax
lea ecx, [esi + 1]
lea edx, [ebp - 0x53c]
call fcn.00405980
mov eax, dword [eax]
push eax
call fcn.00490d26
add esp, 4
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x52c], eax
call fcn.00402760
lea ecx, [ebp - 0x538]
call fcn.00402760
mov eax, dword [ebp - 0x530]
mov ecx, dword [ebp - 0x52c]
mov edx, dword [ebp - 0x544]
mov dword [ebx], eax
mov dword [edx], ecx
cmp dword [ebx], 0
seta al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret