Function at 0x40bce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x484]
push eax
push 1
push 0
push str.SOFTWAREPCScriptUpdateInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x490], 3
mov dword [ebp - 0x494], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40bd4c
push 0x43634c
call fcn.00403790
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x494]
push ecx
mov ecx, dword [ebp - 0x484]
lea edx, [ebp - 0x49c]
push edx
lea eax, [ebp - 0x490]
push eax
push 0
push str.ForceUpdateTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40bda9
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x43636c
call fcn.00403790
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x4a4]
push ecx
lea edx, [ebp - 0x49c]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
call ebx
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00422210
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xb5a1c0
lea ecx, [ebp - 0x210]
push str._sPCScript.dat
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x480]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40be6e
lea ecx, [ebp - 0x210]
push ecx
push 0x436390
push 0xb5b3f8
call esi
add esp, 0xc
push 0xb5b3f8
call fcn.00403790
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x468]
push eax
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x488], ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x4ac]
push edx
lea eax, [ebp - 0x48c]
push eax
call edi
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x4ac]
push edx
call ebx
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x216]
movzx edx, word [ebp - 0x218]
push eax
movzx eax, word [ebp - 0x21a]
push ecx
movzx ecx, word [ebp - 0x21e]
push edx
movzx edx, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x224]
push ecx
movzx ecx, word [ebp - 0x226]
push edx
movzx edx, word [ebp - 0x228]
push eax
movzx eax, word [ebp - 0x22a]
push ecx
movzx ecx, word [ebp - 0x22e]
push edx
movzx edx, word [ebp - 0x230]
push eax
push ecx
push edx
push 0x4363a8
push 0xb5b3f8
call esi
push 0xb5b3f8
call fcn.00403790
add esp, 0x3c
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x49c]
push ecx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, dword [ebp - 4]
xor edx, edx
test eax, eax
sets dl
pop edi
pop esi
xor ecx, ebp
pop ebx
mov eax, edx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret