Function at 0x411a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x484]
push eax
push 1
push 0
push str.SOFTWAREPCScriptUpdateInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x490], 3
mov dword [ebp - 0x494], 8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411aac
push 0x44218c
call fcn.00406870
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x494]
push ecx
mov ecx, dword [ebp - 0x484]
lea edx, [ebp - 0x49c]
push edx
lea eax, [ebp - 0x490]
push eax
push 0
push str.ForceUpdateTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411b09
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4421ac
call fcn.00406870
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x4a4]
push ecx
lea edx, [ebp - 0x49c]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
call ebx
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00428450
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x48df60
lea ecx, [ebp - 0x210]
push str._sPCScript.dat
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x480]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x411bce
lea ecx, [ebp - 0x210]
push ecx
push 0x4421d0
push 0x48f198
call esi
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x468]
push eax
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x488], ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x4ac]
push edx
lea eax, [ebp - 0x48c]
push eax
call edi
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x4ac]
push edx
call ebx
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x216]
movzx edx, word [ebp - 0x218]
push eax
movzx eax, word [ebp - 0x21a]
push ecx
movzx ecx, word [ebp - 0x21e]
push edx
movzx edx, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x224]
push ecx
movzx ecx, word [ebp - 0x226]
push edx
movzx edx, word [ebp - 0x228]
push eax
movzx eax, word [ebp - 0x22a]
push ecx
movzx ecx, word [ebp - 0x22e]
push edx
movzx edx, word [ebp - 0x230]
push eax
push ecx
push edx
push 0x4421e8
push 0x48f198
call esi
push 0x48f198
call fcn.00406870
add esp, 0x3c
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x49c]
push ecx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov ecx, dword [ebp - 4]
xor edx, edx
test eax, eax
sets dl
pop edi
pop esi
xor ecx, ebp
pop ebx
mov eax, edx
call fcn.004217a4
mov esp, ebp
pop ebp
ret