Function at 0x45a6c0
Capabilities:
Access peb ldr_data
Check os version
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46a9e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
mov eax, dword [0x4823c0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 0xc]
push 0x46d280
mov ecx, edi
mov dword [esp + 0x2ac], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0040afb0
mov al, byte [esi + 0x2d]
test al, al
mov dword [esi + 0x30], ebx
jne 0x45a711
mov byte [esi + 0x2c], bl
mov eax, dword [esp + 0x2c0]
mov ebp, dword [eax + 4]
cmp byte [ebp], 0x5c
je 0x45aa1a
mov al, byte [0x4790f0]
mov edx, dword [0x4790ec]
mov ecx, dword [str.Volatile]
mov byte [esp + 0x26c], al
mov al, byte [0x4790e4]
mov dword [esp + 0x268], edx
mov edx, dword [0x4790e0]
mov dword [esp + 0x264], ecx
mov ecx, dword [str.volatile]
mov byte [esp + 0x278], al
mov al, byte [0x4790d8]
mov dword [esp + 0x274], edx
mov edx, dword [0x4790d4]
mov dword [esp + 0x270], ecx
mov ecx, dword [str.VOLATILE]
mov byte [esp + 0x284], al
lea eax, [esp + 0x264]
mov dword [esp + 0x280], edx
mov dword [esp + 0x27c], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45a7a1
mov ecx, dword [esp + 0x2c0]
sub eax, edx
mov ebx, eax
mov eax, dword [ecx + 8]
dec eax
cmp eax, ebx
jl 0x45aa76
xor eax, eax
test ebx, ebx
jle 0x45aa76
lea esp, [esp]
mov cl, byte [eax + ebp]
cmp cl, byte [esp + eax + 0x270]
je 0x45a7e9
cmp cl, byte [esp + eax + 0x27c]
jne 0x45aa76
inc eax
cmp eax, ebx
jl 0x45a7d0
push 0x46d280
lea ecx, [esp + 0x28c]
call fcn.0040b1b0
mov ebp, dword [esp + 0x2bc]
push 1
lea edx, [esp + 0x28c]
push edx
push ebp
mov ecx, esi
mov dword [esp + 0x2c0], 0
call fcn.0045a6c0
lea ecx, [esp + 0x288]
mov byte [esp + 0x13], al
mov dword [esp + 0x2b4], 0xffffffff
call fcn.0040aec0
mov al, byte [esp + 0x13]
test al, al
je 0x45a84d
mov ecx, esi
call fcn.00459410
mov ecx, dword [esp + 0x2c0]
mov eax, dword [ecx + 8]
dec eax
lea edx, [ebx + 1]
cmp eax, edx
jle 0x45aa3a
mov eax, dword [ecx + 4]
cmp byte [ebx + eax], 0x5c
jne 0x45aa3a
lea ecx, [esp + 0x1c]
call fcn.0045a340
lea eax, [ebp - 1]
cmp eax, 5
mov dword [esp + 0x2b4], 1
ja case.default.0x45a890
jmp dword [eax*4 + 0x45af80]
lea ecx, [esp + 0x264]
push ecx
lea ecx, [esp + 0x28c]
call fcn.0040b1b0
push 1
lea edx, [esp + 0x28c]
push edx
push 1
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 2
call fcn.0045a6c0
lea ecx, [esp + 0x288]
jmp 0x45a9f1
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0xa4]
call fcn.0040b1b0
push 1
lea ecx, [esp + 0xa4]
push ecx
push 2
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 3
call fcn.0045a6c0
lea ecx, [esp + 0xa0]
jmp 0x45a9f1
lea edx, [esp + 0x264]
push edx
lea ecx, [esp + 0x84]
call fcn.0040b1b0
push 1
lea eax, [esp + 0x84]
push eax
push 3
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 4
call fcn.0045a6c0
lea ecx, [esp + 0x80]
jmp 0x45a9f1
lea ecx, [esp + 0x264]
push ecx
lea ecx, [esp + 0xe4]
call fcn.0040b1b0
push 1
lea edx, [esp + 0xe4]
push edx
push 4
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 5
call fcn.0045a6c0
lea ecx, [esp + 0xe0]
jmp 0x45a9f1
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0xc4]
call fcn.0040b1b0
push 1
lea ecx, [esp + 0xc4]
push ecx
push 5
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 6
call fcn.0045a6c0
lea ecx, [esp + 0xc0]
jmp 0x45a9f1
lea edx, [esp + 0x264]
push edx
lea ecx, [esp + 0x64]
call fcn.0040b1b0
push 1
lea eax, [esp + 0x64]
push eax
push 5
lea ecx, [esp + 0x28]
mov byte [esp + 0x2c0], 7
call fcn.0045a6c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x2b4], 1
call fcn.0040aec0
mov eax, dword [esp + 0x24]
test eax, eax
lea ecx, [esp + 0x1c]
jne 0x45aa21
mov dword [esp + 0x2b4], 0xffffffff
call fcn.0045a460
xor al, al
jmp 0x45af59
call fcn.00459410
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2b4], 0xffffffff
call fcn.0045a460
lea eax, [ebp - 1]
cmp eax, 4
ja case.default.0x45aa42
jmp dword [eax*4 + 0x45af98]
mov dword [esi + 0x30], 1
jmp case.default.0x45aa42
mov dword [esi + 0x30], 2
jmp case.default.0x45aa42
mov dword [esi + 0x30], 3
jmp case.default.0x45aa42
mov dword [esi + 0x30], 4
jmp case.default.0x45aa42
mov dword [esi + 0x30], 5
jmp case.default.0x45aa42
mov ebp, dword [esp + 0x2bc]
mov dword [esi + 0x30], 0
push str.HKEY_LOCAL_MACHINESoftwareMatroxMatrox_Imaging_Library
lea ecx, [esp + 0x64]
call fcn.0040b1b0
push 0
push eax
lea ecx, [esp + 0x108]
mov dword [esp + 0x2bc], 8
call fcn.0045a3c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x2b4], 0xa
call fcn.0040aec0
lea eax, [ebp - 1]
cmp eax, 5
ja case.default.0x45aac9
jmp dword [eax*4 + 0x45afac]
push str.Version
lea ecx, [esp + 0xc4]
call fcn.0040b1b0
mov ecx, dword [esp + 0x108]
test ecx, ecx
jne 0x45aaf0
xor bl, bl
jmp 0x45ab0b
mov eax, dword [eax + 4]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
lea ecx, [esp + 0xc0]
call fcn.0040aec0
test bl, bl
mov dword [esi + 4], 0x80000002
je 0x45ab57
push str.SoftwareMatroxMIPMILRuntime_
lea ecx, [esp + 0xe4]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0xb
call fcn.0043a4c0
mov ecx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], ecx
lea ecx, [esp + 0xe0]
jmp 0x45ae2d
push str.SoftwareMatroxMatrox_Imaging_LibraryRuntime_
lea ecx, [esp + 0x84]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0xc
call fcn.0043a4c0
mov edx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], edx
lea ecx, [esp + 0x80]
jmp 0x45ae2d
push str.Version
lea ecx, [esp + 0xa4]
call fcn.0040b1b0
mov ecx, dword [esp + 0x108]
test ecx, ecx
jne 0x45abac
xor bl, bl
jmp 0x45abc7
mov eax, dword [eax + 4]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
lea ecx, [esp + 0xa0]
call fcn.0040aec0
test bl, bl
mov dword [esi + 4], 0x80000001
je 0x45ac13
push str.SoftwareMatroxMIPMILRuntime_
lea ecx, [esp + 0x28c]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0xd
call fcn.0043a4c0
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
lea ecx, [esp + 0x288]
jmp 0x45ae2d
push str.SoftwareMatroxMatrox_Imaging_LibraryRuntime_
lea ecx, [esp + 0x1a8]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0xe
call fcn.0043a4c0
mov ecx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], ecx
lea ecx, [esp + 0x1a4]
jmp 0x45ae2d
push str.Version
lea ecx, [esp + 0x148]
call fcn.0040b1b0
mov ecx, dword [esp + 0x108]
test ecx, ecx
jne 0x45ac68
xor bl, bl
jmp 0x45ac83
mov eax, dword [eax + 4]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
lea ecx, [esp + 0x144]
call fcn.0040aec0
test bl, bl
mov dword [esi + 4], 0x80000002
je 0x45accf
push str.SoftwareMatroxMIPDevelopment_
lea ecx, [esp + 0x1e8]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0xf
call fcn.0043a4c0
mov edx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], edx
lea ecx, [esp + 0x1e4]
jmp 0x45ae2d
push str.SoftwareMatroxMatrox_Imaging_LibraryDevelopment_
lea ecx, [esp + 0x248]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0x10
call fcn.0043a4c0
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
lea ecx, [esp + 0x244]
jmp 0x45ae2d
push str.Version
lea ecx, [esp + 0x168]
call fcn.0040b1b0
mov ecx, dword [esp + 0x108]
test ecx, ecx
jne 0x45ad24
xor bl, bl
jmp 0x45ad3f
mov eax, dword [eax + 4]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
lea ecx, [esp + 0x164]
call fcn.0040aec0
test bl, bl
mov dword [esi + 4], 0x80000001
je 0x45ad8b
push str.SoftwareMatroxMIPDevelopment_
lea ecx, [esp + 0x188]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0x11
call fcn.0043a4c0
mov ecx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], ecx
lea ecx, [esp + 0x184]
jmp 0x45ae2d
push str.SoftwareMatroxMatrox_Imaging_LibraryDevelopment_
lea ecx, [esp + 0x1c8]
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0x12
call fcn.0043a4c0
mov edx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], edx
lea ecx, [esp + 0x1c4]
jmp 0x45ae2d
push str.SoftwareMatroxImaging_Board_
lea ecx, [esp + 0x208]
mov dword [esi + 4], 0x80000002
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0x13
call fcn.0043a4c0
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
lea ecx, [esp + 0x204]
jmp 0x45ae2d
push str.SoftwareMatroxImaging_Board_
lea ecx, [esp + 0x228]
mov dword [esi + 4], 0x80000001
call fcn.0040b1b0
mov ebx, eax
push ebx
mov ecx, edi
mov byte [esp + 0x2b8], 0x14
call fcn.0043a4c0
mov ecx, dword [ebx + 0x1c]
mov dword [edi + 0x1c], ecx
lea ecx, [esp + 0x224]
mov byte [esp + 0x2b4], 0xa
call fcn.0040aec0
mov ebx, dword [esp + 0x2c0]
mov eax, dword [ebx + 8]
dec eax
test eax, eax
jle 0x45ae61
mov eax, dword [edi + 8]
test eax, eax
jle 0x45ae59
push 1
mov ecx, edi
call fcn.00436c10
push ebx
mov ecx, edi
call fcn.0043a550
mov eax, dword [esi + 8]
test eax, eax
je 0x45ae6f
xor bl, bl
jmp 0x45af40
mov eax, dword [esi + 0x14]
dec eax
cmp eax, 1
jl 0x45aea6
jmp 0x45ae80
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
cmp byte [edx + eax - 2], 0x5c
jne 0x45aea6
mov eax, dword [edi + 8]
push 0x20
add eax, 0xfffffffe
push eax
mov ecx, edi
call fcn.00457e90
mov eax, dword [esi + 0x14]
dec eax
cmp eax, 1
jge 0x45ae80
mov ebx, dword [esi + 0x30]
mov dl, byte [esp + 0x2c4]
mov eax, dword [esi + 4]
test ebx, ebx
setne cl
test dl, dl
je 0x45aee6
mov ebp, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
push edx
xor edx, edx
test cl, cl
push 0
setne dl
push 0x20019
push edx
push 0
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x45aefd
mov ecx, dword [edi + 4]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb al, al
inc al
xor ebp, ebp
test al, al
jne 0x45af11
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x45af15
mov eax, dword [esp + 0x14]
cmp eax, ebp
setne bl
test bl, bl
mov dword [esi + 8], eax
jne 0x45af40
push 0x46d280
mov ecx, edi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
call fcn.0040afb0
mov al, byte [esi + 0x2d]
test al, al
mov dword [esi + 0x30], ebp
jne 0x45af40
mov byte [esi + 0x2c], bl
lea ecx, [esp + 0x100]
mov dword [esp + 0x2b4], 0xffffffff
call fcn.0045a460
mov al, bl
mov ecx, dword [esp + 0x2ac]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x29c]
pop ebx
call fcn.00465927
add esp, 0x2a8
ret 0xc