Function at 0x438980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c8a0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x476458]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
push esi
mov eax, 0x106
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0042a330
cmp dword [ebp - 0x18], 8
jb 0x4389ed
mov eax, dword [ebp - 0x2c]
mov edi, eax
cmp eax, esi
jne 0x4389f0
push esi
call fcn.004410cb
add esp, 4
or eax, 0xffffffff
jmp 0x438bcd
lea edi, [ebp - 0x2c]
lea ecx, [ebp - 0x50]
push ecx
push 1
push esi
push str.SOFTWAREMozillaMozilla_Firefox
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x54], 0x105
mov dword [ebp - 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x438a38
mov ecx, dword [ebp - 0x50]
lea edx, [ebp - 0x54]
push edx
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
push str.CurrentVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x438a48
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push ecx
push eax
call fcn.00441639
mov edx, dword [ebp - 0x1c]
mov ecx, eax
add esp, 8
cmp ecx, edx
ja 0x438a6d
or eax, 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.00403110
xor esi, esi
jmp 0x438a7f
mov eax, ecx
push esi
sub eax, edx
lea edi, [ebp - 0x2c]
call fcn.0042a330
mov edi, 8
cmp dword [ebp - 0x1c], esi
jne 0x438a9d
cmp dword [ebp - 0x18], edi
jb 0x438a95
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004410cb
add esp, 4
or eax, 0xffffffff
jmp 0x438bcd
xor eax, eax
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], ax
push 0x20
mov eax, str.SOFTWAREMozillaMozilla_Firefox
lea esi, [ebp - 0x48]
mov dword [ebp - 0x34], 7
call fcn.00408f90
push 1
mov eax, 0x464b80
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00415170
push 0
lea ecx, [ebp - 0x2c]
push ecx
or eax, 0xffffffff
call fcn.00415080
push 5
mov eax, str.Main
mov ecx, esi
call fcn.00415170
mov ecx, dword [ebx + 0x10]
cmp ecx, 0x105
ja 0x438b23
cmp ecx, 0x106
jb 0x438b0e
or eax, 0xffffffff
mov ecx, 0x106
mov esi, ebx
call fcn.00403110
jmp 0x438b23
mov eax, 0x106
push 0
sub eax, ecx
mov edi, ebx
call fcn.0042a330
mov edi, 8
cmp dword [ebx + 0x14], edi
jb 0x438b2c
mov eax, dword [ebx]
jmp 0x438b2e
mov eax, ebx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0x105
cmp dword [ebp - 0x34], edi
jae 0x438b40
lea edx, [ebp - 0x48]
push eax
push str.PathToExe
push reloc.WS2_32.dll_bind
lea esi, [ebp - 0x4c]
call fcn.0043e4a0
mov ecx, dword [ebx + 0x10]
add esp, 0xc
cmp dword [ebx + 0x14], edi
jb 0x438b62
mov eax, dword [ebx]
jmp 0x438b64
mov eax, ebx
push ecx
push eax
call fcn.00441639
mov edx, dword [ebx + 0x10]
mov ecx, eax
add esp, 8
cmp ecx, edx
ja 0x438b83
or eax, 0xffffffff
mov esi, ebx
call fcn.00403110
jmp 0x438b95
mov eax, ecx
push 0
sub eax, edx
mov edi, ebx
call fcn.0042a330
mov edi, 8
cmp dword [ebp - 0x34], edi
jb 0x438ba6
mov edx, dword [ebp - 0x48]
push edx
call fcn.004410cb
add esp, 4
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
cmp dword [ebp - 0x18], edi
jb 0x438bcb
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004410cb
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440ba3
mov esp, ebp
pop ebp
ret