Function at 0x403737
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1d88]
mov eax, 0x1e08
call fcn.0040aae0
mov eax, dword [0x425250]
xor eax, ebp
mov dword [ebp + 0x1d84], eax
mov eax, dword [ebp + 0x1d90]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push edi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1d94]
mov dword [ebp - 0x68], eax
mov edi, 0x104
push edi
lea eax, [ebp + 0x1b7c]
push eax
push 0x43b
push dword [0x426798]
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], 0x20019
mov byte [ebp - 0x61], bl
call esi
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x1c80]
push eax
push 0x43c
push dword [0x426798]
call esi
cmp dword [ebp - 0x78], ebx
jbe 0x4037de
cmp eax, ebx
jbe 0x4037de
cmp dword [ebp - 0x78], eax
jne 0x4037de
lea eax, [ebp + 0x1c80]
push eax
lea eax, [ebp + 0x1b7c]
push eax
call fcn.0040a8db
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp - 0x61], al
call fcn.00403611
test al, al
je 0x403809
cmp byte [ebp - 0x61], bl
jne 0x403809
mov dword [ebp - 0x74], 0x20119
cmp byte [0x4268b5], bl
je 0x403824
push 0x40
push 0x426774
push str.Added_add_flag_to_access_native_64_bit_registry_area.
jmp 0x40381d
cmp byte [0x4268b5], bl
je 0x403824
push 0x40
push 0x426774
push str.Did_NOT_add_flag_to_access_native_64_bit_registry_area.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x68]
cmp eax, ebx
jne 0x403832
xor eax, eax
jmp 0x4039c9
mov edi, dword [ebp - 0x7c]
xor ecx, ecx
mov word [eax], cx
cmp edi, ebx
je 0x40382b
push edi
call fcn.0040a08a
pop ecx
cmp eax, 0x28
jae 0x4039bd
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov esi, 0x201
lea eax, [ebp + 0x1374]
push esi
push eax
call fcn.0040a01b
push edi
lea eax, [ebp + 0x1374]
push esi
push eax
call fcn.0040a47e
add esp, 0x18
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp + 0x1374]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403966
cmp dword [ebp - 0x6c], ebx
je 0x403966
push str.InstallLocation
mov word [ebp - 0x60], ax
lea eax, [ebp + 0x1778]
push esi
push eax
call fcn.0040a01b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x1778]
push eax
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], 0xc02
call edi
test eax, eax
je 0x403916
push str.UninstallLocation
lea eax, [ebp + 0x1778]
push esi
push eax
call fcn.0040a01b
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp + 0x1778]
push eax
push dword [ebp - 0x6c]
call edi
test eax, eax
jne 0x403938
mov eax, dword [ebp - 0x70]
shr eax, 1
cmp dword [ebp + 0x1d98], eax
jbe 0x403938
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0x1d98]
push dword [ebp - 0x68]
call fcn.0040a01b
add esp, 0xc
cmp byte [0x4268b5], bl
je 0x40395b
mov eax, dword [ebp - 0x68]
cmp word [eax], bx
jne 0x40395b
push 0x40
push 0x426774
push str.Cant_do_Call_home_because_failed_to_retrieve_install_uninstall_location.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4039bd
cmp byte [0x4268b5], bl
je 0x4039bd
push str.Call_Home_wont_be_done_because_Uninstall_key_could_not_be_found_for_GUID_
mov esi, 0x3e8
lea eax, [ebp + 0xba4]
push esi
push eax
call fcn.0040a01b
push edi
lea eax, [ebp + 0xba4]
push esi
push eax
call fcn.0040a47e
push 0x41c71c
lea eax, [ebp + 0xba4]
push esi
push eax
call fcn.0040a47e
add esp, 0x24
push 0x40
push 0x426524
lea eax, [ebp + 0xba4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x68]
movzx eax, word [ecx]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp + 0x1d84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ede
add ebp, 0x1d88
leave
ret