Function at 0x40d7a0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c0
mov eax, dword [0x52be84]
xor eax, esp
mov dword [esp + 0x4bc], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x44], esi
call fcn.0041fc00
push eax
lea ecx, [esp + 0x40]
call fcn.00431b90
mov dword [esi], 0
call fcn.004054f0
test eax, eax
je 0x40dc46
push 0x103
lea eax, [esp + 0x1ad]
push 0
push eax
mov byte [esp + 0x1b4], 0
call fcn.0045a690
add esp, 0xc
push 0x103
lea ecx, [esp + 0x2b5]
push 0
push ecx
mov byte [esp + 0x2bc], 0
call fcn.0045a690
add esp, 0xc
push 0x104
lea edx, [esp + 0x2b4]
push edx
call fcn.00433420
mov eax, dword [eax + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x2b0]
push ecx
lea ecx, [esp + 0x18]
call fcn.00403d30
mov edx, dword [esp + 0x14]
push 0x5c
push edx
call fcn.004556a0
add esp, 8
test eax, eax
jne 0x40d868
or eax, 0xffffffff
jmp 0x40d86c
sub eax, dword [esp + 0x14]
inc eax
push eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00415580
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx - 0xc]
mov eax, dword [esp + 0x28]
sub edx, dword [eax - 0xc]
lea ecx, [esp + 0x10]
push edx
push ecx
lea ecx, [esp + 0x1c]
call fcn.00415500
push 9
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.00415500
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x40d8ee
cmp dword [esi + 0xc], 0
jl 0x40d8e0
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40d8e0
push eax
call fcn.00403e80
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.00403fe0
add ebx, 0x10
mov dword [esp + 0x10], ebx
jmp 0x40d8ee
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00404330
mov esi, dword [esp + 0x20]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jne 0x40d91c
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.004520b0
add esp, 0x14
cmp eax, 1
jne 0x40d91c
int3
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x40d932
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
push 5
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
call fcn.00415580
push str.CheckFileVer.dll
lea edx, [esp + 0x28]
push edx
push 0x51bfa0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.004156e0
add esp, 0xc
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00415600
add esp, 0xc
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004156e0
mov esi, dword [esp + 0x2c]
add esi, 0xfffffff0
lea ebx, [esi + 0xc]
add esp, 0xc
cmp dword [ebx], 0
jne 0x40d9ac
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.004520b0
add esp, 0x14
cmp eax, 1
jne 0x40d9ac
int3
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x40d9c2
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov esi, dword [esp + 0x2c]
add esi, 0xfffffff0
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jne 0x40d9f0
push str.nRefs___0
push 0
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.004520b0
add esp, 0x14
cmp eax, 1
jne 0x40d9f0
int3
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x40da06
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea ecx, [esp + 0x48]
call fcn.00436970
mov eax, dword [esp + 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
or ecx, dword [eax - 8]
jge 0x40da2f
push 0
lea ecx, [esp + 0x10]
call fcn.00404140
mov eax, dword [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x50]
call fcn.00436b20
test eax, eax
jne 0x40ddc6
push 0x104
push eax
lea edx, [esp + 0x3c0]
push edx
call fcn.0045a690
add esp, 0xc
call fcn.0041b6b0
neg eax
sbb eax, eax
and eax, 4
push 0
add eax, 0x26
push eax
lea eax, [esp + 0x3c0]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40dc10
lea ecx, [esp + 0x3b8]
push ecx
lea ecx, [esp + 0x30]
call fcn.00403d30
push str.CheckFileVer.dll
lea edx, [esp + 0x28]
push edx
push str.GECSP
mov eax, edx
push eax
push str.GECSP
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.004156e0
add esp, 0xc
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00415600
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004156e0
add esp, 0xc
push eax
lea edx, [esp + 0x28]
push edx
call fcn.00415600
add esp, 0xc
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004156e0
mov ecx, dword [eax]
mov esi, dword [esp + 0x18]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
add esp, 0xc
cmp eax, esi
je 0x40db3a
cmp dword [esi + 0xc], 0
jl 0x40db2c
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40db2c
push eax
call fcn.00403e80
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.00403fe0
add ebx, 0x10
mov dword [esp + 0xc], ebx
jmp 0x40db3a
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00404330
lea ecx, [esp + 0x20]
call fcn.00403df0
lea ecx, [esp + 0x1c]
call fcn.00403df0
lea ecx, [esp + 0x18]
call fcn.00403df0
lea ecx, [esp + 0x30]
call fcn.00403df0
lea ecx, [esp + 0x38]
call fcn.00403df0
mov eax, dword [esp + 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
or ecx, dword [eax - 8]
jge 0x40db87
push 0
lea ecx, [esp + 0x10]
call fcn.00404140
mov eax, dword [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x50]
call fcn.00436b20
test eax, eax
jne 0x40ddbd
lea ecx, [esp + 0x1c]
call fcn.00403850
push str.SOFTWAREMicrosoftCryptographyDefaultsProvider_
lea ecx, [esp + 0x20]
call fcn.004043e0
call fcn.0041b6b0
test eax, eax
je 0x40dbc9
push str.SOFTWAREWow6432NodeMicrosoftCryptographyDefaultsProvider_
lea ecx, [esp + 0x20]
call fcn.004043e0
push str.HaiTai_Cryptographic_Service_Provider
lea ecx, [esp + 0x20]
call fcn.00415180
lea edx, [esp + 0x20]
push edx
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x2c]
call fcn.00404190
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40dc6a
lea ecx, [esp + 0x1c]
call fcn.00403df0
lea ecx, [esp + 0x2c]
call fcn.00403df0
lea ecx, [esp + 0x48]
call fcn.00436a00
lea ecx, [esp + 0xc]
call fcn.00403df0
lea ecx, [esp + 0x24]
call fcn.00403df0
lea ecx, [esp + 0x10]
call fcn.00403df0
lea ecx, [esp + 0x28]
call fcn.00403df0
lea ecx, [esp + 0x14]
call fcn.00403df0
lea ecx, [esp + 0x3c]
call fcn.004334e0
mov eax, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x4bc]
xor ecx, esp
call fcn.004520a0
mov esp, ebp
pop ebp
ret 8
push 0x103
lea eax, [esp + 0xa5]
push 0
push eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], 0x80
mov byte [esp + 0xac], 0
call fcn.0045a690
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push str.Image_Path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dbfe
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x1c]
call fcn.00403d30
lea esi, [esp + 0x18]
call fcn.004154e0
inc eax
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.00415580
mov ecx, dword [eax]
mov esi, dword [esp + 0x18]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x40dd3d
cmp dword [esi + 0xc], 0
jl 0x40dd2f
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40dd2f
push eax
call fcn.00403e80
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.00403fe0
add ebx, 0x10
mov dword [esp + 0x18], ebx
jmp 0x40dd3d
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00404330
lea ecx, [esp + 0x34]
call fcn.00403df0
push 0x51b84c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.004156e0
mov ecx, dword [eax]
mov esi, dword [esp + 0x18]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
add esp, 0xc
cmp eax, esi
je 0x40dda2
cmp dword [esi + 0xc], 0
jl 0x40dd94
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40dd94
push eax
call fcn.00403e80
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.00403fe0
add ebx, 0x10
mov dword [esp + 0xc], ebx
jmp 0x40dda2
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00404330
lea ecx, [esp + 0x34]
call fcn.00403df0
lea ecx, [esp + 0x18]
call fcn.00403df0
lea ecx, [esp + 0x1c]
call fcn.00403df0
lea ecx, [esp + 0x2c]
call fcn.00403df0
mov eax, dword [esp + 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
or ecx, dword [eax - 8]
jge 0x40dde6
push 0
lea ecx, [esp + 0x10]
call fcn.00404140
mov eax, dword [esp + 0xc]
push eax
lea edx, [esp + 0x1ac]
push 0x104
push edx
call fcn.00454120
add esp, 0xc
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40de5a
lea ebx, [esp + 0x60]
mov dword [esp + 0x60], vtable.CModuleVersion.0
mov dword [esp + 0x98], 0
call fcn.0041b570
test eax, eax
je 0x40de43
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x44]
shr ecx, 0x10
cmp ecx, 4
sbb edx, edx
inc edx
mov dword [eax], edx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x98]
push ecx
call fcn.004203f0
add esp, 4
lea ecx, [esp + 0x48]
call fcn.00436a00
lea ecx, [esp + 0xc]
call fcn.00403df0
lea ecx, [esp + 0x24]
call fcn.00403df0
lea ecx, [esp + 0x10]
call fcn.00403df0
lea ecx, [esp + 0x28]
call fcn.00403df0
lea ecx, [esp + 0x14]
call fcn.00403df0
lea ecx, [esp + 0x3c]
call fcn.004334e0
mov ecx, dword [esp + 0x4c4]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004520a0
mov esp, ebp
pop ebp
ret 8