Function at 0x43b750
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c934c
mov eax, dword fs:[0]
push eax
sub esp, 0x854
mov eax, dword [0x51eee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x85c], ebx
mov dword [ebp - 0x860], 0
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x858]
mov dword [ebp - 4], 0
call fcn.0040bf10
mov esi, eax
call fcn.0043dcc0
test al, al
jne 0x43b7e8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test esi, esi
je 0x43b988
lea eax, [ebp - 0x83c]
push eax
call fcn.00434190
add esp, 4
mov eax, dword [ebp - 0x83c]
or edi, 0xffffffff
mov edx, dword [eax - 0xc]
mov byte [ebp - 4], 1
test edx, edx
je 0x43b935
lea ecx, [edx - 1]
test ecx, ecx
js 0x43b97e
cmp ecx, edx
jg 0x43b97e
cmp word [eax + ecx*2], 0x5c
je 0x43b841
push 0x4d95f8
lea ecx, [ebp - 0x83c]
call fcn.0040b8e0
push str.Mozilla_Firefox_firefox.exe
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x838]
push eax
call fcn.0040b720
lea eax, [ebp - 0x838]
push eax
mov byte [ebp - 4], 2
call fcn.004337c0
add esp, 0x10
test al, al
je 0x43b8e6
mov eax, dword [ebp - 0x838]
add eax, 0xfffffff0
push eax
call fcn.00404840
mov edx, dword [ebp - 0x838]
add eax, 0x10
add edx, 0xfffffff0
or edi, 0xffffffff
mov dword [ebx], eax
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43b8ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x83c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x43b8ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x858]
test ecx, ecx
je 0x43b8df
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x43bbd4
call fcn.0043db90
test al, al
jne 0x43b912
mov esi, dword [0x520340]
mov ecx, 1
cmp esi, ecx
jle 0x43b90c
mov edi, edi
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x43b900
mov dword [0x520340], ecx
mov edx, dword [ebp - 0x838]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43b935
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x4d8e30
mov ecx, ebx
call fcn.00401ff0
mov edx, dword [ebp - 0x83c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x43b962
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x858]
test eax, eax
je 0x43b8df
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x43bbd4
push 0x80070057
call fcn.00404480
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x834], ax
lea eax, [ebp - 0x832]
push eax
call fcn.004a7560
mov ebx, dword [0x520340]
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 8
jne 0x43ba40
mov eax, ebx
mov dword [ebp - 0x844], 0
and eax, 0x80000001
jns 0x43b9e1
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x838], eax
mov eax, ebx
cdq
mov ecx, 3
idiv ecx
mov dword [ebp - 0x848], eax
mov eax, ebx
mov dword [ebp - 0x83c], edx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x84c], eax
mov eax, ebx
and eax, 0x80000003
jns 0x43ba18
dec eax
or eax, 0xfffffffc
inc eax
mov dword [ebp - 0x840], eax
lea edx, [ebp - 0x33]
mov eax, dword [ebp - 0x844]
inc eax
mov word [edx - 1], 0
mov byte [edx + 1], 0
mov dword [ebp - 0x844], eax
lea edx, [edx + 0xc]
cmp eax, 3
jl 0x43ba21
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x840], esi
mov ebx, dword [ebp - 0x858]
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0x4d8e30
push ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x844], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [ebp - 0x838], edi
test edi, edi
jne 0x43baef
mov eax, dword [ebp - 0x848]
cmp eax, 1
je 0x43bab5
cmp eax, 2
je 0x43bab5
mov dword [ebp - 0x838], 0xd
jmp 0x43baef
mov eax, dword [ebp - 0x844]
test eax, eax
je 0x43badc
test al, 1
jne 0x43bad0
shr eax, 1
cmp word [ebp + eax*2 - 0x836], 0
je 0x43bae5
mov dword [ebp - 0x838], 0xd
jmp 0x43baef
xor eax, eax
mov word [ebp - 0x834], ax
mov dword [ebp - 0x838], 0
call fcn.0043dc30
test al, al
jne 0x43bb36
mov edi, dword [0x520340]
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub edi, ecx
xor ecx, ecx
lea eax, [edi + 0x63]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a5340
push eax
call fcn.004a7190
add esp, 8
cmp dword [ebp - 0x838], 0
jne 0x43bb78
lea ecx, [ebp - 0x834]
lea edx, [ecx + 2]
jmp 0x43bb50
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43bb50
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x840]
call fcn.00409950
mov esi, dword [ebp - 0x840]
test ebx, ebx
je 0x43bb8b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x858], ebx
lea edi, [esi - 0x10]
push edi
mov dword [ebp - 0x854], 0
call fcn.00404840
mov esi, dword [ebp - 0x85c]
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43bbc7
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x43bbd2
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a63c4
mov esp, ebp
pop ebp
ret