Function at 0x4011b0
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
push ebx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x324], ax
lea eax, [ebp - 0x322]
push eax
xor ebx, ebx
call fcn.00402220
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x324]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea eax, [ebp - 0x324]
push 0x5c
push eax
call fcn.004018b8
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x401461
push esi
add ecx, 2
xor esi, esi
mov dword [ebp + 8], ecx
cmp dword [ebp + 0x10], ebx
jbe 0x401457
mov ebx, dword [ebp + 0xc]
push edi
jmp 0x401230
mov eax, dword [ebx]
test eax, eax
je 0x40135d
push eax
push ecx
call fcn.004019f7
add esp, 8
test eax, eax
jne 0x40135a
lea eax, [ebp - 4]
push eax
push section..data
push 0
push 8
push str.AiLdaAppStatusInfo
push str.SOFTWAREAMDEEU
push 0x80000002
mov dword [ebp - 4], 0x30
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40135a
cmp esi, 5
ja 0x40135a
cmp dword [esi*8 + 0x422004], eax
je 0x40135a
cmp dword [ebx + 4], eax
je 0x401449
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x324]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40135a
push eax
mov dword [ebp - 4], 0
call fcn.0040170b
mov edi, eax
add esp, 4
test edi, edi
je 0x40135a
push edi
push dword [ebp - 0x18]
lea eax, [ebp - 0x324]
push dword [ebp - 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401351
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov byte [ebp - 0x11c], 0
call fcn.00402220
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x11c]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.00401000
add esp, 0x1c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x401377
push edi
call fcn.0040177f
add esp, 4
mov ecx, dword [ebp + 8]
inc esi
add ebx, 0x14
cmp esi, dword [ebp + 0x10]
jb 0x401230
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x1ff
lea eax, [ebp - 0x523]
push 0
push eax
mov byte [ebp - 0x524], 0
call fcn.00402220
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*4]
xor ebx, ebx
lea eax, [ecx + eax*4]
add esp, 0xc
mov dword [ebp + 0x10], eax
cmp dword [eax + 4], ebx
jbe 0x40141a
lea esi, [eax + 8]
lea ebx, [ebx]
push 0x200
push dword [esi]
lea eax, [ebp - 0x524]
push 0x200
push eax
push 0
call fcn.00401ee5
mov eax, dword [esi]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013d2
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0x10]
call fcn.00401840
add esp, 0xc
test eax, eax
je 0x401430
push 0x200
lea eax, [ebp - 0x524]
push 0
push eax
call fcn.00402220
mov eax, dword [ebp + 0x10]
inc ebx
add esp, 0xc
add esi, 4
cmp ebx, dword [eax + 4]
jb 0x4013b0
push edi
xor esi, esi
call fcn.0040177f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov esi, 1
call fcn.0040177f
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc