Function at 0x100053f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b97b
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x10051114]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, 1
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 0
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshalowp.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x258], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005517
mov esi, dword [ebp - 0x258]
push 0x200
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x274], esi
push eax
mov dword [ebp - 0x270], 0x200
call fcn.100214a0
add esp, 0xc
mov dword [ebp - 0x23c], 0x200
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x244]
push eax
push 0
push str.InstallDate
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005507
mov eax, dword [ebp - 0x244]
cmp eax, ebx
je 0x100054ec
cmp eax, 2
jne 0x10005507
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x10005535
test al, 1
jne 0x10005507
shr eax, 1
cmp word [ebp + eax*2 - 0x216], 0
je 0x1000553e
mov ebx, 1
test esi, esi
je 0x10005517
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100178b1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x24c], 0
push eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x250], 0
push eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0
push eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x244], 0
push eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x23c], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x240], 0
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.100059c0
add esp, 0x20
cmp eax, 6
jne 0x1000550c
mov edx, dword [ebp - 0x24c]
mov eax, 0x76c
cmp edx, eax
cmovl edx, eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x24c], edx
cmp eax, 1
jl 0x100055eb
cmp eax, 0xc
jle 0x100055f6
mov eax, 1
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x254]
cmp ecx, 1
jl 0x10005606
cmp ecx, 0x1f
jle 0x10005611
mov ecx, 1
mov dword [ebp - 0x254], ecx
mov edi, dword [ebp - 0x244]
test edi, edi
js 0x10005620
cmp edi, 0x17
jle 0x10005628
xor edi, edi
mov dword [ebp - 0x244], edi
mov ebx, dword [ebp - 0x23c]
test ebx, ebx
js 0x10005637
cmp ebx, 0x3b
jle 0x1000563f
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
cmp dword [ebp - 0x240], 0
jl 0x10005651
cmp dword [ebp - 0x240], 0x3b
jle 0x1000565b
mov dword [ebp - 0x240], 0
cmp dword [ebp + 0xc], 0
je 0x10005807
cmp edx, 0x7b2
jl 0x10005916
lea edi, [eax - 1]
cmp edi, 0xb
ja 0x10005920
lea eax, [ecx - 1]
cmp eax, 0x1e
ja 0x1000592a
lea eax, [edx - 0x76c]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x218], 0xffffffff
call fcn.1002d0dc
mov ecx, eax
mov dword [ebp - 0x25c], eax
and ecx, edx
mov dword [ebp - 0x248], edx
add esp, 4
cmp ecx, 0xffffffff
je 0x10005934
push 0
call fcn.1002d174
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x260], edx
push eax
call fcn.1002cc0d
add esp, 0xc
test eax, eax
jne 0x1000572c
mov ebx, dword [ebp - 0x224]
add ebx, 0x76c
jmp 0x1000572e
xor ebx, ebx
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.1002cc0d
add esp, 8
test eax, eax
jne 0x10005751
mov edi, dword [ebp - 0x228]
inc edi
jmp 0x10005753
xor edi, edi
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.1002cc0d
xor ecx, ecx
add esp, 8
test eax, eax
cmove ecx, dword [ebp - 0x22c]
cmp ebx, 0x7b2
jl 0x1000593e
dec edi
cmp edi, 0xb
ja 0x10005948
lea eax, [ecx - 1]
cmp eax, 0x1e
ja 0x10005952
lea eax, [ebx - 0x76c]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x218], 0xffffffff
call fcn.1002d0dc
mov edi, eax
mov ebx, edx
mov ecx, edi
add esp, 4
and ecx, ebx
cmp ecx, 0xffffffff
je 0x1000595c
sub edi, dword [ebp - 0x25c]
sbb ebx, dword [ebp - 0x248]
jmp 0x100058e5
cmp edx, 0x7b2
jl 0x10005966
dec eax
mov dword [ebp - 0x248], eax
cmp eax, 0xb
ja 0x10005970
lea eax, [ecx - 1]
cmp eax, 0x1e
ja 0x1000597a
cmp edi, 0x17
ja 0x10005984
cmp ebx, 0x3b
ja 0x1000598e
mov eax, dword [ebp - 0x240]
cmp eax, 0x3b
ja 0x10005998
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x228], eax
lea eax, [edx - 0x76c]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x218], 0xffffffff
call fcn.1002d0dc
mov ecx, eax
mov dword [ebp - 0x248], eax
and ecx, edx
mov dword [ebp - 0x25c], edx
add esp, 4
cmp ecx, 0xffffffff
je 0x100059a2
jmp 0x100058cb
push 0
call fcn.1002d174
add esp, 4
mov edi, eax
sub edi, dword [ebp - 0x248]
mov ebx, edx
sbb ebx, dword [ebp - 0x25c]
mov eax, dword [ebp + 8]
mov ecx, 0x18
imul ecx
push 0
push 0xe10
push edx
push eax
call fcn.10017940
cmp ebx, edx
jg 0x10005507
jl 0x1000590f
cmp edi, eax
jae 0x10005507
xor ebx, ebx
jmp 0x1000550c
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80070057
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80070057
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80004005
call fcn.10002690
push 0x80070057
call fcn.10002690
int3