Function at 0x10108ad0
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, ecx
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 0xc]
mov ecx, edx
push edi
mov dword [ebp - 0x814], esi
mov dword [esi + 0x94], eax
mov eax, dword [ebp + 0x10]
lea edi, [ecx + 2]
mov dword [esi + 0x9c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10108b14
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0xd0]
call fcn.10008240
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10108b35
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [esi + 0xe8]
call fcn.10008240
mov edi, dword [ebp - 0x80c]
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10108b60
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0xa0]
call fcn.10008240
mov eax, dword [0x10259028]
test al, 1
jne 0x10108bb6
or eax, 1
mov dword [0x10259020], 0
mov dword [0x10259028], eax
xor eax, eax
push 0x10217860
mov dword [0x10259024], 7
mov word [0x10259010], ax
call fcn.101e22c0
add esp, 4
mov eax, dword [0x10259020]
test eax, eax
jne 0x10108d19
push 0x400
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.102134e7
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.102134e7
add esp, 0x18
lea eax, [ebp - 0x404]
push 0x104
push eax
push dword [0x10256b30]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1025abd4
push 0x4000
call fcn.101e2340
mov ebx, eax
add esp, 8
mov dword [ebp - 0x810], ebx
test ebx, ebx
je 0x10108cea
push 0x4000
push 0
push ebx
call fcn.102134e7
add esp, 0xc
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10108ce1
cmp eax, 0x3fff
ja 0x10108ce1
push ebx
push eax
push 0
lea eax, [ebp - 0x404]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10108ce1
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0x10219e0c
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10108ce1
mov eax, dword [ebp - 0x80c]
push dword [ebp - 0x810]
movzx ecx, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx esi, word [eax + 0xc]
mov dword [ebp - 0x808], ecx
call fcn.10213517
mov eax, dword [ebp - 0x808]
push esi
push edi
push ebx
movzx eax, ax
push eax
push str._hu._hu._hu._hu
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.10008ee0
mov esi, dword [ebp - 0x814]
add esp, 0x20
jmp 0x10108cea
push ebx
call fcn.10213517
add esp, 4
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10108cf3
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
mov ecx, 0x10259010
call fcn.10008240
mov eax, dword [0x10259020]
lea ecx, [esi + 0xb8]
cmp ecx, 0x10259010
je 0x10108d42
cmp dword [0x10259024], 8
mov edx, 0x10259010
jb 0x10108d3b
mov edx, dword [0x10259010]
push eax
push edx
call fcn.10008240
cmp dword [esi + 0x94], 0
je 0x10108de8
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 1
push eax
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x810], 4
push eax
push str.EnableUE
push str.SOFTWARE360Safe
push SysReAllocString
mov dword [ebp - 0x80c], 4
call edi
test eax, eax
je 0x10108dd7
lea eax, [ebp - 0x810]
mov dword [ebp - 0x808], 1
push eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x810], 4
push eax
lea eax, [ebp - 0x80c]
push eax
push str.EnableUE
push str.SOFTWARE360Safe
push reloc.OLEAUT32.dll_SysReAllocString
call edi
xor eax, eax
cmp dword [ebp - 0x808], eax
setne al
mov dword [esi + 0x98], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 0x14