Function at 0x416200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x511014]
xor eax, ebp
mov dword [esp + 0x38], eax
xor ebx, ebx
mov dword [esi], ebx
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
movaps xmm0, xmmword [0x502ac0]
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0x50], ebx
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea edi, [esp + 8]
mov dword [edi], ebx
push edi
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41656a
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov ecx, 4
mov dword [esp + 8], ecx
lea edx, [esp + 0x30]
mov dword [edx], ecx
lea ecx, [esp + 0x2c]
mov dword [ecx], ebx
push edx
push ecx
push edi
xor ecx, ecx
mov dword [esp + 0x10], 0
push ecx
push 0x502b6c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4162f5
mov eax, dword [esp + 8]
add eax, 0xfffffffd
mov dword [esp + 4], 0
cmp dword [esp + 0x30], 4
mov ecx, 0
jne 0x4162e7
mov ecx, dword [esp + 0x2c]
cmp eax, 2
mov eax, dword [esp + 4]
cmovb eax, ecx
mov dword [esp + 4], eax
lea edi, [esp + 0x20]
lea ecx, [esp + 0x14]
push edi
push str.DisplayVersion
call fcn.00416890
movzx eax, byte [edi + 0xb]
mov ecx, eax
and ecx, 0x7f
test al, al
mov ebx, dword [edi + 4]
cmovs ecx, ebx
test ecx, ecx
je 0x416768
mov ecx, eax
and cl, 0x7f
test al, al
lea edx, [esp + 0x20]
mov eax, dword [edx]
cmovns eax, edx
movzx ecx, cl
cmovs ecx, ebx
push ecx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0047bbf0
add esp, 0xc
mov edi, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xf]
mov dword [esp + 0x33], eax
mov dl, byte [esp + 0x13]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41637b
push eax
mov ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, ebx
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0
test ecx, ecx
jne 0x416614
cmp byte [esp + 0x2b], 0
js 0x416624
mov eax, dword [esp + 4]
mov dword [esi + 0x10], eax
cmp byte [esi + 0x2b], 0
js 0x416639
mov dword [esi + 0x20], edi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x33]
mov dword [esi + 0x24], eax
mov dword [esi + 0x27], ecx
mov byte [esi + 0x2b], dl
mov ecx, dword [esi + 4]
mov eax, 0x15
cmp ecx, 0xa
jne 0x41664f
mov ecx, dword [esi + 0xc]
cmp ecx, 0x55ef
ja 0x4163fe
cmp ecx, 0x4f7b
ja 0x416682
cmp ecx, 0x4a63
ja 0x41668c
mov eax, 0x12
jne 0x416579
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
mov eax, dword [0x5168dc]
mov ecx, dword [0x514f00]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x416464
push 0x5168dc
call fcn.00494ba0
add esp, 4
cmp dword [0x5168dc], 0xffffffff
jne 0x416464
push 0x500514
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5168d8], eax
push 0x5168dc
call fcn.00495b95
add esp, 4
mov ecx, dword [0x5168d8]
test ecx, ecx
je 0x416696
xor eax, eax
mov word [esp + 0x20], ax
lea ebx, [esp + 0x14]
mov word [ebx], ax
call dword [section..00cfg]
push ebx
lea eax, [esp + 0x24]
push eax
push edi
call ecx
test eax, eax
je 0x4164cc
movzx eax, word [esp + 0x20]
cmp eax, 0x14c
jne 0x4166cb
xor eax, eax
inc eax
mov dword [esi + 0x40], eax
movzx eax, word [esp + 0x14]
xor ecx, ecx
cmp eax, 0x8664
sete cl
mov edx, 2
sub edx, ecx
xor ecx, ecx
cmp eax, 0xaa64
cmovne ecx, edx
mov dword [esi + 0x44], ecx
mov edi, dword [ebp + 8]
movzx eax, word [edi + 0x114]
mov dword [esi + 0x18], eax
movzx eax, word [edi + 0x116]
mov dword [esi + 0x1c], eax
add edi, 0x14
je 0x4166f9
lea ebx, [esi + 0x2c]
push edi
call fcn.00495e86
add esp, 4
push eax
push edi
lea eax, [esp + 0x28]
push eax
call fcn.0047bbf0
add esp, 0xc
cmp byte [esi + 0x37], 0
js 0x4166fc
mov eax, dword [esp + 0x28]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp + 0x20]
movsd qword [ebx], xmm0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x38], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, 0xa
jne 0x41670b
mov eax, dword [ebp + 0x10]
cmp eax, 4
jne 0x416749
mov dword [esi + 0x14], 3
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.00496ce3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor eax, eax
mov dword [esp + 4], 0
jmp 0x416321
cmp ecx, 0x4a61
ja 0x416836
mov eax, 0x10
je 0x4163fe
mov eax, 0xf
cmp ecx, 0x47ba
ja 0x4163fe
mov eax, 0xe
je 0x4163fe
mov eax, 0xd
cmp ecx, 0x4562
ja 0x4163fe
mov eax, 0xc
cmp ecx, 0x42ed
ja 0x4163fe
mov eax, 0xb
cmp ecx, 0x3faa
ja 0x4163fe
mov eax, 0xa
cmp ecx, 0x3ad6
ja 0x4163fe
mov eax, 9
cmp ecx, 0x3838
ja 0x4163fe
cmp ecx, 0x295a
mov eax, 7
sbb eax, 0xffffffff
jmp 0x4163fe
push 1
mov ebx, edx
call fcn.0042a9f0
mov edx, ebx
jmp 0x41638f
push dword [esp + 0x20]
mov ebx, edx
call fcn.00494aa1
mov edx, ebx
add esp, 4
jmp 0x41639a
lea eax, [esi + 0x20]
push dword [eax]
mov ebx, edx
call fcn.00494aa1
mov edx, ebx
add esp, 4
jmp 0x4163ab
cmp ecx, 0xb
je 0x4163fe
mov eax, 0x16
cmp ecx, 6
ja 0x4163fe
mov edx, dword [esi + 8]
jne 0x416840
lea ecx, [edx + 3]
cmp edx, 3
mov eax, 6
cmovb eax, ecx
jmp 0x4163fe
mov eax, 0x14
jmp 0x4163fe
mov eax, 0x13
jmp 0x4163fe
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4164cc
cmp dword [esp + 0x20], 0
je 0x4167f1
xor eax, eax
inc eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
jmp 0x4164cc
test eax, eax
je 0x4164a6
add eax, 0xfffffe40
cmp eax, 4
ja 0x4167cd
mov ecx, 0x15
bt ecx, eax
jae 0x4167cd
mov eax, 2
jmp 0x4164a6
int3
push dword [ebx]
call fcn.00494aa1
add esp, 4
jmp 0x416511
cmp eax, 5
jne 0x416784
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp eax, 1
je 0x416821
cmp eax, 2
mov eax, dword [ebp + 8]
jne 0x41678d
cmp byte [eax + 0x11a], 1
jne 0x416736
cmp word [ecx], 9
je 0x41675c
mov eax, dword [ebp + 8]
cmp word [eax + 0x118], 0
jns 0x4167e5
jmp 0x41678d
cmp eax, 0x45
jg 0x416799
cmp eax, 0x1b
jbe 0x4167d7
cmp eax, 0x30
jne 0x41678d
mov dword [esi + 0x14], 1
jmp 0x416553
lea ecx, [esp + 0x14]
push edi
push str.ReleaseId
call fcn.00416890
mov al, byte [esp + 0x2b]
mov ebx, dword [esp + 0x24]
jmp 0x416321
cmp eax, 6
je 0x416540
mov dword [esi + 0x14], 0
jmp 0x416553
lea ecx, [eax - 0x46]
cmp ecx, 0xe
ja 0x4167af
mov edx, 0x4005
bt edx, ecx
jb 0x41654c
lea ecx, [eax - 0x79]
cmp ecx, 9
jbe 0x4167fd
add eax, 0xffffff5c
cmp eax, 2
jae 0x41678d
mov dword [esi + 0x14], 5
jmp 0x416553
mov eax, 3
jmp 0x4164a6
mov ecx, 0x206f780
bt ecx, eax
jae 0x416867
mov dword [esi + 0x14], 2
jmp 0x416553
mov dword [esi + 0x40], 0
jmp 0x4164cc
mov edx, 0x330
bt edx, ecx
jb 0x41654c
mov edx, 3
bt edx, ecx
jae 0x4167b7
mov dword [esi + 0x14], 4
jmp 0x416553
mov eax, dword [ebp + 8]
test byte [eax + 0x119], 2
je 0x41675c
jmp 0x41678d
mov eax, 0x11
jmp 0x4163fe
xor eax, eax
test edx, edx
je 0x4163fe
cmp ecx, 5
jne 0x4163fe
xor ecx, ecx
cmp edx, 1
sete cl
mov eax, 2
sub eax, ecx
jmp 0x4163fe
mov ecx, 0x8010040
bt ecx, eax
jb 0x41654c
cmp eax, 1
jne 0x416757
jmp 0x41675c