Function at 0x47ec00
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x506e0c], 0
push ebx
push esi
push edi
mov ecx, 0xa
mov esi, 0x4ec668
lea edi, [ebp - 0xf8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xd
mov esi, 0x4ec694
lea edi, [ebp - 0x130]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x47ec75
mov esi, dword [0x4f8b78]
mov edi, dword [0x4f8b7c]
mov dword [ebp - 0x3f4], esi
mov dword [ebp - 0x3f0], edi
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0x20106
jmp 0x47ec81
mov edi, dword [ebp - 0x3f0]
mov esi, dword [ebp - 0x3f4]
push 0x94
lea eax, [ebp - 0x3dc]
push 0
push eax
mov dword [ebp - 0x3e8], 0
call fcn.004d29c0
add esp, 0xc
lea ecx, [ebp - 0x3dc]
push ecx
mov dword [ebp - 0x3dc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x3d8], 6
jne 0x47f10f
cmp dword [ebp - 0x3d4], 1
jbe 0x47f10f
mov esi, dword [ebp + 8]
push esi
lea ebx, [ebp - 0xcc]
call fcn.004c2260
add esp, 4
mov edx, str.WinPatrol_Plus
mov ecx, ebx
call fcn.0047bb80
test eax, eax
jne 0x47ed04
mov edx, str.WinPatrol__Free_Edition_
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x47ed1c
push 0x80
lea edx, [ebp - 0xcc]
mov ecx, 2
call fcn.004ca1e0
add esp, 4
lea edi, [ebp - 0x23c]
mov ebx, esi
call fcn.004c22f0
push esi
lea ebx, [ebp - 0x344]
call fcn.004c23e0
mov eax, dword [0x4f8b78]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
lea edx, [ebp - 0x3e0]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push CreateStatusWindowA
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47edd4
lea ecx, [ebp - 0x3e4]
push ecx
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3ec]
push eax
push 0
lea ecx, [ebp - 0xcc]
push ecx
push edx
mov dword [ebp - 0x3e4], 0x20
call ebx
test eax, eax
je 0x47edaf
mov eax, dword [ebp - 0x3e0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
jmp 0x47edda
mov ecx, dword [ebp - 0x3e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x28], 3
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x47edda
mov dword [ebp - 0x3e8], 1
jmp 0x47edda
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4f8b78]
lea edx, [ebp - 0x3e0]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push 0x80000001
call esi
test eax, eax
jne 0x47ee58
lea ecx, [ebp - 0x3e4]
push ecx
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3ec]
push eax
push 0
lea ecx, [ebp - 0xcc]
push ecx
push edx
mov dword [ebp - 0x3e4], 0x20
call ebx
test eax, eax
je 0x47ee3f
mov eax, dword [ebp - 0x3e0]
push eax
call edi
jmp 0x47ee58
mov ecx, dword [ebp - 0x3e0]
push ecx
call edi
cmp byte [ebp - 0x28], 3
jne 0x47ee58
mov dword [ebp - 0x3e8], 1
mov eax, dword [0x4f8b78]
lea edx, [ebp - 0x3e0]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
push CreateStatusWindowA
call esi
test eax, eax
jne 0x47eed6
lea ecx, [ebp - 0x3e4]
push ecx
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3ec]
push eax
push 0
lea ecx, [ebp - 0xcc]
push ecx
push edx
mov dword [ebp - 0x3e4], 0x20
call ebx
test eax, eax
je 0x47eebd
mov eax, dword [ebp - 0x3e0]
push eax
call edi
jmp 0x47eed6
mov ecx, dword [ebp - 0x3e0]
push ecx
call edi
cmp byte [ebp - 0x28], 3
jne 0x47eed6
mov dword [ebp - 0x3e8], 1
mov eax, dword [0x4f8b78]
lea edx, [ebp - 0x3e0]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun32
push 0x80000001
call esi
test eax, eax
jne 0x47ef54
lea ecx, [ebp - 0x3e4]
push ecx
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3ec]
push eax
push 0
lea ecx, [ebp - 0xcc]
push ecx
push edx
mov dword [ebp - 0x3e4], 0x20
call ebx
test eax, eax
je 0x47ef3b
mov eax, dword [ebp - 0x3e0]
push eax
call edi
jmp 0x47ef54
mov ecx, dword [ebp - 0x3e0]
push ecx
call edi
cmp byte [ebp - 0x28], 3
jne 0x47ef54
mov dword [ebp - 0x3e8], 1
mov edx, dword [ebp + 8]
push edx
lea ebx, [ebp - 0x23c]
call fcn.004c23e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 4
mov eax, ebx
push eax
call edi
test eax, eax
jle 0x47efad
mov cl, 0x5c
cmp byte [ebp + eax - 0x23c], cl
je 0x47ef87
dec eax
test eax, eax
jg 0x47ef77
jmp 0x47efad
lea ecx, [ebp + eax - 0x23b]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x344]
call fcn.004010b0
lea edx, [ebp - 0x344]
push edx
call edi
mov ecx, dword [0x4f8b78]
lea eax, [ebp - 0x3e0]
push eax
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedStartupFolder
push CreateStatusWindowA
call esi
test eax, eax
jne 0x47f038
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x3e4]
push edx
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x3e0]
lea ecx, [ebp - 0x3ec]
push ecx
push 0
lea edx, [ebp - 0x344]
push edx
push eax
mov dword [ebp - 0x3e4], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47f01b
mov ecx, dword [ebp - 0x3e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47f038
mov edx, dword [ebp - 0x3e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x28], 3
jne 0x47f038
mov dword [ebp - 0x3e8], 1
mov ecx, dword [0x4f8b78]
lea eax, [ebp - 0x3e0]
push eax
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedStartupFolder
push 0x80000001
call esi
test eax, eax
jne 0x47f0a4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x3e4]
push edx
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x3e0]
lea ecx, [ebp - 0x3ec]
push ecx
push 0
lea edx, [ebp - 0x344]
push edx
push eax
mov dword [ebp - 0x3e4], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47f0e4
mov ecx, dword [ebp - 0x3e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3e8], 0
je 0x47f103
cmp dword [0x506e0c], 0
je 0x47f0cd
mov eax, dword [ebp - 0x3f4]
mov ecx, dword [ebp - 0x3f0]
mov dword [0x4f8b78], eax
mov dword [0x4f8b7c], ecx
mov eax, dword [ebp - 0x3e8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x3e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x28], 3
jne 0x47f0a4
mov dword [ebp - 0x3e8], 1
jmp 0x47f0ad
mov edi, dword [ebp - 0x3f0]
mov esi, dword [ebp - 0x3f4]
cmp dword [0x506e0c], 0
je 0x47f12c
mov dword [0x4f8b78], 0x20019
mov dword [0x4f8b7c], 0x20006
mov edx, dword [ebp + 8]
push edx
lea ebx, [ebp - 0xcc]
call fcn.004c2260
add esp, 4
mov edx, str.WinPatrol_Plus
mov ecx, ebx
call fcn.0047bb80
test eax, eax
jne 0x47f15e
mov edx, str.WinPatrol__Free_Edition_
mov ecx, ebx
call fcn.0047bb80
test eax, eax
je 0x47f176
push 0x80
lea edx, [ebp - 0xcc]
mov ecx, 2
call fcn.004ca1e0
add esp, 4
push 0x20
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xf8]
push ecx
lea ecx, [ebp - 0x48]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
je 0x47f1cc
cmp dword [0x506e0c], 0
je 0x47f1af
mov dword [0x4f8b78], esi
mov dword [0x4f8b7c], edi
lea edx, [ebp - 0x48]
push edx
call fcn.004cf33f
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
push 0x20
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x48]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
test eax, eax
jne 0x47f19a
cmp dword [0x506e0c], eax
je 0x47f204
mov dword [0x4f8b78], esi
mov dword [0x4f8b7c], edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret