Function at 0x420660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x5a6008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x140
push 0
push esi
mov dword [ebp - 0x1bc], ecx
call fcn.00513330
push 0x98
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.00513330
push 0x90
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1b4], 0x9c
push 0
push eax
call fcn.00513330
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x24
mov dword [ebp - 0x118], 0x94
push str.KERNEL32.DLL
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420870
push 0x58e9c8
push eax
call edi
test eax, eax
je 0x420870
lea ecx, [ebp - 0x1b4]
push ecx
call eax
test eax, eax
je 0x420870
mov ebx, dword [ebp - 0x11c]
mov ecx, ebx
and ecx, 1
mov al, bl
mov edx, ecx
or edx, 2
and al, 2
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 0x80
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and eax, 0x200
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and eax, 0x400
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x100
and al, 0x40
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and eax, 0x100
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000
and eax, 0x4000
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80000
and eax, 0x2000
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x100000
and eax, 0x1000
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x200000
and al, 4
cmove edx, ecx
test ebx, 0x8000
je 0x4207c9
or edx, 0x10000000
movzx eax, byte [ebp - 0x11a]
xor ecx, ecx
mov dword [esi + 0x130], edx
sub eax, 1
je 0x4207f3
sub eax, 1
je 0x4207ec
sub eax, 1
jne 0x4207f8
lea ecx, [eax + 2]
jmp 0x4207f8
mov ecx, 3
jmp 0x4207f8
mov ecx, 1
push esi
push 1
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x13c], ecx
push dword [ebp - 0x11e]
mov ecx, dword [ebp - 0x1bc]
push dword [ebp - 0x120]
push eax
push dword [ebp - 0x1a8]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.00421670
cmp dword [esi + 0x13c], 1
je 0x420a5f
test byte [ebp - 0x11c], 0xa2
jne 0x420a5f
or dword [esi + 0x134], 0x20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511339
mov esp, ebp
pop ebp
ret 4
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x420977
push 0x58e9c8
push eax
call edi
test eax, eax
je 0x420896
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x420898
xor eax, eax
test eax, eax
je 0x420977
mov ecx, dword [ebp - 0x108]
xor edi, edi
cmp ecx, 2
jne 0x420901
lea ecx, [ebp - 0x104]
call fcn.00422190
movzx edi, ax
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x110]
xor eax, eax
push esi
push 0
push dword [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x104]
push eax
push ebx
push edx
push ecx
mov ecx, dword [ebp - 0x1bc]
call fcn.00421670
cmp dword [ebp - 0x108], 2
jne 0x420a5f
jmp 0x420a3a
cmp ecx, 1
jne 0x4208bb
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
cmp ecx, 4
jne 0x42092b
lea eax, [ebx - 0x3b7]
cmp eax, 0x81
ja 0x42092b
mov edi, 1
jmp 0x4208c7
mov edx, dword [ebp - 0x110]
push ebx
call fcn.00421f50
add esp, 4
test eax, eax
je 0x420945
mov edi, 2
jmp 0x4208cd
push ebx
call fcn.00421f80
add esp, 4
test eax, eax
je 0x42095f
mov edi, 2
lea eax, [edi + 3]
jmp 0x4208cf
push ebx
call fcn.00421fb0
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
jmp 0x4208cd
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x420a77
push 0x58e9bc
push eax
call edi
test eax, eax
je 0x420a77
call eax
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], edi
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420a15
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420a09
lea eax, [ebp - 0x84]
push eax
call fcn.0051e079
add esp, 4
mov edi, eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1bc]
push esi
push 0
push 2
push 0
push 0
push 0x560f28
push edi
movzx eax, bx
shr eax, 8
push eax
movzx eax, bl
push eax
call fcn.00421670
push esi
call fcn.00420a90
cmp dword [esi + 0x13c], 1
je 0x420a59
test byte [ebp - 0x11c], 0xa2
jne 0x420a59
or dword [esi + 0x134], 0x20
push esi
call fcn.00420be0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511339
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00511339
mov esp, ebp
pop ebp
ret 4