Function at 0x420770
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [ebp + 8]
test eax, eax
je 0x4207bb
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4207bb
lea ecx, [esi + 0x148]
push ecx
movzx ecx, word [esi + 0x12e]
push ecx
movzx ecx, word [esi + 0x12c]
push ecx
push dword [esi + 0x9c]
push dword [esi + 0x98]
call eax
mov ecx, dword [esi + 0x130]
mov eax, dword [esi + 0x148]
and ecx, 0xfffffffd
mov dword [esi + 0x130], ecx
cmp eax, 0x62
ja 0x420d86
je 0x420d6b
dec eax
cmp eax, 0x60
ja case.default.0x4212bc
jmp dword [eax*4 + 0x421420]
or ecx, 0x80000
or dword [esi + 0x134], 0x1000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x10000000
or dword [esi + 0x134], 0x8800
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x10000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x1800000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x1000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x2800000
or dword [esi + 0x134], 0x8000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x2000000
jmp 0x42085f
or ecx, 0x8800000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x8000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x134], 0x4000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800002
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800002
jmp 0x4208a1
or ecx, 0x400000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0xc00000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x24000020
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20000020
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x4000020
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x4000020
jmp 0x4208a1
or ecx, 0x24000002
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20000002
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x4000002
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
mov dword [esi + 0xa8], 5
or ecx, 2
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x24000000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x20
jmp case.default.0x4212bc
or ecx, 0x20000000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x4000000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x4000000
or dword [esi + 0x134], 0x4020
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x400
jmp case.default.0x4212bc
or ecx, 0x20000080
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x10000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x13c], 0x80
jmp case.default.0x4212bc
or ecx, 0x20000000
mov dword [esi + 0x130], ecx
or dword [esi + 0x13c], 0x100
jmp case.default.0x4212bc
or ecx, 0x40000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 1
jmp case.default.0x4212bc
or ecx, 0x4000000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 2
jmp case.default.0x4212bc
or ecx, 1
or dword [esi + 0x134], 0x8004
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20000001
jmp 0x420aa0
or ecx, 0x20080002
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80002
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 8
or ecx, 0x80000
or ecx, 0x20000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80000
or dword [esi + 0x134], 8
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20080000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20080000
jmp 0x4209d6
or ecx, 0x80000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x20080000
or dword [esi + 0x134], 0x10
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80000
or dword [esi + 0x134], 0x10
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80000
or dword [esi + 0x134], 0x4010
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x1000000
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x2000000
or dword [esi + 0x134], 0x8040
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 0xc0
jmp case.default.0x4212bc
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x80
jmp case.default.0x4212bc
or ecx, 0x4000001
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 1
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x100
jmp case.default.0x4212bc
or ecx, 0x100
or dword [esi + 0x134], 0x200
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x220
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x18200
jmp case.default.0x4212bc
or ecx, 0x20000100
jmp 0x420c41
or ecx, 0x10000
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x810000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x400000
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x2000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x2000
mov dword [esi + 0xa8], 9
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x20000
jmp case.default.0x4212bc
or ecx, 0x100
or dword [esi + 0x134], 0x40000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x100
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x100
or dword [esi + 0x134], 0x2000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
mov dword [esi + 0xa8], 9
or dword [esi + 0x134], 0x4000000
jmp case.default.0x4212bc
or ecx, 0x100
jmp 0x420bf8
or ecx, 0x800000
or dword [esi + 0x134], 0x4000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
cmp eax, 0x95
ja 0x421028
je 0x421019
sub eax, 0x63
cmp eax, 0x31
ja case.default.0x4212bc
jmp dword [eax*4 + 0x4215a4]
or dword [esi + 0x134], 0x4080000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x4100000
jmp case.default.0x4212bc
or ecx, 0x4000
jmp 0x420bf8
or dword [esi + 0x134], 0x14000000
jmp case.default.0x4212bc
or ecx, 0x100
or dword [esi + 0x134], 0x2004000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x100
or dword [esi + 0x134], 0x2004040
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x100
jmp 0x4208a1
or ecx, 0x100
or dword [esi + 0x134], 0x4040
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x80000
or dword [esi + 0x138], 1
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x800000
jmp case.default.0x4212bc
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x8000080
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x900000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x880000
jmp case.default.0x4212bc
or dword [esi + 0x138], 8
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x2000000
or dword [esi + 0x138], 0x10
jmp case.default.0x4212bc
or dword [esi + 0x138], 4
jmp case.default.0x4212bc
or dword [esi + 0x138], 2
jmp case.default.0x4212bc
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x1000000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x20
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x134], 0x40000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800002
jmp 0x420f0e
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x40000080
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x134], 0x40004000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800002
jmp 0x420f49
or ecx, 2
or dword [esi + 0x134], 0x10000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x8000000
mov dword [esi + 0x130], ecx
or dword [esi + 0x138], 0x40
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x100080
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x80080
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x138], 0x80
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800002
jmp 0x420fb7
or ecx, 0x20
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x80000000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x80000020
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x20000000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x800
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x100
jmp case.default.0x4212bc
cmp eax, 0xbf
ja 0x4211c9
je 0x4211a7
sub eax, 0x9f
cmp eax, 0x1e
ja case.default.0x4212bc
jmp dword [eax*4 + 0x42166c]
or ecx, 0x20000020
jmp 0x4208a1
or ecx, 0x20000000
jmp 0x4209d6
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x138], 0x200
jmp case.default.0x4212bc
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x134], 0x1000080
jmp case.default.0x4212bc
or ecx, 0x20000000
or dword [esi + 0x138], 0x400
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x80000000
or dword [esi + 0x138], 0x400
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x138], 0x1000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 0x800002
jmp 0x4210d1
or dword [esi + 0x138], 0x4000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x8000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x40000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x40
or dword [esi + 0x138], 0x2000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x80000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x40
or ecx, 0x800000
mov dword [esi + 0x130], ecx
or dword [esi + 0x138], 0x2000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x200000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x400000
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x138], 0x800000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x1000000
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x40000000
or ecx, 2
or dword [esi + 0x138], 0x800000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
cmp eax, 0xcc
ja 0x42129d
je 0x421291
sub eax, 0xc0
cmp eax, 0xb
ja case.default.0x4212bc
jmp dword [eax*4 + 0x4216e8]
or dword [esi + 0x138], 0x100000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x2000000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x4000000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x8000000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x10000000
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x20000000
jmp case.default.0x4212bc
or dword [esi + 0x13c], 0x10
jmp case.default.0x4212bc
or dword [esi + 0x13c], 2
jmp case.default.0x4212bc
or dword [esi + 0x13c], 4
jmp case.default.0x4212bc
or dword [esi + 0x13c], 8
or ecx, 0x800000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x13c], 8
jmp case.default.0x4212bc
or dword [esi + 0x13c], 0x40
jmp case.default.0x4212bc
cmp eax, 0xd2
ja 0x421357
je 0x42134e
sub eax, 0xcd
cmp eax, 4
ja case.default.0x4212bc
jmp dword [eax*4 + 0x421718]
or dword [esi + 0x134], 0x40000000
or ecx, 2
or dword [esi + 0x138], 0x800080
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or ecx, 2
or dword [esi + 0x138], 0x800080
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x134], 0x4000
or ecx, 2
or dword [esi + 0x138], 0x800000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x400
or dword [esi + 0x13c], 0x400
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x400
or dword [esi + 0x13c], 0x800
jmp case.default.0x4212bc
or dword [esi + 0x13c], 0x20
jmp case.default.0x4212bc
cmp eax, 0x198
ja 0x4213b8
je 0x421399
sub eax, 0x196
je 0x421381
sub eax, 1
jne case.default.0x4212bc
or ecx, 0x20
or dword [esi + 0x138], 0x80000400
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x40000400
or ecx, 0x20000000
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
or dword [esi + 0x138], 0x400
or ecx, 0x20000020
or dword [esi + 0x13c], 1
mov dword [esi + 0x130], ecx
jmp case.default.0x4212bc
cmp eax, 0xabcdabcd
jne case.default.0x4212bc
or dword [esi + 0x13c], 0x200
cmp dword [esi + 0xa4], 4
jne 0x42141b
cmp dword [esi + 0x98], 5
jne 0x42141b
cmp dword [esi + 0x9c], 0
jne 0x4213ed
cmp dword [esi + 0x140], 1
je 0x421411
cmp dword [esi + 0x98], 5
jne 0x42141b
cmp dword [esi + 0x9c], 0
je 0x42141b
cmp dword [esi + 0x140], 1
jne 0x42141b
test byte [esi + 0x130], 0x40
jne 0x42141b
or dword [esi + 0x134], 0x80
pop esi
pop ebp
ret 4