Function at 0x440530
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0xc20], eax
push esi
push edi
xor esi, esi
push 0x7fe
lea eax, [esp + 0x42e]
push esi
push eax
mov edi, ecx
mov word [esp + 0x434], si
call sub.ntdll.dll_memset
push 0xfe
lea ecx, [esp + 0x13a]
push esi
push ecx
mov word [esp + 0x140], si
call sub.ntdll.dll_memset
add esp, 0x18
xor eax, eax
jmp 0x440590
movzx ecx, word [eax + 0x4ddc08]
mov word [esp + eax + 0x128], cx
add eax, 2
cmp cx, si
jne 0x440590
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesdmioBoot_InfoPrimary_Disk_Group]
mov word [esp + eax + 0x428], cx
add eax, 2
cmp cx, si
jne 0x4405b0
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 6
jb 0x440627
xor eax, eax
jmp 0x4405f0
movzx ecx, word [eax + str.PrimaryPackId]
mov word [esp + eax + 0x128], cx
add eax, 2
cmp cx, si
jne 0x4405f0
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServices_volmgrx]
mov word [esp + eax + 0x428], cx
add eax, 2
cmp cx, si
jne 0x440610
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x42c]
push ecx
push 0x80000002
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4406be
mov eax, 1
test byte [0x4f1904], al
jne 0x44067b
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x185
mov ecx, str..disk.cpp
add esi, 8
call fcn.0043fa10
mov edx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKey_on_GetSysDgGuid.
push 0x4f18dc
call edx
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc20]
xor ecx, esp
call fcn.00462b77
add esp, 0xc24
ret
push 0x1fe
lea eax, [esp + 0x22e]
push esi
push eax
mov word [esp + 0x234], si
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x22c]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x138]
push ecx
push edx
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44075f
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x190
mov ecx, str..disk.cpp
add esi, 8
call fcn.0043fa10
push eax
mov eax, dword [esi]
push str._s:_Failed_to_RegQueryValueEx_on_GetSysDgGuid.
push edi
call eax
mov ecx, dword [esp + 0x18]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc20]
xor ecx, esp
call fcn.00462b77
add esp, 0xc24
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x440774
sub eax, edx
sar eax, 1
cmp eax, 0x100
jbe 0x4407cc
call fcn.0041e870
mov edi, eax
mov esi, dword [edi]
push 0x198
mov ecx, str..disk.cpp
add esi, 8
call fcn.0043fa10
push eax
mov eax, dword [esi]
push str._s:_Buffer_insufficient_
push edi
call eax
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc20]
xor ecx, esp
call fcn.00462b77
add esp, 0xc24
ret
lea ecx, [esp + 0x228]
push ecx
push 0x100
push edi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ecx, dword [esp + 0xc34]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00462b77
add esp, 0xc24
ret