Function at 0x41fa00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x140
push 0
push esi
mov dword [ebp - 0x1bc], ecx
call fcn.0051b450
push 0x98
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.0051b450
push 0x90
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1b4], 0x9c
push 0
push eax
call fcn.0051b450
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x24
mov dword [ebp - 0x118], 0x94
push str.KERNEL32.DLL
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fc10
push 0x597c20
push eax
call edi
test eax, eax
je 0x41fc10
lea ecx, [ebp - 0x1b4]
push ecx
call eax
test eax, eax
je 0x41fc10
mov ebx, dword [ebp - 0x11c]
mov ecx, ebx
and ecx, 1
mov al, bl
mov edx, ecx
or edx, 2
and al, 2
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 0x80
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and eax, 0x200
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and eax, 0x400
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x100
and al, 0x40
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and eax, 0x100
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000
and eax, 0x4000
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80000
and eax, 0x2000
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x100000
and eax, 0x1000
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x200000
and al, 4
cmove edx, ecx
test ebx, 0x8000
je 0x41fb69
or edx, 0x10000000
movzx eax, byte [ebp - 0x11a]
xor ecx, ecx
mov dword [esi + 0x130], edx
sub eax, 1
je 0x41fb93
sub eax, 1
je 0x41fb8c
sub eax, 1
jne 0x41fb98
lea ecx, [eax + 2]
jmp 0x41fb98
mov ecx, 3
jmp 0x41fb98
mov ecx, 1
push esi
push 1
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x13c], ecx
push dword [ebp - 0x11e]
mov ecx, dword [ebp - 0x1bc]
push dword [ebp - 0x120]
push eax
push dword [ebp - 0x1a8]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.00420a10
cmp dword [esi + 0x13c], 1
je 0x41fdff
test byte [ebp - 0x11c], 0xa2
jne 0x41fdff
or dword [esi + 0x134], 0x20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret 4
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fd17
push 0x597c20
push eax
call edi
test eax, eax
je 0x41fc36
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x41fc38
xor eax, eax
test eax, eax
je 0x41fd17
mov ecx, dword [ebp - 0x108]
xor edi, edi
cmp ecx, 2
jne 0x41fca1
lea ecx, [ebp - 0x104]
call fcn.00421530
movzx edi, ax
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x110]
xor eax, eax
push esi
push 0
push dword [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x104]
push eax
push ebx
push edx
push ecx
mov ecx, dword [ebp - 0x1bc]
call fcn.00420a10
cmp dword [ebp - 0x108], 2
jne 0x41fdff
jmp 0x41fdda
cmp ecx, 1
jne 0x41fc5b
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
cmp ecx, 4
jne 0x41fccb
lea eax, [ebx - 0x3b7]
cmp eax, 0x81
ja 0x41fccb
mov edi, 1
jmp 0x41fc67
mov edx, dword [ebp - 0x110]
push ebx
call fcn.004212f0
add esp, 4
test eax, eax
je 0x41fce5
mov edi, 2
jmp 0x41fc6d
push ebx
call fcn.00421320
add esp, 4
test eax, eax
je 0x41fcff
mov edi, 2
lea eax, [edi + 3]
jmp 0x41fc6f
push ebx
call fcn.00421350
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
jmp 0x41fc6d
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fe17
push 0x597c14
push eax
call edi
test eax, eax
je 0x41fe17
call eax
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], edi
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fdb5
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fda9
lea eax, [ebp - 0x84]
push eax
call fcn.00527749
add esp, 4
mov edi, eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1bc]
push esi
push 0
push 2
push 0
push 0
push 0x569fe8
push edi
movzx eax, bx
shr eax, 8
push eax
movzx eax, bl
push eax
call fcn.00420a10
push esi
call fcn.0041fe30
cmp dword [esi + 0x13c], 1
je 0x41fdf9
test byte [ebp - 0x11c], 0xa2
jne 0x41fdf9
or dword [esi + 0x134], 0x20
push esi
call fcn.0041ff80
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00519459
mov esp, ebp
pop ebp
ret 4