Function at 0x41fee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x5d7008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x140
push 0
push esi
mov dword [ebp - 0x1bc], ecx
call fcn.0053f2b0
push 0x98
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.0053f2b0
push 0x90
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1b4], 0x9c
push 0
push eax
call fcn.0053f2b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x24
mov dword [ebp - 0x118], 0x94
push str.KERNEL32.DLL
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4200f0
push 0x5b99b4
push eax
call edi
test eax, eax
je 0x4200f0
lea ecx, [ebp - 0x1b4]
push ecx
call eax
test eax, eax
je 0x4200f0
mov ebx, dword [ebp - 0x11c]
mov ecx, ebx
and ecx, 1
mov al, bl
mov edx, ecx
or edx, 2
and al, 2
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 0x80
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and eax, 0x200
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and eax, 0x400
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x100
and al, 0x40
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and eax, 0x100
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000
and eax, 0x4000
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80000
and eax, 0x2000
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x100000
and eax, 0x1000
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x200000
and al, 4
cmove edx, ecx
test ebx, 0x8000
je 0x420049
or edx, 0x10000000
movzx eax, byte [ebp - 0x11a]
xor ecx, ecx
mov dword [esi + 0x130], edx
sub eax, 1
je 0x420073
sub eax, 1
je 0x42006c
sub eax, 1
jne 0x420078
lea ecx, [eax + 2]
jmp 0x420078
mov ecx, 3
jmp 0x420078
mov ecx, 1
push esi
push 1
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x13c], ecx
push dword [ebp - 0x11e]
mov ecx, dword [ebp - 0x1bc]
push dword [ebp - 0x120]
push eax
push dword [ebp - 0x1a8]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.00420ef0
cmp dword [esi + 0x13c], 1
je 0x4202df
test byte [ebp - 0x11c], 0xa2
jne 0x4202df
or dword [esi + 0x134], 0x20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret 4
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x4201f7
push 0x5b99b4
push eax
call edi
test eax, eax
je 0x420116
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x420118
xor eax, eax
test eax, eax
je 0x4201f7
mov ecx, dword [ebp - 0x108]
xor edi, edi
cmp ecx, 2
jne 0x420181
lea ecx, [ebp - 0x104]
call fcn.00421a10
movzx edi, ax
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x110]
xor eax, eax
push esi
push 0
push dword [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x104]
push eax
push ebx
push edx
push ecx
mov ecx, dword [ebp - 0x1bc]
call fcn.00420ef0
cmp dword [ebp - 0x108], 2
jne 0x4202df
jmp 0x4202ba
cmp ecx, 1
jne 0x42013b
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
cmp ecx, 4
jne 0x4201ab
lea eax, [ebx - 0x3b7]
cmp eax, 0x81
ja 0x4201ab
mov edi, 1
jmp 0x420147
mov edx, dword [ebp - 0x110]
push ebx
call fcn.004217d0
add esp, 4
test eax, eax
je 0x4201c5
mov edi, 2
jmp 0x42014d
push ebx
call fcn.00421800
add esp, 4
test eax, eax
je 0x4201df
mov edi, 2
lea eax, [edi + 3]
jmp 0x42014f
push ebx
call fcn.00421830
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
jmp 0x42014d
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x4202f7
push 0x5b99a8
push eax
call edi
test eax, eax
je 0x4202f7
call eax
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], edi
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420295
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420289
lea eax, [ebp - 0x84]
push eax
call fcn.00547d9c
add esp, 4
mov edi, eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1bc]
push esi
push 0
push 2
push 0
push 0
push 0x584fd8
push edi
movzx eax, bx
shr eax, 8
push eax
movzx eax, bl
push eax
call fcn.00420ef0
push esi
call fcn.00420310
cmp dword [esi + 0x13c], 1
je 0x4202d9
test byte [ebp - 0x11c], 0xa2
jne 0x4202d9
or dword [esi + 0x134], 0x20
push esi
call fcn.00420460
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d630
mov esp, ebp
pop ebp
ret 4