Function at 0x4378d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5fc
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x4c], 0
mov edx, esp
lea esi, [ebp - 0x44c]
mov dword [edx], esi
mov dword [edx + 8], 0x400
mov dword [edx + 4], 0
mov dword [ebp - 0x588], ecx
mov dword [ebp - 0x58c], eax
call fcn.00540e93
mov dword [ebp - 0x450], 0x400
mov ecx, esp
lea edx, [ebp - 0x4d0]
mov dword [ecx], edx
mov dword [ecx + 8], 0x80
mov dword [ecx + 4], 0
mov dword [ebp - 0x590], eax
call fcn.00540e93
mov ecx, esp
lea edx, [ebp - 0x4ec]
mov dword [ecx], edx
mov dword [ebp - 0x594], eax
call fcn.0040c0d4
mov dword [ebp - 0x504], str.SOFTWAREMicrosoftWindows_NTCurrentVersionProductName
mov dword [ebp - 0x500], 0x2c
mov eax, esp
lea ecx, [ebp - 0x508]
mov dword [eax], ecx
mov dword [ebp - 0x598], ecx
call fcn.004032f8
mov dword [ebp - 0x28], 0x550e90
mov dword [ebp - 0x24], 0x558e24
mov eax, ebp
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x437e0c
mov dword [ebp - 0x3c], 1
lea eax, [ebp - 0x44]
call fcn.00551af9
mov eax, dword [ebp - 0x504]
mov ecx, dword [ebp - 0x500]
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x598]
mov dword [edx + 0xc], eax
lea ecx, [ebp - 0x4fc]
mov dword [edx], ecx
call fcn.00403314
jmp 0x4379e5
mov dword [ebp - 0x3c], 2
mov eax, esp
lea ecx, [ebp - 0x52c]
mov dword [eax], ecx
call fcn.00410fac
jmp 0x4379fd
mov dword [ebp - 0x3c], 3
mov eax, esp
lea ecx, [ebp - 0x4fc]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x52c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x548]
mov dword [eax], ecx
call fcn.0045dbec
jmp 0x437a27
mov eax, esp
lea ecx, [ebp - 0x548]
mov dword [eax], ecx
call fcn.004057a0
mov dword [ebp - 0x3c], 4
mov ecx, esp
lea edx, [ebp - 0x4c]
mov dword [ecx + 8], edx
mov dword [ecx + 4], eax
mov dword [ecx], SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
mov dword [ebp - 0x59c], eax
jmp 0x437a5e
lea eax, [ebp - 0x548]
mov dword [esp], eax
call fcn.00405890
mov eax, dword [ebp - 0x59c]
cmp eax, 0
jne 0x437d5a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 5
mov ecx, esp
lea edx, [ebp - 0x450]
mov dword [ecx + 0x14], edx
lea edx, [ebp - 0x44c]
mov dword [ecx + 0x10], edx
lea edx, [ebp - 0x48]
mov dword [ecx + 0xc], edx
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0x558c11
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0x5a0], eax
jmp 0x437abf
mov eax, dword [ebp - 0x5a0]
cmp eax, 0
jne 0x437d58
mov dword [ebp - 0x3c], 6
mov eax, esp
lea ecx, [ebp - 0x44c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x4ec]
mov dword [eax], ecx
call fcn.00437e6c
mov dword [ebp - 0x5a4], eax
jmp 0x437af5
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 7
mov ecx, esp
lea edx, [ebp - 0x450]
mov dword [ecx + 0x14], edx
lea edx, [ebp - 0x4d0]
mov dword [ecx + 0x10], edx
lea edx, [ebp - 0x48]
mov dword [ecx + 0xc], edx
mov dword [ecx], eax
mov dword [ecx + 8], 0
mov dword [ecx + 4], str.CurrentBuild
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0x5a8], eax
jmp 0x437b39
mov eax, dword [ebp - 0x5a8]
cmp eax, 0
jne 0x437ca0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 8
mov ecx, esp
mov dword [ecx], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0x5ac], eax
jmp 0x437b66
mov dword [ebp - 0x3c], 9
mov eax, esp
lea ecx, [ebp - 0x4ec]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x564]
mov dword [eax], ecx
mov dword [eax + 8], 0x558c2a
call fcn.00437ea0
jmp 0x437b8e
mov dword [ebp - 0x3c], 0xa
mov eax, esp
lea ecx, [ebp - 0x4d0]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x564]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x58c]
mov dword [eax], ecx
call fcn.004136c4
jmp 0x437bb8
lea eax, [ebp - 0x564]
mov dword [esp], eax
call fcn.00405890
mov dword [ebp - 0x568], 1
jmp 0x437d83
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xb
mov ecx, esp
mov dword [ecx], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0x5d8], eax
jmp 0x437cbe
mov dword [ebp - 0x3c], 0xc
mov eax, esp
lea ecx, [ebp - 0x4ec]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x584]
mov dword [eax], ecx
mov dword [eax + 8], 0x558c2a
call fcn.00437ea0
jmp 0x437ce6
mov dword [ebp - 0x3c], 0xd
mov eax, esp
lea ecx, [ebp - 0x4d0]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x584]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x58c]
mov dword [eax], ecx
call fcn.004136c4
jmp 0x437d10
lea eax, [ebp - 0x584]
mov dword [esp], eax
call fcn.00405890
mov dword [ebp - 0x568], 1
jmp 0x437d83
jmp 0x437d5a
mov dword [ebp - 0x3c], 0xe
mov eax, esp
mov ecx, dword [ebp - 0x58c]
mov dword [eax], ecx
mov dword [eax + 4], 0x558bca
call fcn.004043c0
jmp 0x437d79
mov dword [ebp - 0x568], 1
lea eax, [ebp - 0x52c]
mov dword [esp], eax
call fcn.00414b64
lea eax, [ebp - 0x4fc]
mov dword [esp], eax
call fcn.00403a50
lea eax, [ebp - 0x4ec]
mov dword [esp], eax
call fcn.00405890
jmp 0x437ddb
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.00551b1a
mov eax, dword [ebp - 0x588]
add esp, 0x5fc
pop esi
pop edi
pop ebx
pop ebp
ret