Function at 0x40d200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d23c
mov eax, 0x46d034
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x46d068
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 8]
add eax, 5
push eax
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
je 0x40d29f
mov eax, dword [ebp - 8]
add eax, 5
push eax
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 0x46d068
push dword [ebp - 4]
call edi
test eax, eax
je 0x40d2b3
push esi
call fcn.004533f0
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 0x46d034
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.CurrentVersion
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 8]
add eax, 5
push eax
call fcn.0045669c
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40d2fb
push esi
call fcn.004533f0
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, 0x46d034
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 5
push eax
push 0
push ebx
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0
push str.CurrentVersion
push dword [ebp - 4]
call edi
test eax, eax
jne 0x40d350
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.CurrentBuildNumber
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 8]
add eax, 5
push eax
call fcn.0045669c
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x40d374
push ebx
call fcn.004533f0
push esi
call fcn.004533f0
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, 0x46d034
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 5
push eax
push 0
push ecx
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 0
push 0
push str.CurrentBuildNumber
push dword [ebp - 4]
call edi
test eax, eax
je 0x40d3cb
push dword [ebp - 0xc]
call fcn.004533f0
push ebx
call fcn.004533f0
push esi
call fcn.004533f0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, 0x46d034
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d3e0
sub ecx, edx
mov edx, ebx
lea edi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x40d3f0
sub edx, edi
mov edi, dword [ebp - 0xc]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
mov al, byte [edi]
inc edi
test al, al
jne 0x40d402
sub edi, dword [ebp - 0x14]
lea eax, [edi + edx]
lea edi, [ecx + 0x32]
add edi, eax
push edi
call fcn.0045669c
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40d447
push dword [ebp - 0xc]
call fcn.004533f0
push ebx
call fcn.004533f0
push esi
call fcn.004533f0
add esp, 0xc
mov eax, 0x46d034
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
push eax
call fcn.0044f970
add esp, 0xc
mov dword [ebp - 0x10], 0
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x642bdc], eax
test eax, eax
je 0x40d49c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x642bdc]
test eax, eax
je 0x40d49c
cmp dword [ebp - 0x10], 0
je 0x40d49c
mov ecx, 1
jmp 0x40d49e
xor ecx, ecx
mov edi, dword [ebp - 0xc]
test ecx, ecx
push edi
push ebx
mov edx, str._s_64_bit__NT_s__Build__s_
mov eax, str._s_32_bit__NT_s__Build__s_
push esi
cmovne eax, edx
push eax
push dword [ebp - 0x14]
call fcn.00402690
push edi
call fcn.004533f0
push ebx
call fcn.004533f0
push esi
call fcn.004533f0
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret