Function at 0x41f6c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x5d60c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x160
push 0
push esi
mov dword [ebp - 0x1bc], ecx
call fcn.0052d9b0
push 0x98
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.0052d9b0
push 0x90
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1b4], 0x9c
push 0
push eax
call fcn.0052d9b0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x24
mov dword [ebp - 0x118], 0x94
push str.KERNEL32.DLL
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41f904
push 0x5bf168
push eax
call edi
test eax, eax
je 0x41f904
lea ecx, [ebp - 0x1b4]
push ecx
call eax
test eax, eax
je 0x41f904
mov eax, dword [ebp - 0x11c]
test al, 1
je 0x41f776
or dword [esi + 0x130], 1
test al, 2
je 0x41f781
or dword [esi + 0x130], 2
test al, 0x10
je 0x41f78c
or dword [esi + 0x130], 0x10
test al, al
jns 0x41f797
or dword [esi + 0x130], 0x20
test eax, 0x200
je 0x41f7a5
or dword [esi + 0x130], 0x40
test eax, 0x400
je 0x41f7b6
or dword [esi + 0x130], 0x80
test al, 0x40
je 0x41f7c4
or dword [esi + 0x130], 0x100
test eax, 0x100
je 0x41f7d5
or dword [esi + 0x130], 0x200
test eax, 0x4000
je 0x41f7e6
or dword [esi + 0x130], 0x40000
test eax, 0x2000
je 0x41f7f7
or dword [esi + 0x130], 0x80000
test eax, 0x1000
je 0x41f808
or dword [esi + 0x130], 0x100000
test al, 4
je 0x41f816
or dword [esi + 0x130], 0x200000
test ax, ax
jns 0x41f825
or dword [esi + 0x130], 0x10000000
test al, 8
je 0x41f833
or dword [esi + 0x138], 0x10000
test al, 0x20
je 0x41f848
or dword [esi + 0x130], 1
or dword [esi + 0x138], 0x20000
test eax, 0x800
je 0x41f863
or dword [esi + 0x130], 0x100
or dword [esi + 0x138], 0x20000
movzx eax, byte [ebp - 0x11a]
xor ecx, ecx
sub eax, 1
je 0x41f887
sub eax, 1
je 0x41f880
sub eax, 1
jne 0x41f88c
lea ecx, [eax + 2]
jmp 0x41f88c
mov ecx, 3
jmp 0x41f88c
mov ecx, 1
push esi
push 1
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x140], ecx
push dword [ebp - 0x11e]
mov ecx, dword [ebp - 0x1bc]
push dword [ebp - 0x120]
push eax
push dword [ebp - 0x1a8]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.00420c80
cmp dword [esi + 0x140], 1
je 0x41fb17
test byte [ebp - 0x11c], 0xa2
jne 0x41fb17
or dword [esi + 0x134], 0x20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052b789
mov esp, ebp
pop ebp
ret 4
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fa0b
push 0x5bf168
push eax
call edi
test eax, eax
je 0x41f92a
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x41f92c
xor eax, eax
test eax, eax
je 0x41fa0b
mov ecx, dword [ebp - 0x108]
xor edi, edi
cmp ecx, 2
jne 0x41f995
lea ecx, [ebp - 0x104]
call fcn.00421b00
movzx edi, ax
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x110]
xor eax, eax
push esi
push 0
push dword [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x104]
push eax
push ebx
push edx
push ecx
mov ecx, dword [ebp - 0x1bc]
call fcn.00420c80
cmp dword [ebp - 0x108], 2
jne 0x41fb17
jmp 0x41faf2
cmp ecx, 1
jne 0x41f94f
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
cmp ecx, 4
jne 0x41f9bf
lea eax, [ebx - 0x3b7]
cmp eax, 0x81
ja 0x41f9bf
mov edi, 1
jmp 0x41f95b
mov edx, dword [ebp - 0x110]
push ebx
call fcn.00421740
add esp, 4
test eax, eax
je 0x41f9d9
mov edi, 2
jmp 0x41f961
push ebx
call fcn.00421770
add esp, 4
test eax, eax
je 0x41f9f3
mov edi, 2
lea eax, [edi + 3]
jmp 0x41f963
push ebx
call fcn.004217a0
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
jmp 0x41f961
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fb2f
push 0x5bf15c
push eax
call edi
test eax, eax
je 0x41fb2f
call eax
mov ebx, eax
mov dword [ebp - 0x1b8], 0
lea eax, [ebp - 0x1b8]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fb2f
push 0x80
xor edi, edi
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.0052d9b0
add esp, 0xc
mov dword [ebp - 0x1c4], edi
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fac1
lea eax, [ebp - 0x84]
push eax
call fcn.00539cb9
add esp, 4
mov edi, eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1bc]
push esi
push 0
push 2
push 0
push 0
push 0x5b9638
push edi
movzx eax, bx
shr eax, 8
push eax
movzx eax, bl
push eax
call fcn.00420c80
push esi
call fcn.0041fb50
cmp dword [esi + 0x140], 1
je 0x41fb11
test byte [ebp - 0x11c], 0xa2
jne 0x41fb11
or dword [esi + 0x134], 0x20
push esi
call fcn.0041fca0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052b789
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052b789
mov esp, ebp
pop ebp
ret 4