Function at 0x410072
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5fd0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x14c], ebx
je 0x410240
mov eax, dword [esi + 0x9c]
sub eax, ebx
je 0x410234
dec eax
je 0x4101c9
dec eax
jne 0x410373
mov eax, dword [esi + 0x90]
sub eax, 3
je 0x4101bd
dec eax
je 0x410193
dec eax
je 0x41011b
dec eax
jne 0x410373
mov eax, dword [esi + 0x94]
sub eax, ebx
je 0x410104
dec eax
je 0x4100f3
dec eax
jne 0x410373
cmp byte [esi + 0x126], 1
sete al
add eax, 0x14
jmp 0x410113
xor eax, eax
cmp byte [esi + 0x126], 1
sete al
add eax, 0x12
jmp 0x410113
xor eax, eax
cmp byte [esi + 0x126], 1
setne al
add eax, 0x10
mov dword [esi + 4], eax
jmp 0x410373
mov eax, dword [esi + 0x94]
sub eax, ebx
je 0x410187
dec eax
je 0x41017b
dec eax
jne 0x410373
mov eax, 0x8000
cmp word [esi + 0x124], ax
jne 0x410149
mov dword [esi + 4], 0xd
jmp 0x410373
cmp byte [esi + 0x126], 1
jne 0x410168
cmp word [esi + 0x128], 9
jne 0x410168
mov dword [esi + 4], 0xc
jmp 0x410373
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
add eax, 0xe
jmp 0x410113
mov dword [esi + 4], 0xb
jmp 0x410373
mov dword [esi + 4], 0xa
jmp 0x410373
movzx eax, byte [esi + 0x126]
dec eax
je 0x4101b1
dec eax
dec eax
jne 0x410373
mov dword [esi + 4], 9
jmp 0x410373
mov dword [esi + 4], 8
jmp 0x410373
mov dword [esi + 4], 7
jmp 0x410373
cmp dword [esi + 0x90], 4
jne 0x410373
mov eax, dword [esi + 0x94]
cmp eax, ebx
je 0x41020e
cmp eax, 0xa
je 0x4101fa
cmp eax, 0x5a
jne 0x410373
mov dword [esi + 4], 6
jmp 0x410373
xor eax, eax
cmp byte [esi + 0xa0], 0x41
sete al
add eax, 4
jmp 0x410113
mov al, byte [esi + 0xa0]
cmp al, 0x42
je 0x410228
cmp al, 0x43
je 0x410228
mov dword [esi + 4], 2
jmp 0x410373
mov dword [esi + 4], 3
jmp 0x410373
mov dword [esi + 4], 1
jmp 0x410373
push edi
push 0x50
pop edi
lea eax, [ebp - 0x58]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.WSOCK32.dll_bind
mov dword [ebp - 0x5c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410372
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push str.ProductType
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410372
cmp dword [ebp - 0x5c], edi
ja 0x410372
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x54]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x4102c4
cmp dword [esi + 0x90], 4
ja 0x4102c4
mov dword [esi + 4], 8
mov dword [esi + 8], 1
lea eax, [ebp - 0x54]
push eax
push str.LANMANNT
call edi
push 2
pop ebx
test eax, eax
jne 0x410317
mov eax, dword [esi + 0x90]
cmp eax, 5
jne 0x410308
cmp dword [esi + 0x94], ebx
jne 0x4102f0
mov dword [esi + 4], 0xe
cmp eax, 5
jne 0x410308
cmp dword [esi + 0x94], 0
jne 0x410308
mov dword [esi + 4], 0xa
mov dword [esi + 8], ebx
cmp eax, 4
ja 0x410317
mov dword [esi + 4], 8
mov dword [esi + 8], ebx
lea eax, [ebp - 0x54]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x410372
mov eax, dword [esi + 0x90]
cmp eax, 5
jne 0x410344
cmp dword [esi + 0x94], ebx
jne 0x410344
push 0xe
pop ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
jmp 0x410347
push 0xe
pop ecx
cmp eax, 5
jne 0x410363
cmp dword [esi + 0x94], 0
jne 0x410363
mov dword [esi + 4], 0xa
mov dword [esi + 8], 3
cmp eax, 4
ja 0x410372
mov dword [esi + 4], 8
mov dword [esi + 8], ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047209e
leave
ret