Function at 0x408030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x5f3418]
xor eax, ebp
mov dword [esp + 0x40], eax
xor edi, edi
mov dword [esi], edi
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
movaps xmm0, xmmword [0x5dee50]
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0x50], edi
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
lea eax, [esp + 0x10]
mov dword [eax], edi
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40838d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov ecx, 4
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x38]
mov dword [edx], ecx
lea ecx, [esp + 0x34]
mov dword [ecx], ebx
push edx
push ecx
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x5def20
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408111
mov eax, dword [esp + 0x10]
add eax, 0xfffffffd
xor ebx, ebx
cmp dword [esp + 0x38], 4
mov ecx, 0
jne 0x40810b
mov ecx, dword [esp + 0x34]
cmp eax, 2
cmovb ebx, ecx
lea edi, [esp + 0x28]
lea ecx, [esp + 0x1c]
push edi
push str.DisplayVersion
call fcn.00408690
mov edx, edi
movzx eax, byte [edi + 0xb]
mov ecx, eax
and ecx, 0x7f
test al, al
mov edi, dword [edi + 4]
cmovs ecx, edi
test ecx, ecx
je 0x40843f
mov ecx, eax
and cl, 0x7f
test al, al
lea edx, [esp + 0x28]
mov eax, dword [edx]
cmovns eax, edx
movzx ecx, cl
cmovs ecx, edi
push ecx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00501f70
add esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x17]
mov dword [esp + 0x3b], eax
mov al, byte [esp + 0x1b]
mov byte [esp + 7], al
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40819d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x24], 0
test edi, edi
jne 0x408396
cmp byte [esp + 0x33], 0
js 0x4083b1
mov dword [esi + 0x10], ebx
cmp byte [esi + 0x2b], 0
js 0x4083c2
mov eax, dword [esp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3b]
mov dword [esi + 0x24], eax
mov dword [esi + 0x27], ecx
mov al, byte [esp + 7]
mov byte [esi + 0x2b], al
mov ecx, dword [esi + 4]
mov eax, 0x15
cmp ecx, 0xa
jne 0x4083d4
mov ecx, dword [esi + 0xc]
cmp ecx, 0x55ef
ja 0x40821e
cmp ecx, 0x4f7b
ja 0x40845b
mov eax, 0x13
cmp ecx, 0x4a63
jbe 0x408465
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
mov eax, dword [0x6bfb18]
mov ecx, dword [0x5f75b4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x408284
push 0x6bfb18
call fcn.00510c6d
add esp, 4
cmp dword [0x6bfb18], 0xffffffff
jne 0x408284
push 0x5d84dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6bfb14], eax
push 0x6bfb18
call fcn.00510d9d
add esp, 4
mov ecx, dword [0x6bfb14]
test ecx, ecx
je 0x408407
xor eax, eax
mov word [esp + 0x28], ax
lea ebx, [esp + 0x1c]
mov word [ebx], ax
call dword [section..00cfg]
push ebx
lea eax, [esp + 0x2c]
push eax
push edi
call ecx
test eax, eax
je 0x4082ec
movzx eax, word [esp + 0x28]
cmp eax, 0x14c
jne 0x408510
xor eax, eax
inc eax
mov dword [esi + 0x40], eax
movzx eax, word [esp + 0x1c]
xor ecx, ecx
cmp eax, 0x8664
sete cl
mov edx, 2
sub edx, ecx
xor ecx, ecx
cmp eax, 0xaa64
cmovne ecx, edx
mov dword [esi + 0x44], ecx
mov edi, dword [ebp + 8]
movzx eax, word [edi + 0x114]
mov dword [esi + 0x18], eax
movzx eax, word [edi + 0x116]
mov dword [esi + 0x1c], eax
add edi, 0x14
je 0x40843c
lea ebx, [esi + 0x2c]
push edi
call fcn.00510eb5
add esp, 4
push eax
push edi
lea eax, [esp + 0x30]
push eax
call fcn.00501f70
add esp, 0xc
cmp byte [esi + 0x37], 0
js 0x40853e
mov eax, dword [esp + 0x30]
mov dword [ebx + 8], eax
movsd xmm0, qword [esp + 0x28]
movsd qword [ebx], xmm0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x38], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, 0xa
jne 0x40854d
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 0x79]
cmp ecx, 2
jae 0x40858b
mov dword [esi + 0x14], 4
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.00512ee3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor eax, eax
xor ebx, ebx
jmp 0x40813f
mov eax, dword [edi]
mov ecx, dword [eax]
mov dword [esp + 8], ecx
call dword [section..00cfg]
mov ecx, edi
push 1
call dword [esp + 0xc]
jmp 0x4081b1
push dword [esp + 0x28]
call fcn.0050fc7c
add esp, 4
jmp 0x4081bc
lea eax, [esi + 0x20]
push dword [eax]
call fcn.0050fc7c
add esp, 4
jmp 0x4081c9
cmp ecx, 0xb
je 0x40821e
mov eax, 0x16
cmp ecx, 6
ja 0x40821e
mov edx, dword [esi + 8]
jne 0x408642
lea ecx, [edx + 3]
cmp edx, 3
mov eax, 6
cmovb eax, ecx
jmp 0x40821e
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4082ec
cmp dword [esp + 0x28], 0
je 0x408621
xor eax, eax
inc eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
jmp 0x4082ec
int3
lea ecx, [esp + 0x1c]
push edx
push str.ReleaseId
call fcn.00408690
mov al, byte [esp + 0x33]
mov edi, dword [esp + 0x2c]
jmp 0x40813f
mov eax, 0x14
jmp 0x40821e
mov eax, 0x12
je 0x40821e
mov eax, 0x11
cmp ecx, 0x4a61
ja 0x40821e
mov eax, 0x10
je 0x40821e
mov eax, 0xf
cmp ecx, 0x47ba
ja 0x40821e
mov eax, 0xe
je 0x40821e
mov eax, 0xd
cmp ecx, 0x4562
ja 0x40821e
mov eax, 0xc
cmp ecx, 0x42ed
ja 0x40821e
mov eax, 0xb
cmp ecx, 0x3faa
ja 0x40821e
mov eax, 0xa
cmp ecx, 0x3ad6
ja 0x40821e
mov eax, 9
cmp ecx, 0x3838
ja 0x40821e
cmp ecx, 0x295a
mov eax, 7
sbb eax, 0xffffffff
jmp 0x40821e
test eax, eax
je 0x4082c6
add eax, 0xfffffe40
cmp eax, 4
ja 0x4085d9
mov ecx, 0x15
bt ecx, eax
jae 0x4085d9
mov eax, 2
jmp 0x4082c6
push dword [ebx]
call fcn.0050fc7c
add esp, 4
jmp 0x408331
cmp eax, 5
jne 0x4085a6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp eax, 1
je 0x40862d
cmp eax, 2
mov eax, dword [ebp + 8]
jne 0x4085af
cmp byte [eax + 0x11a], 1
jne 0x408578
cmp word [ecx], 9
je 0x40859a
mov eax, dword [ebp + 8]
cmp word [eax + 0x118], 0
jns 0x408615
jmp 0x4085af
cmp eax, 0x45
jg 0x4085bb
cmp eax, 0x1b
jbe 0x40860b
cmp eax, 0x30
jne 0x4085af
mov dword [esi + 0x14], 1
jmp 0x408376
cmp eax, 6
je 0x408360
mov dword [esi + 0x14], 0
jmp 0x408376
lea ecx, [eax - 0x46]
cmp ecx, 0xe
ja 0x4085e3
mov edx, 0x4005
bt edx, ecx
jae 0x4085e3
mov dword [esi + 0x14], 3
jmp 0x408376
mov eax, 3
jmp 0x4082c6
lea ecx, [eax - 0x7d]
cmp ecx, 5
ja 0x4085f5
mov edx, 0x33
bt edx, ecx
jb 0x4085cd
add eax, 0xffffff5c
cmp eax, 2
jae 0x4085af
mov dword [esi + 0x14], 5
jmp 0x408376
mov ecx, 0x206f780
bt ecx, eax
jae 0x408669
mov dword [esi + 0x14], 2
jmp 0x408376
mov dword [esi + 0x40], 0
jmp 0x4082ec
mov eax, dword [ebp + 8]
test byte [eax + 0x119], 2
je 0x40859a
jmp 0x4085af
xor eax, eax
test edx, edx
je 0x40821e
cmp ecx, 5
jne 0x40821e
xor ecx, ecx
cmp edx, 1
sete cl
mov eax, 2
sub eax, ecx
jmp 0x40821e
mov ecx, 0x8010050
bt ecx, eax
jb 0x4085cd
cmp eax, 1
jne 0x408595
jmp 0x40859a