Function at 0x41c8f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x440]
sub esp, 0x440
push 0xffffffffffffffff
push 0x445160
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4629b4]
xor eax, ebp
mov dword [ebp + 0x43c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x52
mov ecx, 0x46b8a4
call fcn.0040df90
push eax
lea ecx, [ebp + 4]
call fcn.0040aeb0
cmp dword [0x46c170], 5
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], 0
jle 0x41ca90
push 0x12
mov ecx, 0x469ae4
call fcn.0040df90
mov ecx, eax
call fcn.00409570
push str.Kernel32
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4699ac], eax
test eax, eax
je 0x41ca23
push 0
push 0
push 0
push 0x52534d42
call eax
mov edi, eax
cmp edi, 0x10
jbe 0x41c9f0
lea ebx, [edi + 2]
push ebx
call fcn.0042daff
mov esi, eax
add esp, 4
test esi, esi
je 0x41c9c1
push ebx
push 0
push esi
call fcn.0042f620
add esp, 0xc
jmp 0x41c9c3
xor esi, esi
mov eax, dword [0x4699ac]
push edi
push esi
push 0
push 0x52534d42
call eax
cmp eax, 0x10
jbe 0x41c9e7
push dword [esi + 4]
lea eax, [esi + 8]
push eax
call fcn.0040fbc0
add esp, 8
push esi
call fcn.0042db08
add esp, 4
mov eax, dword [0x4699ac]
push edi
push 0
push 0x324d5054
push 0x41435049
call eax
test eax, eax
je 0x41ca1d
push 0x53
mov ecx, 0x46b8a4
call fcn.0040df90
push eax
lea ecx, [ebp + 4]
call fcn.0040df10
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp + 0x1c]
call fcn.004050b0
push 0x13
mov ecx, 0x469ae4
mov byte [ebp - 4], 1
call fcn.0040df90
mov ecx, eax
call fcn.00409570
push str.Kernel32
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4699b0], eax
call fcn.0040f7d0
call fcn.0041f900
test eax, eax
jne 0x41cc9c
push eax
push eax
push str.00000000_0000_0000_0000_000000000000
push 0x4464a0
call dword [0x4699b0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jmp 0x41cc9f
call fcn.00414fc0
xor edi, edi
mov dword [0x46c124], 1
cmp dword [0x46c128], 1
jne 0x41cbcc
push 0x10000
call fcn.0042daff
mov esi, eax
add esp, 4
test esi, esi
je 0x41cad2
push 0x10000
push edi
push esi
call fcn.0042f620
add esp, 0xc
jmp 0x41cad4
xor esi, esi
push 1
push 0x10000
push esi
push 0xf0000
call fcn.00408220
test eax, eax
je 0x41cbcc
xor ebx, ebx
mov dword [ebp], edi
mov ecx, esi
xor edx, edx
cmp dword [ecx], 0x494d445f
jne 0x41cb05
cmp byte [ecx + 4], 0x5f
je 0x41cb15
add edx, 0x10
add ecx, 0x10
cmp edx, 0x10000
jl 0x41caf7
jmp 0x41cb5b
movzx edi, byte [ecx + 0xb]
movzx eax, byte [ecx + 0xa]
movzx ebx, byte [ecx + 7]
shl edi, 8
add edi, eax
shl ebx, 8
movzx eax, byte [ecx + 9]
shl edi, 8
add edi, eax
movzx eax, byte [ecx + 8]
shl edi, 8
add edi, eax
movzx eax, byte [ecx + 6]
push 0xf
push ecx
mov dword [ebp], edi
or ebx, eax
call fcn.0040e220
xor edi, edi
add esp, 8
test eax, eax
mov eax, 1
cmovne edi, eax
push esi
call fcn.0042db08
add esp, 4
test edi, edi
je 0x41cbcc
lea edi, [ebx + 8]
push edi
call fcn.0042daff
mov esi, eax
add esp, 4
test esi, esi
je 0x41cb88
push edi
push 0
push esi
call fcn.0042f620
add esp, 0xc
jmp 0x41cb8a
xor esi, esi
push 1
push ebx
lea edi, [esi + 8]
push edi
push dword [ebp]
call fcn.00408220
test eax, eax
je 0x41cbb9
mov byte [esi + 4], bl
shr ebx, 8
mov byte [esi + 5], bl
push dword [esi + 4]
push edi
call fcn.0040fbc0
add esp, 8
mov edi, 1
jmp 0x41cbbb
xor edi, edi
push esi
call fcn.0042db08
add esp, 4
test edi, edi
jne 0x41ca1d
push 0x200
lea eax, [ebp + 0x23c]
mov dword [ebp + 0x38], 0
push 0
push eax
call fcn.0042f620
push str.ServicesmssmbiosData
push 0x46a8fc
push 0x447380
lea eax, [ebp + 0x23c]
push 0xffffffffffffffff
push eax
call fcn.0040d4b0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp + 0x38]
add esp, 0x20
push eax
push 0x20019
push 0
lea eax, [ebp + 0x23c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x41ca23
push 0x10000
call fcn.0042daff
mov esi, eax
add esp, 4
test esi, esi
je 0x41cc52
push 0x10000
push 0
push esi
call fcn.0042f620
add esp, 0xc
jmp 0x41cc54
xor esi, esi
lea eax, [ebp + 0x34]
mov dword [ebp + 0x34], 0x10000
push eax
push esi
push 0
push 0
push str.SMBiosData
push dword [ebp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cc85
push dword [esi + 4]
lea eax, [esi + 8]
push eax
call fcn.0040fbc0
add esp, 8
push esi
call fcn.0042db08
add esp, 4
push dword [ebp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41ca23
cmp eax, 2
jne 0x41cdf4
push 0x200
lea eax, [ebp + 0x23c]
push 0
push eax
call fcn.0042f620
lea eax, [ebp + 0x23c]
mov dword [ebp + 0x38], 0x100
push 0x200
push eax
call fcn.0040c8d0
mov esi, dword [0x4699b0]
add esp, 0x14
test esi, esi
je 0x41cdbb
push 0x4c
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push dword [ebp + 0x38]
lea ecx, [ebp + 0x23c]
push ecx
push str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
push eax
call esi
test eax, eax
jne 0x41cdbb
push 0x200
push eax
mov dword [ebp], eax
lea eax, [ebp + 0x3c]
push eax
call fcn.0042f620
add esp, 0xc
mov ecx, 0x469a38
push 0x5e
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push 0x46a8fc
push 0x447380
lea eax, [ebp + 0x3c]
push 0xffffffffffffffff
push eax
call fcn.0040d4b0
add esp, 0x14
lea eax, [ebp]
push eax
push 0x20019
push 0
lea eax, [ebp + 0x3c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x41cdbb
push 0x4a
mov ecx, 0x469a38
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], 8
call fcn.0040df90
mov ecx, eax
call fcn.00409580
lea ecx, [ebp + 0x38]
push ecx
lea ecx, [ebp + 0x34]
push ecx
push 0
push 0
push eax
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41cdb2
cmp dword [ebp + 0x34], 1
jne 0x41cdb2
mov eax, 1
mov word [ebp + 0x23c], ax
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp + 0x23c], 0
lea eax, [ebp + 4]
mov ecx, 0x46b8a4
push eax
je 0x41cde1
push 0x4a
call fcn.0040df90
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404aa0
jmp 0x41ce06
push 0x4b
call fcn.0040df90
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404aa0
jmp 0x41ce06
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x24]
push str.Legacy
push eax
call fcn.0040ca90
add esp, 0xc
lea ecx, [ebp + 0x1c]
push eax
call fcn.004050f0
lea ecx, [ebp - 0x24]
call fcn.004050d0
push 0xffffffffffffffff
lea ecx, [ebp + 0x1c]
call fcn.00409580
push eax
push 0x469ed4
call fcn.0040d900
add esp, 0xc
lea ecx, [ebp + 0x1c]
call fcn.004050d0
lea ecx, [ebp + 4]
call fcn.004050d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x43c]
xor ecx, ebp
call fcn.0042d960
lea esp, [ebp + 0x440]
pop ebp
ret