Function at 0x429a70
Capabilities:
Check os version
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov eax, dword [0x44b008]
cmp eax, 0x44b008
mov esi, dword [ebp + 8]
lea ebx, [edi + 1]
je 0x429ab3
test byte [eax + 0x3c], bl
je 0x429ab3
cmp byte [eax + 0x39], 5
jb 0x429ab3
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push esi
push 0x446a0c
push 0x33
push ecx
push edx
call fcn.004170e0
push esi
push 0
call sub.sfc.dll_SfcIsFileProtected
test eax, eax
je 0x429af6
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429aeb
test byte [eax + 0x3c], bl
je 0x429aeb
cmp byte [eax + 0x39], 5
jb 0x429aeb
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push esi
push 0x446a0c
push 0x34
push ecx
push edx
call fcn.004170e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429b27
test byte [eax + 0x3c], bl
je 0x429b27
cmp byte [eax + 0x39], 5
jb 0x429b27
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push esi
push 0x446a0c
push 0x35
push ecx
push edx
call fcn.004170e0
mov eax, dword [0x44b008]
cmp dword [0x456b20], edi
jne 0x429b60
cmp eax, 0x44b008
je 0x429b55
test byte [eax + 0x3c], bl
je 0x429b55
cmp byte [eax + 0x39], 5
jb 0x429b55
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x36
push ecx
push edx
call fcn.004170b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x429bb2
mov ecx, dword [0x44b008]
cmp ecx, 0x44b008
je 0x429fcf
test byte [ecx + 0x3c], bl
je 0x429fcf
cmp byte [ecx + 0x39], 5
jb 0x429fcf
mov edx, dword [ecx + 0x34]
push eax
mov eax, dword [ecx + 0x30]
push 0x446a0c
push 0x37
push edx
push eax
jmp 0x429fca
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and eax, 0xff
cmp eax, 6
jb 0x429c6b
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp + 8]
push eax
push 0
push str.LoadAppInit_DLLs
push ecx
mov dword [ebp - 0x10], 4
call esi
test eax, eax
je 0x429c2a
mov ecx, dword [0x44b008]
cmp ecx, 0x44b008
je 0x429fcf
test byte [ecx + 0x3c], bl
je 0x429fcf
cmp byte [ecx + 0x39], 5
jb 0x429fcf
mov edx, dword [ecx + 0x34]
push eax
mov eax, dword [ecx + 0x30]
push 0x446a0c
push 0x38
push edx
push eax
jmp 0x429fca
cmp dword [ebp - 0x14], edi
jne 0x429c6b
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x39
push ecx
push edx
call fcn.004170b0
jmp 0x429fcf
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp + 8]
push ecx
push 0
push str.AppInit_DLLs
push edx
call esi
test eax, eax
jne 0x429fa1
mov eax, dword [ebp - 4]
test eax, eax
jne 0x429cca
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0
push 0x446a0c
push 0x3a
push ecx
push edx
jmp 0x429fca
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x429d09
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov edx, dword [eax + 0x30]
push ecx
mov ecx, dword [eax + 0x34]
push 0x446a0c
push 0x3b
push ecx
push edx
jmp 0x429fca
push eax
call fcn.0042e047
mov edi, eax
add esp, 4
test edi, edi
je 0x429d55
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push edi
lea ecx, [ebp + 8]
push ecx
push 0
push str.AppInit_DLLs
push edx
call esi
test eax, eax
je 0x429dd4
cmp eax, 0xea
jne 0x429d91
push edi
call fcn.0042df6a
mov eax, dword [ebp - 4]
push eax
call fcn.0042e047
mov edi, eax
add esp, 8
test edi, edi
jne 0x429d18
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x3c
push ecx
push edx
call fcn.004170b0
jmp 0x429fcf
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x44b008]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x3e
push ecx
push edx
jmp 0x429fca
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x429e13
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov edx, dword [eax + 0x30]
push ecx
mov ecx, dword [eax + 0x34]
push 0x446a0c
push 0x3d
push ecx
push edx
jmp 0x429fca
mov eax, dword [ebp - 4]
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x429e5c
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x3f
push ecx
push edx
call fcn.004170b0
jmp 0x429fcf
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429e88
test byte [eax + 0x3c], bl
je 0x429e88
cmp byte [eax + 0x39], 5
jb 0x429e88
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push edi
push 0x446a0c
push 0x40
push ecx
push edx
call fcn.004170e0
mov ecx, dword [0x456b20]
push edi
call fcn.0042a750
cmp al, bl
jne 0x429f22
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429ec7
test byte [eax + 0x3c], bl
je 0x429ec7
cmp byte [eax + 0x39], 5
jb 0x429ec7
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x41
push ecx
push edx
call fcn.004170b0
mov ecx, dword [0x456b20]
push edi
call fcn.0042aea0
cmp al, bl
jne 0x429ef7
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429f22
test byte [eax + 0x3c], bl
je 0x429f22
cmp byte [eax + 0x39], 5
jb 0x429f22
push 0x446a0c
push 0x42
jmp 0x429f15
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429f22
test byte [eax + 0x3c], bl
je 0x429f22
cmp byte [eax + 0x39], 5
jb 0x429f22
push 0x446a0c
push 0x43
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push ecx
push edx
call fcn.004170b0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov ecx, dword [0x456b20]
call fcn.0042a7b0
cmp al, bl
jne 0x429f6d
mov dword [ebp - 0xc], ebx
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov edx, dword [eax + 0x34]
mov eax, dword [eax + 0x30]
push 0x446a0c
push 0x44
push edx
push eax
call fcn.004170b0
jmp 0x429fcf
mov dword [ebp - 0xc], 0
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x429fcf
test byte [eax + 0x3c], bl
je 0x429fcf
cmp byte [eax + 0x39], 5
jb 0x429fcf
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 0x446a0c
push 0x45
push ecx
push edx
call fcn.004170b0
jmp 0x429fcf
mov ecx, dword [0x44b008]
cmp ecx, 0x44b008
je 0x429fcf
test byte [ecx + 0x3c], bl
je 0x429fcf
cmp byte [ecx + 0x39], 5
jb 0x429fcf
push eax
mov eax, dword [ecx + 0x34]
mov ecx, dword [ecx + 0x30]
push 0x446a0c
push 0x46
push eax
push ecx
call fcn.004198f0
mov eax, dword [ebp - 8]
test eax, eax
je 0x429fdd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x429fea
push edi
call fcn.0042df6a
add esp, 4
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc