Function at 0x41ef50
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4577ca
mov eax, dword fs:[0]
push eax
sub esp, 0x92c
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x928], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x940]
mov dword fs:[0], eax
mov eax, dword [esp + 0x950]
mov dword [esp + 0x18], eax
mov ebx, ecx
mov dword [esp + 0x948], 1
mov eax, dword [esp + 0x958]
mov edi, pe_nt_image_headers32
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x96c], edi
jae 0x41efc7
lea eax, [esp + 0x958]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
mov ebp, eax
call esi
lea edx, [esp + 0x28]
cmp eax, edx
jle 0x41efff
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
jmp 0x41f00b
push 0xe
call esi
lea ecx, [esp + 0x28]
cmp eax, ecx
jle 0x41f010
call fcn.00418620
cmp ebp, 2
jne 0x41f1a7
mov eax, dword [esp + 0x958]
cmp dword [esp + 0x96c], edi
jae 0x41f030
lea eax, [esp + 0x958]
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebp, eax
mov eax, dword [esp + 0x958]
cmp dword [esp + 0x96c], edi
jae 0x41f065
lea eax, [esp + 0x958]
push eax
push ebx
lea eax, [esp + 0x98]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x41f098
mov ecx, dword [edi]
jmp 0x41f09a
mov ecx, edi
cmp ecx, 0x45c408
ja 0x41f0d5
cmp eax, 0x10
jb 0x41f0ab
mov ecx, dword [edi]
jmp 0x41f0ad
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45c408
jbe 0x41f0d5
cmp eax, 0x10
jb 0x41f0c1
mov edi, dword [edi]
push 0x39
mov eax, 0x45c408
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x41f119
cmp eax, 0x39
jae 0x41f0e7
mov ecx, dword [esi + 0x14]
push ecx
push 0x39
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41f0f3
mov eax, dword [edi]
jmp 0x41f0f5
mov eax, edi
push 0x39
push 0x45c408
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x39
jb 0x41f115
mov edi, dword [edi]
mov byte [edi + 0x39], 0
lea esi, [esp + 0x60]
call fcn.00401900
push eax
mov byte [esp + 0x958], 2
call fcn.00401c70
mov esi, pe_nt_image_headers32
mov byte [esp + 0x950], 3
cmp dword [eax + 0x18], esi
jb 0x41f147
mov eax, dword [eax + 4]
jmp 0x41f14a
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041c440
add esp, 0x14
cmp dword [esp + 0xa8], esi
jb 0x41f173
mov eax, dword [esp + 0x94]
push eax
call fcn.0043c853
add esp, 4
lea esi, [esp + 0x38]
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], 0
mov byte [esp + 0x948], 1
call fcn.00429050
mov edi, pe_nt_image_headers32
cmp ebp, 5
jne 0x41f2f9
mov eax, dword [esp + 0x958]
cmp dword [esp + 0x96c], edi
jae 0x41f1c7
lea eax, [esp + 0x958]
push eax
push ebx
lea ecx, [esp + 0x98]
push ecx
sub esp, 0x1c
mov esi, esp
mov ebp, 0xf
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
mov dword [esp + 0x3c], esp
cmp eax, ebx
jb 0x41f1ff
mov ecx, dword [edi]
jmp 0x41f201
mov ecx, edi
cmp ecx, 0x45c444
ja 0x41f23a
cmp eax, ebx
jb 0x41f211
mov ecx, dword [edi]
jmp 0x41f213
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45c444
jbe 0x41f23a
cmp eax, ebx
jb 0x41f226
mov edi, dword [edi]
push 0x3c
mov eax, 0x45c444
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x41f27c
cmp eax, 0x3c
jae 0x41f24c
mov ecx, dword [esi + 0x14]
push ecx
push 0x3c
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x41f257
mov eax, dword [edi]
jmp 0x41f259
mov eax, edi
push 0x3c
push 0x45c444
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
mov dword [esi + 0x14], 0x3c
cmp dword [esi + 0x18], ebx
jb 0x41f278
mov edi, dword [edi]
mov byte [edi + 0x3c], 0
lea esi, [esp + 0x60]
call fcn.00401900
push eax
mov byte [esp + 0x958], 4
call fcn.00401c70
mov byte [esp + 0x950], 5
cmp dword [eax + 0x18], ebx
jb 0x41f2a5
mov eax, dword [eax + 4]
jmp 0x41f2a8
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041c440
add esp, 0x14
cmp dword [esp + 0xa8], ebx
jb 0x41f2d1
mov eax, dword [esp + 0x94]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0xa8], ebp
lea esi, [esp + 0x38]
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], 0
call fcn.00429050
jmp 0x41fb90
test ebp, ebp
je 0x41f439
mov eax, dword [esp + 0x958]
cmp dword [esp + 0x96c], edi
jae 0x41f318
lea eax, [esp + 0x958]
push eax
push ebx
push ebp
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebx, [esp + 0xb8]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x41f34b
mov ecx, dword [edi]
jmp 0x41f34d
mov ecx, edi
cmp ecx, 0x45c488
ja 0x41f388
cmp eax, 0x10
jb 0x41f35e
mov ecx, dword [edi]
jmp 0x41f360
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45c488
jbe 0x41f388
cmp eax, 0x10
jb 0x41f374
mov edi, dword [edi]
push 0x3f
mov eax, 0x45c488
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402ea0
jmp 0x41f3cc
cmp eax, 0x3f
jae 0x41f39a
mov ecx, dword [esi + 0x14]
push ecx
push 0x3f
mov ecx, esi
call fcn.00403800
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41f3a6
mov eax, dword [edi]
jmp 0x41f3a8
mov eax, edi
push 0x3f
push 0x45c488
push ecx
push eax
call fcn.0043c85e
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3f
jb 0x41f3c8
mov edi, dword [edi]
mov byte [edi + 0x3f], 0
lea esi, [esp + 0x60]
call fcn.00401900
mov edx, ebx
mov ecx, eax
mov byte [esp + 0x954], 6
call fcn.00401a70
mov esi, pe_nt_image_headers32
mov byte [esp + 0x954], 7
cmp dword [eax + 0x18], esi
jb 0x41f3fd
mov eax, dword [eax + 4]
jmp 0x41f400
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 1
push edx
call fcn.0041c440
add esp, 0x18
cmp dword [esp + 0xa8], esi
jb 0x41f429
mov eax, dword [esp + 0x94]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0xa8], 0xf
jmp 0x41f2d8
cmp dword [esp + 0x1c], 0
je 0x41fb9f
call fcn.00431ed0
mov dword [esp + 0x948], 1
xor ebp, ebp
mov eax, 0xf
mov dword [esp + 0x30], ebp
mov dword [esp + 0xc8], eax
mov dword [esp + 0xc4], ebp
mov byte [esp + 0xb4], 0
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe0], ebp
mov byte [esp + 0xd0], 0
mov dword [esp + 0x100], eax
mov dword [esp + 0xfc], ebp
mov byte [esp + 0xec], 0
mov dword [esp + 0x11c], eax
mov dword [esp + 0x118], ebp
mov byte [esp + 0x108], 0
mov byte [esp + 0x948], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebp
shr esi, 0x18
call fcn.0043cb47
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41f4ef
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call fcn.00418690
call fcn.00419f50
mov edi, dword [esp + 0x98c]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebp
mov dword [esp + 0x134], 1
call fcn.0043c831
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.0043c831
cdq
idiv esi
cmp edx, esi
jle 0x41f532
mov edx, 1
jmp 0x41f537
mov eax, esi
cdq
idiv esi
mov eax, edx
sub eax, 1
jne 0x41f548
call fcn.00418470
call fcn.00418740
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x95c]
push edx
lea ecx, [esp + 0xbc]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0x13c], ebp
call fcn.00402ea0
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x978]
push eax
lea ecx, [esp + 0xd8]
call fcn.00402ea0
cmp edi, ebp
je 0x41f835
push 0x3ff
lea ecx, [esp + 0x141]
push ebp
push ecx
mov byte [esp + 0x148], 0
call fcn.00444d20
mov eax, dword [esp + 0x980]
add esp, 0xc
cmp dword [esp + 0x988], 0x10
mov dword [esp + 0x28], 0x400
jae 0x41f5ca
lea eax, [esp + 0x974]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x140]
push ecx
push ebp
push ebp
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebp
jne 0x41fa16
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f5f7
sub eax, edx
je 0x41fa16
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], cl
lea eax, [esp + 0x90]
push eax
sub esp, 0x1c
mov byte [esp + 0x968], 0xb
lea edx, [esp + 0x15c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
lea esi, [esp + 0x38]
call fcn.00402c00
mov ebp, dword [esp + 0x38]
push ebp
mov ecx, esi
call fcn.0040f230
test eax, eax
jge 0x41f676
lea ecx, [esp + 0x90]
mov byte [esp + 0x948], 0xa
call fcn.00402c70
jmp 0x41fa1a
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0xf4]
call fcn.00402ea0
sub esp, 0x1c
lea edx, [esp + 0x158]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.00402c00
lea eax, [esp + 0xc8]
push eax
push ebp
call fcn.0041fd70
mov esi, eax
call fcn.00438a10
sub eax, 1
jne 0x41f6d5
call fcn.00419cc0
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
test esi, esi
jge 0x41f6f2
lea ecx, [esp + 0x90]
mov byte [esp + 0x948], 0xa
call fcn.00402c70
jmp 0x41fa1a
sub esp, 0x1c
mov dword [esp + 0x30], esp
lea edx, [esp + 0x120]
mov ecx, esp
push edx
call fcn.00402c40
push ebp
call fcn.0041b890
test eax, eax
jl 0x41f71a
mov dword [esp + 0x30], 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x948], 0xa
call fcn.00402c70
cmp dword [esp + 0x30], 0
jne 0x41fc4a
lea ecx, [esp + 0xac]
push ecx
push ebp
call fcn.00421310
test eax, eax
jl 0x41fb17
sub esp, 0x1c
lea edx, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00402c40
sub esp, 0x1c
lea eax, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
mov byte [esp + 0x984], 0x15
call fcn.00402c40
mov ebp, dword [esp + 0x50]
mov ecx, ebp
mov byte [esp + 0x980], 0xa
call fcn.0040ddc0
sub esp, 0x1c
lea edx, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00402c40
push ebp
call fcn.0041b890
mov esi, eax
call fcn.00417a50
test eax, eax
je 0x41f7c2
call fcn.004188b0
test esi, esi
jge 0x41fc4a
mov eax, dword [esp + 0x108]
mov edi, pe_nt_image_headers32
cmp dword [esp + 0x11c], edi
jae 0x41f7e6
lea eax, [esp + 0x108]
push eax
lea eax, [esp + 0x94]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
push 0x33
mov ecx, 0x45c4fc
call fcn.00404720
lea esi, [esp + 0x5c]
call fcn.00401900
mov ecx, eax
mov byte [esp + 0x950], 0x16
call fcn.00401db0
mov byte [esp + 0x94c], 0x17
cmp dword [eax + 0x18], edi
jb 0x41fc76
mov eax, dword [eax + 4]
jmp 0x41fc79
mov ebp, dword [esp + 0x18]
xor edi, edi
mov byte [esp + 0x27], 0
push 0x3ff
lea eax, [esp + 0x141]
push 0
push eax
mov ebx, 0x400
mov byte [esp + 0x148], 0
call fcn.00444d20
add esp, 0xc
push 0x3ff
lea ecx, [esp + 0x541]
push 0
push ecx
mov byte [esp + 0x548], 0
call fcn.00444d20
lea eax, [esp + 0x33]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f890
sub eax, edx
je 0x41f8a5
call fcn.00419cc0
call fcn.00439810
mov dword [esp + 0x14], ebx
call fcn.00403c90
mov esi, 0xa
mov dword [esp + 0x948], esi
mov dword [esp + 0x34], ebx
call fcn.00417b10
sub eax, 1
jne 0x41f8d2
call fcn.00401450
call fcn.004187c0
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x540]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x150]
push eax
mov dword [esp + 0x960], esi
mov ecx, dword [esp + 0x34]
push edi
push ecx
mov dword [esp + 0x48], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x41fa1a
cmp dword [esp + 0x28], 1
jne 0x41f9fb
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jmp 0x41f930
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f930
sub eax, edx
je 0x41f9fb
lea eax, [esp + 0x53c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f950
sub eax, edx
je 0x41f9fb
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], cl
lea edx, [esp + 0x20]
push edx
sub esp, 0x1c
lea eax, [esp + 0x15c]
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
mov byte [esp + 0x96c], 0x10
lea ebx, [esp + 0xb4]
call fcn.00402c00
mov esi, ebp
call fcn.0040f120
mov ecx, ebx
test eax, eax
jl 0x41f9ee
push 0xffffffffffffffff
push 0
push ecx
lea ecx, [esp + 0xf4]
call fcn.00402ea0
sub esp, 0x1c
lea edx, [esp + 0x558]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.00402c00
lea eax, [esp + 0xc8]
push eax
push ebp
call fcn.0041fd70
test eax, eax
jge 0x41fa0a
mov ecx, ebx
mov byte [esp + 0x948], 0xa
call fcn.00402c70
inc edi
cmp edi, 0xc8
jb 0x41f840
jmp 0x41fa1a
sub esp, 0x1c
mov dword [esp + 0x3c], esp
jmp 0x41f6f9
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0xac]
push eax
push ebp
lea ecx, [esp + 0x1c]
call fcn.00420620
test eax, eax
jl 0x41fb17
sub esp, 0x1c
lea edx, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00402c40
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
push eax
push esi
call fcn.0040df70
sub esp, 0x1c
lea edx, [esp + 0x120]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.00402c40
push esi
call fcn.0041b890
test eax, eax
jge 0x41fc20
cmp dword [esp + 0x11c], 0x10
mov eax, dword [esp + 0x108]
jae 0x41fa95
lea eax, [esp + 0x108]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push 0x33
mov ecx, 0x45c4c8
lea edi, [esp + 0xb4]
call fcn.00404720
lea esi, [esp + 0x58]
call fcn.00401900
mov edx, edi
mov ecx, eax
mov byte [esp + 0x94c], 0x11
call fcn.00401a70
mov byte [esp + 0x94c], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x41fadf
mov eax, dword [eax + 4]
jmp 0x41fae2
add eax, 4
push eax
mov eax, dword [esp + 0x20]
push 1
push eax
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x90]
call fcn.00402c70
lea esi, [esp + 0x38]
call fcn.00429050
call fcn.00417b10
mov dword [esp + 0x948], 0xa
lea edi, [esp + 0xe8]
call fcn.004290c0
call fcn.00417b10
lea edi, [esp + 0x104]
mov dword [esp + 0x948], 0xa
call fcn.004290c0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x978]
push ecx
lea ecx, [esp + 0xd8]
mov dword [esp + 0x130], 0
call fcn.00402ea0
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x120], 0xffffffff
lea edx, [esp + 0xac]
push edx
lea ebx, [ebp + 0x2d8]
call fcn.00429a80
lea esi, [esp + 0xac]
call fcn.0041fcf0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41fb9f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x96c], esi
jb 0x41fbbd
mov eax, dword [esp + 0x958]
push eax
call fcn.0043c853
add esp, 4
mov dword [esp + 0x96c], 0xf
mov dword [esp + 0x968], 0
mov byte [esp + 0x958], 0
cmp dword [esp + 0x988], esi
jb 0x41fbf4
mov ecx, dword [esp + 0x974]
push ecx
call fcn.0043c853
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x940]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x928]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x938
ret 0x40
cmp dword [esp + 0x134], 0
je 0x41fb17
mov edi, dword [esp + 0x1c]
lea esi, [esp + 0xac]
call fcn.004212a0
test eax, eax
jl 0x41fb17
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x108]
mov eax, pe_nt_image_headers32
cmp dword [esp + 0x11c], eax
jae 0x41fc66
lea ecx, [esp + 0x108]
cmp dword [ebp + 0x25c], eax
jb 0x41fca7
mov eax, dword [ebp + 0x248]
jmp 0x41fcad
add eax, 4
push eax
push 1
push ebp
call fcn.0041c440
add esp, 0x10
lea ecx, [esp + 0x90]
call fcn.00402c70
lea esi, [esp + 0x38]
mov byte [esp + 0x948], 0xa
call fcn.00429050
jmp 0x41fb17
lea eax, [ebp + 0x248]
push ecx
push eax
call fcn.0043cd92
add esp, 8
test eax, eax
jne 0x41fb71
mov dword [esp + 0x128], 1
call fcn.00417a90
test eax, eax
je 0x41fb71
call fcn.00418980
jmp 0x41fb71