Function at 0x403ca0
Capabilities:
Check os version
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xac
lea eax, [esp + 0x18]
push ebp
push eax
mov dword [esp + 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403d6f
cmp dword [esp + 0x28], 5
jb 0x403d6f
mov eax, dword [esp + 0x24]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403d7b
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicroSoftCryptographyDefaultsProviderMicrosoft_Strong_Cryptographic_Provider
push 0x80000002
call ebp
test eax, eax
jne 0x403d6f
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x403d42
mov eax, dword [esp + 0xbc]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Type
push edx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403d64
mov dword [esp + 4], eax
push 4
lea ecx, [esp + 8]
jmp 0x403d4b
mov ecx, dword [esp + 0xbc]
push 4
mov edx, dword [esp + 0xc]
push ecx
push 4
push 0
push str.Type
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403d7b
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
add esp, 0xac
ret 0x10
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftDriver_Signing
push 0x80000001
call ebp
mov esi, dword [esp + 0xc0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x403dd1
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftDriver_Signing
push 0x80000001
mov dword [esi], 3
call ebx
jmp 0x403e01
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x403e2b
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
push 0
push str.Policy
push eax
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x403e2b
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push str.Policy
mov dword [esp + 0x20], 0
push edx
jmp 0x403e53
cmp dword [esi], 3
jne 0x403e42
push str.SoftwareMicrosoftDriver_Signing
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x403e59
mov eax, dword [esp + 0x14]
push 4
push esi
push 4
push 0
push str.Policy
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftDriver_Signing
push 0x80000002
call ebp
mov esi, dword [esp + 0xbc]
test eax, eax
je 0x403ea7
lea edx, [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftDriver_Signing
push 0x80000002
mov dword [esi], 3
call ebx
jmp 0x403ed7
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x403f01
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
push 0
push str.Policy
push eax
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x403f01
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push 4
push ecx
push 3
push 0
push str.Policy
mov dword [esp + 0x20], 0
push edx
jmp 0x403f29
cmp dword [esi], 3
jne 0x403f18
push str.SoftwareMicrosoftDriver_Signing
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x403f2f
mov eax, dword [esp + 0x18]
push 4
push esi
push 3
push 0
push str.Policy
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop esi
pop ebx
mov eax, 1
pop ebp
add esp, 0xac
ret 0x10