Function at 0x42ef50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x4b8040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x410], 0x52fe1dc8
mov dword [ebp - 0x40c], 0x31e775a5
mov eax, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x410], 0xf1e891be
mov dword [ebp - 0x40c], 0xce63dd22
mov eax, dword [ebp - 0x410]
push esi
mov esi, ecx
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x410], 0x653dfeb3
mov dword [ebp - 0x40c], 0xdb83cdf8
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x410], 0x7f0c6d55
mov dword [ebp - 0x40c], 0x165cf366
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x410], 0x2bb66e85
mov dword [ebp - 0x40c], 0x679510d5
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x98beb99e
mov dword [ebp - 0x40c], 0xaf16a950
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x45c], ecx
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x470dedf
mov dword [ebp - 0x40c], 0xb5eaa59b
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x454], ecx
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x7f0c4430
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x40c], 0x165cf366
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
movaps xmm1, xmmword [ebp - 0x440]
xorps xmm1, xmmword [ebp - 0x460]
movaps xmmword [ebp - 0x440], xmm1
movaps xmm1, xmmword [ebp - 0x430]
mov dword [ebp - 0x444], ecx
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x448], eax
lea edx, [ecx + 1]
xorps xmm1, xmmword [ebp - 0x450]
push edi
movaps xmmword [ebp - 0x430], xmm1
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42f110
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [esi + 0xc]
call fcn.0041f4e0
push 0xff
lea eax, [ebp - 0x108]
mov dword [ebp - 0x414], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x414]
add esp, 0xc
mov dword [ebp - 0x40c], 0xff
push eax
push 1
push 0
push 0x4b057c
push reloc.WS2_32.dll_bind
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x42f1dd
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 2
push str.SystemManufacturer
push 0
push dword [ebp - 0x414]
call esi
test eax, eax
jne 0x42f1dd
mov ecx, str.Microsoft_Corporation
lea eax, [ebp - 0x108]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42f1d0
test dl, dl
je 0x42f1cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42f1d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x42f1b0
xor eax, eax
jmp 0x42f1d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x42f3bf
push 0xff
lea eax, [ebp - 0x208]
mov dword [ebp - 0x414], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x40c], 0xff
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x4b057c
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x42f27f
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push 2
push str.BIOSVendor
push 0
push dword [ebp - 0x414]
call esi
test eax, eax
jne 0x42f27f
mov ecx, str.Microsoft_Corporation
lea eax, [ebp - 0x208]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42f272
test dl, dl
je 0x42f26e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42f272
add eax, 2
add ecx, 2
test dl, dl
jne 0x42f252
xor eax, eax
jmp 0x42f277
sbb eax, eax
or eax, 1
test eax, eax
je 0x42f3bf
push 0xff
lea eax, [ebp - 0x308]
mov dword [ebp - 0x414], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x40c], 0xff
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x4b057c
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x42f321
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x308]
push eax
push 0
push 2
push str.SystemFamily
push 0
push dword [ebp - 0x414]
call esi
test eax, eax
jne 0x42f321
mov ecx, str.Virtual_Machine
lea eax, [ebp - 0x308]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42f314
test dl, dl
je 0x42f310
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42f314
add eax, 2
add ecx, 2
test dl, dl
jne 0x42f2f4
xor eax, eax
jmp 0x42f319
sbb eax, eax
or eax, 1
test eax, eax
je 0x42f3bf
push 0xff
lea eax, [ebp - 0x408]
mov dword [ebp - 0x414], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x40c], 0xff
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x4b057c
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x42f3d4
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push 2
push str.SystemProductName
push 0
push dword [ebp - 0x414]
call esi
test eax, eax
jne 0x42f3d4
mov ecx, str.Virtual_Machine
lea eax, [ebp - 0x408]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42f3b6
test dl, dl
je 0x42f3b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42f3b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x42f396
xor eax, eax
jmp 0x42f3bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42f3d4
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044317d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0044317d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret