Function at 0x416da5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x427e20
call fcn.0041c160
sub esp, 0x750
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [eax + 0x3214]
call fcn.004052e1
xor ebx, ebx
cmp eax, ebx
je 0x416ffe
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00403219
xor eax, eax
lea edi, [ebp - 0x2b]
mov byte [ebp - 0x2c], bl
mov ecx, dword [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ecx]
mov dword [ebp - 4], ebx
cmp eax, ecx
mov dword [ebp - 0x14], eax
je 0x416ff2
mov esi, 0x104
mov eax, dword [eax + 0x10]
cmp eax, ebx
jne 0x416e11
mov eax, 0x428478
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
call fcn.00413045
mov edi, eax
lea eax, [ebp - 0x144]
push esi
push eax
push ebx
lea eax, [ebp - 0x2c]
push dword [0x428e3c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x3214]
call fcn.00405355
cmp eax, dword [edi + 8]
jne 0x416fde
lea eax, [ebp - 0x658]
push esi
push eax
push ebx
push dword [0x428e40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x3214]
call fcn.00405355
cmp eax, dword [edi + 0xc]
jb 0x416fde
lea eax, [ebp - 0x450]
push esi
push eax
push ebx
push dword [0x428e48]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x3214]
call fcn.00405355
cmp eax, dword [edi + 0x10]
jb 0x416fde
lea eax, [ebp - 0x248]
push esi
push eax
push ebx
push dword [0x428e4c]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x3214]
call fcn.00405355
cmp eax, dword [edi + 0x14]
jne 0x416fde
lea eax, [ebp - 0x34c]
push esi
push eax
push ebx
push dword [0x428e44]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x3214]
call fcn.00405355
cmp eax, dword [edi + 0xc]
jbe 0x416fde
cmp dword [edi + 0x14], 2
jne 0x417020
lea eax, [ebp - 0x144]
push eax
call fcn.0041cc72
cmp eax, 4
pop ecx
jne 0x416f50
mov edi, dword [ebp + 0xc]
push str.1.20.1827.0
lea eax, [edi + 0xac]
push eax
call fcn.00416138
pop ecx
test eax, eax
pop ecx
jl 0x416f35
mov edi, 0x300
jmp 0x416f7b
lea eax, [ebp - 0x554]
push esi
push eax
push ebx
push dword [0x428e50]
lea eax, [ebp - 0x2c]
lea ecx, [edi + 0x3214]
push eax
jmp 0x416f6c
lea eax, [ebp - 0x75c]
push esi
push eax
push ebx
push dword [0x428e50]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x3214]
call fcn.00405355
mov edi, eax
cmp edi, ebx
je 0x417020
mov dword [ebp + 8], ebx
push 0x20019
push str.SystemCurrentControlSetControlWindows
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00409a5b
test eax, eax
jne 0x416fca
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push str.CSDVersion
mov dword [ebp - 0x30], ebx
push dword [ebp + 8]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x10], edi
jae 0x41700f
cmp dword [ebp + 8], ebx
mov byte [ebp - 4], bl
je 0x416fde
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
lea ecx, [ebp - 0x14]
call fcn.004042c2
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3c]
jne 0x416e05
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004032c5
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
cmp dword [ebp + 8], ebx
je 0x417020
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004032c5
push 1
pop eax
jmp 0x417000