Function at 0x100a0ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10149eb3
mov eax, dword fs:[0]
push eax
sub esp, 0x5e0
mov eax, dword [0x1019a128]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push pe_nt_image_headers32
lea eax, [ebp - 0x534]
mov byte [esi + 0x10], 0
push 0
push eax
call fcn.10117ff0
add esp, 0xc
mov dword [ebp - 0x538], 0x11c
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100a103e
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100a103e
lea ecx, [ebp - 0x538]
push ecx
call eax
test eax, eax
jne 0x100a103e
mov eax, dword [ebp - 0x534]
mov dword [esi], eax
mov eax, dword [ebp - 0x530]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x52c]
mov dword [esi + 8], eax
lea eax, [ebp - 0x53c]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x53c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a103e
push 0x400
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x414], 0x400
push eax
call fcn.10117ff0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push str.BuildLabEx
push dword [ebp - 0x53c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x53c]
test eax, eax
je 0x100a0fc9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a103e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x410]
push eax
call fcn.10123fae
mov edi, eax
add esp, 4
test edi, edi
je 0x100a103e
lea eax, [ebp - 0x540]
mov dword [ebp - 0x540], 0
push eax
push 0x1016a068
push edi
call fcn.10124332
add esp, 0xc
test eax, eax
je 0x100a1035
lea eax, [ebp - 0x540]
push eax
push 0x1016a068
push 0
call fcn.10124332
add esp, 0xc
test eax, eax
je 0x100a1035
push eax
call fcn.10124213
add esp, 4
test eax, eax
jle 0x100a1035
mov dword [esi + 0xc], eax
mov byte [esi + 0x10], 1
push edi
call fcn.1011bbac
add esp, 4
cmp byte [esi + 0x10], 0
jne 0x100a10cf
push str.__win7sp2::sp2_t::needsWin7SP2Rollout
mov edx, 0x20
lea ecx, [ebp - 0x4c8]
call fcn.1000aed0
add esp, 4
mov dword [ebp - 4], 0
cmp byte [eax + 0x48], 0
je 0x100a1079
mov edx, str.could_not_read_OS_info
mov ecx, eax
call fcn.100205a0
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 4], 0xffffffff
call fcn.1000ad70
push str.__win7sp2::sp2_t::needsWin7SP2Rollout
mov edx, 0x20
lea ecx, [ebp - 0x5e8]
call fcn.1000aed0
add esp, 4
mov dword [ebp - 4], 0xa
cmp byte [eax + 0x48], 0
je 0x100a10bc
mov edx, str.Could_not_determine_if_the_Win7_SP2_rollout_update_is_necessary.
mov ecx, eax
call fcn.100205a0
lea ecx, [ebp - 0x5e8]
call fcn.1000ad70
or eax, 0xffffffff
jmp 0x100a1453
cmp dword [esi], 6
jne 0x100a1415
cmp dword [esi + 4], 1
jne 0x100a1415
cmp dword [esi + 8], 0x1db1
lea ecx, [ebp - 0x4c8]
push str.__win7sp2::sp2_t::needsWin7SP2Rollout
mov edx, 0x20
jbe 0x100a1180
call fcn.1000aed0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 3
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
mov edx, str.OS_build__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
push dword [esi + 8]
mov ecx, edi
call fcn.100201d0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
mov edx, str.__is_higher_than_the_threshold_build_number__
mov ecx, edi
call fcn.10020800
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
push 0x1db1
mov ecx, edi
call fcn.100201d0
cmp byte [edi + 0x48], 0
je 0x100a1446
mov edx, str.__required_to_need_SP2._SP2_rollout_update_is_probably_already_installed.
mov ecx, edi
jmp 0x100a1441
jae 0x100a1208
call fcn.1000aed0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 4
mov al, byte [edi + 0x48]
test al, al
je 0x100a11f3
mov edx, str.OS_build__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a11f3
push dword [esi + 8]
mov ecx, edi
call fcn.100201d0
mov al, byte [edi + 0x48]
test al, al
je 0x100a11f3
mov edx, str.__is_lower_than_the_threshold_build_number__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a11f3
push 0x1db1
mov ecx, edi
call fcn.100201d0
cmp byte [edi + 0x48], 0
je 0x100a11f3
mov edx, str._._SP2_rollout_update_is_required.
mov ecx, edi
call fcn.100205a0
lea ecx, [ebp - 0x4c8]
call fcn.1000ad70
mov eax, 1
jmp 0x100a1453
call fcn.1000aed0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 5
mov al, byte [edi + 0x48]
test al, al
je 0x100a1275
mov edx, str.OS_build__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1275
push dword [esi + 8]
mov ecx, edi
call fcn.100201d0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1275
mov edx, str.__is_equal_with_the_threshold_build_number__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1275
push 0x1db1
mov ecx, edi
call fcn.100201d0
cmp byte [edi + 0x48], 0
je 0x100a1275
mov edx, str._._Checking_build_lab_version.
mov ecx, edi
call fcn.100205a0
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 4], 0xffffffff
call fcn.1000ad70
cmp dword [esi + 0xc], 0
lea ecx, [ebp - 0x4c8]
push str.__win7sp2::sp2_t::needsWin7SP2Rollout
mov edx, 0x20
je 0x100a13f9
call fcn.1000aed0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 6
mov al, byte [edi + 0x48]
test al, al
je 0x100a12d6
mov edx, str.BuildLabEx_number_is_read:
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a12d6
push dword [esi + 0xc]
mov ecx, edi
call fcn.100201d0
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 4], 0xffffffff
call fcn.1000ad70
cmp dword [esi + 0xc], 0x5b6b
lea ecx, [ebp - 0x4c8]
push str.__win7sp2::sp2_t::needsWin7SP2Rollout
mov edx, 0x20
jae 0x100a1387
call fcn.1000aed0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 7
mov al, byte [edi + 0x48]
test al, al
je 0x100a1372
mov edx, str.OS_build_lab__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1372
push dword [esi + 0xc]
mov ecx, edi
call fcn.100201d0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1372
mov edx, str.__is_lower_with_the_threshold_build_lab_number__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1372
push 0x5b6b
mov ecx, edi
call fcn.100201d0
cmp byte [edi + 0x48], 0
je 0x100a1372
mov edx, str._._SP2_rollout_update_is_required.
mov ecx, edi
call fcn.100205a0
lea ecx, [ebp - 0x4c8]
call fcn.1000ad70
mov eax, 1
jmp 0x100a1453
call fcn.1000aed0
add esp, 4
mov edi, eax
mov dword [ebp - 4], 8
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
mov edx, str.OS_build_lab__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
push dword [esi + 0xc]
mov ecx, edi
call fcn.100201d0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
mov edx, str.__is_higher_with_the_threshold_build_lab_number__
mov ecx, edi
call fcn.100205a0
mov al, byte [edi + 0x48]
test al, al
je 0x100a1446
push 0x5b6b
mov ecx, edi
call fcn.100201d0
cmp byte [edi + 0x48], 0
je 0x100a1446
mov edx, str._._SP2_rollout_update_is_probably_already_installed.
mov ecx, edi
jmp 0x100a1441
call fcn.1000aed0
add esp, 4
mov dword [ebp - 4], 9
cmp byte [eax + 0x48], 0
je 0x100a1446
mov edx, str.Could_not_read_the_BuildLabEx_number.
jmp 0x100a143f
push str.__win7sp2::sp2_t::needsWin7SP2Rollout
mov edx, 0x20
lea ecx, [ebp - 0x4c8]
call fcn.1000aed0
add esp, 4
mov dword [ebp - 4], 2
cmp byte [eax + 0x48], 0
je 0x100a1446
mov edx, str.OS_is_not_Windows_7.
mov ecx, eax
call fcn.100205a0
lea ecx, [ebp - 0x4c8]
call fcn.1000ad70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101157bc
mov esp, ebp
pop ebp
ret