Function at 0x41fd20
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [ebp + 8]
test eax, eax
je 0x41fd6b
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fd6b
lea ecx, [esi + 0x148]
push ecx
movzx ecx, word [esi + 0x12e]
push ecx
movzx ecx, word [esi + 0x12c]
push ecx
push dword [esi + 0x9c]
push dword [esi + 0x98]
call eax
mov eax, dword [esi + 0x130]
mov ecx, dword [esi + 0x148]
and eax, 0xfffffffd
mov dword [esi + 0x130], eax
cmp ecx, 0x62
ja 0x4202f7
je 0x4202dd
dec ecx
cmp ecx, 0x60
ja case.default.0x42081e
jmp dword [ecx*4 + 0x420974]
or eax, 0x80000
or dword [esi + 0x134], 0x1000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x10000000
or dword [esi + 0x134], 0x8800
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x10000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x1800000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x1000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x2800000
or dword [esi + 0x134], 0x8000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x2000000
jmp 0x41fe09
or eax, 0x8800000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x8000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x134], 0x4000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800002
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800002
jmp 0x41fe48
or eax, 0x400000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0xc00000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x24000020
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20000020
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x4000020
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x4000020
jmp 0x41fe48
or eax, 0x24000002
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20000002
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x4000002
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
mov dword [esi + 0xa8], 5
or eax, 2
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x24000000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x20
jmp case.default.0x42081e
or eax, 0x20000000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x4000000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x4000000
or dword [esi + 0x134], 0x4020
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 0x400
jmp case.default.0x42081e
or eax, 0x20000080
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x10000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x13c], 0x80
jmp case.default.0x42081e
or eax, 0x20000000
mov dword [esi + 0x130], eax
or dword [esi + 0x13c], 0x100
jmp case.default.0x42081e
or eax, 0x40000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 1
jmp case.default.0x42081e
or eax, 0x4000000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 2
jmp case.default.0x42081e
or eax, 1
or dword [esi + 0x134], 0x8004
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20000001
jmp 0x420031
or eax, 0x20080002
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80002
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 8
or eax, 0x20080000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80000
or dword [esi + 0x134], 8
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20080000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20080000
jmp 0x41ff6e
or eax, 0x80000
or dword [esi + 0x134], 0x20
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x20080000
or dword [esi + 0x134], 0x10
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80000
or dword [esi + 0x134], 0x10
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80000
or dword [esi + 0x134], 0x4010
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x1000000
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x2000000
or dword [esi + 0x134], 0x8040
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 0xc0
jmp case.default.0x42081e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x80
jmp case.default.0x42081e
or eax, 0x4000001
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 1
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 0x100
jmp case.default.0x42081e
or eax, 0x100
or dword [esi + 0x134], 0x200
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 0x220
jmp case.default.0x42081e
or dword [esi + 0x134], 0x18200
jmp case.default.0x42081e
or eax, 0x20000100
jmp 0x4201bc
or eax, 0x10000
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x810000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x400000
or dword [esi + 0x134], 0x40
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x2000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x2000
mov dword [esi + 0xa8], 9
jmp case.default.0x42081e
or dword [esi + 0x134], 0x20000
jmp case.default.0x42081e
or eax, 0x100
or dword [esi + 0x134], 0x40000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x100
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x100
or dword [esi + 0x134], 0x2000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
mov dword [esi + 0xa8], 9
or dword [esi + 0x134], 0x4000000
jmp case.default.0x42081e
or eax, 0x100
jmp 0x420175
or eax, 0x800000
or dword [esi + 0x134], 0x4000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
cmp ecx, 0x95
ja 0x42058c
je 0x42057d
sub ecx, 0x63
cmp ecx, 0x31
ja case.default.0x42081e
jmp dword [ecx*4 + 0x420af8]
or dword [esi + 0x134], 0x4080000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x4100000
jmp case.default.0x42081e
or eax, 0x4000
jmp 0x420175
or dword [esi + 0x134], 0x14000000
jmp case.default.0x42081e
or eax, 0x100
or dword [esi + 0x134], 0x2004000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x100
or dword [esi + 0x134], 0x2004040
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x100
jmp 0x41fe48
or eax, 0x100
or dword [esi + 0x134], 0x4040
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x80000
or dword [esi + 0x138], 1
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x800000
jmp case.default.0x42081e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x8000080
jmp case.default.0x42081e
or dword [esi + 0x134], 0x900000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x880000
jmp case.default.0x42081e
or dword [esi + 0x138], 8
jmp case.default.0x42081e
or dword [esi + 0x134], 0x2000000
or dword [esi + 0x138], 0x10
jmp case.default.0x42081e
or dword [esi + 0x138], 4
jmp case.default.0x42081e
or dword [esi + 0x138], 2
jmp case.default.0x42081e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x1000000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x20
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x134], 0x40000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800002
jmp 0x420477
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x40000080
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x134], 0x40004000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800002
jmp 0x4204b0
or eax, 2
or dword [esi + 0x134], 0x10000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x8000000
mov dword [esi + 0x130], eax
or dword [esi + 0x138], 0x40
jmp case.default.0x42081e
or dword [esi + 0x134], 0x100080
jmp case.default.0x42081e
or dword [esi + 0x134], 0x80080
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x138], 0x80
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800002
jmp 0x42051c
or eax, 0x20
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x80000000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x80000020
jmp case.default.0x42081e
or dword [esi + 0x134], 0x20000000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x800
jmp case.default.0x42081e
or dword [esi + 0x138], 0x100
jmp case.default.0x42081e
cmp ecx, 0xbf
ja 0x420728
je 0x420706
sub ecx, 0x9f
cmp ecx, 0x1e
ja case.default.0x42081e
jmp dword [ecx*4 + 0x420bc0]
or eax, 0x20000020
jmp 0x41fe48
or eax, 0x20000000
jmp 0x41ff6e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x138], 0x200
jmp case.default.0x42081e
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x134], 0x1000080
jmp case.default.0x42081e
or eax, 0x20000000
or dword [esi + 0x138], 0x400
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 0x80000000
or dword [esi + 0x138], 0x400
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x138], 0x1000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 0x800002
jmp 0x420632
or dword [esi + 0x138], 0x4000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x8000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x40000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x40
or dword [esi + 0x138], 0x2000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x80000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x40
or eax, 0x800000
mov dword [esi + 0x130], eax
or dword [esi + 0x138], 0x2000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x200000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x400000
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x138], 0x800000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x138], 0x1000000
jmp case.default.0x42081e
or dword [esi + 0x134], 0x40000000
or eax, 2
or dword [esi + 0x138], 0x800000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
cmp ecx, 0xcc
ja 0x4207fd
je 0x4207f1
sub ecx, 0xc0
cmp ecx, 0xb
ja case.default.0x42081e
jmp dword [ecx*4 + 0x420c3c]
or dword [esi + 0x138], 0x100000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x2000000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x4000000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x8000000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x10000000
jmp case.default.0x42081e
or dword [esi + 0x138], 0x20000000
jmp case.default.0x42081e
or dword [esi + 0x13c], 0x10
jmp case.default.0x42081e
or dword [esi + 0x13c], 2
jmp case.default.0x42081e
or dword [esi + 0x13c], 4
jmp case.default.0x42081e
or dword [esi + 0x13c], 8
or eax, 0x800000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x13c], 8
jmp case.default.0x42081e
or dword [esi + 0x13c], 0x40
jmp case.default.0x42081e
cmp ecx, 0xd2
ja 0x4208b9
je 0x4208b0
sub ecx, 0xcd
cmp ecx, 4
ja case.default.0x42081e
jmp dword [ecx*4 + 0x420c6c]
or dword [esi + 0x134], 0x40000000
or eax, 2
or dword [esi + 0x138], 0x800080
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or eax, 2
or dword [esi + 0x138], 0x800080
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x134], 0x4000
or eax, 2
or dword [esi + 0x138], 0x800000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x138], 0x400
or dword [esi + 0x13c], 0x400
jmp case.default.0x42081e
or dword [esi + 0x138], 0x400
or dword [esi + 0x13c], 0x800
jmp case.default.0x42081e
or dword [esi + 0x13c], 0x20
jmp case.default.0x42081e
cmp ecx, 0x198
ja 0x42091a
je 0x4208fc
sub ecx, 0x196
je 0x4208e5
sub ecx, 1
jne case.default.0x42081e
or eax, 0x20
or dword [esi + 0x138], 0x80000400
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x138], 0x40000400
or eax, 0x20000000
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
or dword [esi + 0x138], 0x400
or eax, 0x20000020
or dword [esi + 0x13c], 1
mov dword [esi + 0x130], eax
jmp case.default.0x42081e
cmp ecx, 0xabcdabcd
jne case.default.0x42081e
or dword [esi + 0x13c], 0x200
cmp dword [esi + 0xa4], 4
jne 0x42096c
cmp dword [esi + 0x98], 5
jne 0x42096c
cmp dword [esi + 0x9c], 0
jne 0x420950
cmp dword [esi + 0x140], 1
jmp 0x420960
cmp dword [esi + 0x140], 1
jne 0x42096c
test byte [esi + 0x130], 0x40
jne 0x42096c
or dword [esi + 0x134], 0x80
pop esi
pop ebp
ret 4