Function at 0x402120
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2474
call fcn.004a9b70
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x61f]
push esi
push eax
mov byte [ebp - 0x620], 0
call fcn.004a3190
add esp, 0xc
mov dword [ebp - 0x2448], 0x104
mov dword [ebp - 0x242c], esi
cmp dword [0x4cd38c], esi
je 0x402175
call fcn.0048fcc0
lea ecx, [ebp - 0x2430]
push ecx
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats
push 0x80000001
mov dword [0x4cd38c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x40257c
lea edx, [ebp - 0x2470]
push edx
lea eax, [ebp - 0x2450]
push eax
lea ecx, [ebp - 0x2458]
push ecx
lea edx, [ebp - 0x2460]
push edx
lea eax, [ebp - 0x2454]
push eax
lea ecx, [ebp - 0x244c]
push ecx
lea edx, [ebp - 0x245c]
push edx
lea eax, [ebp - 0x242c]
push eax
mov eax, dword [ebp - 0x2430]
push esi
lea ecx, [ebp - 0x2448]
push ecx
lea edx, [ebp - 0x620]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x242c], esi
je 0x40257c
mov dword [ebp - 0x2438], esi
mov dword [ebp - 0x2434], esi
mov esi, dword [ebp - 0x2438]
mov eax, 0xff
lea ecx, [ebp - 0x2468]
push ecx
mov dword [ebp - 0x2444], eax
mov dword [ebp - 0x2440], eax
lea edx, [ebp - 0x2444]
push edx
lea eax, [ebp - 0xc28]
push eax
mov eax, dword [ebp - 0x2430]
push 0
lea ecx, [ebp - 0x2440]
push ecx
lea edx, [ebp - 0x318]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [ebp - 0x2434]
mov edx, ecx
inc esi
inc ecx
mov dword [ebp - 0x2438], esi
mov dword [ebp - 0x2434], ecx
cmp edx, dword [ebp - 0x242c]
ja 0x40257c
cmp eax, 0x103
je 0x40257c
test eax, eax
jne 0x40220c
lea eax, [ebp - 0xb28]
push eax
lea ecx, [ebp - 0x218]
lea edx, [ebp - 0x318]
call fcn.0048ee50
add esp, 4
test eax, eax
je 0x40220c
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40220c
xor ebx, ebx
xor edi, edi
cmp dword [0x4cd38c], ebx
jle 0x402302
jmp 0x4022d0
lea esi, [ebp - 0x728]
call fcn.0048fb30
mov edx, esi
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.00483b10
test eax, eax
jne 0x4022f1
lea ebx, [eax + 1]
inc edi
cmp edi, dword [0x4cd38c]
jl 0x4022d0
test ebx, ebx
jne 0x40220c
push 0x1400
lea ecx, [ebp - 0x2428]
push 0
push ecx
call fcn.004a3190
lea edx, [ebp - 0x110]
add esp, 0xc
push edx
lea ecx, [ebp - 0x218]
call fcn.0047f1b0
lea eax, [ebp - 0x110]
add esp, 4
push eax
lea ecx, [ebp - 0x2428]
call fcn.0048e9d0
add esp, 4
lea ecx, [ebp - 0x1c28]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0x1028]
call fcn.00401000
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp - 0xb28]
push edx
call esi
test eax, eax
jns 0x4023df
lea eax, [ebp - 0x1828]
push eax
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0xb28]
call fcn.00401000
lea ecx, [ebp - 0xb28]
push ecx
call esi
test eax, eax
jns 0x4023df
lea edx, [ebp - 0x2428]
push edx
call esi
test eax, eax
jne 0x4023c3
lea eax, [ebp - 0x110]
push eax
call fcn.0047f140
movzx ecx, ax
add esp, 4
lea edx, [ebp + ecx - 0x110]
push edx
jmp 0x4023ca
lea eax, [ebp - 0x2428]
push eax
mov edx, 0x7ffffffe
mov eax, 0x400
lea ecx, [ebp - 0xb28]
call fcn.00401000
lea ecx, [ebp - 0x218]
push ecx
call esi
test eax, eax
jle 0x40220c
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x518]
call fcn.00401000
mov eax, 0x200
lea ecx, [ebp - 0x518]
cmp byte [ecx], 0
je 0x402420
inc ecx
dec eax
jne 0x402415
jmp 0x402448
test eax, eax
je 0x402448
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x518]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x200
lea eax, [ebp - 0x518]
cmp byte [eax], 0
je 0x40245e
inc eax
dec edx
jne 0x402453
jmp 0x402488
test edx, edx
je 0x402488
mov ecx, 0x200
sub ecx, edx
lea edx, [ebp - 0x318]
mov eax, 0x200
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x518]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x200
lea ecx, [ebp - 0x518]
cmp byte [ecx], 0
je 0x40249e
inc ecx
dec eax
jne 0x402493
jmp 0x4024c6
test eax, eax
je 0x4024c6
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4b1924
lea ecx, [ebp + ecx - 0x518]
mov edx, 0x7fffffff
call fcn.00401000
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0x243c]
push eax
push ecx
push 0
lea edx, [ebp - 0x518]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402508
push str.Type
lea esi, [ebp - 0x243c]
call fcn.0048e640
add esp, 4
cmp eax, 1
ja 0x40220c
lea eax, [ebp - 0x318]
push eax
call fcn.004026e0
add esp, 4
cmp dword [0x4d2a94], 0
mov esi, eax
jle 0x40253a
mov edx, 0x4b1938
lea ecx, [ebp - 0x1c28]
call fcn.0047dee0
test eax, eax
jne 0x40220c
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40220c
push esi
push 0x4b0
lea edx, [ebp - 0x2028]
push edx
lea eax, [ebp - 0x318]
push eax
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0xb28]
call fcn.0048f730
add esp, 0x10
jmp 0x40220c
mov ecx, dword [ebp - 0x2430]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [0x4cd38c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret