Function at 0x41f5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x140
push 0
push esi
call fcn.004cddb0
push 0x98
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.004cddb0
push 0x90
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1b4], 0x9c
push 0
push eax
call fcn.004cddb0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x24
mov dword [ebp - 0x118], 0x94
push str.KERNEL32.DLL
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41f7d4
push 0x53e788
push eax
call edi
test eax, eax
je 0x41f7d4
lea ecx, [ebp - 0x1b4]
push ecx
call eax
test eax, eax
je 0x41f7d4
mov ebx, dword [ebp - 0x11c]
mov ecx, ebx
and ecx, 1
mov al, bl
mov edx, ecx
or edx, 2
and al, 2
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 0x80
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and eax, 0x200
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and eax, 0x400
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x100
and al, 0x40
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and eax, 0x100
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000
and eax, 0x4000
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80000
and eax, 0x2000
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x100000
and eax, 0x1000
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x200000
and al, 4
cmove edx, ecx
test ebx, 0x8000
je 0x41f733
or edx, 0x10000000
movzx eax, byte [ebp - 0x11a]
xor ecx, ecx
mov dword [esi + 0x130], edx
sub eax, 1
je 0x41f75d
sub eax, 1
je 0x41f756
sub eax, 1
jne 0x41f762
lea ecx, [eax + 2]
jmp 0x41f762
mov ecx, 3
jmp 0x41f762
mov ecx, 1
push esi
push 1
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x13c], ecx
push dword [ebp - 0x11e]
push dword [ebp - 0x120]
push eax
push dword [ebp - 0x1a8]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.00420630
cmp dword [esi + 0x13c], 1
je 0x41fa11
test byte [ebp - 0x11c], 0xa2
jne 0x41fa11
or dword [esi + 0x134], 0x20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 4
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41f92f
push 0x53e788
push eax
call edi
test eax, eax
je 0x41f7fa
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x41f7fc
xor eax, eax
test eax, eax
je 0x41f92f
mov ecx, dword [ebp - 0x108]
xor edi, edi
cmp ecx, 2
jne 0x41f8b6
lea ecx, [ebp - 0x104]
xor edx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41f820
sub ecx, edi
je 0x41f873
xor edi, edi
cmp byte [ebp - 0x104], dl
je 0x41f85f
nop word [eax + eax]
movsx eax, byte [ebp + edi - 0x104]
push eax
call fcn.004d56f1
add esp, 4
test eax, eax
jne 0x41f85f
inc edi
cmp byte [ebp + edi - 0x104], al
jne 0x41f840
lea eax, [ebp - 0x104]
add eax, edi
push eax
call fcn.004d58de
add esp, 4
movzx edx, ax
mov ebx, dword [ebp - 0x114]
movzx edi, dx
mov edx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x110]
xor eax, eax
push esi
push 0
push dword [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x104]
push eax
push edx
push ecx
push ebx
call fcn.00420630
cmp dword [ebp - 0x108], 2
jne 0x41fa11
jmp 0x41f9ec
mov ebx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x10c]
cmp ecx, 1
jne 0x41f882
cmp ebx, 4
jne 0x41f8e0
lea eax, [edx - 0x3b7]
cmp eax, 0x81
ja 0x41f8dd
mov edi, ecx
jmp 0x41f882
cmp ebx, 4
mov ecx, dword [ebp - 0x110]
jne 0x41f912
call fcn.00420f30
test eax, eax
je 0x41f8f8
mov edi, 2
jmp 0x41f888
cmp ecx, 0xa
jae 0x41f912
cmp edx, 0x4be
jb 0x41f912
mov edi, 2
lea eax, [edi + 3]
jmp 0x41f88a
cmp ebx, 4
jne 0x41f888
call fcn.00420f50
test eax, eax
mov eax, 1
cmovne edi, eax
jmp 0x41f888
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fa29
push 0x53e77c
push eax
call edi
test eax, eax
je 0x41fa29
call eax
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], edi
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f9cd
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x1bc], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c0]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f9c1
lea eax, [ebp - 0x84]
push eax
call fcn.004d58de
add esp, 4
mov edi, eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
push 2
push 0
push 0
push 0x518188
push edi
movzx eax, bx
shr eax, 8
push eax
movzx eax, bl
push eax
call fcn.00420630
push esi
call fcn.0041fa40
cmp dword [esi + 0x13c], 1
je 0x41fa0b
test byte [ebp - 0x11c], 0xa2
jne 0x41fa0b
or dword [esi + 0x134], 0x20
push esi
call fcn.0041fb90
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 4