Function at 0x41fa40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x140
push 0
push esi
mov dword [ebp - 0x1bc], ecx
call fcn.0051a780
push 0x98
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.0051a780
push 0x90
lea eax, [ebp - 0x114]
mov dword [ebp - 0x1b4], 0x9c
push 0
push eax
call fcn.0051a780
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x24
mov dword [ebp - 0x118], 0x94
push str.KERNEL32.DLL
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fc50
push 0x597be0
push eax
call edi
test eax, eax
je 0x41fc50
lea ecx, [ebp - 0x1b4]
push ecx
call eax
test eax, eax
je 0x41fc50
mov ebx, dword [ebp - 0x11c]
mov ecx, ebx
and ecx, 1
mov al, bl
mov edx, ecx
or edx, 2
and al, 2
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x10
and al, 0x10
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x20
and al, 0x80
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40
and eax, 0x200
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and eax, 0x400
mov al, bl
cmove edx, ecx
mov ecx, edx
or ecx, 0x100
and al, 0x40
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x200
and eax, 0x100
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000
and eax, 0x4000
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x80000
and eax, 0x2000
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x100000
and eax, 0x1000
mov al, bl
cmove ecx, edx
mov edx, ecx
or edx, 0x200000
and al, 4
cmove edx, ecx
test ebx, 0x8000
je 0x41fba9
or edx, 0x10000000
movzx eax, byte [ebp - 0x11a]
xor ecx, ecx
mov dword [esi + 0x130], edx
sub eax, 1
je 0x41fbd3
sub eax, 1
je 0x41fbcc
sub eax, 1
jne 0x41fbd8
lea ecx, [eax + 2]
jmp 0x41fbd8
mov ecx, 3
jmp 0x41fbd8
mov ecx, 1
push esi
push 1
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov dword [esi + 0x13c], ecx
push dword [ebp - 0x11e]
mov ecx, dword [ebp - 0x1bc]
push dword [ebp - 0x120]
push eax
push dword [ebp - 0x1a8]
push dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call fcn.00420a50
cmp dword [esi + 0x13c], 1
je 0x41fe3f
test byte [ebp - 0x11c], 0xa2
jne 0x41fe3f
or dword [esi + 0x134], 0x20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518799
mov esp, ebp
pop ebp
ret 4
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fd57
push 0x597be0
push eax
call edi
test eax, eax
je 0x41fc76
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x41fc78
xor eax, eax
test eax, eax
je 0x41fd57
mov ecx, dword [ebp - 0x108]
xor edi, edi
cmp ecx, 2
jne 0x41fce1
lea ecx, [ebp - 0x104]
call fcn.00421570
movzx edi, ax
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x110]
xor eax, eax
push esi
push 0
push dword [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x104]
push eax
push ebx
push edx
push ecx
mov ecx, dword [ebp - 0x1bc]
call fcn.00420a50
cmp dword [ebp - 0x108], 2
jne 0x41fe3f
jmp 0x41fe1a
cmp ecx, 1
jne 0x41fc9b
mov ecx, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x10c]
cmp ecx, 4
jne 0x41fd0b
lea eax, [ebx - 0x3b7]
cmp eax, 0x81
ja 0x41fd0b
mov edi, 1
jmp 0x41fca7
mov edx, dword [ebp - 0x110]
push ebx
call fcn.00421330
add esp, 4
test eax, eax
je 0x41fd25
mov edi, 2
jmp 0x41fcad
push ebx
call fcn.00421360
add esp, 4
test eax, eax
je 0x41fd3f
mov edi, 2
lea eax, [edi + 3]
jmp 0x41fcaf
push ebx
call fcn.00421390
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
jmp 0x41fcad
push str.KERNEL32.DLL
call ebx
test eax, eax
je 0x41fe57
push 0x597bd4
push eax
call edi
test eax, eax
je 0x41fe57
call eax
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1b8], edi
push eax
push 0x20119
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41fdf5
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
push eax
push edi
push str.CurrentBuildNumber
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41fde9
lea eax, [ebp - 0x84]
push eax
call fcn.00526a89
add esp, 4
mov edi, eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1bc]
push esi
push 0
push 2
push 0
push 0
push 0x569fa8
push edi
movzx eax, bx
shr eax, 8
push eax
movzx eax, bl
push eax
call fcn.00420a50
push esi
call fcn.0041fe70
cmp dword [esi + 0x13c], 1
je 0x41fe39
test byte [ebp - 0x11c], 0xa2
jne 0x41fe39
or dword [esi + 0x134], 0x20
push esi
call fcn.0041ffc0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518799
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00518799
mov esp, ebp
pop ebp
ret 4