Function at 0x4c43f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e8
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xfe
mov dword [ebp - 0x8e8], eax
xor esi, esi
lea eax, [ebp - 0x1a2]
xor edx, edx
push esi
push eax
mov dword [ebp - 0x8e4], ecx
mov word [ebp - 0x1a4], dx
call fcn.004e8ba0
push 0xfe
lea edx, [ebp - 0x2a2]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x2a4], cx
call fcn.004e8ba0
push 0x110
lea eax, [ebp - 0x7b4]
push esi
push eax
call fcn.004e8ba0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0x24
lea ecx, [ebp - 0x7b8]
push ecx
mov dword [ebp - 0x7b8], 0x114
call edi
push 0x11c
lea edx, [ebp - 0x8d4]
push esi
push edx
call fcn.004e8ba0
add esp, 0xc
lea eax, [ebp - 0x8d4]
push eax
mov dword [ebp - 0x8d4], 0x11c
call edi
cmp dword [ebp - 0x8d0], 6
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jb 0x4c41bc
lea edx, [ebp - 0x2a4]
lea ecx, [ebp - 0x1a4]
call fcn.004a6340
xor eax, eax
jmp 0x4c41a0
movzx ecx, word [ebp + eax - 0x2a4]
mov word [eax + 0x56d8c8], cx
add eax, 2
cmp cx, si
jne 0x4c41a0
jmp 0x4c425d
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4c41ff
cmp al, 5
jne 0x4c41ff
lea ebx, [ebp - 0x2a4]
lea ecx, [ebp - 0x1a4]
call fcn.004a5ea0
xor eax, eax
movzx ecx, word [ebp + eax - 0x2a4]
mov word [eax + 0x56d8c8], cx
add eax, 2
cmp cx, si
jne 0x4c41e0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x4c425d
xor eax, eax
movzx ecx, word [eax + str.Windows]
mov word [ebp + eax - 0x1a4], cx
add eax, 2
cmp cx, si
jne 0x4c4201
lea eax, [ebp - 0x7a4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4c4221
sub eax, edx
sar eax, 1
je 0x4c425d
lea ecx, [ebp - 0x7a4]
push ecx
lea edx, [ebp - 0x2a4]
push 0x5252a8
push edx
call ebx
lea eax, [ebp - 0x7a4]
push eax
push 0x54b3ac
push 0x56d8c8
call ebx
add esp, 0x18
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x1a4]
mov word [eax + 0x56d808], cx
add eax, 2
cmp cx, si
jne 0x4c4260
push 0x3e
lea edx, [ebp - 0xa2]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0xa4], cx
call fcn.004e8ba0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
add ecx, 0xfffffffc
cmp ecx, 0xe
ja case.0x4c42b6.5
movzx edx, byte [ecx + 0x4c4788]
jmp dword [edx*4 + 0x4c4770]
shr eax, 0xa
dec eax
cmp eax, 4
ja case.default.0x4c42ca
jmp dword [eax*4 + 0x4c4798]
xor eax, eax
jmp 0x4c42e0
movzx ecx, word [eax + str.CHINESE_TRADITIONAL]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c42e0
jmp case.default.0x4c42ca
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.CHINESE_SIMPLIFIED]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c4300
jmp case.default.0x4c42ca
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.CHINESE_HONGKONG]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c4320
jmp case.default.0x4c42ca
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.CHINESE_SINGAPORE]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c4340
jmp case.default.0x4c42ca
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.CHINESE_MACAU]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c4360
jmp case.default.0x4c42ca
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.ENGLISH]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c4380
jmp case.default.0x4c42ca
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.JAPANESE]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c43a0
jmp case.default.0x4c42ca
xor eax, eax
jmp 0x4c43c0
movzx ecx, word [eax + str.KOREAN]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c43c0
jmp case.default.0x4c42ca
xor eax, eax
jmp 0x4c43e0
movzx ecx, word [eax + str.FRENCH]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c43e0
jmp case.default.0x4c42ca
xor eax, eax
jmp 0x4c4400
movzx ecx, word [eax + 0x51c514]
mov word [ebp + eax - 0xa4], cx
add eax, 2
cmp cx, si
jne 0x4c4400
mov edi, 0x200
call fcn.004bc0d0
test eax, eax
je 0x4c442a
mov edi, 0x100
lea eax, [ebp - 0x8d8]
push eax
or edi, 1
push edi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersion_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x8d8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c45d0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x8dc]
push edx
mov dword [ebp - 0x62], eax
mov dword [ebp - 0x5e], eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov dword [ebp - 0x52], eax
mov dword [ebp - 0x4e], eax
mov dword [ebp - 0x4a], eax
mov word [ebp - 0x46], ax
lea eax, [ebp - 0x64]
push eax
push esi
xor ecx, ecx
push esi
mov word [ebp - 0x64], cx
mov ecx, dword [ebp - 0x8d8]
push str.CurrentVersion
mov ebx, 0x20
push ecx
mov dword [ebp - 0x8dc], ebx
call edi
xor eax, eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x8dc]
push eax
lea ecx, [ebp - 0x44]
push ecx
push esi
xor edx, edx
push esi
mov word [ebp - 0x44], dx
mov edx, dword [ebp - 0x8d8]
push str.ReleaseId
push edx
mov dword [ebp - 0x8dc], ebx
call edi
xor eax, eax
lea ecx, [ebp - 0x8dc]
push ecx
lea edx, [ebp - 0x24]
push edx
push esi
push esi
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov eax, dword [ebp - 0x8d8]
push str.CurrentBuildNumber
push eax
mov dword [ebp - 0x8dc], ebx
call edi
mov eax, dword [ebp - 0x8d8]
lea ecx, [ebp - 0x8dc]
push ecx
lea edx, [ebp - 0x8e0]
push edx
push esi
push esi
push 0x54b568
push eax
mov dword [ebp - 0x8e0], esi
mov dword [ebp - 0x8dc], 4
call edi
mov edx, dword [ebp - 0x8e0]
cmp edx, esi
jbe 0x4c4587
lea eax, [ebp - 0x24]
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4c4560
sub eax, edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x24]
push 0x54b570
push ecx
call edi
add esp, 0xc
jmp 0x4c458d
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
call fcn.004bbf40
test eax, eax
je 0x4c45a0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x44]
push eax
jmp 0x4c45a8
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x64]
push edx
push str._s___s_
push 0x56d988
call edi
mov eax, dword [ebp - 0x8d8]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp - 0x8d8], esi
push 0x3fe
lea edx, [ebp - 0x6a2]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x6a4], cx
call fcn.004e8ba0
lea eax, [ebp - 0xa4]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4c45f7
sub eax, edx
sar eax, 1
je 0x4c46cf
call fcn.004bc0d0
test eax, eax
je 0x4c4672
call fcn.004bbf40
test eax, eax
je 0x4c4647
push 0x56d988
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0x6a4]
push str._s_x64__t____s__s_
push edx
call ebx
add esp, 0x14
jmp 0x4c4740
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x1a4]
push edx
lea eax, [ebp - 0x6a4]
push str._s_x64__t____s_s
push eax
call ebx
add esp, 0x14
jmp 0x4c4740
call fcn.004bbf40
test eax, eax
je 0x4c46a4
push 0x56d988
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0x1a4]
push edx
lea eax, [ebp - 0x6a4]
push str._s_t____s__s_
push eax
call ebx
add esp, 0x14
jmp 0x4c4740
lea ecx, [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x6a4]
push str._s_t____s_s
push ecx
call ebx
add esp, 0x14
jmp 0x4c4740
call fcn.004bc0d0
test eax, eax
je 0x4c470b
call fcn.004bbf40
test eax, eax
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x6a4]
je 0x4c46fb
push 0x56d988
push edx
push str._s_x64___s_
push eax
jmp 0x4c473b
lea ecx, [ebp - 0x2a4]
push ecx
push edx
push str._s_x64__s
push eax
jmp 0x4c473b
call fcn.004bbf40
lea ecx, [ebp - 0x1a4]
lea edx, [ebp - 0x6a4]
test eax, eax
je 0x4c472d
push 0x56d988
push ecx
push str._s__s_
jmp 0x4c473a
lea eax, [ebp - 0x2a4]
push eax
push ecx
push 0x51c508
push edx
call ebx
add esp, 0x10
mov esi, dword [ebp - 0x8e4]
mov ebx, dword [ebp - 0x8e8]
push 0xcb
lea edi, [ebp - 0x6a4]
call fcn.004c2ef0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret