Function at 0x428010
Capabilities:
Get common file path
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x728]
sub esp, 0x728
push 0xffffffffffffffff
push 0x46943d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x488540]
xor eax, ebp
mov dword [ebp + 0x724], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290e5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 4
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 5
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x4290f9
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 6
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x429103
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 7
call fcn.00431d31
mov ecx, eax
test ecx, ecx
je 0x42910d
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 8
lea eax, [ebp + 0x14]
push 0x100
push 0
push eax
mov dword [ebp], 0x11c
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x10], 0
call fcn.0044e5d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor eax, eax
mov dword [ebp + 0x114], eax
add esp, 0xc
mov dword [ebp + 0x118], eax
mov eax, dword [0x48cd50]
test eax, eax
jne 0x4281d7
push str.ntdll.dll
call ebx
test eax, eax
je 0x4281ce
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x48cd50], eax
jmp 0x4281d3
mov eax, dword [0x48cd50]
test eax, eax
je 0x4281dd
lea ecx, [ebp]
push ecx
call eax
lea ecx, [ebp - 0x34]
call fcn.00429210
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
jne case.0x4286f4.29
mov eax, dword [ebp + 0x10]
sub eax, 1
je 0x428b28
sub eax, 1
jne case.0x4286f4.29
mov ecx, dword [ebp + 4]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ecx, 3
jne 0x42822e
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push str.Windows_NT3._d
push eax
call fcn.00408d30
add esp, 0xc
jmp 0x428438
mov eax, dword [ebp + 8]
cmp ecx, 4
jne 0x428252
test eax, eax
jne 0x428425
push 0xb
push str.Windows_NT4
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp ecx, 5
jne 0x428321
test eax, eax
jne 0x428273
push 0xc
push str.Windows_2000
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 1
jne 0x42828c
push 0xa
push str.Windows_XP
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 2
jne 0x428425
push 0x59
call edi
test eax, eax
je 0x4282b6
mov ecx, 0x16
mov eax, str.Windows_Server_2003_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
mov eax, 0x2000
cmp word [ebp + 0x118], ax
jne 0x4282dd
mov ecx, 0x1b
mov eax, str.Windows_Storage_Server_2003
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp byte [ebp + 0x11a], 1
jne 0x428308
call fcn.00427f30
test eax, eax
je 0x428308
mov ecx, 0xa
mov eax, str.Windows_XP
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
mov ecx, 0x13
mov eax, str.Windows_Server_2003
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp ecx, 6
jne 0x4284a1
test eax, eax
jne 0x428369
cmp byte [ebp + 0x11a], 1
je 0x428350
mov ecx, 0x13
mov eax, str.Windows_Server_2008
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
mov ecx, 0xd
mov eax, str.Windows_Vista
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 1
jne 0x4283a8
cmp byte [ebp + 0x11a], al
je 0x42838f
mov ecx, 0x16
mov eax, str.Windows_Server_2008_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
mov ecx, 9
mov eax, str.Windows_7
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 2
jne 0x4283e2
cmp byte [ebp + 0x11a], 1
je 0x4283cc
mov ecx, 0x13
mov eax, str.Windows_Server_2012
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
mov ecx, 9
mov eax, str.Windows_8
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 3
jne 0x42841c
cmp byte [ebp + 0x11a], 1
je 0x428406
mov ecx, 0x16
mov eax, str.Windows_Server_2012_R2
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
mov ecx, 0xb
mov eax, str.Windows_8.1
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 4
je 0x4284aa
push eax
push ecx
lea eax, [ebp - 0x14]
push str.Windows_NT__d._d
push eax
call fcn.00408d30
add esp, 0x10
mov eax, dword [ebp + 4]
cmp eax, 6
jb 0x4288cf
push str.kernel32.dll
call ebx
test eax, eax
je case.0x4286f4.29
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.0x4286f4.29
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push ecx
push 0
push 0
push dword [ebp + 8]
push dword [ebp + 4]
call eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x14
ja 0x4286d2
je 0x4286be
dec eax
cmp eax, 0x12
ja case.0x4286f4.29
jmp dword [eax*4 + 0x429118]
cmp ecx, 0xa
jb 0x428425
cmp byte [ebp + 0x11a], 1
je 0x42851b
mov eax, dword [ebp + 0xc]
cmp eax, 0x65b8
jb 0x4284d6
mov ecx, 0x13
mov eax, str.Windows_Server_2025
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 0x4f78
jb 0x4284f6
mov ecx, 0x13
mov eax, str.Windows_Server_2022
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp eax, 0x4563
mov eax, str.Windows_Server_2019
jae 0x428507
mov eax, str.Windows_Server_2016
mov ecx, 0x13
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
cmp dword [ebp + 0xc], 0x55ec
mov ecx, 0xa
mov eax, str.Windows_11
jae 0x428533
mov eax, str.Windows_10
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
jmp 0x428438
push 8
push str.Business
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xa
push str.Business_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xe
push str.Cluster_Server
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x1e
push str.Datacenter__Full_installation_
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x25
push str.Datacenter__Server_Core_installation_
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xa
push str.Enterprise
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x1e
push str.Enterprise__Full_installation_
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x25
push str.Enterprise__Server_Core_installation_
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x2f
push str.Datacenter_Enterprise_for_Itanium_based_Systems
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xa
push str.Home_Basic
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xc
push str.Home_Basic_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xc
push str.Home_Premium
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xb
push str.Home_Server
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x15
push str.Small_Business_Server
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x23
push str.Server_Standard__full_installation_
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x23
push str.Server_Standard__core_installation_
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 7
push str.Starter
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 8
push str.Ultimate
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xa
push str.Web_Server
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x16
push str.Storage_Server_Express
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp eax, 0x31
ja 0x428817
je 0x4287d9
add eax, 0xffffffeb
cmp eax, 0x1b
ja case.0x4286f4.29
movzx eax, byte [eax + 0x42918c]
jmp dword [eax*4 + 0x429164]
push 0xc
push str.Enterprise_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xe
push str.Home_Premium_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x19
push str.Server_for_Small_Business
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x1d
push str.Small_Business_Server_Premium
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x19
push str.Storage_Server_Enterprise
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x17
push str.Storage_Server_Standard
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x18
push str.Storage_Server_Workgroup
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0xa
push str.Ultimate_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp dword [ebp + 4], 6
jne 0x4287c0
cmp dword [ebp + 8], 2
ja 0x4287c0
mov ecx, 0xc
mov eax, str.Professional
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
mov ecx, 3
mov eax, 0x47ae40
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp dword [ebp + 4], 6
jne 0x4287fe
cmp dword [ebp + 8], 2
ja 0x4287fe
mov ecx, 0xe
mov eax, str.Professional_N
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
mov ecx, 5
mov eax, str.Pro_N
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp eax, 0xa1
ja 0x42885b
je 0x428847
sub eax, 0x3c
je 0x428833
sub eax, 1
je 0x428833
sub eax, 1
jne case.0x4286f4.29
push 0x11
push str.Essentials_Server
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x13
push str.Pro_for_Workstation
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp eax, 0xa5
ja 0x4288b0
je 0x42889c
sub eax, 0xa2
je 0x428888
sub eax, 2
jne case.0x4286f4.29
push 0x11
push str.Pro_for_Education
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x15
push str.Pro_for_Workstation_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
push 0x13
push str.Pro_for_Education_N
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp eax, 0xabcdabcd
jne case.0x4286f4.29
push 0xa
push str.Unlicensed
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp eax, 5
jne case.0x4286f4.29
mov eax, dword [ebp + 8]
test eax, eax
jne 0x428949
mov al, byte [ebp + 0x11a]
cmp al, 1
jne 0x4288fd
push 0xc
push str.Professional
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
cmp al, 3
jne case.0x4286f4.29
mov al, byte [ebp + 0x118]
lea ecx, [ebp - 0x10]
test al, al
jns 0x428923
push 0x11
push str.DataCenter_Server
call fcn.004029e0
jmp case.0x4286f4.29
test al, 2
je 0x428938
push 0xf
push str.Advanced_Server
call fcn.004029e0
jmp case.0x4286f4.29
push 6
push str.Server
call fcn.004029e0
jmp case.0x4286f4.29
cmp eax, 1
jb case.0x4286f4.29
mov eax, dword [ebp + 0x118]
test eax, 0x200
je 0x428968
push 0xc
push str.Home_Edition
jmp 0x4289a9
mov cl, byte [ebp + 0x118]
test cl, cl
jns 0x42897b
push 0x12
push str.Datacenter_Edition
jmp 0x4289a9
test cl, 2
je 0x428989
push 0x12
push str.Enterprise_Edition
jmp 0x4289a9
test eax, 0x400
je 0x428999
push 0xb
push str.Web_Edition
jmp 0x4289a9
cmp byte [ebp + 0x11a], 1
jne 0x4289b1
push 0xc
push str.Professional
lea ecx, [ebp - 0x10]
call fcn.004029e0
push 0x57
call edi
test eax, eax
je 0x428b08
push 0x208
lea eax, [ebp + 0x11c]
push 0
push eax
call fcn.0044e5d0
push 0x200
lea eax, [ebp + 0x324]
push 0
push eax
call fcn.0044e5d0
add esp, 0x18
lea eax, [ebp + 0x11c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ehomeehshell.exe
mov edi, eax
lea eax, [ebp + 0x11c]
push 0x104
push eax
call fcn.00453570
add esp, 0xc
test edi, edi
je case.0x4286f4.29
lea edx, [ebp + 0x324]
lea ecx, [ebp + 0x11c]
call fcn.0042b420
test eax, eax
je case.0x4286f4.29
lea ecx, [ebp + 0x324]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428a40
sub ecx, edx
lea eax, [ebp + 0x324]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.004029e0
mov edi, dword [ebp - 0x30]
cmp dword [edi - 0xc], 0
jl case.0x4286f4.29
push 0x47b038
push edi
call fcn.0044dba1
add esp, 8
test eax, eax
je case.0x4286f4.29
sub eax, edi
sar eax, 1
jne case.0x4286f4.29
push 0xd
push str.Media_Center
lea ecx, [ebp - 0x10]
call fcn.004029e0
push 0x4753f0
push str.5.1.
lea ecx, [ebp - 0x30]
call fcn.0041a010
push dword [ebp - 0x30]
call fcn.00457242
fld qword [0x47dce0]
lea ecx, [ebp - 0x10]
fcomp st(1)
add esp, 4
fnstsw ax
push 4
test ah, 1
jne 0x428add
push str.2002
fstp st(0)
call fcn.00408b90
jmp case.0x4286f4.29
fcomp qword [0x47dce8]
fnstsw ax
test ah, 0x41
jp 0x428af9
push str.2004
call fcn.00408b90
jmp case.0x4286f4.29
push str.2005
call fcn.00408b90
jmp case.0x4286f4.29
push 0x56
call edi
test eax, eax
je case.0x4286f4.29
push 9
push str.Tablet_PC
lea ecx, [ebp - 0x10]
call fcn.004029e0
jmp case.0x4286f4.29
mov eax, dword [ebp + 8]
test eax, eax
je 0x428b89
cmp eax, 0xa
je 0x428b52
mov ecx, 0xa
cmp eax, 0x5a
je 0x428b48
mov eax, str.Windows_9x
jmp 0x428bd9
mov eax, str.Windows_Me
jmp 0x428bd9
mov ax, word [ebp + 0xc]
mov ecx, 0x8ae
cmp ax, cx
jb 0x428b6c
mov eax, str.Windows_98_SE
mov ecx, 0xd
jmp 0x428bd9
mov ecx, 0x7d0
cmp ax, cx
jb 0x428b82
mov eax, str.Windows_98_SP1
mov ecx, 0xe
jmp 0x428bd9
mov eax, str.Windows_98
jmp 0x428bd4
mov ax, word [ebp + 0xc]
mov ecx, 0x4be
cmp ax, cx
jb 0x428ba3
mov eax, str.Windows_95_OSR2.5
mov ecx, 0x11
jmp 0x428bd9
mov ecx, 0x4bc
cmp ax, cx
jb 0x428bb9
mov eax, str.Windows_95_OSR2.1
mov ecx, 0x11
jmp 0x428bd9
mov ecx, 0x457
cmp ax, cx
jne 0x428bcf
mov eax, str.Windows_95_OSR2
mov ecx, 0xf
jmp 0x428bd9
mov eax, str.Windows_95
mov ecx, 0xa
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e0
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push dword [ebp + 4]
push str._d._d
push eax
call fcn.00408d30
movzx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push 0x47874c
push eax
call fcn.00408d30
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push str._s___s_Build__s_
push dword [ebp - 0x2c]
call fcn.00408d30
add esp, 0x30
lea ecx, [ebp + 0x14]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428c30
sub ecx, edx
lea eax, [ebp + 0x14]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.004029e0
push 0x47b0a0
push str.Service_Pack
lea ecx, [ebp - 0x38]
call fcn.0041a010
cmp dword [ebp + 4], 0xa
jb 0x428d42
lea eax, [ebp - 0x24]
mov dword [ebp - 0x3c], 1
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x64], 0x200
mov dword [ebp - 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428d42
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x524]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x428cf2
lea ecx, [ebp + 0x524]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428cd0
sub ecx, edx
lea eax, [ebp + 0x524]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.004029e0
mov esi, dword [ebp - 0x20]
cmp dword [esi - 0xc], 0
jne 0x428d42
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x524]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push str.ReleaseId
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x428d42
lea ecx, [ebp + 0x524]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428d20
sub ecx, edx
lea eax, [ebp + 0x524]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.004029e0
mov esi, dword [ebp - 0x20]
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push dword [ebp + 4]
push str._d._d
push eax
call fcn.00408d30
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0x47874c
push eax
call fcn.00408d30
add esp, 0x1c
call fcn.00427f30
test eax, eax
je 0x428d7d
mov eax, 0x47b158
jmp 0x428f1a
mov eax, dword [0x488fd4]
cmp eax, 0xffffffff
jne 0x428df4
push str.kernel32.dll
mov dword [0x488fd4], 0
call ebx
test eax, eax
je 0x428def
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428def
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x60]
push ecx
call eax
cmp word [ebp - 0x60], 5
jne 0x428def
mov dword [0x488fd4], 1
mov eax, str.ARM32
mov ecx, 5
jmp 0x428f1f
mov eax, dword [0x488fd4]
test eax, eax
je 0x428e07
mov eax, str.ARM32
mov ecx, 5
jmp 0x428f1f
mov eax, dword [0x488fd0]
cmp eax, 0xffffffff
jne 0x428e7e
push str.kernel32.dll
mov dword [0x488fd0], 0
call ebx
test eax, eax
je 0x428e79
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428e79
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x60]
push ecx
call eax
cmp word [ebp - 0x60], 0xc
jne 0x428e79
mov dword [0x488fd0], 1
mov eax, str.ARM64
mov ecx, 5
jmp 0x428f1f
mov eax, dword [0x488fd0]
test eax, eax
je 0x428e91
mov eax, str.ARM64
mov ecx, 5
jmp 0x428f1f
mov eax, dword [0x488fd8]
cmp eax, 0xffffffff
jne 0x428f05
push str.kernel32.dll
mov dword [0x488fd8], 0
call ebx
test eax, eax
je 0x428f00
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428f00
xor ecx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x60]
push ecx
call eax
cmp word [ebp - 0x60], 6
jne 0x428f00
mov dword [0x488fd8], 1
mov eax, str.IA64
mov ecx, 4
jmp 0x428f1f
mov eax, dword [0x488fd8]
test eax, eax
je 0x428f15
mov eax, str.IA64
mov ecx, 4
jmp 0x428f1f
mov eax, 0x47500c
mov ecx, 3
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004029e0
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
cmp dword [eax - 0xc], 0
je 0x428f43
mov esi, dword [ebp - 0x28]
push esi
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push eax
jmp 0x428f7e
cmp dword [esi - 0xc], 0
mov esi, dword [ebp - 0x28]
push esi
push edi
push dword [ebp - 0x18]
je 0x428f56
push dword [ebp - 0x20]
jmp 0x428f60
mov eax, dword [ebp - 0x38]
cmp dword [eax - 0xc], 0
je 0x428f78
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str._s__s__s___s_Build__s____s_
push dword [ebp - 0x2c]
call fcn.00408d30
add esp, 0x20
jmp 0x428f8e
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str._s__s___s_Build__s____s_
push dword [ebp - 0x2c]
call fcn.00408d30
add esp, 0x1c
mov byte [ebp - 4], 7
or ebx, 0xffffffff
mov edx, dword [ebp - 0x30]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428faf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428fcd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428feb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x429006
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x429021
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42903f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42905d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42907b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x42909a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x724]
xor ecx, ebp
call fcn.0044c3da
lea esp, [ebp + 0x728]
pop ebp
ret
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
aad 0x9d
std
jmp [eax + 5]
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
push 0x80004005
call fcn.00402eb0
nop
xchg esi, eax
xchg byte [edx], al
test byte [ebp - 0x79e1ffbe], 0x42
add byte [esi + 167789189], ah
xchg byte [edx], al
inc edx
test dword [edx], eax
pop edx
xchg byte [edx], al
jle 0x4290bb
inc edx
add byte [esi - 0x7a], al
inc edx
add byte [edx - 0x7dffbd7b], bh
xchg byte [edx], al
xchg edx, eax
test dword [edx], eax
outsb dx, byte [esi]
xchg byte [edx], al
into
test dword [edx], eax
loop 0x4290d7
inc edx
add byte [esi - 0x7b], dl
inc edx
add byte [edx + 0x6a004286], ch
test dword [edx], eax
xor al, byte [esi - 0x78a0ffbe]
inc edx
add byte [ebx - 0x79], dh
inc edx
add byte [ebx - 0x79], cl
inc edx
add byte [ebx], ah
xchg dword [edx], eax
aaa
xchg dword [edx], eax
ja 0x873d91c0
inc edx
add byte [edi - 0x64ffbd79], al
xchg dword [edx], eax
and ecx, dword [edx + eax*2 + 0x2010000]
add eax, dword [eax + 151586566]
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [ecx], ecx
or dword [eax], ecx
int3