Function at 0x409460
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xcd0]
sub esp, 0xcd0
push 0xffffffffffffffff
push 0x4428d1
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x466df4]
xor eax, ebp
mov dword [ebp + 0xccc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push pe_nt_image_headers32
lea eax, [ebp + 0x894]
mov dword [0x468c1c], 0
push 0
push eax
mov dword [ebp - 0x10], 0x208
call fcn.00424c20
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp + 0x890]
add esp, 0xc
mov dword [ebp + 0x890], 0x114
push eax
call edi
mov eax, dword [ebp + 0x8a0]
mov edx, dword [ebp + 0x894]
mov ecx, dword [ebp + 0x898]
mov esi, dword [ebp + 0x89c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x468c20], edx
mov dword [0x468c24], ecx
mov dword [0x468c28], esi
sub eax, 1
je 0x40993f
sub eax, 1
jne 0x4099a8
mov dword [0x46541c], 6
mov dword [0x468c10], 2
mov dword [0x468c14], 3
mov dword [0x468c38], eax
cmp edx, 6
jb 0x409620
cmp ecx, 2
jb 0x409620
push eax
mov byte [ebp - 0x60], al
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x58], vtable.SmartCOMPointer_struct_IWbemLocator_.0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], vtable.SmartCOMPointer_struct_IWbemServices_.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x38], ax
mov dword [ebp - 0x34], eax
push 0x465210
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], eax
call fcn.00409db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
test al, al
je 0x409602
cmp dword [ebp - 0x34], 4
sbb eax, eax
and eax, dword [ebp - 0x34]
mov dword [0x468c38], eax
movzx eax, word [ebp - 0x40]
mov dword [0x468c20], eax
movzx eax, word [ebp - 0x3e]
mov dword [0x468c24], eax
movzx eax, word [ebp - 0x3c]
mov dword [0x468c28], eax
movzx eax, word [ebp - 0x3a]
mov dword [0x468c2c], eax
movzx eax, word [ebp - 0x38]
mov dword [0x468c30], eax
call fcn.00408dd0
mov ecx, dword [0x468c28]
jmp 0x409698
call fcn.00408dd0
mov dword [0x46541c], 0x17
mov dword [0x468c38], 0
jmp 0x409720
cmp edx, 4
jbe 0x409607
push 0x118
lea eax, [ebp + 0x9a8]
push 0
push eax
call fcn.00424c20
add esp, 0xc
mov dword [ebp + 0x9a4], 0x11c
lea eax, [ebp + 0x9a4]
push eax
call edi
test eax, eax
je 0x409607
movzx eax, byte [ebp + 0xabe]
mov ecx, dword [ebp + 0x9b0]
mov dword [0x468c38], eax
mov eax, dword [ebp + 0x9a8]
mov dword [0x468c20], eax
mov eax, dword [ebp + 0x9ac]
mov dword [0x468c24], eax
movzx eax, word [ebp + 0xab8]
mov dword [0x468c2c], eax
movzx eax, word [ebp + 0xaba]
mov dword [0x468c28], ecx
mov dword [0x468c30], eax
push ecx
push 0x44723c
push 0x20
push 0x468c70
call fcn.0040c670
mov esi, dword [0x468c38]
xor eax, eax
mov ebx, dword [0x468c24]
add esp, 0x10
mov edi, dword [0x468c20]
cmp esi, 4
mov ecx, 0x446c78
cmovge esi, eax
mov dword [0x468c38], esi
cmp edi, dword [ecx]
jne 0x4096ef
cmp ebx, dword [ecx + 4]
jne 0x4096ef
movzx eax, byte [ecx + 8]
xor edx, edx
cmp esi, 1
sete dl
cmp edx, eax
je 0x409900
add ecx, 0x10
cmp ecx, 0x446d78
jb 0x4096d2
mov esi, 0x17
mov dword [0x46541c], esi
cmp edi, 5
ja 0x409710
jne 0x40971a
test ebx, ebx
je 0x40971a
mov dword [0x468c40], 0x7f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp]
call fcn.00403220
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 0x4477bc
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x68], 0x4477bc
mov dword [ebp - 0x64], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 3
call edi
test eax, eax
jne 0x4098c3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp + 0xac0]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4472a4
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x409820
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4097ef
cmp eax, 2
jbe 0x4097b7
cmp eax, 7
jne 0x4097ef
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409cd8
xor edx, edx
mov word [ebp + eax + 0xac0], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409cd8
xor ecx, ecx
mov word [ebp + eax + 0xac0], cx
lea eax, [ebp + 0xac0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040cc50
lea ecx, [ebp - 0x2c]
call fcn.0040ca60
push 0
push str.preinstallation_environment
lea ecx, [ebp - 0x2c]
call fcn.0040cec0
test eax, eax
js 0x409820
or dword [0x468c1c], 4
lea eax, [ebp - 0x10]
mov dword [0x468c34], 0
push eax
lea eax, [ebp + 0xac0]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.ReleaseId
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x4098ba
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x409899
cmp eax, 2
jbe 0x409861
cmp eax, 7
jne 0x409899
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409cd8
xor edx, edx
mov word [ebp + eax + 0xac0], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409cd8
xor ecx, ecx
mov word [ebp + eax + 0xac0], cx
push 0x20
push 0xa
push 1
push 4
push 0x468c34
lea eax, [ebp + 0xac0]
push eax
push 0x465210
call fcn.0040c4c0
add esp, 0x1c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x68]
call fcn.0040c7b0
lea ecx, [ebp - 0x2c]
call fcn.0040c7b0
lea ecx, [ebp]
mov dword [ebp - 4], 4
call fcn.004032b0
mov edx, dword [0x468c20]
mov ecx, dword [0x468c24]
mov esi, dword [0x468c28]
mov dword [ebp - 4], 0xffffffff
jmp 0x4099ae
mov esi, dword [ecx + 0xc]
cmp esi, 0x12
jne 0x4096ff
mov eax, dword [0x468c28]
mov ecx, 0x446d78
cmp eax, dword [ecx]
jne 0x409927
movzx eax, byte [ecx + 4]
cmp edx, eax
je 0x409937
mov eax, dword [0x468c28]
add ecx, 0xc
cmp ecx, 0x446e68
jb 0x409916
jmp 0x4096ff
mov esi, dword [ecx + 8]
jmp 0x4096ff
mov dword [0x468c10], 1
mov dword [0x468c14], 2
cmp ecx, 0x5a
jb 0x409964
mov dword [0x46541c], 5
jmp 0x40999f
cmp ecx, 0xa
jb 0x409975
mov dword [0x46541c], 4
jmp 0x40999f
mov eax, 0x438
cmp si, ax
jbe 0x40998b
mov dword [0x46541c], 3
jmp 0x40999f
mov dword [0x468c14], 1
mov dword [0x46541c], 2
movzx eax, si
mov dword [ebp + 0x89c], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push ecx
push edx
push str._d._d._d
push 0x10
push 0x468c50
call fcn.0040c670
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x468c3c], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0x108
mov dword [0x468c18], eax
lea ecx, [ebp + 0x224]
push 2
lea eax, [ebp + 0x238]
push eax
call fcn.00403220
mov eax, dword [ebp + 0x234]
xor ecx, ecx
mov word [eax], cx
push ecx
lea ecx, [ebp + 0x224]
mov dword [ebp - 4], 5
call fcn.004084b0
mov eax, dword [ebp + 0x234]
movzx eax, word [eax]
push eax
call fcn.0042ce7d
add esp, 4
mov word [0x468c48], ax
mov eax, 0x43
mov word [0x468c4c], ax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x447320
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x409ae4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp + 0xac0]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.BootDir
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x409adb
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x409ac5
cmp eax, 2
jbe 0x409a8d
cmp eax, 7
jne 0x409ac5
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409cd8
xor edx, edx
mov word [ebp + eax + 0xac0], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409cd8
xor ecx, ecx
mov word [ebp + eax + 0xac0], cx
movzx eax, word [ebp + 0xac0]
push eax
call fcn.0042ce7d
add esp, 4
mov word [0x468c4c], ax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x88]
mov dword [0x465420], eax
movzx eax, word [ebp - 0x8c]
cmp eax, 0xc
ja case.0x409b0f.1
movzx eax, byte [eax + 0x409cf8]
jmp dword [eax*4 + 0x409ce0]
mov dword [0x465418], 1
jmp 0x409b5c
mov dword [0x465418], 4
jmp 0x409b5c
mov dword [0x465418], 5
jmp 0x409b5c
mov dword [0x465418], 8
jmp 0x409b5c
mov dword [0x465418], 9
jmp 0x409b5c
mov dword [0x465418], 0
cmp dword [0x4689ac], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x409b9b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push eax
call dword [0x4689ac]
test eax, eax
je 0x409b9b
mov eax, dword [0x465418]
mov edx, 0xaa64
cmp word [ebp - 0x1c], dx
mov ecx, 9
cmove eax, ecx
mov dword [0x465418], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x409bc0
cmp dword [ebp - 0x24], 0
je 0x409bc0
or dword [0x468c1c], 1
push 0
push 0x108
push 2
lea eax, [ebp + 0x45c]
push eax
lea ecx, [ebp + 0x448]
call fcn.00403220
mov eax, dword [ebp + 0x458]
xor ecx, ecx
mov word [eax], cx
push ecx
push 0x108
push 2
lea eax, [ebp + 0x680]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp + 0x66c]
call fcn.00403220
mov eax, dword [ebp + 0x67c]
xor ecx, ecx
mov word [eax], cx
push ecx
push ecx
lea ecx, [ebp + 0x448]
mov byte [ebp - 4], 7
call fcn.00407f10
test al, al
je 0x409c80
push 0
push 0x446c34
push str.writableCheck
push dword [ebp + 0x458]
lea ecx, [ebp + 0x66c]
call fcn.00408210
test al, al
je 0x409c80
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x67c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x409c79
push 0
mov byte [0x465424], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x409c80
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00405140
lea ecx, [ebp + 0x66c]
mov byte [ebp - 4], 8
call fcn.004032b0
lea ecx, [ebp + 0x448]
mov byte [ebp - 4], 9
call fcn.004032b0
lea ecx, [ebp + 0x224]
mov dword [ebp - 4], 0xa
call fcn.004032b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xccc]
xor ecx, ebp
call fcn.00422f50
lea esp, [ebp + 0xcd0]
pop ebp
ret
call fcn.004239c8
nop dword [eax]
push ss
wait
inc eax
add byte [edx], bh
wait
inc eax
add byte [esi], ch
wait
inc eax
add byte [edx], ah
wait
inc eax
add byte [esi - 0x65], al
inc eax
add byte [edx - 0x65], dl
inc eax
add byte [eax], al
add eax, 0x1050505
add al, byte [84214533]
add al, 204
int3