Function at 0x40cd20
Capabilities:
Check os version
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4621c1
mov eax, dword fs:[0]
push eax
mov eax, 0x1114
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x1120], 0x495b38
mov dword [0x495b5c], 7
mov dword [0x495b58], 0
mov word [0x495b48], ax
mov dword [ebp - 4], eax
mov dword [0x495b74], 7
mov dword [0x495b70], eax
mov word [0x495b60], ax
mov dword [0x495b8c], 7
mov dword [0x495b88], eax
mov word [0x495b78], ax
mov dword [0x495ba4], 7
mov dword [0x495ba0], eax
mov word [0x495b90], ax
mov dword [0x495bbc], 7
mov dword [0x495bb8], eax
mov word [0x495ba8], ax
mov byte [ebp - 4], 4
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov word [0x495bc0], ax
mov word [ebp - 0xd8], ax
push 0x64
lea eax, [ebp - 0xd8]
push eax
push str.PROCESSOR_ARCHITECTURE
call esi
test eax, eax
je 0x40cdff
cmp eax, 0x64
jbe 0x40ce08
xor eax, eax
mov word [ebp - 0xd8], ax
lea eax, [ebp - 0xd8]
push eax
push str.AMD64
call fcn.0044fe43
add esp, 8
test eax, eax
sete al
mov byte [0x495bc0], al
test al, al
jne 0x40ce80
xor eax, eax
mov word [ebp - 0xd8], ax
push 0x64
lea eax, [ebp - 0xd8]
push eax
push str.PROCESSOR_ARCHITEW6432
call esi
test eax, eax
je 0x40ce4c
cmp eax, 0x64
jbe 0x40ce55
xor eax, eax
mov word [ebp - 0xd8], ax
lea eax, [ebp - 0xd8]
push eax
push str.AMD64
call fcn.0044fe43
movzx ecx, byte [0x495bc1]
add esp, 8
mov edx, 1
test eax, eax
cmove ecx, edx
mov byte [0x495bc1], cl
lea eax, [ebp - 0x1118]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [0x495b38], 0
mov dword [0x495b3c], 0
mov dword [0x495b40], 0
mov dword [0x495b44], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d31d
xor ebx, ebx
mov dword [ebp - 0x10e0], ebx
mov dword [ebp - 0x10e8], ebx
mov dword [ebp - 0x10e4], ebx
mov dword [ebp - 0x10f0], 7
mov dword [ebp - 0x1114], ebx
mov dword [ebp - 0x1110], ebx
mov dword [ebp - 0x110c], ebx
mov dword [ebp - 0x1108], ebx
mov dword [ebp - 0x10f4], ebx
mov word [ebp - 0x1104], ax
mov dword [ebp - 0x10ec], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x10dc], 0x1000
mov ecx, 0x1000
lea eax, [ebp - 0x10d8]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40cf30
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10d8]
push eax
push ecx
push ecx
push 0x46d0c4
push dword [ebp - 0x1118]
call edi
test eax, eax
je 0x40cf6b
xor edx, edx
mov word [ebp - 0x10d8], dx
jmp 0x40cf72
mov dx, word [ebp - 0x10d8]
lea ecx, [ebp - 0x10d8]
lea esi, [ecx + 2]
jmp 0x40cf80
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cf80
sub ecx, esi
sar ecx, 1
je 0x40cfa3
xor eax, eax
test dx, dx
cmove ecx, eax
push ecx
lea eax, [ebp - 0x10d8]
push eax
jmp 0x40cfaa
push 7
push str.Windows
mov ecx, 0x495b90
call fcn.004023a0
push 0xffffffffffffffff
push 0
push 0x495b90
mov ecx, 0x495ba8
call fcn.004020b0
mov dword [ebp - 0x10dc], 0x1000
mov ecx, 0x1000
lea eax, [ebp - 0x10d8]
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40cfe0
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10d8]
push eax
push ecx
push ecx
push str.CurrentBuildNumber
push dword [ebp - 0x1118]
call edi
test eax, eax
je 0x40d015
xor edx, edx
mov word [ebp - 0x10d8], dx
jmp 0x40d01c
mov dx, word [ebp - 0x10d8]
lea ecx, [ebp - 0x10d8]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d025
sub ecx, esi
sar ecx, 1
je 0x40d064
xor eax, eax
test dx, dx
cmove ecx, eax
push ecx
lea eax, [ebp - 0x10d8]
push eax
mov ecx, 0x495b78
call fcn.004023a0
lea eax, [ebp - 0x10d8]
push eax
call fcn.004505f4
add esp, 4
mov dword [0x495b40], eax
mov dword [ebp - 0x10dc], 0x1000
mov ecx, 0x1000
lea eax, [ebp - 0x10d8]
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40d080
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10d8]
push eax
push ecx
push ecx
push str.CurrentVersion
push dword [ebp - 0x1118]
call edi
test eax, eax
je 0x40d0b3
xor eax, eax
mov word [ebp - 0x10d8], ax
lea ecx, [ebp - 0x10d8]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d0c0
sub ecx, edx
sar ecx, 1
je 0x40d124
lea eax, [ebp - 0x10d8]
push eax
call fcn.004505f4
lea edx, [ebp - 0x10d8]
add esp, 4
mov ebx, eax
xor ecx, ecx
lea esi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40d0f0
sub edx, esi
sar edx, 1
test edx, edx
jle 0x40d124
jmp 0x40d110
cmp word [ebp + ecx*2 - 0x10d8], 0x2e
je 0x40d2da
inc ecx
cmp ecx, edx
jl 0x40d110
xor esi, esi
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10e0]
push eax
push 0
push 0
push str.CurrentMajorVersionNumber
push dword [ebp - 0x1118]
mov dword [ebp - 0x10dc], 4
call edi
test eax, eax
jne 0x40d2f3
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10e8]
push eax
push 0
push 0
push str.CurrentMinorVersionNumber
push dword [ebp - 0x1118]
mov dword [ebp - 0x10dc], 4
call edi
mov ecx, dword [ebp - 0x10e8]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x10e0]
cmovne ecx, edx
mov dword [ebp - 0x10e8], ecx
cmp eax, 6
ja 0x40d1ad
jne 0x40d2fd
cmp ecx, 3
jbe 0x40d2fd
mov ebx, eax
mov esi, ecx
mov dword [ebp - 0x10dc], 0x1000
mov ecx, 0x1000
lea eax, [ebp - 0x10d8]
mov byte [eax], dl
lea eax, [eax + 1]
dec ecx
jne 0x40d1c6
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10d8]
push eax
push ecx
push ecx
push str.ReleaseId
push dword [ebp - 0x1118]
call edi
test eax, eax
je 0x40d1f8
xor eax, eax
mov word [ebp - 0x10d8], ax
lea ecx, [ebp - 0x10d8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d201
sub ecx, edx
sar ecx, 1
je 0x40d223
lea eax, [ebp - 0x10d8]
push eax
mov ecx, 0x495b60
call fcn.00401f70
mov dword [ebp - 0x10dc], 0x1000
mov ecx, 0x1000
lea eax, [ebp - 0x10d8]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40d238
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10d8]
push eax
push ecx
push ecx
push str.DisplayVersion
push dword [ebp - 0x1118]
call edi
test eax, eax
je 0x40d26b
xor eax, eax
mov word [ebp - 0x10d8], ax
lea ecx, [ebp - 0x10d8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d274
sub ecx, edx
sar ecx, 1
je 0x40d296
lea eax, [ebp - 0x10d8]
push eax
mov ecx, 0x495b48
call fcn.00401f70
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10e4]
push eax
push 0
push 0
push 0x46d1d0
push dword [ebp - 0x1118]
mov dword [ebp - 0x10dc], 4
call edi
mov ecx, dword [ebp - 0x10e4]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x10e4], ecx
mov dword [0x495b44], ecx
jmp 0x40d2fd
lea eax, [ebp - 0x10d6]
lea eax, [eax + ecx*2]
push eax
call fcn.004505f4
add esp, 4
mov esi, eax
jmp 0x40d126
mov dword [ebp - 0x10e0], 0
test ebx, ebx
je 0x40d30d
mov dword [0x495b38], ebx
mov dword [0x495b3c], esi
push dword [ebp - 0x1118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov eax, dword [0x495b38]
cmp eax, 0xa
jne 0x40d36c
cmp dword [0x495b40], 0x55f0
jl 0x40d38a
push 3
push ecx
push 0x46d1d8
mov ecx, 0x495b90
call fcn.00409230
mov esi, eax
cmp esi, 0xffffffff
je 0x40d38a
push 3
push esi
mov ecx, 0x495b90
call fcn.00401fc0
push 3
push ecx
push esi
mov ecx, 0x495b90
call fcn.0044db20
mov eax, dword [0x495b38]
test eax, eax
jne 0x40d38a
call dword [sym.imp.KERNEL32.DLL_GetVersion]
movzx ecx, al
shr eax, 8
movzx eax, al
mov dword [0x495b38], ecx
mov dword [0x495b3c], eax
mov eax, 0x495b38
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret