Function at 0x405be5
Capabilities:
Check os version
Get common file path
Get session user name
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [0x40b8e0], 0x9c
push 0x40b8e0
call sub.KERNEL32.DLL_GetVersionExA
mov esi, dword [0x40bbc8]
cmp byte [esi], 1
je 0x405d2b
cmp dword [0x40b8e4], 7
jge 0x405c4b
cmp dword [0x40b8e4], 6
jne 0x405c5a
cmp dword [0x40b8e8], 0
jne 0x405c4b
cmp word [0x40b996], 1
jne 0x405c3c
cmp byte [esi + 3], 1
je 0x405d2b
jmp 0x405d23
cmp byte [esi + 2], 1
je 0x405d2b
jmp 0x405d23
cmp byte [esi + 1], 1
je 0x405d2b
jmp 0x405d23
cmp dword [0x40b8e4], 5
jne 0x405cac
cmp dword [0x40b8e8], 2
jne 0x405c7b
cmp byte [esi + 4], 1
je 0x405d2b
jmp 0x405d23
cmp dword [0x40b8e8], 1
jne 0x405c93
cmp byte [esi + 5], 1
je 0x405d2b
jmp 0x405d23
cmp dword [0x40b8e8], 0
jne 0x405d23
cmp byte [esi + 6], 1
je 0x405d2b
jmp 0x405d23
cmp dword [0x40b8e4], 4
jne 0x405d02
cmp dword [0x40b8f0], 2
jne 0x405cc6
cmp byte [esi + 7], 1
je 0x405d2b
jmp 0x405d23
cmp dword [0x40b8e8], 0x5a
jne 0x405cd7
cmp byte [esi + 9], 1
je 0x405d2b
jmp 0x405d00
cmp dword [0x40b8e8], 0xa
jne 0x405ce8
cmp byte [esi + 0xa], 1
je 0x405d2b
jmp 0x405d00
cmp dword [0x40b8e8], 0
je 0x405cfa
cmp dword [0x40b8e8], 3
jne 0x405d00
cmp byte [esi + 0xb], 1
je 0x405d2b
jmp 0x405d23
cmp dword [0x40b8e4], 3
jne 0x405d23
cmp dword [0x40b8f0], 2
jne 0x405d23
cmp dword [0x40b8e8], 0x33
jne 0x405d23
cmp byte [esi + 8], 1
je 0x405d2b
mov byte [0x40bbf0], 0xfd
ret
add dword [0x40bbc8], 0xc
mov esi, dword [0x40bbc8]
lodsb al, byte [esi]
or al, al
je 0x405eb9
mov byte [0x40bc15], al
mov dword [0x40bba4], 0
push 0x40bc46
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x405de8
mov dword [0x40bba8], 0
mov dword [0x40bba0], 0x100
push 0
push 0
push 0
push 0
push 0x40bba0
push 0x40a9ef
push dword [0x40bba8]
push dword [0x40bc46]
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x405ddd
inc dword [0x40bba8]
mov ecx, dword [0x40bba4]
mov eax, 0x40a9ef
mov eax, dword [eax]
cmp al, 0x76
jne 0x405d83
cmp cl, ah
jg 0x405d83
mov cl, ah
rol eax, 0x10
cmp al, 0
jne 0x405dd3
mov ah, 0x30
mov ch, ah
mov dword [0x40bba4], ecx
jmp 0x405d83
push dword [0x40bc46]
call sub.advapi32.dll_RegCloseKey
cmp dword [0x40bba4], 0
jne 0x405e25
push 0x40bc46
push 0x20019
push 0
push str.SoftwareMicrosoft.NET_FrameworkPolicy_v1.0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x405e9a
inc dword [0x40bba4]
push dword [0x40bc46]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [0x40bba4]
cmp byte [0x40bc15], 1
je 0x405ea2
cmp byte [0x40bc15], 2
jne 0x405e47
cmp al, 0x31
jg 0x405ea2
cmp ah, 0x31
jge 0x405ea2
jmp 0x405e9a
cmp byte [0x40bc15], 3
jne 0x405e56
cmp al, 0x32
jge 0x405ea2
jmp 0x405e9a
cmp byte [0x40bc15], 4
jne 0x405e65
cmp al, 0x33
jge 0x405ea2
jmp 0x405e9a
cmp byte [0x40bc15], 5
jne 0x405e79
cmp al, 0x33
jg 0x405ea2
cmp cl, 0x35
jge 0x405ea2
jmp 0x405e9a
cmp byte [0x40bc15], 6
jne 0x405e88
cmp al, 0x34
jge 0x405ea2
jmp 0x405e9a
cmp byte [0x40bc15], 7
jne 0x405e9a
cmp al, 0x34
jg 0x405ea2
cmp cl, 0x35
jge 0x405ea2
mov byte [0x40bbf0], 0xfc
ret
inc dword [0x40bbc8]
push dword [0x40bbc8]
call sub.KERNEL32.DLL_lstrlenA
add dword [0x40bbc8], eax
inc dword [0x40bbc8]
mov eax, dword [0x40bbc8]
cmp byte [eax], 0
je 0x405f46
cmp dword [0x40b8f0], 2
jne 0x405f46
mov dword [0x40bba0], 0x100
push 0x40bba0
push 0x40a9ef
call sub.advapi32.dll_GetUserNameA
push 0x40a9ef
call sub.KERNEL32.DLL_lstrlenA
inc eax
push 0x100
push 0x40aaf3
push eax
push 0x40a9ef
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push str.netapi32.dll
call sub.KERNEL32.DLL_LoadLibraryA
push str.NetUserGetInfo
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40bba0
push 1
push 0x40aaf3
push 0
call eax
mov eax, dword [0x40bba0]
cmp dword [eax + 0xc], 2
je 0x405f46
mov byte [0x40bbf0], 0xfb
mov eax, dword [0x40bbc8]
mov cl, byte [eax + 1]
mov byte [0x40bc45], cl
mov ecx, dword [eax + 2]
mov dword [0x40bc41], ecx
add dword [0x40bbc8], 6
push dword [0x40bbc8]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bbc8]
mov dword [0x40bbcc], eax
cmp byte [0x40bbf0], 0xfb
je 0x406182
push eax
push dword [0x40bbc0]
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bbc0], eax
add eax, dword [0x40bbcc]
mov dword [0x40bc0a], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc0a]
mov dword [0x40bc02], eax
cmp byte [eax], 0
je 0x405fca
mov byte [0x40bc01], 1
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc02]
mov dword [0x40bc2c], eax
push eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bc2c], eax
pop eax
cmp byte [0x40bc5a], 2
je 0x406152
push eax
mov bl, byte [eax]
cmp bl, 1
jne 0x40601f
mov eax, str.SystemDrive
push 0x100
push 0x40acfb
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
jmp 0x40611c
cmp bl, 2
jne 0x406030
push str.ProgramFilesDir
jmp 0x40603a
cmp bl, 3
jne 0x40608f
push str.CommonFilesDir
push 0x40bba0
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
pop eax
mov dword [0x40bba4], 0x104
push 0x40bba4
push 0x40acfb
push 0
push 0
push eax
push dword [0x40bba0]
call sub.advapi32.dll_RegQueryValueExA
push dword [0x40bba0]
call sub.advapi32.dll_RegCloseKey
jmp 0x40611c
cmp bl, 4
jne 0x4060aa
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetWindowsDirectoryA
jmp 0x40611c
cmp bl, 5
jne 0x4060c5
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetSystemDirectoryA
jmp 0x40611c
cmp bl, 6
jne 0x4060d6
mov eax, str.UserProfile
jmp 0x406005
cmp bl, 7
jne 0x4060e7
mov eax, str.AppData
jmp 0x406005
cmp bl, 8
jne 0x4060f5
mov eax, 5
jmp 0x4060ff
cmp bl, 9
jne 0x40612d
mov eax, 0x10
push 0x40bba0
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x40acfb
push dword [0x40bba0]
call sub.shell32.dll_SHGetPathFromIDListA
pop eax
mov byte [eax], 0x5c
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcatA
jmp 0x406152
cmp bl, 0xa
jne 0x406145
push 0x40acfb
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40611c
pop eax
inc eax
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcpyA
push dword [0x40bc2c]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc2c]
mov dword [0x40bc30], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc30]
mov dword [0x40bc06], eax
mov byte [0x40bbf0], 1
ret