Function at 0x402550
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x25
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x4ac]
push ebx
mov edi, edx
sub esp, 0x4fc
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4ac], 0x94
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x4a8]
sub esp, 4
cmp eax, 5
je 0x402850
cmp eax, 6
je 0x402703
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4cc], 0x400
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea edi, [ebp - 0x4bc]
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
lea ebx, [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x4cc]
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProductName
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x418]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x4d4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x4c4], edi
sub esp, 0x18
mov ecx, dword [ebx]
add ebx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x402630
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [ebx + 2]
mov edx, eax
cmove ebx, ecx
add dl, al
lea eax, [ebp - 0x418]
sbb ebx, 3
sub ebx, eax
cmp ebx, 0xf
mov dword [ebp - 0x4c8], ebx
ja 0x402730
cmp ebx, 1
je 0x402830
lea edx, [ebp - 0x4c4]
test ebx, ebx
mov eax, edi
mov dword [ebp - 0x4dc], edx
jne 0x402769
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x4c0], ebx
mov byte [eax + ebx], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0x4ec139
call fcn.00466c30
sub esp, 0xc
cmp eax, 0xffffffff
je 0x402790
lea eax, [esi + 8]
mov ecx, 0x3031
mov dword [esi + 4], 2
mov word [esi + 8], cx
mov byte [esi + 0xa], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x4c4]
cmp eax, edi
je 0x4026f9
mov dword [esp], eax
call fcn.004e0b90
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x4a4]
test eax, eax
je 0x402875
cmp eax, 1
jne 0x40259e
lea eax, [esi + 8]
mov byte [esi + 8], 0x37
mov dword [esi + 4], 1
mov byte [esi + 9], 0
mov dword [esi], eax
jmp 0x4026f9
lea eax, [ebp - 0x4c4]
mov dword [esp + 4], 0
mov ecx, eax
mov dword [ebp - 0x4dc], eax
lea eax, [ebp - 0x4c8]
mov dword [esp], eax
call fcn.004c4000
mov ecx, dword [ebp - 0x4c8]
sub esp, 8
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4bc], ecx
lea edx, [ebp - 0x418]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov ebx, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x4c4]
jmp 0x402696
mov ecx, dword [ebp - 0x4dc]
mov dword [esp + 8], 3
mov dword [esp + 4], 0
mov dword [esp], 0x4ec13c
call fcn.00466c30
sub esp, 0xc
cmp eax, 0xffffffff
je 0x4027e0
lea eax, [esi + 8]
mov edx, 0x3138
mov dword [esi + 4], 2
mov word [esi + 8], dx
mov byte [esi + 0xa], 0
mov dword [esi], eax
jmp 0x4026e7
mov ecx, dword [ebp - 0x4dc]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x4ec140
call fcn.00466c30
sub esp, 0xc
cmp eax, 0xffffffff
lea eax, [esi + 8]
mov dword [esi], eax
je 0x402895
mov byte [esi + 8], 0x38
mov dword [esi + 4], 1
mov byte [esi + 9], 0
jmp 0x4026e7
movzx eax, byte [ebp - 0x418]
lea edx, [ebp - 0x4c4]
mov dword [ebp - 0x4dc], edx
mov byte [ebp - 0x4bc], al
mov eax, edi
jmp 0x402696
lea eax, [esi + 8]
mov ebx, 0x7078
mov byte [0x4ea00c], 0
mov dword [esi + 4], 2
mov word [esi + 8], bx
mov dword [esi], eax
mov byte [esi + 0xa], 0
jmp 0x4026f9
lea eax, [esi + 8]
mov dword [esi + 8], 0x74736976
mov byte [esi + 0xc], 0x61
mov dword [esi + 4], 5
mov byte [esi + 0xd], 0
mov dword [esi], eax
jmp 0x4026f9
mov eax, 0x776f
mov dword [esi + 8], 0x6e6b6e75
mov byte [esi + 0xe], 0x6e
mov word [esi + 0xc], ax
mov dword [esi + 4], 7
mov byte [esi + 0xf], 0
jmp 0x4026e7