Function at 0x4058f0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov eax, dword [0x410cb0]
sub esp, 0x2a4
test eax, eax
push esi
push edi
jne 0x405c7f
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x9c
push eax
call esi
test eax, eax
jne 0x405999
lea ecx, [esp + 0x10]
mov byte [0x410c70], al
push ecx
mov dword [esp + 0x14], 0x94
call esi
test eax, eax
jne 0x405962
lea edx, [esp + 0xac]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop edi
xor al, al
pop esi
add esp, 0x2a4
ret
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0xaa]
mov dword [0x410c7c], eax
mov eax, dword [esp + 0xa8]
mov dword [0x410c74], esi
mov dword [0x410c78], edi
mov dword [0x410c80], ecx
jmp 0x4059ff
mov ecx, dword [esp + 0x1c]
mov dx, word [esp + 0xa4]
mov ax, word [esp + 0xa6]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [0x410c7c], ecx
mov ecx, dword [esp + 0x20]
mov word [0x410c84], dx
mov dl, byte [esp + 0xaa]
mov word [0x410c86], ax
mov eax, dword [esp + 0xa8]
mov byte [0x410c70], 1
mov dword [0x410c74], esi
mov dword [0x410c78], edi
mov dword [0x410c80], ecx
mov word [0x410c88], ax
mov byte [0x410c8a], dl
sub ecx, 0
je 0x405c6e
dec ecx
je 0x405c1e
dec ecx
jne 0x405c75
cmp esi, 6
jb 0x405a37
mov byte [0x410caf], 1
mov byte [0x410ca8], 1
mov byte [0x410caa], 1
mov byte [0x410cac], 1
cmp esi, 5
jne 0x405a88
cmp edi, 2
jne 0x405a4a
mov byte [0x410cad], 1
jmp 0x405a56
cmp edi, 1
jne 0x405a6d
mov byte [0x410cab], 1
mov byte [0x410ca8], 1
mov byte [0x410caa], 1
mov byte [0x410cac], 1
jmp 0x405a9b
test edi, edi
jne 0x405a9b
mov byte [0x410ca9], 1
mov byte [0x410ca8], 1
mov byte [0x410caa], 1
jmp 0x405a9b
cmp esi, 4
ja 0x405a9b
mov byte [0x410ca6], 1
mov byte [0x410ca8], 1
mov cl, byte [0x410c70]
test cl, cl
je 0x405b5c
cmp dl, 1
jne 0x405ad0
cmp esi, 4
jne 0x405abe
mov byte [0x410ca7], dl
jmp 0x405c75
not eax
shr eax, 9
and eax, 1
mov dword [0x410c90], eax
jmp 0x405c75
cmp dl, 3
jne 0x405c75
cmp esi, 5
jne 0x405b48
cmp edi, 2
jne 0x405b1d
test al, 0x80
je 0x405af6
mov dword [0x410c9c], 3
jmp 0x405c75
test al, 2
je 0x405b09
mov dword [0x410c9c], 2
jmp 0x405c75
xor ecx, ecx
cmp ax, 0x400
sete cl
mov dword [0x410c9c], ecx
jmp 0x405c75
test edi, edi
jne 0x405b48
test al, 0x80
je 0x405b34
mov dword [0x410c98], 2
jmp 0x405c75
and eax, 0xff
shr eax, 1
and eax, 1
mov dword [0x410c98], eax
jmp 0x405c75
and eax, 0xff
shr eax, 1
and eax, 1
mov dword [0x410c94], eax
jmp 0x405c75
lea edx, [esp + 8]
mov esi, 0x200
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405c75
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0xac]
push eax
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405c75
cmp dword [esp + 0xc], esi
ja 0x405c75
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0xac]
push ecx
push str.WINNT
call esi
test eax, eax
jne 0x405be2
mov dword [0x410c8c], eax
lea edx, [esp + 0xac]
push edx
push str.LANMANNT
call esi
test eax, eax
jne 0x405bff
mov dword [0x410c8c], 1
lea eax, [esp + 0xac]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x405c75
mov dword [0x410c8c], 2
jmp 0x405c75
cmp esi, 4
jne 0x405c75
test edi, edi
jne 0x405c43
mov al, byte [esp + 0x25]
mov byte [0x410ca1], 1
cmp al, 0x43
je 0x405c3a
cmp al, 0x42
jne 0x405c75
mov byte [0x410ca2], 1
jmp 0x405c75
cmp edi, 0xa
jne 0x405c60
mov al, byte [esp + 0x25]
mov byte [0x410ca3], 1
cmp al, 0x41
jne 0x405c75
mov byte [0x410ca4], 1
jmp 0x405c75
cmp edi, 0x5a
jne 0x405c75
mov byte [0x410ca5], 1
jmp 0x405c75
mov byte [0x410ca0], 1
mov dword [0x410cb0], 1
pop edi
mov al, 1
pop esi
add esp, 0x2a4
ret