Function at 0x4022a0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
mov eax, dword [0x6b7e64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1f3
lea eax, [ebp - 0x1f7]
mov byte [ebp - 0x1f8], 0
push 0
push eax
mov esi, ecx
call fcn.00623f60
push 0x3e7
lea eax, [ebp - 0x5df]
mov byte [ebp - 0x5e0], 0
push 0
push eax
call fcn.00623f60
add esp, 0x18
mov dword [ebp - 0xa64], 0x9c
lea eax, [ebp - 0xa64]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x402332
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Microsoft_Windows
push 0x3e8
push esi
call fcn.0062bf49
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0061e015
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp - 0x9ca]
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xa68], eax
push ebx
push edi
mov edi, dword [ebp - 0xa5c]
cmp cl, 3
je 0x40235a
cmp cl, 2
je 0x40235a
xor ebx, ebx
jmp 0x40235f
mov ebx, 1
push dword [ebp - 0xa58]
push edi
push eax
push str._v_d._d._d_
lea eax, [ebp - 0x9c8]
push 0x3e8
push eax
call fcn.00401df0
mov cx, word [ebp - 0x9d0]
add esp, 0x18
test cx, cx
je 0x4023d8
mov ax, word [ebp - 0x9ce]
test ax, ax
je 0x4023bb
movzx eax, ax
push eax
movzx eax, cx
push eax
push str.SP_d._d
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.00401df0
add esp, 0x14
jmp 0x4023d8
movzx eax, cx
push eax
push str.SP_d
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.00401df0
add esp, 0x10
mov eax, dword [ebp - 0xa68]
cmp eax, 5
jne 0x402439
test edi, edi
jne 0x4023fb
test ebx, ebx
mov eax, str.Windows_2000_Workstation__s__s
mov ecx, str.Windows_2000_Server__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp edi, 1
jne 0x40241c
test dword [ebp - 0x9cc], 0x200
mov eax, str.Windows_XP_Professional__s__s
mov ecx, str.Windows_XP_Home_Edition__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp edi, 2
jne 0x4025a3
test ebx, ebx
mov eax, str.Windows_XP_64_bit_Edition__s__s
mov ecx, str.Windows_Server_2003__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp eax, 6
jne 0x4024a5
test edi, edi
jne 0x402456
test ebx, ebx
mov eax, str.Windows_Vista__s__s
mov ecx, str.Windows_Server_2008__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp edi, 1
jne 0x40246f
test ebx, ebx
mov eax, str.Windows_7__s__s
mov ecx, str.Windows_Server_2008_R2__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp edi, 2
jne 0x402488
test ebx, ebx
mov eax, str.Windows_8__s__s
mov ecx, str.Windows_Server_2012__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp edi, 3
jne 0x4025a3
test ebx, ebx
mov eax, str.Windows_8.1__s__s
mov ecx, str.Windows_Server_2012_R2__s__s
cmovne eax, ecx
jmp 0x4025a8
cmp eax, 0xa
jne 0x4025a3
test ebx, ebx
je 0x402589
lea eax, [ebp - 0xa68]
mov byte [ebp - 0x5e0], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402521
lea eax, [ebp - 0xa6c]
mov dword [ebp - 0xa6c], 0x3e8
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0xa70]
push eax
push 0
push str.ReleaseId
push dword [ebp - 0xa68]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xa68]
test eax, eax
je 0x402535
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa58]
cmp eax, 0x4563
jbe 0x402576
mov eax, str.Windows_Server_2022__s__s
jmp 0x4025a8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5e0]
push eax
call fcn.0062cdfd
add esp, 4
cmp eax, 0x711
ja 0x402568
je 0x402561
cmp eax, 0x647
je 0x402582
cmp eax, 0x70b
jne 0x402582
mov eax, str.Windows_Server_2019__s__s
jmp 0x4025a8
cmp eax, 0x7d9
je 0x40252e
mov eax, str.Windows_Server_2016__s__s
jmp 0x4025a8
add eax, 0xffffc7c6
cmp eax, 0xd29
jbe 0x402561
mov eax, str.Windows_Server_2016__s__s
jmp 0x4025a8
cmp dword [ebp - 0xa58], 0x55f0
jb 0x40259c
mov eax, str.Windows_11__s__s
jmp 0x4025a8
mov eax, str.Windows_10__s__s
jmp 0x4025a8
mov eax, str.Windows__s__s
lea ecx, [ebp - 0x9c8]
push ecx
lea ecx, [ebp - 0x1f8]
push ecx
push eax
push 0x3e8
push esi
call fcn.00401df0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov eax, 1
pop edi
pop ebx
pop esi
call fcn.0061e015
mov esp, ebp
pop ebp
ret