Function at 0x48a982
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov dl, byte [0x54dd08]
push ebx
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x2f3]
mov byte [ebp - 0x2f4], dl
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a3]
mov byte [ebp - 0x1a4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x3f3]
mov byte [ebp - 0x3f4], dl
mov esi, 0x9c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
mov edi, eax
cmp edi, ebx
jne 0x48aa24
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call esi
test eax, eax
je 0x48ad4e
mov eax, dword [ebp - 0x94]
sub eax, ebx
je 0x48adf6
dec eax
je 0x48ad55
dec eax
jne 0x48ae09
push 5
pop esi
cmp dword [ebp - 0xa0], esi
jne 0x48aaae
cmp dword [ebp - 0x9c], 2
jne 0x48aa6f
lea eax, [ebp - 0x2f4]
push 0x536094
push eax
call sub.MSVCRT.dll_strcpy
cmp dword [ebp - 0xa0], esi
pop ecx
pop ecx
jne 0x48aaae
cmp dword [ebp - 0x9c], 1
jne 0x48aa93
lea eax, [ebp - 0x2f4]
push 0x53607c
push eax
call sub.MSVCRT.dll_strcpy
cmp dword [ebp - 0xa0], esi
pop ecx
pop ecx
jne 0x48aaae
cmp dword [ebp - 0x9c], ebx
jne 0x48aaca
lea eax, [ebp - 0x2f4]
push 0x536064
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
ja 0x48aaca
lea eax, [ebp - 0x2f4]
push 0x53604c
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, reloc.WSOCK32.dll_bind
je 0x48abb0
cmp byte [ebp - 0xa], 1
jne 0x48ab10
cmp dword [ebp - 0xa0], 4
jne 0x48aaf6
push 0x53603c
jmp 0x48ab96
test byte [ebp - 0xb], 2
je 0x48ab06
push 0x53602c
jmp 0x48ab96
push 0x53601c
jmp 0x48ab96
cmp byte [ebp - 0xa], 3
je 0x48ab20
cmp byte [ebp - 0xa], 2
jne 0x48ac9b
cmp dword [ebp - 0xa0], esi
jne 0x48ab8b
cmp dword [ebp - 0x9c], 2
jne 0x48ab61
test byte [ebp - 0xc], 0x80
je 0x48ab3e
push 0x536008
jmp 0x48ab96
test byte [ebp - 0xc], 2
je 0x48ab4b
push 0x535ff4
jmp 0x48ab96
cmp word [ebp - 0xc], 0x400
jne 0x48ab5a
push 0x535fe8
jmp 0x48ab96
push 0x535fd4
jmp 0x48ab96
cmp dword [ebp - 0x9c], 0
jne 0x48ab8b
test byte [ebp - 0xc], 0x80
je 0x48ab77
push 0x535fc0
jmp 0x48ab96
test byte [ebp - 0xc], 2
je 0x48ab84
push 0x535fb0
jmp 0x48ab96
push 0x523400
jmp 0x48ab96
test byte [ebp - 0xc], 2
je 0x48aba9
push 0x535f90
lea eax, [ebp - 0x1a4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x48ac9b
push 0x535f84
jmp 0x48ab96
push 0x50
lea eax, [ebp - 4]
pop esi
push eax
push 1
push 0
push 0x535f54
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x48ad4e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 0
push 0
push 0x535f48
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48ad4e
cmp dword [ebp - 8], esi
ja 0x48ad4e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1f4]
push eax
push 0x513fa0
call esi
test eax, eax
jne 0x48ac30
lea eax, [ebp - 0x1a4]
push 0x535f3c
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x1f4]
push eax
push 0x535f30
call esi
test eax, eax
jne 0x48ac55
lea eax, [ebp - 0x1a4]
push 0x523400
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x1f4]
push eax
push 0x535f24
call esi
test eax, eax
jne 0x48ac7a
lea eax, [ebp - 0x1a4]
push 0x535fb0
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp - 0x9c]
lea eax, [ebp - 0x3f4]
push dword [ebp - 0xa0]
push 0x523720
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
cmp dword [ebp - 0xa0], 4
jne 0x48ad21
lea eax, [ebp - 0x90]
push 0x535f14
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x48ad21
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x535ed8
push ebx
call edi
test eax, eax
mov eax, dword [ebp - 0x98]
jne 0x48acf1
and eax, 0xffff
push eax
lea eax, [ebp - 0x3f4]
push 0x535ebc
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x48ad13
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x3f4]
push 0x535eac
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48ae09
mov eax, dword [ebp - 0x98]
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x3f4]
push 0x535eac
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x48ae09
xor eax, eax
jmp 0x48ae32
cmp dword [ebp - 0xa0], 4
jne 0x48ae09
cmp dword [ebp - 0x9c], ebx
jne 0x48ada8
lea eax, [ebp - 0x2f4]
push 0x535e94
push eax
call sub.MSVCRT.dll_strcpy
cmp byte [ebp - 0x8f], 0x43
pop ecx
pop ecx
je 0x48ad8f
cmp byte [ebp - 0x8f], 0x42
jne 0x48ad9f
push 0x535e8c
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x48ae09
cmp dword [ebp - 0x9c], 0xa
jne 0x48ade6
lea eax, [ebp - 0x2f4]
push 0x535e74
push eax
call sub.MSVCRT.dll_strcpy
cmp byte [ebp - 0x8f], 0x41
pop ecx
pop ecx
jne 0x48addd
push 0x535e70
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x48ae09
cmp dword [ebp - 0x9c], 0x5a
jne 0x48ae09
push 0x535e48
jmp 0x48adfb
push 0x535e34
lea eax, [ebp - 0x2f4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x2f4]
push eax
push 0x5228d4
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret