Function at 0x416be0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
push 0x11c
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.005533a0
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea ecx, [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x416c5a
mov dword [ebp - 0x130], 0x114
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x416c5a
mov eax, dword [ebp - 0xc]
jmp 0x417039
cmp dword [ebp - 4], 0
je 0x416c87
movzx eax, byte [ebp - 0x16]
cmp eax, 1
jne 0x416c72
mov dword [ebp - 8], 0
jmp 0x416c82
movzx ecx, byte [ebp - 0x16]
cmp ecx, 3
jne 0x416c82
mov dword [ebp - 8], 1
jmp 0x416edb
xor edx, edx
mov word [ebp - 0x1f8], dx
push 0xc6
push 0
lea eax, [ebp - 0x1f6]
push eax
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x1fc]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.SHELL32.dll_SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x200]
push edx
lea eax, [ebp - 0x1f8]
push eax
push 0
push 0
push str.ProductType
mov ecx, dword [ebp - 0x1fc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x1fc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x208], str.WINNT
mov ecx, dword [ebp - 0x208]
mov dx, word [ecx]
mov word [ebp - 0x20a], dx
mov eax, dword [ebp - 0x204]
cmp dx, word [eax]
jne 0x416d6e
cmp word [ebp - 0x20a], 0
je 0x416d62
mov ecx, dword [ebp - 0x208]
mov dx, word [ecx + 2]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0x204]
cmp dx, word [eax + 2]
jne 0x416d6e
add dword [ebp - 0x208], 4
add dword [ebp - 0x204], 4
cmp word [ebp - 0x20c], 0
jne 0x416d08
mov dword [ebp - 0x210], 0
jmp 0x416d79
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x210], ecx
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x214], 0
jne 0x416d95
mov dword [ebp - 8], 0
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], str.LANMANNT
mov ecx, dword [ebp - 0x21c]
mov dx, word [ecx]
mov word [ebp - 0x21e], dx
mov eax, dword [ebp - 0x218]
cmp dx, word [eax]
jne 0x416e11
cmp word [ebp - 0x21e], 0
je 0x416e05
mov ecx, dword [ebp - 0x21c]
mov dx, word [ecx + 2]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0x218]
cmp dx, word [eax + 2]
jne 0x416e11
add dword [ebp - 0x21c], 4
add dword [ebp - 0x218], 4
cmp word [ebp - 0x220], 0
jne 0x416dab
mov dword [ebp - 0x224], 0
jmp 0x416e1c
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x224], ecx
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0x228], edx
cmp dword [ebp - 0x228], 0
jne 0x416e38
mov dword [ebp - 8], 1
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], str.SERVERNT
mov ecx, dword [ebp - 0x230]
mov dx, word [ecx]
mov word [ebp - 0x232], dx
mov eax, dword [ebp - 0x22c]
cmp dx, word [eax]
jne 0x416eb4
cmp word [ebp - 0x232], 0
je 0x416ea8
mov ecx, dword [ebp - 0x230]
mov dx, word [ecx + 2]
mov word [ebp - 0x234], dx
mov eax, dword [ebp - 0x22c]
cmp dx, word [eax + 2]
jne 0x416eb4
add dword [ebp - 0x230], 4
add dword [ebp - 0x22c], 4
cmp word [ebp - 0x234], 0
jne 0x416e4e
mov dword [ebp - 0x238], 0
jmp 0x416ebf
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x23c], edx
cmp dword [ebp - 0x23c], 0
jne 0x416edb
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x41702f
cmp dword [ebp - 0x240], 1
je 0x416fde
cmp dword [ebp - 0x240], 2
je 0x416f0f
jmp 0x417036
cmp dword [ebp - 0x12c], 4
ja 0x416f24
mov dword [ebp - 0xc], 6
jmp 0x416fdc
cmp dword [ebp - 0x12c], 5
jne 0x416f42
cmp dword [ebp - 0x128], 0
jne 0x416f42
mov dword [ebp - 0xc], 0xb
jmp 0x416fdc
cmp dword [ebp - 0x12c], 5
jne 0x416f5d
cmp dword [ebp - 0x128], 1
jne 0x416f5d
mov dword [ebp - 0xc], 0xd
jmp 0x416fdc
cmp dword [ebp - 0x12c], 5
jne 0x416f78
cmp dword [ebp - 0x128], 2
jne 0x416f78
mov dword [ebp - 0xc], 0xf
jmp 0x416fdc
cmp dword [ebp - 0x12c], 6
jne 0x416fa2
cmp dword [ebp - 0x128], 0
jne 0x416fa2
cmp dword [ebp - 8], 0
je 0x416f99
mov dword [ebp - 0xc], 0x15
jmp 0x416fa0
mov dword [ebp - 0xc], 0x13
jmp 0x416fdc
cmp dword [ebp - 0x12c], 6
jne 0x416fcc
cmp dword [ebp - 0x128], 1
jne 0x416fcc
cmp dword [ebp - 8], 0
je 0x416fc3
mov dword [ebp - 0xc], 0x15
jmp 0x416fca
mov dword [ebp - 0xc], 0x17
jmp 0x416fdc
cmp dword [ebp - 0x12c], 6
jb 0x416fdc
mov dword [ebp - 0xc], 0x1b
jmp 0x417036
cmp dword [ebp - 0x12c], 4
jne 0x416ff9
cmp dword [ebp - 0x128], 0
jne 0x416ff9
mov dword [ebp - 0xc], 3
jmp 0x41702d
cmp dword [ebp - 0x12c], 4
jne 0x417014
cmp dword [ebp - 0x128], 0xa
jne 0x417014
mov dword [ebp - 0xc], 8
jmp 0x41702d
cmp dword [ebp - 0x12c], 4
jne 0x41702d
cmp dword [ebp - 0x128], 0x5a
jne 0x41702d
mov dword [ebp - 0xc], 0xa
jmp 0x417036
mov dword [ebp - 0xc], 2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret