Function at 0x100717c0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1f4], eax
push edi
lea eax, [ebp - 0x1e8]
push eax
mov dword [ebp - 0x1f0], ebx
mov edi, 1
mov dword [ebp - 0x1e8], 0x11c
call sym.iImportLib.dll_int___cdecl_elex::os::ISAFE_GetVersionExW_struct__OSVERSIONINFOW__
add esp, 4
test eax, eax
jne 0x10071838
lea eax, [ebp - 0x1e8]
push eax
mov dword [ebp - 0x1e8], 0x114
call sym.iImportLib.dll_int___cdecl_elex::os::ISAFE_GetVersionExW_struct__OSVERSIONINFOW__
add esp, 4
test eax, eax
jne 0x10071836
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
xor edi, edi
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007185e
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x1007186b
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1d8]
push esi
xor esi, esi
sub eax, esi
je 0x10071bfd
dec eax
je 0x10071bba
dec eax
jne 0x10071a49
mov eax, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0x1e0]
cmp eax, 5
ja 0x100718a5
jne 0x100718b5
test ecx, ecx
je 0x1007195c
cmp word [ebp - 0xcc], 9
mov edx, 0x80000
cmove esi, edx
cmp eax, 6
jbe 0x100718c8
cmp eax, 0xa
je 0x100718c5
or esi, 0x2000
cmp eax, 6
jne 0x100718d1
cmp ecx, 4
je 0x100718de
jmp 0x100718e9
cmp eax, 0xa
jne 0x100718e4
test ecx, ecx
jne 0x10071a49
or esi, 0x1900
cmp eax, 6
jne 0x10071953
cmp ecx, 3
jne 0x100718f9
or esi, 0x1800
jmp 0x10071a49
cmp ecx, 2
jne 0x10071909
or esi, 0x1700
jmp 0x10071a49
cmp ecx, 1
jne 0x1007192c
cmp byte [ebp - 0xce], cl
jne 0x10071921
or esi, 0x1600
jmp 0x10071a49
or esi, 0x150b
jmp 0x10071a49
test ecx, ecx
jne 0x10071a49
or esi, 0x1500
cmp byte [ebp - 0xce], 1
jne 0x1007194b
or esi, 0xa
jmp 0x10071a49
or esi, 0xb
jmp 0x10071a49
cmp eax, 5
jne 0x10071a90
cmp ecx, 2
jne 0x10071a02
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov bl, byte [ebp - 0xce]
mov edx, dword [ebp - 0xd0]
test eax, eax
mov ax, word [ebp - 0xcc]
jne 0x100719ab
mov ecx, 0x2000
cmp dx, cx
je 0x100719ab
mov ecx, 0x8000
cmp dx, cx
je 0x100719ab
cmp bl, 1
jne 0x100719ab
cmp ax, 9
jne 0x100719ab
or esi, 0x81300
jmp 0x100719eb
or esi, 0x1400
test dl, dl
jns 0x100719ba
or esi, 4
jmp 0x100719d4
test dl, 2
je 0x100719c4
or esi, 5
jmp 0x100719d4
test edx, 0x400
je 0x100719d1
or esi, 6
jmp 0x100719d4
or esi, 7
cmp bl, 1
je 0x100719eb
cmp ax, 6
je 0x100719e5
cmp ax, 9
jne 0x100719eb
or esi, 0x80000
mov eax, dword [ebp - 0x1e4]
cmp eax, 5
jne 0x10071a9c
mov ecx, dword [ebp - 0x1e0]
jmp 0x10071a0e
mov bl, byte [ebp - 0xce]
mov edx, dword [ebp - 0xd0]
cmp ecx, 1
jne 0x10071a31
mov ebx, dword [ebp - 0x1f0]
or esi, 0x1300
test edx, 0x200
je 0x10071a2c
or esi, 2
jmp 0x10071a49
or esi, 3
jmp 0x10071a49
test ecx, ecx
jne 0x10071a43
or esi, 0x1200
cmp bl, 1
jne 0x10071a77
or esi, 3
mov ebx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f4]
test eax, eax
je 0x10071a55
mov dword [eax], esi
test ebx, ebx
je 0x10071a61
mov eax, dword [ebp - 0x1dc]
mov dword [ebx], eax
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
test dl, dl
jns 0x10071a80
or esi, 4
jmp 0x10071a43
mov ebx, dword [ebp - 0x1f0]
test dl, 2
je 0x10071ae8
or esi, 8
jmp 0x10071a49
mov bl, byte [ebp - 0xce]
mov edx, dword [ebp - 0xd0]
cmp eax, 4
jne 0x10071aa9
or esi, 0x1100
jmp 0x10071ab6
jae 0x10071ab1
or esi, 0x1000
cmp eax, 4
ja 0x10071a43
test edi, edi
je 0x10071af0
cmp bl, 1
jne 0x10071ac7
or esi, 1
jmp 0x10071a43
cmp bl, 3
je 0x10071ad5
cmp bl, 2
jne 0x10071a43
mov ebx, dword [ebp - 0x1f0]
test dl, 2
je 0x10071ae8
or esi, 5
jmp 0x10071a49
or esi, 9
jmp 0x10071a49
lea eax, [ebp - 0x1ec]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xa8], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10071ba7
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10071ba7
cmp dword [ebp - 0xa8], 0x50
ja 0x10071ba7
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0xa4]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x10071b74
or esi, 1
lea eax, [ebp - 0xa4]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x10071b89
or esi, 9
lea eax, [ebp - 0xa4]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x10071a43
or esi, 8
jmp 0x10071a43
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1e4], 4
jne 0x10071a49
mov eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x10071bdb
mov esi, 0x200
jmp 0x10071a49
cmp eax, 0xa
jne 0x10071bea
mov esi, 0x300
jmp 0x10071a49
cmp eax, 0x5a
jne 0x10071a49
mov esi, 0x400
jmp 0x10071a49
mov esi, 0x100
jmp 0x10071a49