Function at 0x4084e0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
mov eax, dword [0x420034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1f0], ecx
push edi
lea ecx, [ebp - 0x1e8]
mov edi, 1
mov dword [ebp - 0x1e8], 0x11c
call fcn.00408400
test eax, eax
jne 0x408542
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], 0x114
call fcn.00408400
test eax, eax
jne 0x408540
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040dc0a
mov esp, ebp
pop ebp
ret
xor edi, edi
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x408568
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x408575
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1d8]
push ebx
push esi
xor esi, esi
sub eax, esi
je 0x408888
dec eax
je 0x408856
dec eax
jne 0x40888d
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e0]
cmp edx, 5
ja 0x4085b0
jne 0x4085c0
test eax, eax
je 0x408638
cmp word [ebp - 0xcc], 9
mov ecx, 0x80000
cmove esi, ecx
cmp edx, 6
jne 0x40862f
cmp eax, 3
jne 0x4085d5
or esi, 0x1800
jmp 0x40888d
cmp eax, 2
jne 0x4085e5
or esi, 0x1700
jmp 0x40888d
cmp eax, 1
jne 0x408608
cmp byte [ebp - 0xce], al
jne 0x4085fd
or esi, 0x1600
jmp 0x40888d
or esi, 0x150b
jmp 0x40888d
test eax, eax
jne 0x40888d
or esi, 0x1500
cmp byte [ebp - 0xce], 1
jne 0x408627
or esi, 0xa
jmp 0x40888d
or esi, 0xb
jmp 0x40888d
cmp edx, 5
jne 0x408735
cmp eax, 2
jne 0x4086da
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
test eax, eax
mov ax, word [ebp - 0xcc]
jne 0x408687
mov edx, 0x2000
cmp cx, dx
je 0x408687
mov edx, 0x8000
cmp cx, dx
je 0x408687
cmp bl, 1
jne 0x408687
cmp ax, 9
jne 0x408687
or esi, 0x81300
jmp 0x4086c7
or esi, 0x1400
test cl, cl
jns 0x408696
or esi, 4
jmp 0x4086b0
test cl, 2
je 0x4086a0
or esi, 5
jmp 0x4086b0
test ecx, 0x400
je 0x4086ad
or esi, 6
jmp 0x4086b0
or esi, 7
cmp bl, 1
je 0x4086c7
cmp ax, 6
je 0x4086c1
cmp ax, 9
jne 0x4086c7
or esi, 0x80000
mov edx, dword [ebp - 0x1e4]
cmp edx, 5
jne 0x408741
mov eax, dword [ebp - 0x1e0]
jmp 0x4086e6
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
cmp eax, 1
jne 0x408701
or esi, 0x1300
test ecx, 0x200
je 0x408714
or esi, 2
jmp 0x40888d
test eax, eax
jne 0x40888d
or esi, 0x1200
cmp bl, 1
jne 0x40871c
or esi, 3
jmp 0x40888d
test cl, cl
jns 0x408728
or esi, 4
jmp 0x40888d
test cl, 2
je 0x40878b
or esi, 8
jmp 0x40888d
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
cmp edx, 4
jne 0x40874e
or esi, 0x1100
jmp 0x40875f
jae 0x408756
or esi, 0x1000
cmp edx, 4
ja 0x40888d
test edi, edi
je 0x408793
cmp bl, 1
jne 0x408770
or esi, 1
jmp 0x40888d
cmp bl, 3
je 0x40877e
cmp bl, 2
jne 0x40888d
test cl, 2
je 0x40878b
or esi, 5
jmp 0x40888d
or esi, 9
jmp 0x40888d
lea eax, [ebp - 0x1ec]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 0xa8], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408843
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408843
cmp dword [ebp - 0xa8], 0x50
ja 0x408843
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0xa4]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x408817
or esi, 1
lea eax, [ebp - 0xa4]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x40882c
or esi, 9
lea eax, [ebp - 0xa4]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x40888d
or esi, 8
jmp 0x40888d
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040dc0a
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1e4], 4
jne 0x40888d
mov eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x408870
mov esi, 0x200
jmp 0x40888d
cmp eax, 0xa
jne 0x40887c
mov esi, 0x300
jmp 0x40888d
cmp eax, 0x5a
jne 0x40888d
mov esi, 0x400
jmp 0x40888d
mov esi, 0x100
mov eax, dword [ebp - 0x1f0]
test eax, eax
je 0x408899
mov dword [eax], esi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
mov eax, 1
pop edi
call fcn.0040dc0a
mov esp, ebp
pop ebp
ret