Function at 0x1000d300
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x4f4
mov ecx, dword [esp + 0x4f8]
mov al, 0xc2
push ebx
mov byte [esp + 0x15], al
mov byte [esp + 0x19], al
push esi
lea eax, [esp + 0xc]
push edi
xor ebx, ebx
push eax
push 0x20019
push ebx
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], 0xaac56b
mov word [esp + 0x2c], 0xcd44
mov word [esp + 0x2e], 0x11d0
mov byte [esp + 0x30], 0x8c
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0xc0
mov byte [esp + 0x34], 0x4f
mov byte [esp + 0x36], 0x95
mov byte [esp + 0x37], 0xee
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000d376
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x4f4
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
lea eax, [esp + 0x1fc]
push edx
push eax
push ebx
push ebx
push str.ImagePath
push ecx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000d3db
lea edx, [esp + 0x64]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esp + 0x508]
lea ecx, [esp + 0x64]
push eax
push ecx
lea edx, [esp + 0x6c]
push str._sDRIVERS_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea esi, [esp + 0x74]
add esp, 0x10
mov dword [esp + 0xc], esi
jmp 0x1000d43e
lea eax, [esp + 0x1fc]
push 0x1005e698
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x1000d402
lea ecx, [esp + 0x1fc]
mov dword [esp + 0xc], ecx
jmp 0x1000d43a
lea edx, [esp + 0x64]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esp + 0x508]
lea ecx, [esp + 0x64]
push eax
push ecx
lea edx, [esp + 0x6c]
push str._sDRIVERS_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x74]
add esp, 0x10
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1000d2c0
mov ecx, eax
add esp, 4
cmp ecx, ebx
je 0x1000d46b
sub eax, 2
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
add esp, 0x4f4
ret
mov al, byte [esi]
xor edi, edi
cmp al, bl
je 0x1000d499
push ebp
lea ebp, [esp + 0x304]
push 1
push esi
push ebp
call dword [sym.imp.MSVCR100.dll_mbtowc]
mov al, byte [esi + 1]
add esp, 0xc
inc edi
add ebp, 2
inc esi
cmp al, bl
jne 0x1000d47b
mov esi, dword [esp + 0x10]
pop ebp
lea edx, [edi + esi]
push 1
lea eax, [esp + edi*2 + 0x304]
push edx
push eax
call dword [sym.imp.MSVCR100.dll_mbtowc]
lea ecx, [esp + 0x30c]
xor eax, eax
mov dword [esp + 0x64], ecx
mov ecx, 0xb
lea edi, [esp + 0x34]
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x168]
lea edx, [esp + 0x54]
push eax
mov dword [esp + 0x58], 0x10
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x2c], 0x2c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], 2
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x16c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, dword [esp + 0x16c]
push str.wintrust.dll
cmp edi, 6
sbb ecx, ecx
and ecx, 0xfffff010
add ecx, 0x1000
mov dword [esp + 0x54], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1000d56a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0x4f4
ret
push str.WinVerifyTrust
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x10071a44], eax
jne 0x1000d58f
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0x4f4
ret
lea edx, [esp + 0x28]
lea ecx, [esp + 0x14]
push edx
push ecx
push 0xffffffffffffffff
call eax
mov esi, eax
cmp esi, 0x80092026
je 0x1000d5b7
cmp esi, 0x800b0004
je 0x1000d5b7
cmp esi, 0x800b0111
jne 0x1000d5b9
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x4f4
ret