Function at 0x405f40
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428afc
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x430090]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431088], 0
je 0x405f7e
mov eax, dword [0x431088]
jmp 0x40636c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 1
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.00409620
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x405fe5
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x405fe5
mov eax, dword [ebp - 0x18]
jmp 0x40636c
cmp dword [ebp - 0x10], 0
je 0x406012
movzx eax, byte [ebp - 0x22]
cmp eax, 1
jne 0x405ffd
mov dword [ebp - 0x14], 0
jmp 0x40600d
movzx ecx, byte [ebp - 0x22]
cmp ecx, 3
jne 0x40600d
mov dword [ebp - 0x14], 1
jmp 0x4060b5
lea edx, [ebp - 0x1e0]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x1dc]
push ecx
push 0
push 0
push str.ProductType
mov edx, dword [ebp - 0x1e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1e0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1dc]
push ecx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40607b
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x1dc]
push edx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x406098
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x1dc]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4060b5
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x1fc], ecx
cmp dword [ebp - 0x1fc], 0
je 0x406359
cmp dword [ebp - 0x1fc], 1
je 0x406308
cmp dword [ebp - 0x1fc], 2
je 0x4060e9
jmp 0x406360
cmp dword [ebp - 0x138], 4
ja 0x4060fe
mov dword [ebp - 0x18], 6
jmp 0x406306
cmp dword [ebp - 0x138], 5
jne 0x40611c
cmp dword [ebp - 0x134], 0
jne 0x40611c
mov dword [ebp - 0x18], 0xb
jmp 0x406306
cmp dword [ebp - 0x138], 5
jne 0x40613a
cmp dword [ebp - 0x134], 1
jne 0x40613a
mov dword [ebp - 0x18], 0xd
jmp 0x406306
cmp dword [ebp - 0x138], 5
jne 0x406158
cmp dword [ebp - 0x134], 2
jne 0x406158
mov dword [ebp - 0x18], 0xf
jmp 0x406306
cmp dword [ebp - 0x138], 6
jne 0x406185
cmp dword [ebp - 0x134], 0
jne 0x406185
cmp dword [ebp - 0x14], 0
je 0x406179
mov dword [ebp - 0x18], 0x15
jmp 0x406180
mov dword [ebp - 0x18], 0x13
jmp 0x406306
cmp dword [ebp - 0x138], 6
jne 0x4061b2
cmp dword [ebp - 0x134], 1
jne 0x4061b2
cmp dword [ebp - 0x14], 0
je 0x4061a6
mov dword [ebp - 0x18], 0x19
jmp 0x4061ad
mov dword [ebp - 0x18], 0x17
jmp 0x406306
cmp dword [ebp - 0x138], 6
jne 0x4062db
cmp dword [ebp - 0x134], 2
jne 0x4062db
cmp dword [ebp - 0x14], 0
je 0x4061db
mov dword [ebp - 0x18], 0x1c
jmp 0x4061e2
mov dword [ebp - 0x18], 0x1b
push 0x42a7b4
push ecx
mov ecx, esp
mov dword [ebp - 0x1ec], esp
push str.CurrentVersion
call fcn.00406800
mov dword [ebp - 0x200], eax
mov edx, dword [ebp - 0x200]
mov dword [ebp - 0x204], edx
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1f0], esp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.00406800
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1f4], esp
push str.HKEY_LOCAL_MACHINE
call fcn.00406800
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x214], ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1f8]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.00406390
add esp, 0x10
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x21c]
push ecx
call fcn.00407100
add esp, 8
mov byte [ebp - 0x21d], al
mov dl, byte [ebp - 0x21d]
mov byte [ebp - 0x1e5], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f8]
call fcn.00406900
movzx eax, byte [ebp - 0x1e5]
test eax, eax
je 0x4062d9
mov dword [ebp - 0x18], 0x1e
jmp 0x406306
cmp dword [ebp - 0x138], 6
jne 0x4062f6
cmp dword [ebp - 0x134], 3
jne 0x4062f6
mov dword [ebp - 0x18], 0x1e
jmp 0x406306
cmp dword [ebp - 0x138], 6
jb 0x406306
mov dword [ebp - 0x18], 0x1f
jmp 0x406360
cmp dword [ebp - 0x138], 4
jne 0x406323
cmp dword [ebp - 0x134], 0
jne 0x406323
mov dword [ebp - 0x18], 3
jmp 0x406357
cmp dword [ebp - 0x138], 4
jne 0x40633e
cmp dword [ebp - 0x134], 0xa
jne 0x40633e
mov dword [ebp - 0x18], 8
jmp 0x406357
cmp dword [ebp - 0x138], 4
jne 0x406357
cmp dword [ebp - 0x134], 0x5a
jne 0x406357
mov dword [ebp - 0x18], 0xa
jmp 0x406360
mov dword [ebp - 0x18], 2
mov ecx, dword [ebp - 0x18]
mov dword [0x431088], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00409b17
mov esp, ebp
pop ebp
ret