Function at 0x42e9f0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
mov eax, dword [0x58f860]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x591cb4], 0
je 0x42ea16
mov eax, dword [0x591cb4]
jmp 0x42ed70
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
push 0x11c
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.00512af0
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
lea ecx, [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42ea7d
mov dword [ebp - 0x130], 0x114
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42ea7d
mov eax, dword [ebp - 0xc]
jmp 0x42ed70
cmp dword [ebp - 4], 0
je 0x42eaaa
movzx eax, byte [ebp - 0x16]
cmp eax, 1
jne 0x42ea95
mov dword [ebp - 8], 0
jmp 0x42eaa5
movzx ecx, byte [ebp - 0x16]
cmp ecx, 3
jne 0x42eaa5
mov dword [ebp - 8], 1
jmp 0x42eb4d
lea edx, [ebp - 0x1d4]
push edx
push 1
push 0
push 0x554618
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x1d0]
push ecx
push 0
push 0
push 0x554600
mov edx, dword [ebp - 0x1d4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1d4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1d0]
push ecx
push 0x5545f4
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42eb13
mov dword [ebp - 8], 0
lea edx, [ebp - 0x1d0]
push edx
push 0x5545e0
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42eb30
mov dword [ebp - 8], 1
lea eax, [ebp - 0x1d0]
push eax
push 0x5545cc
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42eb4d
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x1f0], ecx
cmp dword [ebp - 0x1f0], 0
je 0x42ed5d
cmp dword [ebp - 0x1f0], 1
je 0x42ed0c
cmp dword [ebp - 0x1f0], 2
je 0x42eb81
jmp 0x42ed64
cmp dword [ebp - 0x12c], 4
ja 0x42eb96
mov dword [ebp - 0xc], 6
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 5
jne 0x42ebb4
cmp dword [ebp - 0x128], 0
jne 0x42ebb4
mov dword [ebp - 0xc], 0xb
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 5
jne 0x42ebd2
cmp dword [ebp - 0x128], 1
jne 0x42ebd2
mov dword [ebp - 0xc], 0xd
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 5
jne 0x42ebf0
cmp dword [ebp - 0x128], 2
jne 0x42ebf0
mov dword [ebp - 0xc], 0xf
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 6
jne 0x42ec1d
cmp dword [ebp - 0x128], 0
jne 0x42ec1d
cmp dword [ebp - 8], 0
je 0x42ec11
mov dword [ebp - 0xc], 0x15
jmp 0x42ec18
mov dword [ebp - 0xc], 0x13
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 6
jne 0x42ec4a
cmp dword [ebp - 0x128], 1
jne 0x42ec4a
cmp dword [ebp - 8], 0
je 0x42ec3e
mov dword [ebp - 0xc], 0x15
jmp 0x42ec45
mov dword [ebp - 0xc], 0x17
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 6
jne 0x42ecdf
cmp dword [ebp - 0x128], 2
jne 0x42ecdf
cmp dword [ebp - 8], 0
je 0x42ec6f
mov dword [ebp - 0xc], 0x1c
jmp 0x42ec76
mov dword [ebp - 0xc], 0x1b
push 0x5545c4
push ecx
mov ecx, esp
push str.CurrentVersion
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x55451c
call fcn.0041c8a0
lea edx, [ebp - 0x1ec]
push edx
call fcn.0042ed80
add esp, 0x10
push eax
call fcn.0041cac0
add esp, 8
mov byte [ebp - 0x1d9], al
lea ecx, [ebp - 0x1ec]
call fcn.0040f740
movzx eax, byte [ebp - 0x1d9]
test eax, eax
je 0x42ecdd
mov dword [ebp - 0xc], 0x1e
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 6
jne 0x42ecfa
cmp dword [ebp - 0x128], 3
jne 0x42ecfa
mov dword [ebp - 0xc], 0x1e
jmp 0x42ed0a
cmp dword [ebp - 0x12c], 6
jb 0x42ed0a
mov dword [ebp - 0xc], 0x1f
jmp 0x42ed64
cmp dword [ebp - 0x12c], 4
jne 0x42ed27
cmp dword [ebp - 0x128], 0
jne 0x42ed27
mov dword [ebp - 0xc], 3
jmp 0x42ed5b
cmp dword [ebp - 0x12c], 4
jne 0x42ed42
cmp dword [ebp - 0x128], 0xa
jne 0x42ed42
mov dword [ebp - 0xc], 8
jmp 0x42ed5b
cmp dword [ebp - 0x12c], 4
jne 0x42ed5b
cmp dword [ebp - 0x128], 0x5a
jne 0x42ed5b
mov dword [ebp - 0xc], 0xa
jmp 0x42ed64
mov dword [ebp - 0xc], 2
mov ecx, dword [ebp - 0xc]
mov dword [0x591cb4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00512610
mov esp, ebp
pop ebp
ret