Function at 0x4081e0
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x4f4
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x4f0], eax
mov eax, dword [esp + 0x4f8]
push ebx
push esi
mov esi, dword [esp + 0x504]
mov cl, 0xc2
mov byte [esp + 0x55], cl
mov byte [esp + 0x59], cl
lea ecx, [esp + 8]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push eax
push reloc.WS2_32.dll_bind
mov dword [esp + 0x60], 0xaac56b
mov word [esp + 0x64], 0xcd44
mov word [esp + 0x66], 0x11d0
mov byte [esp + 0x68], 0x8c
mov byte [esp + 0x6a], bl
mov byte [esp + 0x6b], 0xc0
mov byte [esp + 0x6c], 0x4f
mov byte [esp + 0x6e], 0x95
mov byte [esp + 0x6f], 0xee
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408277
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x4f0]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x4f4
ret
mov ecx, dword [esp + 8]
push edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1fc]
push eax
push ebx
push ebx
push str.ImagePath
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4082c9
push 0x104
lea edx, [esp + 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
lea eax, [esp + 0xf8]
push eax
push str._sDRIVERS_s
mov ecx, eax
push ecx
jmp 0x40830f
lea edx, [esp + 0x1f8]
push 0x5b1cbc
push edx
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4082eb
lea edi, [esp + 0x1f8]
jmp 0x40831f
push 0x104
lea eax, [esp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
lea ecx, [esp + 0xf8]
push ecx
push str._sDRIVERS_s
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x104]
add esp, 0x10
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 0x80
push 3
push ebx
push 1
push bind
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x408463
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp byte [edi], bl
je 0x40837b
push ebp
lea ebp, [esp + 0x300]
nop
push 1
lea ecx, [esi + edi]
push ecx
push ebp
call sub.api_ms_win_crt_convert_l1_1_0.dll_mbtowc
add esi, 1
add esp, 0xc
add ebp, 2
cmp byte [esi + edi], bl
jne 0x408360
pop ebp
push 1
lea edx, [esi + edi]
push edx
lea eax, [esp + esi*2 + 0x304]
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_mbtowc
push 0x2c
lea edx, [esp + 0x24]
lea ecx, [esp + 0x30c]
push ebx
push edx
mov dword [esp + 0x58], 0x10
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea ecx, [esp + 0x60]
lea eax, [esp + 0x40]
push ecx
mov dword [esp + 0x18], 0x2c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x64], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x64], 6
push str.wintrust.dll
sbb edx, edx
and edx, 0xfffff010
add edx, 0x1000
mov dword [esp + 0x40], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x408445
push str.WinVerifyTrust
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0xa1c124], eax
jne 0x40847d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4f0]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x4f4
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x4f0]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x4f4
ret
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
push 0xffffffffffffffff
call eax
mov esi, eax
cmp esi, 0x80092026
je 0x4084a5
cmp esi, 0x800b0004
je 0x4084a5
cmp esi, 0x800b0111
jne 0x4084a7
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x4fc]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0052bfb9
add esp, 0x4f4
ret