Function at 0x1002f0b0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x10048034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x270], ecx
push edi
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x26c], ebx
mov edi, 1
mov dword [ebp - 0x148], 0x11c
mov dword [ebp - 0x264], 0x11c
call fcn.1002ef00
test eax, eax
je 0x1002f11a
push dword [ebp - 0x148]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
jmp 0x1002f156
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1002f156
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x148], 0x114
call fcn.1002f030
test eax, eax
jne 0x1002f154
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f746
mov esp, ebp
pop ebp
ret
xor edi, edi
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002f179
lea ecx, [ebp - 0x2c]
push ecx
call eax
jmp 0x1002f183
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x138]
push esi
xor esi, esi
sub eax, esi
je 0x1002f4b8
dec eax
je 0x1002f475
dec eax
jne 0x1002f316
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
cmp edx, 5
ja 0x1002f1b9
jne 0x1002f1c6
test eax, eax
je 0x1002f238
cmp word [ebp - 0x2c], 9
mov ecx, 0x80000
cmove esi, ecx
cmp edx, 6
jne 0x1002f22f
cmp eax, 3
jne 0x1002f1db
or esi, 0x1800
jmp 0x1002f316
cmp eax, 2
jne 0x1002f1eb
or esi, 0x1700
jmp 0x1002f316
cmp eax, 1
jne 0x1002f20b
cmp byte [ebp - 0x2e], al
jne 0x1002f200
or esi, 0x1600
jmp 0x1002f316
or esi, 0x150b
jmp 0x1002f316
test eax, eax
jne 0x1002f316
or esi, 0x1500
cmp byte [ebp - 0x2e], 1
jne 0x1002f227
or esi, 0xa
jmp 0x1002f316
or esi, 0xb
jmp 0x1002f316
cmp edx, 5
jne 0x1002f35d
cmp eax, 2
jne 0x1002f2d5
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov bl, byte [ebp - 0x2e]
mov ecx, dword [ebp - 0x30]
test eax, eax
mov ax, word [ebp - 0x2c]
jne 0x1002f27e
mov edx, 0x2000
cmp cx, dx
je 0x1002f27e
mov edx, 0x8000
cmp cx, dx
je 0x1002f27e
cmp bl, 1
jne 0x1002f27e
cmp ax, 9
jne 0x1002f27e
or esi, 0x81300
jmp 0x1002f2be
or esi, 0x1400
test cl, cl
jns 0x1002f28d
or esi, 4
jmp 0x1002f2a7
test cl, 2
je 0x1002f297
or esi, 5
jmp 0x1002f2a7
test ecx, 0x400
je 0x1002f2a4
or esi, 6
jmp 0x1002f2a7
or esi, 7
cmp bl, 1
je 0x1002f2be
cmp ax, 6
je 0x1002f2b8
cmp ax, 9
jne 0x1002f2be
or esi, 0x80000
mov edx, dword [ebp - 0x144]
cmp edx, 5
jne 0x1002f363
mov eax, dword [ebp - 0x140]
jmp 0x1002f2db
mov bl, byte [ebp - 0x2e]
mov ecx, dword [ebp - 0x30]
cmp eax, 1
jne 0x1002f2fe
mov ebx, dword [ebp - 0x26c]
or esi, 0x1300
test ecx, 0x200
je 0x1002f2f9
or esi, 2
jmp 0x1002f316
or esi, 3
jmp 0x1002f316
test eax, eax
jne 0x1002f310
or esi, 0x1200
cmp bl, 1
jne 0x1002f344
or esi, 3
mov ebx, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x1002f322
mov dword [eax], esi
test ebx, ebx
je 0x1002f32e
mov eax, dword [ebp - 0x13c]
mov dword [ebx], eax
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f746
mov esp, ebp
pop ebp
ret
test cl, cl
jns 0x1002f34d
or esi, 4
jmp 0x1002f310
mov ebx, dword [ebp - 0x26c]
test cl, 2
je 0x1002f3ac
or esi, 8
jmp 0x1002f316
mov bl, byte [ebp - 0x2e]
mov ecx, dword [ebp - 0x30]
cmp edx, 4
jne 0x1002f370
or esi, 0x1100
jmp 0x1002f37d
jae 0x1002f378
or esi, 0x1000
cmp edx, 4
ja 0x1002f310
test edi, edi
je 0x1002f3b4
cmp bl, 1
jne 0x1002f38b
or esi, 1
jmp 0x1002f310
cmp bl, 3
je 0x1002f399
cmp bl, 2
jne 0x1002f310
mov ebx, dword [ebp - 0x26c]
test cl, 2
je 0x1002f3ac
or esi, 5
jmp 0x1002f316
or esi, 9
jmp 0x1002f316
lea eax, [ebp - 0x268]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 8], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002f462
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1e8]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002f462
cmp dword [ebp - 8], 0x50
ja 0x1002f462
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x1e8]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x1002f42f
or esi, 1
lea eax, [ebp - 0x1e8]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x1002f444
or esi, 9
lea eax, [ebp - 0x1e8]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x1002f310
or esi, 8
jmp 0x1002f310
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.1002f746
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x144], 4
jne 0x1002f316
mov eax, dword [ebp - 0x140]
test eax, eax
jne 0x1002f496
mov esi, 0x200
jmp 0x1002f316
cmp eax, 0xa
jne 0x1002f4a5
mov esi, 0x300
jmp 0x1002f316
cmp eax, 0x5a
jne 0x1002f316
mov esi, 0x400
jmp 0x1002f316
mov esi, 0x100
jmp 0x1002f316