Function at 0x4049c0
Capabilities:
Check os version
Get common file path
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adb2b
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x4e52d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebx], 0
push str.ntdll.dll
mov dword [ebp - 0x544], edi
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x404a40
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x404a2d
lea ecx, [ebp - 0x540]
push ecx
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebx], 0
jbe 0x404a40
mov al, 1
jmp 0x404d69
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x216]
push eax
mov word [ebp - 0x218], dx
call fcn.004950a0
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x404b1e
push str.kernel32.dll
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x404b1e
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x404b1e
push esi
call fcn.004911e8
add esp, 4
mov edi, eax
push edi
push esi
xor esi, esi
push esi
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x404b0d
lea edx, [ebp - 0x540]
push edx
lea eax, [ebp - 0x538]
push eax
push 0x4bb124
push edi
mov dword [ebp - 0x540], esi
mov dword [ebp - 0x538], esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x404b0d
mov eax, dword [ebp - 0x538]
movzx ecx, word [eax + 0x12]
mov dword [ebx], ecx
movzx edx, word [eax + 0x10]
mov eax, dword [ebp - 0x544]
mov dword [eax], edx
push edi
call fcn.004913be
add esp, 4
cmp dword [ebx], esi
ja 0x404a39
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x540]
push ecx
lea edx, [ebp - 0x538]
push edx
lea eax, [ebp - 0x53c]
push eax
push str.CurrentMajorVersionNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x540], edi
mov dword [ebp - 0x53c], edi
call esi
mov ecx, dword [ebp - 0x538]
lea edx, [ebp - 0x53c]
push edx
lea eax, [ebp - 0x538]
push eax
mov dword [ebx], ecx
lea ecx, [ebp - 0x540]
push ecx
push str.CurrentMinorVersionNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x53c], edi
mov dword [ebp - 0x540], edi
call esi
mov eax, dword [ebp - 0x538]
mov edx, dword [ebp - 0x544]
mov dword [edx], eax
cmp dword [ebx], 0
jne 0x404d66
test eax, eax
jne 0x404d63
lea eax, [ebp - 0x534]
push eax
mov dword [ebp - 0x534], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x404bea
xor al, al
jmp 0x404d69
cmp dword [ebp - 0x530], 6
jne 0x404d4d
cmp dword [ebp - 0x52c], 2
jne 0x404d4d
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x41e]
push edx
mov word [ebp - 0x420], cx
call fcn.004950a0
push str.CurrentVersion
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x420]
call fcn.00404870
add esp, 0x18
test al, al
je 0x404d4d
mov ecx, 0x4bb300
lea eax, [ebp - 0x420]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404c74
test dx, dx
je 0x404c70
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404c74
add eax, edi
add ecx, edi
test dx, dx
jne 0x404c50
xor eax, eax
jmp 0x404c79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404d4d
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402120
mov ecx, 0x2e
lea esi, [ebp - 0x538]
mov dword [ebp - 4], 0
call fcn.00404f70
mov ecx, dword [ebp - 0x538]
push 0x2e
push ecx
mov esi, eax
call fcn.00492744
add esp, 8
test eax, eax
jne 0x404cc6
or eax, 0xffffffff
jmp 0x404cce
sub eax, dword [ebp - 0x538]
sar eax, 1
test esi, esi
jle 0x404d42
cmp esi, eax
jne 0x404d42
mov eax, esi
lea ecx, [ebp - 0x53c]
lea edx, [ebp - 0x538]
call fcn.00405040
mov eax, dword [eax]
push eax
call fcn.00492858
add esp, 4
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x530], eax
call fcn.00401d40
mov edx, dword [ebp - 0x538]
mov eax, dword [edx - 0xc]
lea edx, [ebp - 0x538]
sub eax, esi
push edx
dec eax
lea ecx, [esi + 1]
lea edx, [ebp - 0x53c]
call fcn.00404f90
mov eax, dword [eax]
push eax
call fcn.00492858
add esp, 4
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x52c], eax
call fcn.00401d40
lea ecx, [ebp - 0x538]
call fcn.00401d40
mov eax, dword [ebp - 0x530]
mov ecx, dword [ebp - 0x52c]
mov edx, dword [ebp - 0x544]
mov dword [ebx], eax
mov dword [edx], ecx
cmp dword [ebx], 0
seta al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004912db
mov esp, ebp
pop ebp
ret