Function at 0x404f60
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x404faf
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call esi
test eax, eax
jne 0x404faf
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
sub eax, 0
je 0x40520a
dec eax
je 0x40518c
dec eax
jne 0x405217
cmp dword [esp + 0x14], 4
ja 0x404fde
push 0x431d00
call fcn.00412ccd
add esp, 4
mov eax, dword [esp + 0x14]
mov esi, 5
cmp eax, esi
jne 0x40501c
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x405008
push 0x431ce8
call fcn.00412ccd
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, esi
jne 0x40501c
cmp dword [esp + 0x18], 1
jne 0x40501c
push 0x431cd0
call fcn.00412ccd
add esp, 4
test edi, edi
je 0x40507a
mov al, byte [esp + 0xaa]
cmp al, 1
jne 0x40504b
mov eax, dword [esp + 0xa8]
test ah, 2
je 0x405041
push 0x431cc4
jmp 0x40511d
push 0x431cb4
jmp 0x40511d
cmp al, 3
jne 0x405125
mov al, byte [esp + 0xa8]
test al, al
jns 0x405068
push 0x431ca0
jmp 0x40511d
test al, 2
jne 0x405118
push 0x431c98
jmp 0x40511d
lea edx, [esp + 8]
push edx
push 1
push 0
push 0x431c68
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xb4]
push ecx
push 0
push 0
push 0x431c5c
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0xb0]
push ecx
push 0x431c54
call esi
test eax, eax
jne 0x4050e5
push 0x431cb4
call fcn.00412ccd
add esp, 4
lea edx, [esp + 0xb0]
push edx
push 0x431c48
call esi
test eax, eax
jne 0x405105
push 0x431c98
call fcn.00412ccd
add esp, 4
lea eax, [esp + 0xb0]
push eax
push 0x431c3c
call esi
test eax, eax
jne 0x405125
push 0x431c28
call fcn.00412ccd
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, 4
ja 0x405160
mov ecx, dword [esp + 0x1c]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push ecx
push eax
push 0x431c08
call fcn.00412ccd
mov eax, dword [esp + 0x30]
add esp, 0x14
and eax, 0xffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x1c]
and edx, 0xffff
push edx
lea eax, [esp + 0x28]
push eax
push 0x431bf8
call fcn.00412ccd
mov eax, dword [esp + 0x28]
add esp, 0xc
and eax, 0xffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x14], 4
jne 0x405217
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4051cc
push 0x431be0
call fcn.00412ccd
mov al, byte [esp + 0x29]
add esp, 4
cmp al, 0x43
je 0x4051b8
cmp al, 0x42
jne 0x4051c5
push 0x431bd8
call fcn.00412ccd
add esp, 4
cmp dword [esp + 0x14], 4
jne 0x405217
cmp dword [esp + 0x18], 0xa
jne 0x4051fc
push 0x431bc0
call fcn.00412ccd
mov al, byte [esp + 0x29]
add esp, 4
cmp al, 0x41
jne 0x4051f5
push 0x431bbc
call fcn.00412ccd
add esp, 4
cmp dword [esp + 0x14], 4
jne 0x405217
cmp dword [esp + 0x18], 0x5a
jne 0x405217
push 0x431ba4
jmp 0x40520f
push 0x431b90
call fcn.00412ccd
add esp, 4
mov eax, dword [esp + 0x1c]
pop edi
and eax, 0xffff
pop esi
mov esp, ebp
pop ebp
ret