Function at 0x440980
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00415680
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x440a25
mov dword [ebp - 0x128], 0x114
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x440a25
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00459050
add esp, 8
push 0x10
push 0x46f92c
push 0x46f954
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 5
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x348], edx
cmp dword [ebp - 0x348], 0
je 0x440cb5
cmp dword [ebp - 0x348], 1
je 0x440c75
cmp dword [ebp - 0x348], 2
je 0x440a59
jmp 0x440cf3
mov dword [0x485c34], 0
cmp dword [ebp - 0x124], 6
jb 0x440a76
mov dword [0x485c34], 1
cmp dword [ebp - 0x124], 5
jbe 0x440a89
mov eax, 1
jmp 0x440cf5
cmp dword [ebp - 0x124], 4
ja 0x440ad3
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00459050
add esp, 8
push 0x10
push 0x46f97c
push 0x46f9a8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 5
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
cmp dword [ebp - 0x124], 5
jne 0x440b3b
cmp dword [ebp - 0x120], 0
jne 0x440b3b
mov dword [0x48802c], 1
movzx edx, word [ebp - 0x14]
cmp edx, 2
jl 0x440afa
jmp 0x440b3b
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00459050
add esp, 8
push 0x10
push 0x46fa3c
push 0x46fa68
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 5
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
call fcn.00438ac0
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x440b90
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.00459050
add esp, 8
push 0x10
push 0x46fafc
push 0x46fb24
mov eax, dword [ebp + 8]
push eax
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 4
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
mov dword [ebp - 0x130], 1
lea ecx, [ebp - 0x12c]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x440c1f
mov dword [ebp - 0x138], 4
mov dword [ebp - 0x344], 0x104
lea edx, [ebp - 0x344]
push edx
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp - 0x138]
push ecx
push 0
push 0x46fbb4
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440c1f
lea eax, [ebp - 0x340]
push eax
push str.6.0.0.0
call fcn.004383a0
add esp, 8
test eax, eax
jg 0x440c1f
mov dword [ebp - 0x130], 0
cmp dword [ebp - 0x130], 0
je 0x440c69
push 0xa
mov ecx, dword [ebp + 8]
push ecx
call fcn.00459050
add esp, 8
push 0x10
push 0x46fbd4
push 0x46fc00
mov edx, dword [ebp + 8]
push edx
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 7
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
mov eax, 1
jmp 0x440cf5
push 0xa
mov eax, dword [ebp + 8]
push eax
call fcn.00459050
add esp, 8
push 0x10
push 0x46fc60
push 0x46fc88
mov ecx, dword [ebp + 8]
push ecx
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 5
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
push 0xa
mov edx, dword [ebp + 8]
push edx
call fcn.00459050
add esp, 8
push 0x10
push 0x46fd1c
push 0x46fd48
mov eax, dword [ebp + 8]
push eax
call fcn.00458f10
add esp, 0x10
mov dword [0x489b40], 5
mov dword [0x489b44], 1
xor eax, eax
jmp 0x440cf5
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret