Function at 0x42bfa0
Capabilities:
Check os version
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e5fc
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1b0]
push eax
mov dword [ebp - 0x1b0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x114], 0x68746f
mov dword [ebp - 0x1bc], 0
call fcn.0042ea30
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1ac], 6
mov eax, dword [0x686984]
mov dword [ebp - 0x1b8], 0
mov ecx, 0x686984
jb 0x42c449
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x118]
push eax
push 0x800
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x118], 0x800
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0xde], 0x6c72555c
mov word [ebp - 0x101], 0x6f73
mov dword [ebp - 0x10a], 0x5c5c6572
mov word [ebp - 0xd0], 0x736e
mov byte [ebp - 0x106], 0x4d
mov dword [ebp - 0xcb], 0x5c707474
mov word [ebp - 0xeb], 0x7341
mov dword [ebp - 0xfe], 0x575c5c74
mov dword [ebp - 0xe9], 0x69636f73
mov dword [ebp - 0xd6], 0x74616963
mov dword [ebp - 0xc7], 0x6573555c
mov word [ebp - 0xfa], 0x6e69
mov word [ebp - 0xee], 0x5c6c
mov word [ebp - 0xf1], 0x6568
mov word [ebp - 0xc3], 0x4372
mov word [ebp - 0xcd], 0x685c
mov word [ebp - 0xf4], 0x5c5c
mov word [ebp - 0xe2], 0x6e6f
mov dword [ebp - 0xc0], 0x6563696f
mov word [ebp - 0xd2], 0x6f69
mov word [ebp - 0xf7], 0x776f
mov word [ebp - 0x10c], 0x6177
mov byte [ebp - 0xec], 0x5c
mov word [ebp - 0xe5], 0x7461
mov byte [ebp - 0xf5], 0x73
mov byte [ebp - 0xce], 0x5c
mov dword [ebp - 0xda], 0x6f737341
mov word [ebp - 0xe0], 0x5c73
mov byte [ebp - 0xef], 0x6c
mov dword [ebp - 0x105], 0x6f726369
mov byte [ebp - 0xbc], 0
mov word [ebp - 0x10f], 0x666f
mov byte [ebp - 0xc1], 0x68
mov byte [ebp - 0x110], 0x53
mov byte [ebp - 0xff], 0x66
mov byte [ebp - 0x10d], 0x74
mov byte [ebp - 0xf8], 0x64
mov byte [ebp - 0xf2], 0x53
mov byte [ebp - 0xe3], 0x69
mov word [ebp - 0x2c], 0x6449
mov word [ebp - 0x2f], 0x6f72
mov byte [ebp - 0x30], 0x50
mov byte [ebp - 0x2d], 0x67
mov byte [ebp - 0x2a], 0
call fcn.004031c0
push eax
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x110]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, dword [ebp - 0x1b8]
push dword [eax - 8]
push eax
call fcn.005cfcd3
add esp, 8
test eax, eax
js 0x42c43f
mov ecx, dword [ebp - 0x1b8]
cmp eax, dword [ecx - 8]
jg 0x42c43f
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x1b8]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x1b8]
mov word [ebp - 0x3d], 0x5448
mov word [ebp - 0x3a], 0x50
mov word [ebp - 0x3f], 0x2e45
mov byte [ebp - 0x40], 0x49
mov byte [ebp - 0x3b], 0x54
mov dword [ebp - 0x53], 0x5255786f
mov dword [ebp - 0x57], 0x66657269
mov word [ebp - 0x4f], 0x4c
mov byte [ebp - 0x58], 0x46
mov word [ebp - 0x61], 0x6d6f
mov dword [ebp - 0x5d], 0x4c4d54
mov word [ebp - 0x64], 0x6843
mov byte [ebp - 0x62], 0x72
mov word [ebp - 0x5f], 0x4865
mov word [ebp - 0x1c], 0x61
mov word [ebp - 0x1f], 0x6570
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x20], 0x4f
mov word [ebp - 0x67], 0x4d54
mov dword [ebp - 0x6c], 0x6d75696d
mov dword [ebp - 0x70], 0x6f726843
mov byte [ebp - 0x68], 0x48
mov byte [ebp - 0x65], 0
mov dword [ebp - 0xa6], 0x32367379
mov dword [ebp - 0xb2], 0x30717870
mov dword [ebp - 0xa1], 0x66306533
mov dword [ebp - 0x95], 0x38726b79
mov dword [ebp - 0x9d], 0x37617162
mov dword [ebp - 0xac], 0x656d7a76
mov dword [ebp - 0x99], 0x70616570
mov word [ebp - 0xb4], 0x7061
mov word [ebp - 0x91], 0x76
mov byte [ebp - 0xa2], 0x6e
mov word [ebp - 0xa8], 0x7032
mov word [ebp - 0xae], 0x6566
cmp dword [eax - 0xc], 0
jl 0x42c3fc
lea ecx, [ebp - 0x40]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c34e
sub ecx, eax
js 0x42c34e
push 0x6518a8
jmp 0x42c634
cmp dword [eax - 0xc], 0
jl 0x42c3fc
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c37f
sub ecx, eax
js 0x42c37f
push 0x6518ac
jmp 0x42c634
cmp dword [eax - 0xc], 0
jl 0x42c3fc
lea ecx, [ebp - 0x64]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c3ac
sub ecx, eax
js 0x42c3ac
push 0x6518b0
jmp 0x42c634
cmp dword [eax - 0xc], 0
jl 0x42c3fc
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c3d3
sub ecx, eax
jns 0x42c62f
cmp dword [eax - 0xc], 0
jl 0x42c3fc
lea ecx, [ebp - 0x70]
push ecx
push eax
call fcn.005ce5b0
add esp, 8
test eax, eax
je 0x42c3fc
sub eax, dword [ebp - 0x1b8]
js 0x42c3fc
push 0x6518b8
jmp 0x42c634
lea ecx, [ebp - 0x1b8]
call fcn.0042ebc0
mov esi, eax
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x42c63f
lea ecx, [ebp - 0xb4]
push ecx
push eax
call fcn.005ce5b0
add esp, 8
test eax, eax
je 0x42c63f
sub eax, dword [esi]
js 0x42c63f
push 0x6518bc
jmp 0x42c634
push 0x80070057
call fcn.00403360
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1b4]
push eax
push 0x800
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x1b4], 0x800
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x7a], 0x6d6f635c
mov word [ebp - 0x86], 0x6873
mov dword [ebp - 0x80], 0x65706f5c
mov word [ebp - 0x73], 0x64
mov word [ebp - 0x83], 0x6c6c
mov dword [ebp - 0x8c], 0x70747468
mov word [ebp - 0x76], 0x616d
mov word [ebp - 0x88], 0x5c5c
mov byte [ebp - 0x81], 0x5c
mov word [ebp - 0x7c], 0x5c6e
mov byte [ebp - 0x74], 0x6e
mov byte [ebp - 0x84], 0x65
call fcn.004031c0
push eax
lea eax, [ebp - 0x118]
push eax
push 0x6508f0
lea eax, [ebp - 0x8c]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, dword [ebp - 0x1b8]
push dword [eax - 8]
push eax
call fcn.005cfcd3
add esp, 8
test eax, eax
js 0x42c43f
mov ecx, dword [ebp - 0x1b8]
cmp eax, dword [ecx - 8]
jg 0x42c43f
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x1b8]
mov byte [eax + ecx], 0
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x4c], 0x70786569
mov word [ebp - 0x45], 0x65
mov word [ebp - 0x48], 0x6f6c
mov byte [ebp - 0x46], 0x72
mov dword [ebp - 0x37], 0x66657269
mov byte [ebp - 0x38], 0x66
mov word [ebp - 0x32], 0x78
mov byte [ebp - 0x33], 0x6f
mov dword [ebp - 0x28], 0x6f726863
mov word [ebp - 0x24], 0x656d
mov byte [ebp - 0x22], 0
mov dword [ebp - 0x18], 0x7265706f
mov word [ebp - 0x14], 0x61
call fcn.0042ebc0
push eax
lea ecx, [ebp - 0x1b8]
call fcn.004182f0
mov eax, dword [ebp - 0x1b8]
cmp dword [eax - 0xc], 0
jl 0x42c63f
lea ecx, [ebp - 0x4c]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c5c2
sub ecx, eax
jns 0x42c344
cmp dword [eax - 0xc], 0
jl 0x42c63f
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c5e9
sub ecx, eax
jns 0x42c375
cmp dword [eax - 0xc], 0
jl 0x42c63f
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.005ce5b0
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
add esp, 8
test ecx, ecx
je 0x42c610
sub ecx, eax
jns 0x42c3a2
cmp dword [eax - 0xc], 0
jl 0x42c63f
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.005ce5b0
add esp, 8
test eax, eax
je 0x42c63f
sub eax, dword [ebp - 0x1b8]
js 0x42c63f
push 0x6518b4
lea ecx, [ebp - 0x1bc]
call fcn.0042ead0
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 0
call fcn.00403340
mov eax, dword [0x686984]
mov ecx, 0x686984
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x1bc]
lea eax, [ebp - 0x1b8]
push str.db__s
push eax
call fcn.00402f20
mov ecx, dword [ebp - 0x1b8]
add esp, 0xc
call fcn.004295b0
push dword [ebp - 0x1a8]
lea eax, [ebp - 0x1b8]
push dword [ebp - 0x1ac]
push str.os__d._d
push eax
call fcn.00402f20
mov ecx, dword [ebp - 0x1b8]
call fcn.004295b0
call fcn.004485f0
neg eax
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0x1b8]
push str.ff__d
push eax
call fcn.00402f20
mov ecx, dword [ebp - 0x1b8]
add esp, 0x1c
call fcn.004295b0
call fcn.0043aa00
neg eax
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0x1b8]
push str.ch__d
push eax
call fcn.00402f20
mov ecx, dword [ebp - 0x1b8]
add esp, 0xc
call fcn.004295b0
lea ecx, [ebp - 0x1b8]
call fcn.00403340
lea ecx, [ebp - 0x1bc]
call fcn.00403340
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret