Function at 0x405f1d
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov dword [ebp - 0x3b4], ecx
cmp dword [0x4776ec], 0
je 0x405f3c
mov al, 1
jmp 0x40643a
push 0x9c
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.00423570
add esp, 0xc
mov dword [ebp - 0x9c], 0x9c
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x405ff8
mov byte [0x4776a8], 0
mov dword [ebp - 0x9c], 0x94
lea edx, [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x405fc7
push 0x104
lea eax, [ebp - 0x1a0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40000
lea ecx, [ebp - 0x1a0]
push ecx
push str.GetVersion_failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x40643a
mov edx, dword [ebp - 0x98]
mov dword [0x4776ac], edx
mov eax, dword [ebp - 0x94]
mov dword [0x4776b0], eax
mov ecx, dword [ebp - 0x90]
mov dword [0x4776b4], ecx
mov edx, dword [ebp - 0x8c]
mov dword [0x4776b8], edx
jmp 0x406056
mov byte [0x4776a8], 1
mov eax, dword [ebp - 0x98]
mov dword [0x4776ac], eax
mov ecx, dword [ebp - 0x94]
mov dword [0x4776b0], ecx
mov edx, dword [ebp - 0x90]
mov dword [0x4776b4], edx
mov eax, dword [ebp - 0x8c]
mov dword [0x4776b8], eax
mov cx, word [ebp - 8]
mov word [0x4776bc], cx
mov dx, word [ebp - 6]
mov word [0x4776be], dx
mov ax, word [ebp - 4]
mov word [0x4776c0], ax
mov cl, byte [ebp - 2]
mov byte [0x4776c2], cl
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x3b8], edx
cmp dword [ebp - 0x3b8], 0
je 0x406427
cmp dword [ebp - 0x3b8], 1
je 0x4063a8
cmp dword [ebp - 0x3b8], 2
je 0x40608a
jmp 0x40642e
cmp dword [ebp - 0x98], 6
jb 0x4060b6
mov byte [0x4776e7], 1
mov byte [0x4776e0], 1
mov byte [0x4776e2], 1
mov byte [0x4776e4], 1
mov byte [0x4776e8], 1
cmp dword [ebp - 0x98], 5
jne 0x4060e4
cmp dword [ebp - 0x94], 2
jne 0x4060e4
mov byte [0x4776e5], 1
mov byte [0x4776e0], 1
mov byte [0x4776e2], 1
mov byte [0x4776e4], 1
cmp dword [ebp - 0x98], 5
jne 0x406112
cmp dword [ebp - 0x94], 1
jne 0x406112
mov byte [0x4776e3], 1
mov byte [0x4776e0], 1
mov byte [0x4776e2], 1
mov byte [0x4776e4], 1
cmp dword [ebp - 0x98], 5
jne 0x406139
cmp dword [ebp - 0x94], 0
jne 0x406139
mov byte [0x4776e1], 1
mov byte [0x4776e0], 1
mov byte [0x4776e2], 1
cmp dword [ebp - 0x98], 4
ja 0x406150
mov byte [0x4776de], 1
mov byte [0x4776e0], 1
xor eax, eax
mov al, byte [0x4776a8]
test eax, eax
je 0x4062b5
mov ecx, dword [ebp - 2]
and ecx, 0xff
cmp ecx, 1
jne 0x4061ad
cmp dword [ebp - 0x98], 4
jne 0x40617f
mov byte [0x4776df], 1
jmp 0x4061a8
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 0x200
test edx, edx
je 0x40619e
mov dword [0x4776c8], 0
jmp 0x4061a8
mov dword [0x4776c8], 1
jmp 0x4062b0
mov eax, dword [ebp - 2]
and eax, 0xff
cmp eax, 3
jne 0x4062b0
cmp dword [ebp - 0x98], 5
jne 0x406232
cmp dword [ebp - 0x94], 2
jne 0x406232
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x4061ef
mov dword [0x4776d4], 3
jmp 0x406230
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x40620b
mov dword [0x4776d4], 2
jmp 0x406230
mov eax, dword [ebp - 4]
and eax, 0xffff
cmp eax, 0x400
jne 0x406226
mov dword [0x4776d4], 1
jmp 0x406230
mov dword [0x4776d4], 0
jmp 0x4062b0
cmp dword [ebp - 0x98], 5
jne 0x40628b
cmp dword [ebp - 0x94], 0
jne 0x40628b
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x406263
mov dword [0x4776d0], 2
jmp 0x406289
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x40627f
mov dword [0x4776d0], 1
jmp 0x406289
mov dword [0x4776d0], 0
jmp 0x4062b0
mov eax, dword [ebp - 4]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x4062a6
mov dword [0x4776cc], 1
jmp 0x4062b0
mov dword [0x4776cc], 0
jmp 0x4063a3
mov dword [ebp - 0x3a8], 0x200
mov dword [ebp - 0x3b0], 0x200
lea ecx, [ebp - 0x3ac]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x4063a3
lea edx, [ebp - 0x3b0]
push edx
lea eax, [ebp - 0x3a4]
push eax
push 0
push 0
push str.ProductType
mov ecx, dword [ebp - 0x3ac]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x4063a3
cmp dword [ebp - 0x3b0], 0x200
ja 0x4063a3
mov edx, dword [ebp - 0x3ac]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3a4]
push eax
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406363
mov dword [0x4776c4], 0
lea ecx, [ebp - 0x3a4]
push ecx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406383
mov dword [0x4776c4], 1
lea edx, [ebp - 0x3a4]
push edx
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4063a3
mov dword [0x4776c4], 2
jmp 0x40642e
cmp dword [ebp - 0x98], 4
jne 0x4063e0
cmp dword [ebp - 0x94], 0
jne 0x4063e0
mov byte [0x4776d9], 1
movsx eax, byte [ebp - 0x87]
cmp eax, 0x43
je 0x4063d9
movsx ecx, byte [ebp - 0x87]
cmp ecx, 0x42
jne 0x4063e0
mov byte [0x4776da], 1
cmp dword [ebp - 0x98], 4
jne 0x40640c
cmp dword [ebp - 0x94], 0xa
jne 0x40640c
mov byte [0x4776db], 1
movsx edx, byte [ebp - 0x87]
cmp edx, 0x41
jne 0x40640c
mov byte [0x4776dc], 1
cmp dword [ebp - 0x98], 4
jne 0x406425
cmp dword [ebp - 0x94], 0x5a
jne 0x406425
mov byte [0x4776dd], 1
jmp 0x40642e
mov byte [0x4776d8], 1
mov dword [0x4776ec], 1
mov al, 1
mov esp, ebp
pop ebp
ret