Function at 0x402490
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x9c], 0x9c
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jne 0x4024f4
mov dword [ebp - 0x9c], 0x94
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4024f4
or eax, 0xffffffff
jmp 0x402c63
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x20c], edx
cmp dword [ebp - 0x20c], 0
je 0x40280d
cmp dword [ebp - 0x20c], 1
je 0x40277f
cmp dword [ebp - 0x20c], 2
je 0x402528
jmp 0x402817
cmp dword [ebp - 0x98], 4
ja 0x40253b
mov dword [ebp - 0xa0], 0xa
cmp dword [ebp - 0x98], 5
jne 0x402557
cmp dword [ebp - 0x94], 0
jne 0x402557
mov dword [ebp - 0xa0], 0x14
cmp dword [ebp - 0x98], 5
jne 0x402573
cmp dword [ebp - 0x94], 1
jne 0x402573
mov dword [ebp - 0xa0], 0x1e
cmp dword [ebp - 0x98], 5
jne 0x40258f
cmp dword [ebp - 0x94], 2
jne 0x40258f
mov dword [ebp - 0xa0], 0x28
cmp dword [ebp - 0x98], 6
jne 0x4025ab
cmp dword [ebp - 0x94], 0
jne 0x4025ab
mov dword [ebp - 0xa0], 0x32
cmp dword [ebp - 0x98], 6
jne 0x4025c7
cmp dword [ebp - 0x94], 1
jne 0x4025c7
mov dword [ebp - 0xa0], 0x3c
cmp dword [ebp - 0xf8], 0
je 0x40267d
mov eax, dword [ebp - 2]
and eax, 0xff
cmp eax, 1
jne 0x402616
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 0x200
test ecx, ecx
je 0x402605
mov edx, dword [ebp - 0xa0]
add edx, 1
mov dword [ebp - 0xa0], edx
jmp 0x402614
mov eax, dword [ebp - 0xa0]
add eax, 2
mov dword [ebp - 0xa0], eax
jmp 0x402678
mov ecx, dword [ebp - 2]
and ecx, 0xff
cmp ecx, 3
jne 0x402678
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 0x80
test edx, edx
je 0x402648
mov eax, dword [ebp - 0xa0]
add eax, 5
mov dword [ebp - 0xa0], eax
jmp 0x402678
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 2
test ecx, ecx
je 0x402669
mov edx, dword [ebp - 0xa0]
add edx, 4
mov dword [ebp - 0xa0], edx
jmp 0x402678
mov eax, dword [ebp - 0xa0]
add eax, 3
mov dword [ebp - 0xa0], eax
jmp 0x40277a
lea ecx, [ebp - 0x200]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4026fe
lea edx, [ebp - 0x204]
push edx
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push str.ProductType
mov ecx, dword [ebp - 0x200]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x4026fe
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push str.ProductType
mov ecx, dword [ebp - 0x200]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x200]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xf4]
push eax
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402730
mov ecx, dword [ebp - 0xa0]
add ecx, 2
mov dword [ebp - 0xa0], ecx
lea edx, [ebp - 0xf4]
push edx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402755
mov eax, dword [ebp - 0xa0]
add eax, 3
mov dword [ebp - 0xa0], eax
lea ecx, [ebp - 0xf4]
push ecx
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40277a
mov edx, dword [ebp - 0xa0]
add edx, 4
mov dword [ebp - 0xa0], edx
jmp 0x402817
cmp dword [ebp - 0x98], 4
jne 0x4027bd
cmp dword [ebp - 0x94], 0
jne 0x4027bd
mov dword [ebp - 0xa0], 1
movsx eax, byte [ebp - 0x87]
cmp eax, 0x43
je 0x4027b3
movsx ecx, byte [ebp - 0x87]
cmp ecx, 0x42
jne 0x4027bd
mov dword [ebp - 0xa0], 6
cmp dword [ebp - 0x98], 4
jne 0x4027ef
cmp dword [ebp - 0x94], 0xa
jne 0x4027ef
mov dword [ebp - 0xa0], 2
movsx edx, byte [ebp - 0x87]
cmp edx, 0x41
jne 0x4027ef
mov dword [ebp - 0xa0], 7
cmp dword [ebp - 0x98], 4
jne 0x40280b
cmp dword [ebp - 0x94], 0x5a
jne 0x40280b
mov dword [ebp - 0xa0], 3
jmp 0x402817
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
cmp dword [ebp - 0x210], 0x42
ja case.0x40284d.29
mov eax, dword [ebp - 0x210]
xor edx, edx
mov dl, byte [eax + 0x402ce2]
jmp dword [edx*4 + 0x402c6a]
push str.Unknow__Version___
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Microsoft__Windows__32s
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Microsoft__Windows__95
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
lea ecx, [ebp - 0x200]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x402911
lea edx, [ebp - 0x204]
push edx
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push str.Version
mov ecx, dword [ebp - 0x200]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x402911
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0xf4]
push eax
push 0
push 0
push str.Version
mov ecx, dword [ebp - 0x200]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x200]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Microsoft
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0xf4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xf4]
push eax
push str.Windows_Millennium_Edition
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40295e
mov dword [ebp - 0xa0], 3
jmp case.0x40284d.29
push str.Windows_Millennium_Edition
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Microsoft__Windows__95_OSR2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Microsoft__Windows__98_SE
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__NT
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__NT__Personal
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__NT__Workstation
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__NT__Server
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__NT__Advance_Server
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__NT__Datacenter_Server
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__2000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__2000__Personal
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__2000__Professional
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__2000__Server
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__2000__Advance_Server
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__2000__Datacenter_Server
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP__Personal
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP__Professional
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP__Server
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP__Advance_Server
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP__Datacenter_Server
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push str.Windows__XP__Professional_x64
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xa0], 0x38
jmp case.0x40284d.29
push str.Windows__Server_2003
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push 0xff
lea eax, [ebp - 0x1f8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._syswow64
lea edx, [ebp - 0x1f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1f8]
push eax
call fcn.00405c6a
add esp, 4
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jne 0x402bbb
push str.Windows_Vista_64_Bit
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xa0], 0x38
jmp case.0x40284d.29
push str.Windows_Vista_32_Bit
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp case.0x40284d.29
push 0xff
lea eax, [ebp - 0x1f8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._syswow64
lea edx, [ebp - 0x1f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1f8]
push eax
call fcn.00405c6a
add esp, 4
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jne 0x402c4e
push str.Windows_7_64_Bit
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xa0], 0x42
jmp case.0x40284d.29
push str.Windows_7_32_Bit
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0xa0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret