Function at 0x5a1d211
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b8
mov eax, dword [0x5b920e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x5b9a70c
lea ecx, [ebp - 0x8b8]
mov dword [ebp - 0x8a4], eax
call fcn.05a17f0e
mov esi, 0x400
push esi
xor ebx, ebx
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.05acaa80
push esi
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.05acaa80
add esp, 0x18
lea eax, [ebp - 0x898]
push eax
mov byte [ebp - 0x899], bl
mov dword [ebp - 0x898], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5a1d297
cmp dword [ebp - 0x894], 6
jae 0x5a1d297
mov byte [ebp - 0x899], 1
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.shell32.dll
call edi
mov dword [ebp - 0x8a0], eax
cmp eax, ebx
je 0x5a1d2f8
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp byte [ebp - 0x899], bl
je 0x5a1d2d0
cmp esi, ebx
je 0x5a1d2f0
lea eax, [ebp - 0x404]
jmp 0x5a1d2e8
cmp esi, ebx
je 0x5a1d2f0
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push 0x23
push ebx
call esi
lea eax, [ebp - 0x804]
push eax
push ebx
push ebx
push 0x2b
push ebx
call esi
push dword [ebp - 0x8a0]
jmp 0x5a1d346
push str.shell32.dll
call edi
mov edi, eax
cmp edi, ebx
je 0x5a1d351
push str.SHGetSpecialFolderPathA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp byte [ebp - 0x899], bl
je 0x5a1d327
cmp esi, ebx
je 0x5a1d345
lea eax, [ebp - 0x404]
jmp 0x5a1d33e
cmp esi, ebx
je 0x5a1d345
push ebx
push 0x23
lea eax, [ebp - 0x404]
push eax
push ebx
call esi
lea eax, [ebp - 0x804]
push ebx
push 0x2b
push eax
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x5a1d3f3
lea eax, [ebp - 0x8a0]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp byte [ebp - 0x899], bl
je 0x5a1d3a0
test eax, eax
jne 0x5a1d3f3
lea eax, [ebp - 0x8ac]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x8ac], esi
mov dword [ebp - 0x8a8], 1
lea eax, [ebp - 0x8a8]
jmp 0x5a1d3c8
test eax, eax
jne 0x5a1d3f3
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x8a8], esi
mov dword [ebp - 0x8ac], 1
lea eax, [ebp - 0x8ac]
push eax
push ebx
push str.CommonFilesDir
push dword [ebp - 0x8a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8a0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x5a1d3f3
mov byte [ebp - 0x404], bl
mov ecx, dword [ebp - 0x8a4]
mov edi, str.Symantec_SharedLicenses
mov esi, str.C:Program_FilesCommon_FilesSymantec_SharedLicenses
cmp byte [ebp - 0x404], bl
je 0x5a1d425
lea eax, [ebp - 0x404]
push eax
call fcn.05a17af4
mov ecx, dword [ebp - 0x8a4]
push edi
call fcn.05a17dd8
jmp 0x5a1d43a
cmp byte [ebp - 0x899], bl
je 0x5a1d430
push esi
jmp 0x5a1d435
push str.C:ProgramDataSymantec_SharedLicenses
call fcn.05a17af4
cmp byte [ebp - 0x899], bl
jne 0x5a1d484
lea ecx, [ebp - 0x8b8]
cmp byte [ebp - 0x804], bl
je 0x5a1d46a
lea eax, [ebp - 0x804]
push eax
call fcn.05a17af4
push edi
lea ecx, [ebp - 0x8b8]
call fcn.05a17dd8
jmp 0x5a1d470
push esi
call fcn.05a17af4
lea eax, [ebp - 0x8b8]
push eax
push dword [ebp - 0x8a4]
call fcn.05a1d0f7
pop ecx
pop ecx
lea ecx, [ebp - 0x8b8]
call fcn.05a17dc2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.05ac7ec0
leave
ret