Function at 0x409710
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xcd0]
sub esp, 0xcd0
push 0xffffffffffffffff
push 0x442611
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x467fd4]
xor eax, ebp
mov dword [ebp + 0xccc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push pe_nt_image_headers32
lea eax, [ebp + 0x894]
mov dword [0x469d0c], 0
push 0
push eax
mov dword [ebp - 0x10], 0x208
call fcn.00424960
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp + 0x890]
add esp, 0xc
mov dword [ebp + 0x890], 0x114
push eax
call edi
mov eax, dword [ebp + 0x8a0]
mov edx, dword [ebp + 0x894]
mov ecx, dword [ebp + 0x898]
mov esi, dword [ebp + 0x89c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x469d10], edx
mov dword [0x469d14], ecx
mov dword [0x469d18], esi
sub eax, 1
je 0x409bf9
sub eax, 1
jne 0x409c62
mov dword [0x46641c], 6
mov dword [0x469d00], 2
mov dword [0x469d04], 3
mov dword [0x469d28], eax
cmp edx, 6
jb 0x4098d5
cmp ecx, 2
jb 0x4098d5
push eax
mov byte [ebp - 0x60], al
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x58], vtable.SmartCOMPointer_struct_IWbemLocator_.0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], vtable.SmartCOMPointer_struct_IWbemServices_.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x38], ax
mov dword [ebp - 0x34], eax
push 0x466210
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], eax
call fcn.0040a060
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
test al, al
je 0x4098b7
cmp dword [ebp - 0x34], 4
sbb eax, eax
and eax, dword [ebp - 0x34]
mov dword [0x469d28], eax
movzx eax, word [ebp - 0x40]
mov dword [0x469d10], eax
movzx eax, word [ebp - 0x3e]
mov dword [0x469d14], eax
movzx eax, word [ebp - 0x3c]
mov dword [0x469d18], eax
movzx eax, word [ebp - 0x3a]
mov dword [0x469d1c], eax
movzx eax, word [ebp - 0x38]
mov dword [0x469d20], eax
call fcn.00409080
mov eax, dword [0x469d1c]
mov ecx, dword [0x469d20]
jmp 0x40994d
call fcn.00409080
mov dword [0x46641c], 0x17
mov dword [0x469d28], 0
jmp 0x4099d6
cmp edx, 4
jbe 0x4098bc
push 0x118
lea eax, [ebp + 0x9a8]
push 0
push eax
call fcn.00424960
add esp, 0xc
mov dword [ebp + 0x9a4], 0x11c
lea eax, [ebp + 0x9a4]
push eax
call edi
test eax, eax
je 0x4098bc
movzx eax, byte [ebp + 0xabe]
movzx ecx, word [ebp + 0xaba]
mov dword [0x469d28], eax
mov eax, dword [ebp + 0x9a8]
mov dword [0x469d10], eax
mov eax, dword [ebp + 0x9ac]
mov dword [0x469d14], eax
mov eax, dword [ebp + 0x9b0]
mov dword [0x469d18], eax
movzx eax, word [ebp + 0xab8]
mov dword [0x469d1c], eax
mov dword [0x469d20], ecx
push ecx
push eax
push str._u._u
push 8
push 0x469d60
call fcn.0040c920
mov edi, dword [0x469d28]
xor eax, eax
mov ebx, dword [0x469d14]
add esp, 0x14
mov esi, dword [0x469d10]
cmp edi, 4
mov ecx, 0x446d58
cmovge edi, eax
mov dword [0x469d28], edi
cmp esi, dword [ecx]
jne 0x4099a5
cmp ebx, dword [ecx + 4]
jne 0x4099a5
movzx eax, byte [ecx + 8]
xor edx, edx
cmp edi, 1
sete dl
cmp edx, eax
je 0x409bb6
add ecx, 0x10
cmp ecx, 0x446e58
jb 0x409988
mov edi, 0x17
mov dword [0x46641c], edi
cmp esi, 5
ja 0x4099c6
jne 0x4099d0
test ebx, ebx
je 0x4099d0
mov dword [0x469d30], 0x7f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0x108
push 2
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp]
call fcn.004031c0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], 0x44789c
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x68], 0x44789c
mov dword [ebp - 0x64], ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 3
call edi
test eax, eax
jne 0x409b79
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp + 0xac0]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x447384
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x409ad6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x409aa5
cmp eax, 2
jbe 0x409a6d
cmp eax, 7
jne 0x409aa5
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409f92
xor edx, edx
mov word [ebp + eax + 0xac0], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409f92
xor ecx, ecx
mov word [ebp + eax + 0xac0], cx
lea eax, [ebp + 0xac0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040cf90
lea ecx, [ebp - 0x2c]
call fcn.0040cda0
push 0
push str.preinstallation_environment
lea ecx, [ebp - 0x2c]
call fcn.0040d200
test eax, eax
js 0x409ad6
or dword [0x469d0c], 4
lea eax, [ebp - 0x10]
mov dword [0x469d24], 0
push eax
lea eax, [ebp + 0xac0]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.ReleaseId
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x409b70
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x409b4f
cmp eax, 2
jbe 0x409b17
cmp eax, 7
jne 0x409b4f
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409f92
xor edx, edx
mov word [ebp + eax + 0xac0], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409f92
xor ecx, ecx
mov word [ebp + eax + 0xac0], cx
push 0x20
push 0xa
push 1
push 4
push 0x469d24
lea eax, [ebp + 0xac0]
push eax
push 0x466210
call fcn.0040c640
add esp, 0x1c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x68]
call fcn.0040ca60
lea ecx, [ebp - 0x2c]
call fcn.0040ca60
lea ecx, [ebp]
mov dword [ebp - 4], 4
call fcn.00403250
mov edx, dword [0x469d10]
mov ecx, dword [0x469d14]
mov esi, dword [0x469d18]
mov dword [ebp - 4], 0xffffffff
jmp 0x409c68
mov edi, dword [ecx + 0xc]
cmp edi, 0x12
jne 0x4099b5
mov eax, dword [0x469d18]
mov ecx, 0x446e58
nop dword [eax]
cmp eax, dword [ecx]
jne 0x409be1
movzx eax, byte [ecx + 4]
cmp edx, eax
je 0x409bf1
mov eax, dword [0x469d18]
add ecx, 0xc
cmp ecx, 0x446f48
jb 0x409bd0
jmp 0x4099b5
mov edi, dword [ecx + 8]
jmp 0x4099b5
mov dword [0x469d00], 1
mov dword [0x469d04], 2
cmp ecx, 0x5a
jb 0x409c1e
mov dword [0x46641c], 5
jmp 0x409c59
cmp ecx, 0xa
jb 0x409c2f
mov dword [0x46641c], 4
jmp 0x409c59
mov eax, 0x438
cmp si, ax
jbe 0x409c45
mov dword [0x46641c], 3
jmp 0x409c59
mov dword [0x469d04], 1
mov dword [0x46641c], 2
movzx eax, si
mov dword [ebp + 0x89c], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push ecx
push edx
push str._d._d._d
push 0x10
push 0x469d40
call fcn.0040c920
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x469d2c], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0x108
mov dword [0x469d08], eax
lea ecx, [ebp + 0x224]
push 2
lea eax, [ebp + 0x238]
push eax
call fcn.004031c0
mov eax, dword [ebp + 0x234]
xor ecx, ecx
mov word [eax], cx
push ecx
lea ecx, [ebp + 0x224]
mov dword [ebp - 4], 5
call fcn.004087a0
mov eax, dword [ebp + 0x234]
movzx eax, word [eax]
push eax
call fcn.0042cbbd
add esp, 4
mov word [0x469d38], ax
mov eax, 0x43
mov word [0x469d3c], ax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x447400
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x409d9e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp + 0xac0]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.BootDir
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x409d95
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x409d7f
cmp eax, 2
jbe 0x409d47
cmp eax, 7
jne 0x409d7f
mov ecx, dword [ebp - 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409f92
xor edx, edx
mov word [ebp + eax + 0xac0], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x409f92
xor ecx, ecx
mov word [ebp + eax + 0xac0], cx
movzx eax, word [ebp + 0xac0]
push eax
call fcn.0042cbbd
add esp, 4
mov word [0x469d3c], ax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x88]
mov dword [0x466420], eax
movzx eax, word [ebp - 0x8c]
cmp eax, 0xc
ja case.0x409dc9.1
movzx eax, byte [eax + 0x409fb0]
jmp dword [eax*4 + 0x409f98]
mov dword [0x466418], 1
jmp 0x409e16
mov dword [0x466418], 4
jmp 0x409e16
mov dword [0x466418], 5
jmp 0x409e16
mov dword [0x466418], 8
jmp 0x409e16
mov dword [0x466418], 9
jmp 0x409e16
mov dword [0x466418], 0
cmp dword [0x469a9c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x409e55
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
call esi
push eax
call dword [0x469a9c]
test eax, eax
je 0x409e55
mov eax, dword [0x466418]
mov edx, 0xaa64
cmp word [ebp - 0x1c], dx
mov ecx, 9
cmove eax, ecx
mov dword [0x466418], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x409e7a
cmp dword [ebp - 0x24], 0
je 0x409e7a
or dword [0x469d0c], 1
push 0
push 0x108
push 2
lea eax, [ebp + 0x45c]
push eax
lea ecx, [ebp + 0x448]
call fcn.004031c0
mov eax, dword [ebp + 0x458]
xor ecx, ecx
mov word [eax], cx
push ecx
push 0x108
push 2
lea eax, [ebp + 0x680]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp + 0x66c]
call fcn.004031c0
mov eax, dword [ebp + 0x67c]
xor ecx, ecx
mov word [eax], cx
push ecx
push ecx
lea ecx, [ebp + 0x448]
mov byte [ebp - 4], 7
call fcn.00408200
test al, al
je 0x409f3a
push 0
push 0x4469c8
push str.writableCheck
push dword [ebp + 0x458]
lea ecx, [ebp + 0x66c]
call fcn.00408500
test al, al
je 0x409f3a
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x67c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x409f33
push 0
mov byte [0x466424], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x409f3a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00405090
lea ecx, [ebp + 0x66c]
mov byte [ebp - 4], 8
call fcn.00403250
lea ecx, [ebp + 0x448]
mov byte [ebp - 4], 9
call fcn.00403250
lea ecx, [ebp + 0x224]
mov dword [ebp - 4], 0xa
call fcn.00403250
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xccc]
xor ecx, ebp
call fcn.00422c85
lea esp, [ebp + 0xcd0]
pop ebp
ret
call fcn.00423708
nop
rcr byte [ebp - 0x620bffc0], 1
inc eax
add al, ch
popfd
inc eax
add ah, bl
popfd
inc eax
add byte [eax], al
sahf
inc eax
add byte [esi + ebx*4], cl
inc eax
add byte [eax], al
add eax, 0x1050505
add al, byte [84214533]
add al, 204
int3