Function at 0x30b58c
Capabilities:
Check os version
Get hostname
Get system information on windows
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x11c
mov eax, dword [esp + 0x130]
mov ebp, dword [eax]
test ebp, ebp
je 0x30bdfa
mov eax, dword [ebp]
cmp eax, 3
je 0x30b5d0
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x16
mov dword [eax], edx
mov eax, dword [esp + 0x134]
mov dword [eax], edx
add esp, 0x11c
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], 0x10
lea eax, [esp]
lea edx, [ebp + 0x40]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x30bdd9
lea eax, [esp + 4]
push 0x9c
push 0
push eax
call fcn.00311ff4
add esp, 0xc
mov dword [esp + 4], 0x9c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebx, eax
test ebx, ebx
jne 0x30b635
mov dword [esp + 4], 0x94
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x30bdb8
mov edx, dword [esp + 0x14]
cmp edx, 2
je 0x30b717
cmp edx, 1
jne 0x30b6f4
mov edx, dword [esp + 8]
cmp edx, 4
jne 0x30b68d
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x30b68d
lea esi, [ebp + 4]
mov edi, 0x31d93c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b664
movsx eax, byte [esp + 0x19]
cmp eax, 0x43
je 0x30ba54
cmp eax, 0x42
je 0x30ba54
mov edx, dword [esp + 8]
cmp edx, 4
jne 0x30b6c3
mov eax, dword [esp + 0xc]
cmp eax, 0xa
jne 0x30b6c3
lea esi, [ebp + 4]
mov edi, 0x31d95c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b6a3
movsx eax, byte [esp + 0x19]
cmp eax, 0x41
je 0x30ba76
mov edx, dword [esp + 8]
cmp edx, 4
jne 0x30b92a
mov eax, dword [esp + 0xc]
cmp eax, 0x5a
jne 0x30b92a
lea esi, [ebp + 4]
mov edi, 0x31d978
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b6e1
jmp 0x30b92a
test edx, edx
jne 0x30b92a
lea esi, [ebp + 4]
mov edi, 0x31d990
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b704
jmp 0x30b92a
mov ecx, dword [esp + 8]
cmp ecx, 4
ja 0x30b73a
lea esi, [ebp + 4]
mov edi, 0x31d7b0
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b728
mov ecx, dword [esp + 8]
cmp ecx, 5
jne 0x30b761
mov edx, dword [esp + 0xc]
test edx, edx
jne 0x30b761
lea esi, [ebp + 4]
mov edi, 0x31d7c8
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b74f
mov ecx, dword [esp + 8]
cmp ecx, 5
jne 0x30b789
mov edx, dword [esp + 0xc]
cmp edx, 1
jne 0x30b789
lea esi, [ebp + 4]
mov edi, 0x31d7e0
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b777
mov ecx, dword [esp + 8]
cmp ecx, 5
jne 0x30b7b1
mov edx, dword [esp + 0xc]
cmp edx, 2
jne 0x30b7b1
lea esi, [ebp + 4]
mov edi, 0x31d7f8
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b79f
mov ecx, dword [esp + 8]
cmp ecx, 5
ja 0x30b7bf
mov edx, dword [esp + 0xc]
cmp edx, 2
jbe 0x30b7d5
lea esi, [ebp + 4]
mov edi, 0x31d810
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b7c7
test ebx, ebx
je 0x30b801
movzx eax, byte [esp + 0x9e]
cmp eax, 1
je 0x30bb23
cmp eax, 3
je 0x30bab6
cmp eax, 2
je 0x30ba98
jmp 0x30b8e0
lea eax, [esp + 0xa0]
push eax
push 1
push 0
push 0x31d8a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0xa8]
lea eax, [esp + 0xa4]
push eax
xor ecx, ecx
push edx
push ecx
push ecx
push 0x31d8d0
push dword [esp + 0xb4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xa8]
push eax
push 0x31d8dc
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x30b880
lea esi, [ebp + 0x8c]
mov edi, 0x31d84c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b872
lea eax, [esp + 0xa8]
push eax
push 0x31d8e4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x30b8b0
lea esi, [ebp + 0x8c]
mov edi, 0x31d884
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b8a2
lea eax, [esp + 0xa8]
push eax
push 0x31d900
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x30b8e0
lea esi, [ebp + 0x8c]
mov edi, 0x31d8f0
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b8d2
mov ecx, dword [esp + 8]
cmp ecx, 4
ja 0x30b90d
movzx eax, word [esp + 0x10]
lea edx, [esp + 0x18]
push eax
lea ebx, [ebp + 0x50]
push edx
push dword [esp + 0x14]
push ecx
push 0x31d90c
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
jmp 0x30b92a
movzx eax, word [esp + 0x10]
lea edx, [esp + 0x18]
push eax
lea ecx, [ebp + 0x50]
push edx
push 0x31d92c
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x30b9cb
movzx eax, word [esp + 0xf8]
cmp eax, 0xffff
je 0x30bd98
test eax, eax
je 0x30bd01
cmp eax, 1
je 0x30bce1
cmp eax, 2
je 0x30bc60
cmp eax, 3
je 0x30bb6e
cmp eax, 6
je 0x30b9ae
cmp eax, 0xa
je 0x30b9ae
cmp eax, 9
jne 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da3c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b99b
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da34
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b9bb
jmp 0x30ba3c
mov eax, dword [esp + 0x110]
cmp eax, 0x182
je 0x30ba21
cmp eax, 0x1e6
jne 0x30b9fd
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9b4
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30b9ed
jmp 0x30ba3c
cmp eax, 0x24a
jne 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da44
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30ba11
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9ac
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30ba2e
mov eax, dword [esp + 0x134]
mov dword [eax], 0
add esp, 0x11c
pop ebx
pop ebp
pop esi
pop edi
ret
lea esi, [ebp + 0x8c]
mov edi, 0x31d954
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30ba5f
mov edx, dword [esp + 8]
jmp 0x30b68d
lea esi, [ebp + 0x8c]
mov edi, 0x31d974
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30ba81
mov edx, dword [esp + 8]
jmp 0x30b6c3
lea esi, [ebp + 0x8c]
mov edi, 0x31d88c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30baa3
jmp 0x30b8e0
movzx eax, word [esp + 0x9c]
test eax, 0x80
jne 0x30bb05
test al, 2
je 0x30bae7
lea esi, [ebp + 0x8c]
mov edi, 0x31d870
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bad4
jmp 0x30b8e0
lea esi, [ebp + 0x8c]
mov edi, 0x31d884
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30baf2
jmp 0x30b8e0
lea esi, [ebp + 0x8c]
mov edi, 0x31d85c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bb10
jmp 0x30b8e0
movzx eax, word [esp + 0x9c]
test eax, 0x200
je 0x30bb50
lea esi, [ebp + 0x8c]
mov edi, 0x31d840
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bb3d
jmp 0x30b8e0
lea esi, [ebp + 0x8c]
mov edi, 0x31d84c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bb5b
jmp 0x30b8e0
movzx eax, word [esp + 0x118]
cmp eax, 1
je 0x30bc40
cmp eax, 3
je 0x30bc20
cmp eax, 4
je 0x30bc00
cmp eax, 6
je 0x30bbe0
cmp eax, 9
jne 0x30bbb7
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da20
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bba4
jmp 0x30ba3c
cmp eax, 0x14
jne 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da2c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bbcd
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da14
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bbed
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da0c
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bc0d
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31da04
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bc2d
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9fc
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bc4d
jmp 0x30ba3c
movzx eax, word [esp + 0x118]
cmp eax, 0x5248
je 0x30bcc1
cmp eax, 0x524a
jne 0x30bc96
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9e4
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bc83
jmp 0x30ba3c
cmp eax, 0x52ac
jne 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9f0
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bcae
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9d8
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bcce
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9cc
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bcee
jmp 0x30ba3c
movzx eax, word [esp + 0x118]
cmp eax, 3
je 0x30bd78
cmp eax, 4
jne 0x30bd33
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9b4
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bd20
jmp 0x30ba3c
cmp eax, 5
jne 0x30bd58
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9bc
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bd45
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9c4
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bd65
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9ac
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bd85
jmp 0x30ba3c
add ebp, 0xc8
mov esi, ebp
mov edi, 0x31d9a4
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x30bda5
jmp 0x30ba3c
call fcn.003057f4
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x134]
mov eax, dword [eax]
mov dword [edx], eax
add esp, 0x11c
pop ebx
pop ebp
pop esi
pop edi
ret
call fcn.003057f4
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, dword [esp + 0x134]
mov eax, dword [eax]
mov dword [edx], eax
add esp, 0x11c
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, dword [esp + 0x134]
mov dword [eax], 0x7f
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
add esp, 0x11c
pop ebx
pop ebp
pop esi
pop edi
ret