Function at 0x1002cd50
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x270], ecx
push edi
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x26c], ebx
mov edi, 1
mov dword [ebp - 0x148], 0x11c
mov dword [ebp - 0x264], 0x11c
call fcn.1002cba0
test eax, eax
je 0x1002cdba
push dword [ebp - 0x148]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
jmp 0x1002cdf6
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1002cdf6
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x148], 0x114
call fcn.1002ccd0
test eax, eax
jne 0x1002cdf4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
xor edi, edi
push str.GetNativeSystemInfo
push 0x1003c4c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002ce19
lea ecx, [ebp - 0x2c]
push ecx
call eax
jmp 0x1002ce23
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x138]
push esi
xor esi, esi
sub eax, esi
je 0x1002d184
dec eax
je 0x1002d141
dec eax
jne 0x1002cfe2
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x140]
cmp ecx, 5
ja 0x1002ce5d
jne 0x1002ce6a
test eax, eax
je 0x1002cf04
cmp word [ebp - 0x2c], 9
mov edx, 0x80000
cmove esi, edx
cmp ecx, 0xa
jne 0x1002ce82
test eax, eax
jne 0x1002cfe2
or esi, 0x1900
jmp 0x1002cfe2
cmp ecx, 6
jne 0x1002cefb
cmp eax, 4
jne 0x1002ce97
or esi, 0x1900
jmp 0x1002cfe2
cmp eax, 3
jne 0x1002cea7
or esi, 0x1800
jmp 0x1002cfe2
cmp eax, 2
jne 0x1002ceb7
or esi, 0x1700
jmp 0x1002cfe2
cmp eax, 1
jne 0x1002ced7
cmp byte [ebp - 0x2e], al
jne 0x1002cecc
or esi, 0x1600
jmp 0x1002cfe2
or esi, 0x150b
jmp 0x1002cfe2
test eax, eax
jne 0x1002cfe2
or esi, 0x1500
cmp byte [ebp - 0x2e], 1
jne 0x1002cef3
or esi, 0xa
jmp 0x1002cfe2
or esi, 0xb
jmp 0x1002cfe2
cmp ecx, 5
jne 0x1002d029
cmp eax, 2
jne 0x1002cfa1
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov bl, byte [ebp - 0x2e]
mov edx, dword [ebp - 0x30]
test eax, eax
mov ax, word [ebp - 0x2c]
jne 0x1002cf4a
mov ecx, 0x2000
cmp dx, cx
je 0x1002cf4a
mov ecx, 0x8000
cmp dx, cx
je 0x1002cf4a
cmp bl, 1
jne 0x1002cf4a
cmp ax, 9
jne 0x1002cf4a
or esi, 0x81300
jmp 0x1002cf8a
or esi, 0x1400
test dl, dl
jns 0x1002cf59
or esi, 4
jmp 0x1002cf73
test dl, 2
je 0x1002cf63
or esi, 5
jmp 0x1002cf73
test edx, 0x400
je 0x1002cf70
or esi, 6
jmp 0x1002cf73
or esi, 7
cmp bl, 1
je 0x1002cf8a
cmp ax, 6
je 0x1002cf84
cmp ax, 9
jne 0x1002cf8a
or esi, 0x80000
mov ecx, dword [ebp - 0x144]
cmp ecx, 5
jne 0x1002d02f
mov eax, dword [ebp - 0x140]
jmp 0x1002cfa7
mov bl, byte [ebp - 0x2e]
mov edx, dword [ebp - 0x30]
cmp eax, 1
jne 0x1002cfca
mov ebx, dword [ebp - 0x26c]
or esi, 0x1300
test edx, 0x200
je 0x1002cfc5
or esi, 2
jmp 0x1002cfe2
or esi, 3
jmp 0x1002cfe2
test eax, eax
jne 0x1002cfdc
or esi, 0x1200
cmp bl, 1
jne 0x1002d010
or esi, 3
mov ebx, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x1002cfee
mov dword [eax], esi
test ebx, ebx
je 0x1002cffa
mov eax, dword [ebp - 0x13c]
mov dword [ebx], eax
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
test dl, dl
jns 0x1002d019
or esi, 4
jmp 0x1002cfdc
mov ebx, dword [ebp - 0x26c]
test dl, 2
je 0x1002d078
or esi, 8
jmp 0x1002cfe2
mov bl, byte [ebp - 0x2e]
mov edx, dword [ebp - 0x30]
cmp ecx, 4
jne 0x1002d03c
or esi, 0x1100
jmp 0x1002d049
jae 0x1002d044
or esi, 0x1000
cmp ecx, 4
ja 0x1002cfdc
test edi, edi
je 0x1002d080
cmp bl, 1
jne 0x1002d057
or esi, 1
jmp 0x1002cfdc
cmp bl, 3
je 0x1002d065
cmp bl, 2
jne 0x1002cfdc
mov ebx, dword [ebp - 0x26c]
test dl, 2
je 0x1002d078
or esi, 5
jmp 0x1002cfe2
or esi, 9
jmp 0x1002cfe2
lea eax, [ebp - 0x268]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 8], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002d12e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1e8]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002d12e
cmp dword [ebp - 8], 0x50
ja 0x1002d12e
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x1e8]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x1002d0fb
or esi, 1
lea eax, [ebp - 0x1e8]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x1002d110
or esi, 9
lea eax, [ebp - 0x1e8]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x1002cfdc
or esi, 8
jmp 0x1002cfdc
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x144], 4
jne 0x1002cfe2
mov eax, dword [ebp - 0x140]
test eax, eax
jne 0x1002d162
mov esi, 0x200
jmp 0x1002cfe2
cmp eax, 0xa
jne 0x1002d171
mov esi, 0x300
jmp 0x1002cfe2
cmp eax, 0x5a
jne 0x1002cfe2
mov esi, 0x400
jmp 0x1002cfe2
mov esi, 0x100
jmp 0x1002cfe2