Function at 0x405bf7
Capabilities:
Check os version
Get common file path
Get session user name
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [0x40b8e0], 0x9c
push 0x40b8e0
call sub.KERNEL32.DLL_GetVersionExA
mov ecx, dword [0x40bbcc]
cmp byte [ecx], 0
je 0x405cde
cmp dword [0x40b8e4], 0xa
jge 0x405cde
mov al, 0xff
cmp dword [0x40b8e4], 6
jne 0x405c63
cmp dword [0x40b8e8], 0
jne 0x405c42
mov al, 5
jmp 0x405cd2
cmp dword [0x40b8e8], 1
jne 0x405c52
mov al, 4
jmp 0x405cd2
cmp dword [0x40b8e8], 2
jne 0x405c5f
mov al, 3
jmp 0x405cd2
mov al, 2
jmp 0x405cd2
cmp dword [0x40b8e4], 5
jne 0x405c8a
cmp dword [0x40b8e8], 2
jne 0x405c79
mov al, 6
jmp 0x405cd2
cmp dword [0x40b8e8], 1
jne 0x405c86
mov al, 7
jmp 0x405cd2
mov al, 8
jmp 0x405cd2
cmp dword [0x40b8e4], 4
jne 0x405cbe
cmp dword [0x40b8e8], 0x5a
jne 0x405ca0
mov al, 9
jmp 0x405cd2
cmp dword [0x40b8e8], 0xa
jne 0x405cad
mov al, 0xa
jmp 0x405cd2
cmp dword [0x40b8f0], 2
jne 0x405cba
mov al, 0xc
jmp 0x405cd2
mov al, 0xb
jmp 0x405cd2
cmp dword [0x40b8e4], 3
jne 0x405cd2
cmp dword [0x40b8e8], 0x33
jne 0x405cd2
mov al, 0xd
cmp byte [ecx], al
jge 0x405cde
mov byte [0x40bbf4], 0xfd
ret
add dword [0x40bbcc], 1
mov esi, dword [0x40bbcc]
lodsb al, byte [esi]
or al, al
je 0x405e6c
mov byte [0x40bc19], al
mov dword [0x40bba8], 0
push 0x40bc4a
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x405d9b
mov dword [0x40bbac], 0
mov dword [0x40bba4], 0x100
push 0
push 0
push 0
push 0
push 0x40bba4
push 0x40a9ef
push dword [0x40bbac]
push dword [0x40bc4a]
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x405d90
inc dword [0x40bbac]
mov ecx, dword [0x40bba8]
mov eax, 0x40a9ef
mov eax, dword [eax]
cmp al, 0x76
jne 0x405d36
cmp cl, ah
jg 0x405d36
mov cl, ah
rol eax, 0x10
cmp al, 0
jne 0x405d86
mov ah, 0x30
mov ch, ah
mov dword [0x40bba8], ecx
jmp 0x405d36
push dword [0x40bc4a]
call sub.advapi32.dll_RegCloseKey
cmp dword [0x40bba8], 0
jne 0x405dd8
push 0x40bc4a
push 0x20019
push 0
push str.SoftwareMicrosoft.NET_FrameworkPolicy_v1.0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x405e4d
inc dword [0x40bba8]
push dword [0x40bc4a]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [0x40bba8]
cmp byte [0x40bc19], 1
je 0x405e55
cmp byte [0x40bc19], 2
jne 0x405dfa
cmp al, 0x31
jg 0x405e55
cmp ah, 0x31
jge 0x405e55
jmp 0x405e4d
cmp byte [0x40bc19], 3
jne 0x405e09
cmp al, 0x32
jge 0x405e55
jmp 0x405e4d
cmp byte [0x40bc19], 4
jne 0x405e18
cmp al, 0x33
jge 0x405e55
jmp 0x405e4d
cmp byte [0x40bc19], 5
jne 0x405e2c
cmp al, 0x33
jg 0x405e55
cmp cl, 0x35
jge 0x405e55
jmp 0x405e4d
cmp byte [0x40bc19], 6
jne 0x405e3b
cmp al, 0x34
jge 0x405e55
jmp 0x405e4d
cmp byte [0x40bc19], 7
jne 0x405e4d
cmp al, 0x34
jg 0x405e55
cmp cl, 0x35
jge 0x405e55
mov byte [0x40bbf4], 0xfc
ret
inc dword [0x40bbcc]
push dword [0x40bbcc]
call sub.KERNEL32.DLL_lstrlenA
add dword [0x40bbcc], eax
inc dword [0x40bbcc]
mov eax, dword [0x40bbcc]
cmp byte [eax], 0
je 0x405ef9
cmp dword [0x40b8f0], 2
jne 0x405ef9
mov dword [0x40bba4], 0x100
push 0x40bba4
push 0x40a9ef
call sub.advapi32.dll_GetUserNameA
push 0x40a9ef
call sub.KERNEL32.DLL_lstrlenA
inc eax
push 0x100
push 0x40aaf3
push eax
push 0x40a9ef
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push str.netapi32.dll
call sub.KERNEL32.DLL_LoadLibraryA
push str.NetUserGetInfo
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40bba4
push 1
push 0x40aaf3
push 0
call eax
mov eax, dword [0x40bba4]
cmp dword [eax + 0xc], 2
je 0x405ef9
mov byte [0x40bbf4], 0xfb
mov eax, dword [0x40bbcc]
mov cl, byte [eax + 1]
mov byte [0x40bc49], cl
mov ecx, dword [eax + 2]
mov dword [0x40bc45], ecx
add dword [0x40bbcc], 6
push dword [0x40bbcc]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bbcc]
mov dword [0x40bbd0], eax
cmp byte [0x40bbf4], 0xfb
je 0x406135
push eax
push dword [0x40bbc4]
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bbc4], eax
add eax, dword [0x40bbd0]
mov dword [0x40bc0e], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc0e]
mov dword [0x40bc06], eax
cmp byte [eax], 0
je 0x405f7d
mov byte [0x40bc05], 1
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc06]
mov dword [0x40bc30], eax
push eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bc30], eax
pop eax
cmp byte [0x40bc5e], 2
je 0x406105
push eax
mov bl, byte [eax]
cmp bl, 1
jne 0x405fd2
mov eax, str.SystemDrive
push 0x100
push 0x40acfb
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
jmp 0x4060cf
cmp bl, 2
jne 0x405fe3
push str.ProgramFilesDir
jmp 0x405fed
cmp bl, 3
jne 0x406042
push str.CommonFilesDir
push 0x40bba4
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
pop eax
mov dword [0x40bba8], 0x104
push 0x40bba8
push 0x40acfb
push 0
push 0
push eax
push dword [0x40bba4]
call sub.advapi32.dll_RegQueryValueExA
push dword [0x40bba4]
call sub.advapi32.dll_RegCloseKey
jmp 0x4060cf
cmp bl, 4
jne 0x40605d
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetWindowsDirectoryA
jmp 0x4060cf
cmp bl, 5
jne 0x406078
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetSystemDirectoryA
jmp 0x4060cf
cmp bl, 6
jne 0x406089
mov eax, str.UserProfile
jmp 0x405fb8
cmp bl, 7
jne 0x40609a
mov eax, str.AppData
jmp 0x405fb8
cmp bl, 8
jne 0x4060a8
mov eax, 5
jmp 0x4060b2
cmp bl, 9
jne 0x4060e0
mov eax, 0x10
push 0x40bba4
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x40acfb
push dword [0x40bba4]
call sub.shell32.dll_SHGetPathFromIDListA
pop eax
mov byte [eax], 0x5c
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcatA
jmp 0x406105
cmp bl, 0xa
jne 0x4060f8
push 0x40acfb
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x4060cf
pop eax
inc eax
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcpyA
push dword [0x40bc30]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc30]
mov dword [0x40bc34], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc34]
mov dword [0x40bc0a], eax
mov byte [0x40bbf4], 1
ret