Function at 0x408580
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0xd44
mov eax, dword [0x45ce14]
xor eax, esp
mov dword [esp + 0xd40], eax
push ebx
push ebp
push esi
push edi
push pe_nt_image_headers32
lea eax, [esp + 0x1a8]
mov dword [0x45eb4c], 0
push 0
push eax
mov dword [esp + 0x1c], 0x208
call fcn.0041ff40
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x1ac]
add esp, 0xc
mov dword [esp + 0x1a0], 0x114
push eax
call edi
mov eax, dword [esp + 0x1b0]
mov edx, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a8]
mov esi, dword [esp + 0x1ac]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x45eb50], edx
mov dword [0x45eb54], ecx
mov dword [0x45eb58], esi
sub eax, 1
je 0x408af7
sub eax, 1
jne 0x408b61
mov dword [0x45b3c4], 6
mov dword [0x45eb40], 2
mov dword [0x45eb44], 3
mov dword [0x45eb68], eax
cmp edx, 6
jb 0x4087bb
cmp ecx, 2
jb 0x4087bb
push eax
mov byte [esp + 0x2c], al
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x28]
xor eax, eax
mov dword [esp + 0x30], vtable.SmartCOMPointer_struct_IWbemLocator_.0
push 0x45ef20
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], vtable.SmartCOMPointer_struct_IWbemServices_.0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov word [esp + 0x54], ax
mov dword [esp + 0x58], eax
call fcn.00408ef0
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x40], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
test al, al
je 0x40875f
cmp dword [esp + 0x54], 4
sbb eax, eax
and eax, dword [esp + 0x54]
mov dword [0x45eb68], eax
movzx eax, word [esp + 0x48]
mov dword [0x45eb50], eax
movzx eax, word [esp + 0x4a]
mov dword [0x45eb54], eax
movzx eax, word [esp + 0x4c]
mov dword [0x45eb58], eax
movzx eax, word [esp + 0x4e]
mov dword [0x45eb5c], eax
movzx eax, word [esp + 0x50]
mov dword [0x45eb60], eax
test ecx, ecx
je 0x40871d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x38], vtable.SmartCOMPointer_struct_IWbemServices_.0
test ecx, ecx
je 0x408733
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x30], vtable.SmartCOMPointer_struct_IWbemLocator_.0
test ecx, ecx
je 0x408749
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esp + 0x2c], 0
jl 0x40883b
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40883b
test ecx, ecx
je 0x408769
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x38], vtable.SmartCOMPointer_struct_IWbemServices_.0
test ecx, ecx
je 0x40877f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x30], vtable.SmartCOMPointer_struct_IWbemLocator_.0
test ecx, ecx
je 0x408795
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esp + 0x2c], 0
jl 0x4087a2
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x45b3c4], 0x15
mov dword [0x45eb68], 0
jmp 0x408908
cmp edx, 4
jbe 0x4087a2
push 0x118
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.0041ff40
add esp, 0xc
mov dword [esp + 0x84], 0x11c
lea eax, [esp + 0x84]
push eax
call edi
test eax, eax
je 0x4087a2
movzx eax, byte [esp + 0x19e]
mov dword [0x45eb68], eax
mov eax, dword [esp + 0x88]
mov dword [0x45eb50], eax
mov eax, dword [esp + 0x8c]
mov dword [0x45eb54], eax
mov eax, dword [esp + 0x90]
mov dword [0x45eb58], eax
movzx eax, word [esp + 0x198]
mov dword [0x45eb5c], eax
movzx eax, word [esp + 0x19a]
mov dword [0x45eb60], eax
push dword [0x45eb60]
push dword [0x45eb5c]
push str._u._u
push 8
push 0x45eba0
call fcn.0040b340
mov edi, dword [0x45eb68]
xor eax, eax
mov ebx, dword [0x45eb54]
add esp, 0x14
mov esi, dword [0x45eb50]
cmp edi, 4
mov ecx, 0x440be8
cmovge edi, eax
lea ebp, [eax + 0x15]
mov dword [0x45eb68], edi
cmp esi, dword [ecx]
jne 0x40889c
cmp ebx, dword [ecx + 4]
jne 0x40889c
movzx eax, byte [ecx + 8]
xor edx, edx
cmp edi, 1
sete dl
cmp edx, eax
je 0x4088a9
add ecx, 0x10
cmp ecx, 0x440ce8
jb 0x408883
jmp 0x4088e1
mov ebp, dword [ecx + 0xc]
cmp ebp, 0x12
jne 0x4088e1
mov eax, dword [0x45eb58]
mov ecx, 0x440ce8
nop dword [eax + eax]
cmp eax, dword [ecx]
jne 0x4088d1
movzx eax, byte [ecx + 4]
cmp edx, eax
je 0x4088de
mov eax, dword [0x45eb58]
add ecx, 0xc
cmp ecx, 0x440dc0
jb 0x4088c0
jmp 0x4088e1
mov ebp, dword [ecx + 8]
mov dword [0x45b3c4], ebp
cmp esi, 5
ja 0x4088f2
jne 0x4088fc
test ebx, ebx
je 0x4088fc
mov dword [0x45eb70], 0x7f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x108
push 2
lea eax, [esp + 0x940]
push eax
lea ecx, [esp + 0x930]
call fcn.00403130
mov eax, dword [esp + 0x930]
xor ecx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov word [eax], cx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0x441710
mov dword [esp + 0x38], ecx
mov dword [esp + 0x6c], 0x441710
mov dword [esp + 0x70], ecx
call edi
test eax, eax
jne 0x408ac5
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0xb48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4411fc
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x408a1d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4089e8
cmp eax, 2
jbe 0x4089af
cmp eax, 7
jne 0x4089e8
mov ecx, dword [esp + 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x408e43
xor edx, edx
mov word [esp + eax + 0xb44], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x408e43
xor ecx, ecx
mov word [esp + eax + 0xb44], cx
lea eax, [esp + 0xb44]
push eax
lea ecx, [esp + 0x24]
call fcn.0040b980
lea ecx, [esp + 0x20]
call fcn.0040b7b0
push 0
push str.preinstallation_environment
lea ecx, [esp + 0x28]
call fcn.0040bbd0
test eax, eax
js 0x408a1d
or dword [0x45eb4c], 4
lea eax, [esp + 0x10]
mov dword [0x45eb64], 0
push eax
lea eax, [esp + 0xb48]
mov dword [esp + 0x14], 0x208
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.ReleaseId
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x408abf
mov eax, dword [esp + 0x18]
test eax, eax
je 0x408a9d
cmp eax, 2
jbe 0x408a64
cmp eax, 7
jne 0x408a9d
mov ecx, dword [esp + 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x408e43
xor edx, edx
mov word [esp + eax + 0xb44], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x408e43
xor ecx, ecx
mov word [esp + eax + 0xb44], cx
push 0x20
push 0xa
push 1
push 4
push 0x45eb64
lea eax, [esp + 0xb58]
push eax
push 0x45ef20
call fcn.0040b060
add esp, 0x1c
push dword [esp + 0x14]
call ebp
lea ecx, [esp + 0x58]
call fcn.0040b470
lea ecx, [esp + 0x20]
call fcn.0040b470
lea ecx, [esp + 0x920]
call fcn.004031c0
mov edx, dword [0x45eb50]
mov ecx, dword [0x45eb54]
mov esi, dword [0x45eb58]
jmp 0x408b67
mov dword [0x45eb40], 1
mov dword [0x45eb44], 2
cmp ecx, 0x5a
jb 0x408b1c
mov dword [0x45b3c4], 5
jmp 0x408b57
cmp ecx, 0xa
jb 0x408b2d
mov dword [0x45b3c4], 4
jmp 0x408b57
mov eax, 0x438
cmp si, ax
jbe 0x408b43
mov dword [0x45b3c4], 3
jmp 0x408b57
mov dword [0x45eb44], 1
mov dword [0x45b3c4], 2
movzx eax, si
mov dword [esp + 0x1ac], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push ecx
push edx
push str._d._d._d
push 0x10
push 0x45eb80
call fcn.0040b340
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x45eb6c], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0x108
mov dword [0x45eb48], eax
lea ecx, [esp + 0x704]
push 2
lea eax, [esp + 0x71c]
push eax
call fcn.00403130
mov eax, dword [esp + 0x70c]
xor ecx, ecx
push ecx
mov word [eax], cx
lea ecx, [esp + 0x700]
call fcn.004078c0
mov eax, dword [esp + 0x70c]
movzx eax, word [eax]
push eax
call fcn.00427ddd
add esp, 4
mov word [0x45eb78], ax
mov eax, 0x43
mov word [0x45eb7c], ax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push 0x441278
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x408ca1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0xb48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.BootDir
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x408c9b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x408c84
cmp eax, 2
jbe 0x408c4b
cmp eax, 7
jne 0x408c84
mov ecx, dword [esp + 0x10]
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x408e43
xor edx, edx
mov word [esp + eax + 0xb44], dx
lea eax, [ecx + 2]
and eax, 0xfffffffe
cmp eax, 0x20c
jae 0x408e43
xor ecx, ecx
mov word [esp + eax + 0xb44], cx
movzx eax, word [esp + 0xb44]
push eax
call fcn.00427ddd
add esp, 4
mov word [0x45eb7c], ax
push dword [esp + 0x14]
call ebp
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x64]
mov dword [0x45b3c8], eax
movzx eax, word [esp + 0x60]
cmp eax, 0xc
ja case.0x408cc6.1
movzx eax, byte [eax + 0x408e60]
jmp dword [eax*4 + 0x408e48]
mov dword [0x45b3c0], 1
jmp 0x408d13
mov dword [0x45b3c0], 4
jmp 0x408d13
mov dword [0x45b3c0], 5
jmp 0x408d13
mov dword [0x45b3c0], 8
jmp 0x408d13
mov dword [0x45b3c0], 9
jmp 0x408d13
mov dword [0x45b3c0], 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x408d3f
cmp dword [esp + 0x1c], 0
je 0x408d3f
or dword [0x45eb4c], 1
push 0
push 0x108
push 2
lea eax, [esp + 0x4f8]
push eax
lea ecx, [esp + 0x4e8]
call fcn.00403130
mov eax, dword [esp + 0x4e8]
xor ecx, ecx
push ecx
push 0x108
push 2
mov word [eax], cx
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x2c4]
call fcn.00403130
mov eax, dword [esp + 0x2c4]
xor ecx, ecx
push ecx
push ecx
mov word [eax], cx
lea ecx, [esp + 0x4e0]
call fcn.00407350
test al, al
je 0x408e01
push 0
push 0x43ff50
push str.writableCheck
push dword [esp + 0x4f4]
lea ecx, [esp + 0x2c4]
call fcn.00407650
test al, al
je 0x408e01
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x2dc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x408dfa
push 0
mov byte [0x45b3cc], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x408e01
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00404890
lea ecx, [esp + 0x2b4]
call fcn.004031c0
lea ecx, [esp + 0x4d8]
call fcn.004031c0
lea ecx, [esp + 0x6fc]
call fcn.004031c0
mov ecx, dword [esp + 0xd50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e282
add esp, 0xd44
ret
call fcn.0041ead8
int 0x8c
inc eax
add cl, dh
mov word [eax], es
in eax, 0x8c
inc eax
add cl, bl
mov word [eax], es
std
mov word [eax], es
or dword [ebp + 0x5000040], ecx
add eax, 33621253
add eax, 84214533
add al, 204
int3