Function at 0x1001562
Capabilities:
Check os version
Query environment variable
Query or enumerate registry value

Disassembly:
test eax, eax
js 0x10010f5
cmp al, 6
jb 0x10010f5
push 0x1001270
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10010f5
push 0x100128c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010f5
push 0
push 0
push 1
push 0
call eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
push 0x105
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 0x105
call edi
push 0x105
mov esi, eax
call edi
add esp, 8
mov edi, eax
test esi, esi
je 0x10017ef
test edi, edi
je 0x1001264
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10012a0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001264
lea ecx, [ebp - 0xc]
push ecx
push esi
lea edx, [ebp - 8]
push edx
push eax
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001264
mov ebx, 2
cmp dword [ebp - 8], ebx
je 0x10017c9
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
mov dword [ebp - 0x10], eax
call esi
push edi
call esi
mov eax, dword [ebp - 4]
add esp, 8
cmp eax, 0xffffffff
je 0x10011ad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
push 0x10012dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x1001221
push 0x10012f8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1001221
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x1001221
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x1001217
push 0
push esi
call dword [ebp + 0x10]
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x10017fd
push 0x1001314
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10017e3
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push ebx
push edx
push ecx
call eax
jmp 0x10017e3
mov eax, edi
cmp dword [ebp - 8], ebx
jne 0x100117c
jmp 0x100117e
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
jmp 0x10017ec
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.010019a9
jmp 0x10017be
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10010c4
push 0x105
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x1001254
jmp 0x1001264
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10017fd
add esp, 4
test edi, edi
je 0x10017fd
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x100180f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10