Function at 0x4087e0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0xd40
mov eax, dword [0x45cdfc]
xor eax, esp
mov dword [esp + 0xd3c], eax
push ebx
push ebp
push esi
push edi
push 0x114
lea eax, [esp + 0x1a4]
mov dword [0x45eb3c], 0
push 0
push eax
mov dword [esp + 0x20], 0x208
call fcn.004201f0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x1ac]
add esp, 0xc
mov dword [esp + 0x1a0], 0x114
push eax
call edi
mov eax, dword [esp + 0x1b0]
mov edx, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a8]
mov esi, dword [esp + 0x1ac]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x45eb40], edx
mov dword [0x45eb44], ecx
mov dword [0x45eb48], esi
sub eax, 1
je 0x408cb5
sub eax, 1
jne 0x408d1f
mov dword [0x45b3bc], 6
mov dword [0x45eb30], 2
mov dword [0x45eb34], 3
mov dword [0x45eb58], eax
cmp edx, 6
jb 0x408a25
cmp ecx, 2
jb 0x408a25
push eax
mov dword [0x45b3bc], 6
mov byte [esp + 0x2c], al
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x28]
xor eax, eax
mov dword [esp + 0x30], vtable.SmartCOMPointer_struct_IWbemLocator_.0
push 0x45ef0c
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], vtable.SmartCOMPointer_struct_IWbemServices_.0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov word [esp + 0x54], ax
mov dword [esp + 0x58], eax
call fcn.004085e0
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x40], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
test al, al
je 0x4089c9
cmp dword [esp + 0x54], 4
sbb eax, eax
and eax, dword [esp + 0x54]
mov dword [0x45eb58], eax
movzx eax, word [esp + 0x48]
mov dword [0x45eb40], eax
movzx eax, word [esp + 0x4a]
mov dword [0x45eb44], eax
movzx eax, word [esp + 0x4c]
mov dword [0x45eb48], eax
movzx eax, word [esp + 0x4e]
mov dword [0x45eb4c], eax
movzx eax, word [esp + 0x50]
mov dword [0x45eb50], eax
test ecx, ecx
je 0x408987
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x38], vtable.SmartCOMPointer_struct_IWbemServices_.0
test ecx, ecx
je 0x40899d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x30], vtable.SmartCOMPointer_struct_IWbemLocator_.0
test ecx, ecx
je 0x4089b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esp + 0x2c], 0
jl 0x408aa5
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x408aa5
test ecx, ecx
je 0x4089d3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x38], vtable.SmartCOMPointer_struct_IWbemServices_.0
test ecx, ecx
je 0x4089e9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x30], vtable.SmartCOMPointer_struct_IWbemLocator_.0
test ecx, ecx
je 0x4089ff
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esp + 0x2c], 0
jl 0x408a0c
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x45b3bc], 0x15
mov dword [0x45eb58], 0
jmp 0x408b70
cmp edx, 4
jbe 0x408a0c
push 0x11c
lea eax, [esp + 0x88]
push 0
push eax
call fcn.004201f0
add esp, 0xc
mov dword [esp + 0x84], 0x11c
lea eax, [esp + 0x84]
push eax
call edi
test eax, eax
je 0x408a0c
movzx eax, byte [esp + 0x19e]
mov dword [0x45eb58], eax
mov eax, dword [esp + 0x88]
mov dword [0x45eb40], eax
mov eax, dword [esp + 0x8c]
mov dword [0x45eb44], eax
mov eax, dword [esp + 0x90]
mov dword [0x45eb48], eax
movzx eax, word [esp + 0x198]
mov dword [0x45eb4c], eax
movzx eax, word [esp + 0x19a]
mov dword [0x45eb50], eax
push dword [0x45eb50]
push dword [0x45eb4c]
push str._u._u
push 8
push 0x45eb90
call fcn.0040b240
mov edi, dword [0x45eb58]
xor eax, eax
mov ebx, dword [0x45eb44]
add esp, 0x14
mov esi, dword [0x45eb40]
cmp edi, 4
mov ecx, 0x441e48
cmovge edi, eax
lea ebp, [eax + 0x15]
mov dword [0x45eb58], edi
nop dword [eax]
cmp esi, dword [ecx]
jne 0x408b09
cmp ebx, dword [ecx + 4]
jne 0x408b09
movzx eax, byte [ecx + 8]
xor edx, edx
cmp edi, 1
sete dl
cmp edx, eax
je 0x408b16
add ecx, 0x10
cmp ecx, 0x441f48
jb 0x408af0
jmp 0x408b49
mov ebp, dword [ecx + 0xc]
cmp ebp, 0x12
jne 0x408b49
mov eax, dword [0x45eb48]
mov ecx, 0x441f48
cmp eax, dword [ecx]
jne 0x408b39
movzx eax, byte [ecx + 4]
cmp edx, eax
je 0x408b46
mov eax, dword [0x45eb48]
add ecx, 0xc
cmp ecx, 0x442020
jb 0x408b28
jmp 0x408b49
mov ebp, dword [ecx + 8]
mov dword [0x45b3bc], ebp
cmp esi, 5
ja 0x408b5a
jne 0x408b64
test ebx, ebx
je 0x408b64
mov dword [0x45eb60], 0x7f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x108
push 2
lea eax, [esp + 0x940]
push eax
lea ecx, [esp + 0x930]
call fcn.00403170
mov eax, dword [esp + 0x930]
xor ecx, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov word [eax], cx
lea eax, [esp + 0x10]
push eax
push 0x20019
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0x442970
mov dword [esp + 0x38], ecx
mov dword [esp + 0x6c], 0x442970
mov dword [esp + 0x70], ecx
call edi
test eax, eax
jne 0x408c83
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xb48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x44245c
push dword [esp + 0x24]
call ebx
test eax, eax
jne 0x408c2e
lea eax, [esp + 0xb44]
push eax
lea ecx, [esp + 0x24]
call fcn.0040b8b0
lea ecx, [esp + 0x20]
call fcn.0040b6c0
push 0
push str.preinstallation_environment
lea ecx, [esp + 0x28]
call fcn.0040bb10
test eax, eax
js 0x408c2e
or dword [0x45eb3c], 4
lea eax, [esp + 0x14]
mov dword [0x45eb54], 0
push eax
lea eax, [esp + 0xb48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.ReleaseId
push dword [esp + 0x24]
call ebx
test eax, eax
jne 0x408c7d
push 0x20
push 0xa
push 1
push 4
push 0x45eb54
lea eax, [esp + 0xb58]
push eax
push 0x45ef0c
call fcn.0040af60
add esp, 0x1c
push dword [esp + 0x10]
call ebp
lea ecx, [esp + 0x58]
call fcn.0040b370
lea ecx, [esp + 0x20]
call fcn.0040b370
lea ecx, [esp + 0x920]
call fcn.00403200
mov edx, dword [0x45eb40]
mov ecx, dword [0x45eb44]
mov esi, dword [0x45eb48]
jmp 0x408d25
mov dword [0x45eb30], 1
mov dword [0x45eb34], 2
cmp ecx, 0x5a
jb 0x408cda
mov dword [0x45b3bc], 5
jmp 0x408d15
cmp ecx, 0xa
jb 0x408ceb
mov dword [0x45b3bc], 4
jmp 0x408d15
mov eax, 0x438
cmp si, ax
jbe 0x408d01
mov dword [0x45b3bc], 3
jmp 0x408d15
mov dword [0x45eb34], 1
mov dword [0x45b3bc], 2
movzx eax, si
mov dword [esp + 0x1ac], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push ecx
push edx
push str._d._d._d
push 0x10
push 0x45eb70
call fcn.0040b240
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x45eb5c], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0x108
mov dword [0x45eb38], eax
lea ecx, [esp + 0x704]
push 2
lea eax, [esp + 0x71c]
push eax
call fcn.00403170
mov eax, dword [esp + 0x70c]
xor ecx, ecx
push ecx
mov word [eax], cx
lea ecx, [esp + 0x700]
call fcn.004078a0
mov eax, dword [esp + 0x70c]
movzx eax, word [eax]
push eax
call fcn.0042809d
add esp, 4
mov word [0x45eb68], ax
mov eax, 0x43
mov word [0x45eb6c], ax
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push 0x4424d8
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x408e08
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xb48]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.BootDir
push dword [esp + 0x24]
call ebx
test eax, eax
jne 0x408e02
movzx eax, word [esp + 0xb44]
push eax
call fcn.0042809d
add esp, 4
mov word [0x45eb6c], ax
push dword [esp + 0x10]
call ebp
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x64]
pop edi
pop esi
mov dword [0x45b3c0], eax
movzx eax, word [esp + 0x58]
pop ebp
pop ebx
cmp eax, 0xc
ja case.0x408e31.1
movzx eax, byte [eax + 0x408fc0]
jmp dword [eax*4 + 0x408fa8]
mov dword [0x45b3b8], 1
jmp 0x408e7e
mov dword [0x45b3b8], 4
jmp 0x408e7e
mov dword [0x45b3b8], 5
jmp 0x408e7e
mov dword [0x45b3b8], 8
jmp 0x408e7e
mov dword [0x45b3b8], 9
jmp 0x408e7e
mov dword [0x45b3b8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x408eaa
cmp dword [esp + 0xc], 0
je 0x408eaa
or dword [0x45eb3c], 1
push 0
push 0x108
push 2
lea eax, [esp + 0x4e8]
push eax
lea ecx, [esp + 0x4d8]
call fcn.00403170
mov eax, dword [esp + 0x4d8]
xor ecx, ecx
push ecx
push 0x108
push 2
mov word [eax], cx
lea eax, [esp + 0x2c4]
push eax
lea ecx, [esp + 0x2b4]
call fcn.00403170
mov eax, dword [esp + 0x2b4]
xor ecx, ecx
push ecx
push ecx
mov word [eax], cx
lea ecx, [esp + 0x4d0]
call fcn.00407330
test al, al
je 0x408f6c
push 0
push 0x440158
push str.writableCheck
push dword [esp + 0x4e4]
lea ecx, [esp + 0x2b4]
call fcn.00407630
test al, al
je 0x408f6c
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x2cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x408f65
push 0
mov byte [0x45b3c4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x408f6c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2a4]
call fcn.00403200
lea ecx, [esp + 0x4c8]
call fcn.00403200
lea ecx, [esp + 0x6ec]
call fcn.00403200
mov ecx, dword [esp + 0xd3c]
xor ecx, esp
call fcn.0041e5aa
add esp, 0xd40
ret