Function at 0x10025240
Capabilities:
Check os version
Contain obfuscated stackstrings
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x10138e70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x85c]
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push 0x11c
push 0
push eax
movdqu xmmword [ebp - 0x888], xmm0
mov dword [ebp - 0x868], 0
movdqu xmmword [ebp - 0x878], xmm0
call fcn.1006ff30
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x85c]
add esp, 0xc
mov dword [ebp - 0x85c], 0x11c
push eax
call ebx
mov dword [ebp - 0x860], eax
test eax, eax
jne 0x100252c5
lea eax, [ebp - 0x85c]
mov dword [ebp - 0x85c], 0x114
push eax
call ebx
movdqa xmm0, xmmword [str.GetNativeSystemI]
lea eax, [ebp - 0x25c]
push 0x50
push 0
push eax
movdqu xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x260], 0x6f666e
call fcn.1006ff30
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x888]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x84c]
dec eax
je 0x100257cf
dec eax
jne 0x100257cf
cmp dword [ebp - 0x858], 5
jne 0x10025346
cmp dword [ebp - 0x854], 2
jne 0x10025346
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
cmp dword [ebp - 0x860], eax
je 0x100255d8
push 0xc6
push eax
mov word [ebp - 0x540], ax
lea eax, [ebp - 0x53e]
push eax
call fcn.1006ff30
movzx eax, word [ebp - 0x748]
push eax
lea eax, [ebp - 0x540]
push str.123__d
push eax
call fcn.10029d10
lea ecx, [ebp - 0x540]
add esp, 0x18
mov eax, ecx
sub esi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x10025393
mov al, byte [ebp - 0x742]
cmp al, 1
je 0x100257b2
cmp al, 3
je 0x100253bd
cmp al, 2
jne 0x100257b2
mov ecx, dword [ebp - 0x858]
cmp ecx, 5
jne 0x10025590
mov eax, dword [ebp - 0x854]
cmp eax, 2
jne 0x10025588
mov ax, word [ebp - 0x888]
cmp ax, 6
jne 0x1002544c
mov eax, dword [ebp - 0x744]
test al, al
jns 0x1002541b
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100253f5
mov ax, word [0x100af9cc]
mov word [edi], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
test al, 2
je 0x100257cf
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10025426
mov ax, word [0x100af9cc]
mov word [edi], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
cmp ax, 9
mov eax, dword [ebp - 0x744]
jne 0x100254d8
add edi, 0xfffffffe
test al, al
jns 0x10025487
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10025463
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
test al, 2
je 0x100254b4
jmp 0x10025490
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10025490
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100254b4
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
add edi, 0xfffffffe
test al, al
jns 0x10025504
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100254e0
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
test al, 2
je 0x10025534
jmp 0x10025510
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10025510
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
test eax, 0x400
je 0x10025564
jmp 0x10025540
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10025540
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10025564
mov eax, dword [0x100af8fc]
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f41a
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x100257cf
add edi, 0xfffffffe
test byte [ebp - 0x744], 2
je 0x100255c0
lea esp, [esp]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100255a0
mov eax, dword [0x100af8fc]
mov dword [edi], eax
jmp 0x100257b8
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100255c0
mov eax, dword [0x100af8fc]
mov dword [edi], eax
jmp 0x100257b8
push 0x1a2
mov word [ebp - 0x1a8], ax
lea eax, [ebp - 0x1a6]
push 0
push eax
mov dword [ebp - 0x860], 0x200
mov dword [ebp - 0x20c], 0x590053
mov dword [ebp - 0x208], 0x540053
mov dword [ebp - 0x204], 0x4d0045
mov dword [ebp - 0x200], 0x5c005c
mov dword [ebp - 0x1fc], 0x750043
mov dword [ebp - 0x1f8], 0x720072
mov dword [ebp - 0x1f4], 0x6e0065
mov dword [ebp - 0x1f0], 0x430074
mov dword [ebp - 0x1ec], 0x6e006f
mov dword [ebp - 0x1e8], 0x720074
mov dword [ebp - 0x1e4], 0x6c006f
mov dword [ebp - 0x1e0], 0x650053
mov dword [ebp - 0x1dc], 0x5c0074
mov dword [ebp - 0x1d8], 0x43005c
mov dword [ebp - 0x1d4], 0x6e006f
mov dword [ebp - 0x1d0], 0x720074
mov dword [ebp - 0x1cc], 0x6c006f
mov dword [ebp - 0x1c8], 0x5c005c
mov dword [ebp - 0x1c4], 0x720050
mov dword [ebp - 0x1c0], 0x64006f
mov dword [ebp - 0x1bc], 0x630075
mov dword [ebp - 0x1b8], 0x4f0074
mov dword [ebp - 0x1b4], 0x740070
mov dword [ebp - 0x1b0], 0x6f0069
mov dword [ebp - 0x1ac], 0x73006e
call fcn.1006ff30
add esp, 0xc
lea eax, [ebp - 0x864]
push eax
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100257cf
push 0x1f0
push eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x478], 0x720050
push eax
mov dword [ebp - 0x474], 0x64006f
mov dword [ebp - 0x470], 0x630075
mov dword [ebp - 0x46c], 0x540074
mov dword [ebp - 0x468], 0x700079
mov dword [ebp - 0x464], 0x65
call fcn.1006ff30
add esp, 0xc
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x740]
push eax
push 0
push 0
lea eax, [ebp - 0x478]
push eax
push dword [ebp - 0x864]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x864]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100257cf
cmp dword [ebp - 0x860], 0x200
ja 0x100257cf
mov ecx, dword [ebp - 0x858]
cmp ecx, 4
jne 0x100257cf
push str.Service_Pack_6
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006f41a
mov esp, ebp
pop ebp
ret