Function at 0x405bf7
Capabilities:
Check os version
Get common file path
Get session user name
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [0x40b8e0], 0x9c
push 0x40b8e0
call sub.KERNEL32.DLL_GetVersionExA
mov esi, dword [0x40bbcc]
cmp byte [esi], 1
je 0x405d3d
cmp dword [0x40b8e4], 7
jge 0x405c5d
cmp dword [0x40b8e4], 6
jne 0x405c6c
cmp dword [0x40b8e8], 0
jne 0x405c5d
cmp word [0x40b996], 1
jne 0x405c4e
cmp byte [esi + 3], 1
je 0x405d3d
jmp 0x405d35
cmp byte [esi + 2], 1
je 0x405d3d
jmp 0x405d35
cmp byte [esi + 1], 1
je 0x405d3d
jmp 0x405d35
cmp dword [0x40b8e4], 5
jne 0x405cbe
cmp dword [0x40b8e8], 2
jne 0x405c8d
cmp byte [esi + 4], 1
je 0x405d3d
jmp 0x405d35
cmp dword [0x40b8e8], 1
jne 0x405ca5
cmp byte [esi + 5], 1
je 0x405d3d
jmp 0x405d35
cmp dword [0x40b8e8], 0
jne 0x405d35
cmp byte [esi + 6], 1
je 0x405d3d
jmp 0x405d35
cmp dword [0x40b8e4], 4
jne 0x405d14
cmp dword [0x40b8f0], 2
jne 0x405cd8
cmp byte [esi + 7], 1
je 0x405d3d
jmp 0x405d35
cmp dword [0x40b8e8], 0x5a
jne 0x405ce9
cmp byte [esi + 9], 1
je 0x405d3d
jmp 0x405d12
cmp dword [0x40b8e8], 0xa
jne 0x405cfa
cmp byte [esi + 0xa], 1
je 0x405d3d
jmp 0x405d12
cmp dword [0x40b8e8], 0
je 0x405d0c
cmp dword [0x40b8e8], 3
jne 0x405d12
cmp byte [esi + 0xb], 1
je 0x405d3d
jmp 0x405d35
cmp dword [0x40b8e4], 3
jne 0x405d35
cmp dword [0x40b8f0], 2
jne 0x405d35
cmp dword [0x40b8e8], 0x33
jne 0x405d35
cmp byte [esi + 8], 1
je 0x405d3d
mov byte [0x40bbf4], 0xfd
ret
add dword [0x40bbcc], 0xc
mov esi, dword [0x40bbcc]
lodsb al, byte [esi]
or al, al
je 0x405ecb
mov byte [0x40bc19], al
mov dword [0x40bba8], 0
push 0x40bc4a
push 0x20019
push 0
push str.SoftwareMicrosoftNET_Framework_SetupNDP
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x405dfa
mov dword [0x40bbac], 0
mov dword [0x40bba4], 0x100
push 0
push 0
push 0
push 0
push 0x40bba4
push 0x40a9ef
push dword [0x40bbac]
push dword [0x40bc4a]
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x405def
inc dword [0x40bbac]
mov ecx, dword [0x40bba8]
mov eax, 0x40a9ef
mov eax, dword [eax]
cmp al, 0x76
jne 0x405d95
cmp cl, ah
jg 0x405d95
mov cl, ah
rol eax, 0x10
cmp al, 0
jne 0x405de5
mov ah, 0x30
mov ch, ah
mov dword [0x40bba8], ecx
jmp 0x405d95
push dword [0x40bc4a]
call sub.advapi32.dll_RegCloseKey
cmp dword [0x40bba8], 0
jne 0x405e37
push 0x40bc4a
push 0x20019
push 0
push str.SoftwareMicrosoft.NET_FrameworkPolicy_v1.0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x405eac
inc dword [0x40bba8]
push dword [0x40bc4a]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [0x40bba8]
cmp byte [0x40bc19], 1
je 0x405eb4
cmp byte [0x40bc19], 2
jne 0x405e59
cmp al, 0x31
jg 0x405eb4
cmp ah, 0x31
jge 0x405eb4
jmp 0x405eac
cmp byte [0x40bc19], 3
jne 0x405e68
cmp al, 0x32
jge 0x405eb4
jmp 0x405eac
cmp byte [0x40bc19], 4
jne 0x405e77
cmp al, 0x33
jge 0x405eb4
jmp 0x405eac
cmp byte [0x40bc19], 5
jne 0x405e8b
cmp al, 0x33
jg 0x405eb4
cmp cl, 0x35
jge 0x405eb4
jmp 0x405eac
cmp byte [0x40bc19], 6
jne 0x405e9a
cmp al, 0x34
jge 0x405eb4
jmp 0x405eac
cmp byte [0x40bc19], 7
jne 0x405eac
cmp al, 0x34
jg 0x405eb4
cmp cl, 0x35
jge 0x405eb4
mov byte [0x40bbf4], 0xfc
ret
inc dword [0x40bbcc]
push dword [0x40bbcc]
call sub.KERNEL32.DLL_lstrlenA
add dword [0x40bbcc], eax
inc dword [0x40bbcc]
mov eax, dword [0x40bbcc]
cmp byte [eax], 0
je 0x405f58
cmp dword [0x40b8f0], 2
jne 0x405f58
mov dword [0x40bba4], 0x100
push 0x40bba4
push 0x40a9ef
call sub.advapi32.dll_GetUserNameA
push 0x40a9ef
call sub.KERNEL32.DLL_lstrlenA
inc eax
push 0x100
push 0x40aaf3
push eax
push 0x40a9ef
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push str.netapi32.dll
call sub.KERNEL32.DLL_LoadLibraryA
push str.NetUserGetInfo
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40bba4
push 1
push 0x40aaf3
push 0
call eax
mov eax, dword [0x40bba4]
cmp dword [eax + 0xc], 2
je 0x405f58
mov byte [0x40bbf4], 0xfb
mov eax, dword [0x40bbcc]
mov cl, byte [eax + 1]
mov byte [0x40bc49], cl
mov ecx, dword [eax + 2]
mov dword [0x40bc45], ecx
add dword [0x40bbcc], 6
push dword [0x40bbcc]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bbcc]
mov dword [0x40bbd0], eax
cmp byte [0x40bbf4], 0xfb
je 0x406194
push eax
push dword [0x40bbc4]
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bbc4], eax
add eax, dword [0x40bbd0]
mov dword [0x40bc0e], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc0e]
mov dword [0x40bc06], eax
cmp byte [eax], 0
je 0x405fdc
mov byte [0x40bc05], 1
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc06]
mov dword [0x40bc30], eax
push eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add dword [0x40bc30], eax
pop eax
cmp byte [0x40bc5e], 2
je 0x406164
push eax
mov bl, byte [eax]
cmp bl, 1
jne 0x406031
mov eax, str.SystemDrive
push 0x100
push 0x40acfb
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
jmp 0x40612e
cmp bl, 2
jne 0x406042
push str.ProgramFilesDir
jmp 0x40604c
cmp bl, 3
jne 0x4060a1
push str.CommonFilesDir
push 0x40bba4
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
pop eax
mov dword [0x40bba8], 0x104
push 0x40bba8
push 0x40acfb
push 0
push 0
push eax
push dword [0x40bba4]
call sub.advapi32.dll_RegQueryValueExA
push dword [0x40bba4]
call sub.advapi32.dll_RegCloseKey
jmp 0x40612e
cmp bl, 4
jne 0x4060bc
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetWindowsDirectoryA
jmp 0x40612e
cmp bl, 5
jne 0x4060d7
push 0x104
push 0x40acfb
call sub.KERNEL32.DLL_GetSystemDirectoryA
jmp 0x40612e
cmp bl, 6
jne 0x4060e8
mov eax, str.UserProfile
jmp 0x406017
cmp bl, 7
jne 0x4060f9
mov eax, str.AppData
jmp 0x406017
cmp bl, 8
jne 0x406107
mov eax, 5
jmp 0x406111
cmp bl, 9
jne 0x40613f
mov eax, 0x10
push 0x40bba4
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x40acfb
push dword [0x40bba4]
call sub.shell32.dll_SHGetPathFromIDListA
pop eax
mov byte [eax], 0x5c
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcatA
jmp 0x406164
cmp bl, 0xa
jne 0x406157
push 0x40acfb
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40612e
pop eax
inc eax
push eax
push 0x40acfb
call sub.KERNEL32.DLL_lstrcpyA
push dword [0x40bc30]
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc30]
mov dword [0x40bc34], eax
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
add eax, dword [0x40bc34]
mov dword [0x40bc0a], eax
mov byte [0x40bbf4], 1
ret