Function at 0x1c5c920
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x130
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x1cf83f0], 2
je 0x1c5c958
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0x130
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x120]
push 0x110
push 0
push esi
call fcn.01c99a20
add esp, 0xc
mov dword [esi - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x1cdf0a0]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.ntdll.dll_VerSetConditionMask]
call edi
mov ebx, 3
xor ecx, ecx
inc ecx
push ebx
push ecx
push edx
push eax
call edi
push ebx
push 0x20
push edx
push eax
call edi
mov dword [esi - 8], 6
xor ecx, ecx
inc ecx
mov dword [esi - 4], ecx
mov word [esi + 0x108], 0
lea esi, [ebp - 0x12c]
push edx
push eax
push 0x23
push esi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1c5c93f
mov dword [ebp - 0x130], 0
push 0x18
call fcn.01c9515a
add esp, 4
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x124], 0x8000000c
mov dword [ebp - 0x128], 9
movzx ecx, word [0x1cea8f6]
mov word [eax + 0x10], cx
movups xmm0, xmmword [str.Software_]
movups xmmword [eax], xmm0
mov word [eax + 0x12], 0
mov eax, dword [0x1cf8bf4]
mov eax, dword [eax + 4]
push esi
push 1
push dword [eax + 8]
call fcn.01c35230
add esp, 0xc
movzx eax, byte [ebp - 0x121]
mov ebx, 4
mov edi, eax
test al, al
jns 0x1c5ca52
mov ebx, 0x7fffffff
and ebx, dword [ebp - 0x124]
dec ebx
mov edi, dword [ebp - 0x128]
mov ecx, ebx
sub ecx, edi
cmp ecx, 0xb
jae 0x1c5cb3d
lea esi, [edi + 0xb]
mov ecx, esi
sub ecx, ebx
mov edx, 0x7ffffff6
sub edx, ebx
cmp edx, ecx
jb 0x1c5ccbe
test al, al
js 0x1c5ca81
lea eax, [ebp - 0x12c]
jmp 0x1c5ca87
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x134], eax
mov ecx, 0x7ffffff7
cmp ebx, 0x3ffffff2
ja 0x1c5cab8
lea eax, [ebx + ebx]
cmp esi, eax
cmova eax, esi
mov ecx, 5
cmp eax, 5
jb 0x1c5cab8
or eax, 3
inc eax
mov ecx, eax
js 0x1c5ccc1
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x138], ecx
lea eax, [ecx + ecx]
push eax
call fcn.01c9515a
add esp, 4
mov esi, eax
test edi, edi
je 0x1c5cae9
lea eax, [edi + edi]
push eax
push dword [ebp - 0x134]
push esi
call fcn.01c994a0
add esp, 0xc
movsd xmm0, qword [0x1cdf19e]
movsd qword [esi + edi*2 + 0xe], xmm0
movups xmm0, xmmword [str.ThirdParty]
movups xmmword [esi + edi*2], xmm0
cmp ebx, 4
je 0x1c5cb15
push dword [ebp - 0x134]
call fcn.01c95155
add esp, 4
mov dword [ebp - 0x12c], esi
mov eax, dword [ebp - 0x138]
or eax, 0x80000000
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x128], eax
lea eax, [esi + eax*2]
jmp 0x1c5cb72
lea ecx, [edi + 0xb]
test al, al
jns 0x1c5cb4a
mov esi, dword [ebp - 0x12c]
movsd xmm0, qword [0x1cdf19e]
movsd qword [esi + edi*2 + 0xe], xmm0
movups xmm0, xmmword [str.ThirdParty]
movups xmmword [esi + edi*2], xmm0
js 0x1c5cb88
mov eax, ecx
and al, 0x7f
mov byte [ebp - 0x121], al
lea eax, [esi + ecx*2]
mov word [eax], 0
cmp byte [ebp - 0x121], 0
js 0x1c5cb90
lea eax, [ebp - 0x12c]
jmp 0x1c5cb96
mov dword [ebp - 0x128], ecx
jmp 0x1c5cb6f
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x130]
push ecx
push 0x20006
push eax
push 2
call fcn.01c3fd00
add esp, 0x10
mov ebx, eax
cmp byte [ebp - 0x121], 0
jns 0x1c5cbc6
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
test bl, bl
je 0x1c5cc2e
mov esi, dword [ebp - 0x130]
cmp byte [0x1cf7de4], 0
je 0x1c5ccaa
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [edi + 4], eax
mov dword [edi], eax
push str.StatusCodes
push edi
call sub.ntdll.dll_RtlInitUnicodeString
sub esp, 0x18
movaps xmm0, xmmword [0x1cdf0d0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.ntdll.dll_NtSetValueKey
test eax, eax
setns bl
mov esi, dword [ebp - 0x130]
cmp byte [0x1cf7de4], 0
je 0x1c5cca0
push esi
call sub.ntdll.dll_NtClose
test bl, bl
jne 0x1c5cc38
mov ecx, 0x11
call fcn.01c5ccd0
call fcn.01c41510
test eax, eax
je 0x1c5cc53
mov esi, eax
mov ecx, eax
call fcn.01c5ccd0
cmp esi, 4
ja 0x1c5c93f
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1cf71b8], eax
test eax, eax
je 0x1c5cc8c
call fcn.01c3d7c0
test eax, eax
jne 0x1c5cc7e
mov byte [0x1cf71e0], 1
mov bl, 1
jmp 0x1c5c941
mov ecx, eax
call fcn.01c5ccd0
call fcn.01c5c6a0
jmp 0x1c5cc96
mov ecx, 0xc
call fcn.01c5ccd0
call fcn.01cc0080
jmp 0x1c5c93f
call fcn.01c34370
jmp 0x1c5cc24
call fcn.01c34370
test al, al
jne 0x1c5cbdd
xor ebx, ebx
jmp 0x1c5cc15
int3
int3