Function at 0x6635d0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
mov ebp, 9
push edi
mov ecx, ebp
xor eax, eax
lea edi, [esp + 0xb8]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x27
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], ebx
push eax
mov dword [esp + 0x20], 0x9c
call esi
test eax, eax
mov dword [esp + 0x14], eax
jne 0x663638
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x94
push ecx
call esi
test eax, eax
jne 0x663638
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
push 0x6e3174
push 0x6e3164
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x66365f
lea edx, [esp + 0xb8]
push edx
call eax
jmp 0x66366d
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
sub eax, 0
je 0x663fe0
dec eax
je 0x663e64
dec eax
jne 0x663e57
mov eax, dword [esp + 0x20]
cmp eax, 6
jne 0x663747
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x66395f
mov al, byte [esp + 0xb6]
mov ebx, dword [esp + 0x234]
cmp al, 1
jne 0x6636fd
test ebx, ebx
je 0x6636ee
mov edi, 0x6e2aa4
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663966
xor ebx, ebx
mov dword [esp + 0x10], 0xc
jmp 0x663966
test ebx, ebx
je 0x663738
mov edi, 0x6e2a88
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0xb
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663966
xor ebx, ebx
mov dword [esp + 0x10], 0xb
jmp 0x663966
cmp eax, 5
jne 0x663907
mov edx, dword [esp + 0x24]
cmp edx, 2
jne 0x6638a3
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x6637ba
mov ebx, dword [esp + 0x234]
test ebx, ebx
je 0x6637ab
mov edi, 0x6e3140
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 0xa
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663852
xor ebx, ebx
mov dword [esp + 0x10], 0xa
jmp 0x663852
cmp byte [esp + 0xb6], 1
jne 0x663811
cmp word [esp + 0xb8], bp
jne 0x663811
mov ebx, dword [esp + 0x234]
test ebx, ebx
je 0x663809
mov edi, 0x6e3110
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663852
xor ebx, ebx
mov dword [esp + 0x10], ebp
jmp 0x663852
mov ebx, dword [esp + 0x234]
test ebx, ebx
je 0x663848
mov edi, 0x6e30f0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x66384a
xor ebx, ebx
mov dword [esp + 0x10], 8
mov eax, dword [esp + 0x20]
cmp eax, 5
jne 0x66390e
mov edx, dword [esp + 0x24]
cmp edx, 1
jne 0x6638bb
test ebx, ebx
je 0x6638ac
mov edi, 0x6e2a50
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 7
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663966
mov ebx, dword [esp + 0x234]
jmp 0x663863
xor ebx, ebx
mov dword [esp + 0x10], 7
jmp 0x663966
test edx, edx
jne 0x663966
test ebx, ebx
je 0x6638fb
mov edi, 0x6e2a38
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 6
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663966
xor ebx, ebx
mov dword [esp + 0x10], 6
jmp 0x663966
mov ebx, dword [esp + 0x234]
cmp eax, 4
ja 0x663959
test ebx, ebx
je 0x66394f
mov edi, 0x6e2a20
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], 5
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663966
xor ebx, ebx
mov dword [esp + 0x10], 5
mov edx, dword [esp + 0x24]
jmp 0x663966
mov ebx, dword [esp + 0x234]
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x663c04
mov al, byte [esp + 0xb6]
cmp al, 1
jne 0x663a07
cmp word [esp + 0xb8], 9
je 0x663d93
cmp dword [esp + 0x20], 4
jne 0x6639d7
test ebx, ebx
je 0x6639d0
mov edi, 0x6e2a0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663d9e
xor ebx, ebx
jmp 0x663d9e
mov eax, dword [esp + 0xb4]
test ah, 2
je 0x6639f5
test ebx, ebx
je 0x663d91
mov edi, 0x6e29fc
jmp 0x663d6a
test ebx, ebx
je 0x663d91
mov edi, 0x6e29ec
jmp 0x663d6a
cmp al, 3
je 0x663a13
cmp al, 2
jne 0x663d93
cmp dword [esp + 0x20], 5
jne 0x663bd6
cmp edx, 2
jne 0x663b92
mov ax, word [esp + 0xb8]
cmp ax, 6
jne 0x663afa
mov al, byte [esp + 0xb4]
test al, 0x80
je 0x663ae4
test ebx, ebx
je 0x663bcf
mov edi, 0x6e30c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
and ecx, 0xffff
lea eax, [esp + 0x12c]
push ecx
push edx
push 0x6e30b0
push eax
call fcn.00642944
add esp, 0x10
test ebx, ebx
je 0x663e53
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 0x10]
mov ecx, edx
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
test al, 2
je 0x663a7a
test ebx, ebx
je 0x663bcf
mov edi, 0x6e3080
jmp 0x663a55
cmp ax, 9
jne 0x663b45
mov al, byte [esp + 0xb4]
test al, 0x80
je 0x663b1d
test ebx, ebx
je 0x663bcf
mov edi, 0x6e3068
jmp 0x663a55
test al, 2
je 0x663b33
test ebx, ebx
je 0x663bcf
mov edi, 0x6e3050
jmp 0x663a55
test ebx, ebx
je 0x663bcf
mov edi, 0x6e3038
jmp 0x663a55
mov eax, dword [esp + 0xb4]
test al, 0x80
je 0x663b5e
test ebx, ebx
je 0x663bcf
mov edi, 0x6e29d8
jmp 0x663a55
test al, 2
je 0x663b70
test ebx, ebx
je 0x663bcf
mov edi, 0x6e29c4
jmp 0x663a55
cmp ax, 0x400
jne 0x663b84
test ebx, ebx
je 0x663bcf
mov edi, 0x6e3028
jmp 0x663a55
test ebx, ebx
je 0x663bcf
mov edi, 0x6e29a0
jmp 0x663a55
test edx, edx
jne 0x663bd6
mov al, byte [esp + 0xb4]
test al, 0x80
je 0x663baf
test ebx, ebx
je 0x663bcf
mov edi, 0x6e298c
jmp 0x663a55
test al, 2
je 0x663bc1
test ebx, ebx
je 0x663bcf
mov edi, 0x6e2978
jmp 0x663a55
test ebx, ebx
je 0x663bcf
mov edi, 0x6e2970
jmp 0x663a55
xor ebx, ebx
jmp 0x663a7a
test byte [esp + 0xb4], 2
je 0x663bf2
test ebx, ebx
je 0x663d91
mov edi, 0x6e2950
jmp 0x663d6a
test ebx, ebx
je 0x663d91
mov edi, 0x6e2944
jmp 0x663d6a
lea eax, [esp + 0x18]
mov edi, 0x50
push eax
push 1
push 0
push 0x6e2914
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edi
call ebp
test eax, eax
je 0x663c33
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x220
ret
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xdc]
push ecx
push edx
push 0
push 0
push 0x6e2908
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x663c26
cmp dword [esp + 0x14], edi
ja 0x663c26
lea edx, [esp + 0xdc]
push edx
push 0x6e2900
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x663cb2
test ebx, ebx
je 0x663cb0
mov edi, 0x6e28f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663cb2
xor ebx, ebx
lea eax, [esp + 0xdc]
push eax
push 0x6e28e4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x663cf9
test ebx, ebx
je 0x663cf7
mov edi, 0x6e2970
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663cf9
xor ebx, ebx
lea eax, [esp + 0xdc]
push eax
push 0x6e28d8
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x663d40
test ebx, ebx
je 0x663d3e
mov edi, 0x6e2978
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663d40
xor ebx, ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x134]
push 0x6e28d0
push edx
call fcn.00642944
add esp, 0x10
test ebx, ebx
je 0x663d91
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663d93
xor ebx, ebx
cmp dword [esp + 0x20], 4
jne 0x663a7a
lea eax, [esp + 0x30]
push 0x6e28c0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x663a7a
lea ecx, [esp + 0x14]
push ecx
push 1
push eax
push 0x6e2884
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x663df4
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x12c]
and edx, 0xffff
push edx
push 0x6e300c
push eax
call fcn.00642944
add esp, 0xc
test ebx, ebx
je 0x663e48
jmp 0x663e1c
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x30]
and eax, 0xffff
lea edx, [esp + 0x12c]
push eax
push ecx
push 0x6e30b0
push edx
call fcn.00642944
add esp, 0x10
test ebx, ebx
je 0x663e48
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x10]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x220
ret
cmp dword [esp + 0x20], 4
jne 0x663e57
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x663efa
mov edx, dword [esp + 0x234]
test edx, edx
je 0x663eac
mov edi, 0x6e283c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663eae
xor edx, edx
mov al, byte [esp + 0x31]
mov ebx, 2
cmp al, 0x43
je 0x663ebf
cmp al, 0x42
jne 0x663e57
test edx, edx
je 0x663e57
mov edi, 0x6e2834
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
cmp eax, 0xa
jne 0x663f90
mov edx, dword [esp + 0x234]
test edx, edx
je 0x663f3a
mov edi, 0x6e281c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x663f3c
xor edx, edx
mov al, byte [esp + 0x31]
mov ebx, 3
cmp al, 0x41
je 0x663f51
cmp al, 0x42
jne 0x663e57
test edx, edx
je 0x663e57
mov edi, 0x6e2818
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
cmp eax, 0x5a
jne 0x663e57
mov edx, dword [esp + 0x234]
test edx, edx
je 0x663fce
mov edi, 0x6e2fe4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x220
ret
mov edx, dword [esp + 0x234]
test edx, edx
je 0x664015
mov edi, 0x6e2fd0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x220
ret