Function at 0x10018000
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x5f8
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x23
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x5c], 0x94
mov dword [esp + 0x60], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x614]
lea ecx, [esp + 0x5c]
push ecx
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x6c], 2
jne 0x100182d5
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1f9]
mov dword [esp + 0x1f4], 0x20c
mov byte [esp + 0x1f8], bl
mov ebp, dword [sym.imp.SETUPAPI.dll_SetupGetInfInformationA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
stosb byte es:[edi], al
mov edi, dword [esp + 0x60c]
push edx
push ebx
push ebx
push 2
push edi
call ebp
test eax, eax
jne 0x10018091
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5f8
ret
mov eax, dword [esp + 0x14]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x34], esi
jne 0x100180b5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5f8
ret
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push esi
push 2
push edi
call ebp
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
mov ebp, eax
mov eax, dword [esp + 0x60]
cmp edx, 2
jne 0x100180de
cmp eax, 5
jne 0x10018135
cmp ecx, 1
jae 0x10018137
cmp ebp, ebx
mov dword [esp + 0x18], 0x14
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov word [esp + 0x28], bx
mov word [esp + 0x2a], bx
je 0x1001811f
lea eax, [esp + 0x1f4]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
push esi
call fcn.10016110
add esp, 0x10
test eax, eax
jne 0x100181aa
push esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x5f8
ret
jbe 0x100180de
mov dword [esp + 0x18], 0x1c
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov word [esp + 0x28], bx
mov word [esp + 0x2a], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
call fcn.1000c760
test eax, eax
je 0x10018194
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x3c]
lea edx, [esp + 0x38]
mov dword [esp + 0x38], ebx
push edx
rep stosd dword es:[edi], eax
call fcn.1000c7b0
mov ax, word [esp + 0x3c]
add esp, 4
mov word [esp + 0x28], ax
cmp ebp, ebx
je 0x1001811f
lea ecx, [esp + 0x1f4]
lea edx, [esp + 0x18]
push ecx
push edx
jmp 0x1001810d
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xf1]
mov byte [esp + 0xf0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x401]
mov byte [esp + 0x400], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x505]
mov byte [esp + 0x504], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0xf0]
push 0x104
push edx
mov ebp, 1
stosb byte es:[edi], al
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0xf0]
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_SearchPathA]
repne scasb al, byte es:[edi]
mov eax, dword [str.OemDir]
mov ecx, dword [0x10041f6c]
dec edi
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0xf4]
mov dword [edi], eax
lea eax, [esp + 0x404]
push eax
push 0x104
mov dword [edi + 4], ecx
lea ecx, [esp + 0x204]
push ebx
push ecx
push edx
call esi
test eax, eax
je 0x10018294
lea eax, [esp + 0x10]
lea ecx, [esp + 0x504]
push eax
push ecx
push 0x104
lea edx, [esp + 0x308]
push ebx
lea eax, [esp + 0x100]
push edx
push eax
call esi
test eax, eax
je 0x10018294
mov ecx, dword [esp + 0x614]
mov dword [ecx], ebp
lea edi, [esp + 0x1f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x610]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x5f8
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x104
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionSetupSetupXINFOEM_Name
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, eax
neg ebp
sbb ebp, ebp
inc ebp
je 0x10018335
mov edx, dword [esp + 0x610]
mov eax, dword [esp + 0x60c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov ebp, eax
neg ebp
sbb ebp, ebp
push edx
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x5f8
ret