Function at 0x401c70
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x43a050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x11c
lea eax, [ebp - 0x1c0]
push esi
push eax
lea ebx, [esi + 1]
call fcn.0041c1a0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x1c0]
push ecx
mov dword [ebp - 0x1c0], 0x11c
call edi
test eax, eax
jne 0x401da4
lea edx, [ebp - 0x1c0]
push edx
mov dword [ebp - 0x1c0], 0x114
call edi
test eax, eax
je 0x401f10
lea eax, [ebp - 0x1c4]
push eax
push ebx
push esi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x1c4]
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0xa4]
push edx
push esi
push esi
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x1c4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea edx, [ebp - 0xa4]
push edx
push str.WINNT
call edi
test eax, eax
jne 0x401d3c
lea eax, [ebp - 0xa4]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x401d50
mov esi, ebx
lea ecx, [ebp - 0xa4]
push ecx
push str.SERVERNT
call edi
test eax, eax
jne 0x401d64
mov esi, ebx
mov eax, dword [ebp - 0x1b0]
sub eax, 0
je 0x401f0b
dec eax
je 0x401ea6
dec eax
jne 0x401f10
mov eax, dword [ebp - 0x1bc]
cmp eax, 4
ja 0x401db6
pop edi
mov ebx, 6
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0xa6]
cmp al, 1
jne 0x401db2
xor esi, esi
jmp 0x401d64
cmp al, 3
jmp 0x401d60
cmp eax, 5
jne 0x401e1b
mov eax, dword [ebp - 0x1b8]
test eax, eax
jne 0x401ddd
pop edi
mov ebx, 0xb
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x401dfa
pop edi
mov ebx, 0xd
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x401f10
pop edi
mov ebx, 0xf
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x401e88
mov eax, dword [ebp - 0x1b8]
test eax, eax
jne 0x401e48
xor ebx, ebx
test esi, esi
setne bl
pop edi
pop esi
lea ebx, [ebx + ebx + 0x13]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x401e6b
xor ebx, ebx
test esi, esi
sete bl
pop edi
pop esi
lea ebx, [ebx + ebx + 0x15]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x401e8e
pop edi
mov ebx, 0x1b
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
jb 0x401f10
pop edi
mov ebx, 0x1c
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1bc], 4
jne 0x401f10
mov eax, dword [ebp - 0x1b8]
test eax, eax
jne 0x401ed1
pop edi
mov ebx, 3
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x401eee
pop edi
mov ebx, 8
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
cmp eax, 0x5a
jne 0x401f10
pop edi
mov ebx, 0xa
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00418cd4
mov esp, ebp
pop ebp
ret
mov ebx, 2
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00418cd4
mov esp, ebp
pop ebp
ret