Function at 0x40256c
Capabilities:
Check os version
Query environment variable
Terminate process

Disassembly:
push 0x118
push 0x416178
call fcn.0040fe60
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push str.0xf654e62a.d
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push eax
call dword [sym.imp.msvcrt.dll___set_app_type]
mov dword [esp], 0x104
lea eax, [ebp - 0x128]
push eax
push str.0x974d9c1c
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
add eax, ebx
mov dword [ebp - 0x1c], eax
push 0xd
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
cmp ax, 0xd
je 0x4025dd
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
wait
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 1
jge 0x402633
push 0x104
lea eax, [ebp - 0x128]
push eax
push str.0x23dd0a5
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add ebx, eax
mov dword [ebp - 0x1c], ebx
push 0xb
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
cmp ax, 0xb
je 0x40262e
mov dword [ebp - 0x20], esi
inc dword [ebp - 0x20]
jmp 0x4025f7
wait
or dword [ebp - 4], 0xffffffff
jmp 0x402648
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
add eax, edi
xor dword [ebp - 0x1c], eax
push str.v4_i_z4___tLXfz6.0O_JTu_iGyhHPB
push esi
mov edi, 0x100000
push edi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ecx, eax
and ecx, 0x5044
or ecx, 0x4d390131
push 0x41
pop eax
xor edx, edx
div ecx
or eax, 0x741f084b
xor edx, edx
mov ecx, 0x36ad0d3d
div ecx
mov ebx, edx
push 0xc
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
cmp ax, 0xc
jne 0x4027cd
push 0x71
call dword [sym.imp.USER32.dll_CharUpperA]
cmp eax, 0x51
jne 0x4027cd
push esi
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x4027cd
call fcn.0040243b
test eax, eax
je 0x4027cd
lea eax, [ebp - 0x1c]
push eax
push 0x415f88
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x24], eax
cmp eax, 6
jne 0x402723
fld qword [0x416108]
call sub.msvcrt.dll__CIsin
fstp dword [ebp + 8]
fld dword [ebp + 8]
fcomp dword [0x416104]
fnstsw ax
test ah, 0x41
jne 0x40277b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
and eax, 0xbf8b570
xor edx, edx
mov ecx, 0x5ffefa7f
div ecx
push 0x47
pop ecx
sub ecx, eax
mov eax, ecx
xor edx, edx
mov ecx, 0x7ffac596
div ecx
mov ebx, edx
or ebx, 0xb9
push str.ug_I_V7tn_gh_RmJbzD__pTtp_4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov ecx, eax
and ecx, 0x428334c
or ecx, 0x72d04c33
mov eax, ebx
xor edx, edx
div ecx
mov ebx, edx
imul ebx, dword [ebp - 0x24]
jmp 0x40286a
push esi
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x4027c3
call fcn.0040243b
test eax, eax
je 0x4027c3
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [0x41eb54], eax
xor eax, eax
xor eax, 0x41417b
push eax
xor ecx, ecx
call fcn.0040212e
xor edx, edx
ret
mov eax, ebx
call fcn.0040fe99
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]