Function at 0x100082d0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x11e8]
mov eax, 0x1268
call fcn.100333a0
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x11e4], eax
push ebx
push esi
push edi
mov ebx, 0x11c
push ebx
lea eax, [ebp + 0xc8]
push 0
push eax
call fcn.10031d30
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp + 0xc8]
push eax
mov dword [ebp + 0xc8], ebx
call esi
test eax, eax
mov dword [ebp - 0x58], eax
jne 0x10008344
lea eax, [ebp + 0xc8]
push eax
mov dword [ebp + 0xc8], 0x114
call esi
test eax, eax
jne 0x10008344
or eax, 0xffffffff
jmp 0x10008618
push str.GetNativeSystemInfo
push 0x10060a10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10008367
lea ecx, [ebp - 0x80]
push ecx
call eax
jmp 0x10008371
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 0x11c
push 0x47
pop ecx
lea esi, [ebp + 0xc8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10007825
add esp, 0x11c
cmp eax, 1
je 0x100083cd
push ebx
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.100329c0
lea eax, [ebp + 0xc8]
push eax
call fcn.1000788c
add esp, 0x10
cmp eax, 1
je 0x100083cd
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xc8]
push eax
call fcn.100329c0
add esp, 0xc
mov eax, dword [ebp + 0xd8]
xor esi, esi
sub eax, esi
je 0x10008615
dec eax
je 0x100085de
dec eax
jne 0x1000833c
mov ecx, dword [ebp + 0xd0]
push 2
pop edx
push 6
pop eax
cmp dword [ebp + 0xcc], eax
jne 0x1000847d
cmp ecx, esi
jne 0x1000841e
cmp word [ebp - 0x80], ax
je 0x10008417
cmp word [ebp - 0x80], 9
je 0x10008417
push 0x50
jmp 0x10008617
push 0x51
jmp 0x10008617
cmp ecx, 1
jne 0x1000843e
cmp word [ebp - 0x80], ax
je 0x10008437
cmp word [ebp - 0x80], 9
je 0x10008437
push 0x5a
jmp 0x10008617
push 0x5b
jmp 0x10008617
cmp ecx, edx
jne 0x1000845d
cmp word [ebp - 0x80], ax
je 0x10008456
cmp word [ebp - 0x80], 9
je 0x10008456
push 0x64
jmp 0x10008617
push 0x65
jmp 0x10008617
cmp ecx, 3
jne 0x10008491
cmp word [ebp - 0x80], ax
je 0x10008476
cmp word [ebp - 0x80], 9
je 0x10008476
push 0x6e
jmp 0x10008617
push 0x6f
jmp 0x10008617
cmp dword [ebp + 0xcc], 5
jne 0x10008491
cmp ecx, edx
jne 0x10008491
push 0x46
jmp 0x10008617
cmp dword [ebp - 0x58], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x1000851e
cmp byte [ebp + 0x1e2], 1
jne 0x100084ed
cmp dword [ebp + 0xcc], 4
jne 0x100084c0
push 0x28
jmp 0x10008617
test word [ebp + 0x1e0], 0x200
je 0x100084d2
push 0x3d
jmp 0x10008617
cmp dword [ebp + 0xcc], 5
jne 0x100084e6
test ecx, ecx
jne 0x100084e6
push 0x33
jmp 0x10008617
push 0x3e
jmp 0x10008617
cmp byte [ebp + 0x1e2], 3
je 0x10008502
cmp byte [ebp + 0x1e2], dl
jne 0x1000859d
cmp dword [ebp + 0xcc], 5
jne 0x100084b9
cmp ecx, edx
je 0x1000859d
test ecx, ecx
jne 0x100084b9
push 0x34
jmp 0x10008617
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push ebx
mov dword [ebp - 0x5c], 0x800
call esi
test eax, eax
je 0x10008540
xor eax, eax
jmp 0x10008618
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x1e4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10008539
cmp dword [ebp - 0x5c], 0x800
ja 0x10008539
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1e4]
push eax
push str.WINNT
call edi
lea eax, [ebp + 0x1e4]
push eax
push str.LANMANNT
call edi
lea eax, [ebp + 0x1e4]
push eax
push str.SERVERNT
call edi
cmp dword [ebp + 0xcc], 4
jne 0x1000833c
push str.Service_Pack_6
lea eax, [ebp + 0xdc]
push eax
call edi
test eax, eax
jne 0x1000833c
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push ebx
call esi
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000833c
cmp dword [ebp + 0xcc], 4
jne 0x1000833c
cmp dword [ebp + 0xd0], esi
jne 0x100085f7
push 0xa
jmp 0x10008617
cmp dword [ebp + 0xd0], 0xa
jne 0x10008604
push 0x14
jmp 0x10008617
cmp dword [ebp + 0xd0], 0x5a
jne 0x1000833c
push 0x1e
jmp 0x10008617
push 0x18
pop eax
mov ecx, dword [ebp + 0x11e4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031c08
add ebp, 0x11e8
leave
ret