Function at 0x1000b7e3
Capabilities:
Check os version

Disassembly:
push 0x348
mov eax, 0x10013c16
call fcn.100128a4
push 0x200
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x220]
call fcn.10009a81
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x220]
push eax
call fcn.1000acd2
push 0x100021d0
lea ecx, [ebp - 0x220]
call fcn.10009c3a
push 0x10007708
call fcn.10010e68
xor esi, esi
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x348], esi
cmp eax, esi
je 0x1000b84d
mov dword [ebp - 0x348], ebx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x34c], esi
je 0x1000b87a
push 0x10001860
lea ecx, [ebp - 0x220]
call fcn.10009c3a
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x220]
call fcn.10009c3a
push 0x100021c0
lea ecx, [ebp - 0x220]
call fcn.10009c3a
mov dword [ebp - 0x344], esi
lea ecx, [ebp - 0x220]
call fcn.1000d0fd
push esi
lea eax, [ebp - 0x344]
push eax
push 0x100021a8
push dword [ebp - 0x214]
mov edi, 0x80000002
push edi
call fcn.1000c4dc
cmp eax, esi
je 0x1000b8f4
cmp dword [ebp - 0x344], esi
je 0x1000b8f4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.10011a47
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x218], 8
je 0x1000b8ed
push dword [ebp - 0x214]
call fcn.1000bf2a
pop ecx
mov al, 1
jmp 0x1000bb2d
lea eax, [ebp - 0x220]
push eax
call fcn.1000acd2
push 0x10001ff4
lea ecx, [ebp - 0x220]
call fcn.10009c3a
push 0x10002010
lea ecx, [ebp - 0x220]
call fcn.10009c3a
lea ecx, [ebp - 0x220]
call fcn.1000d0fd
push esi
lea eax, [ebp - 0x344]
push eax
push 0x1000218c
push dword [ebp - 0x214]
push edi
call fcn.1000c4dc
cmp eax, esi
je 0x1000b964
cmp dword [ebp - 0x344], esi
je 0x1000b964
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.10011a47
jmp 0x1000b8d4
lea eax, [ebp - 0x334]
push eax
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x334], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1000b98a
call fcn.1000fea1
cmp dword [ebp - 0x330], 5
ja 0x1000b99d
jne 0x1000b9a7
cmp dword [ebp - 0x32c], esi
jbe 0x1000b9a7
mov dword [ebp - 0x350], 0x101
mov dword [ebp - 0x338], esi
mov byte [ebp - 4], 0xe
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x338]
push eax
push dword [ebp - 0x350]
push esi
push 0x10002118
push edi
call ebx
test eax, eax
jne 0x1000ba40
mov dword [ebp - 0x354], esi
mov dword [ebp - 0x340], esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x340]
push eax
push esi
push esi
lea eax, [ebp - 0x354]
push eax
push esi
push esi
push esi
push dword [ebp - 0x338]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1000ba40
cmp dword [ebp - 0x354], esi
jne 0x1000ba14
cmp dword [ebp - 0x340], esi
je 0x1000ba40
mov byte [ebp - 4], 5
cmp dword [ebp - 0x338], esi
je 0x1000ba2c
push dword [ebp - 0x338]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.10011a47
jmp 0x1000b8d4
mov dword [ebp - 0x33c], esi
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x33c]
push eax
push dword [ebp - 0x350]
push esi
push 0x100020a0
push edi
call ebx
test eax, eax
jne 0x1000bad5
mov dword [ebp - 0x340], esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x340]
push eax
push esi
push esi
push esi
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1000bad5
cmp dword [ebp - 0x340], esi
je 0x1000bad5
mov byte [ebp - 4], 0xe
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x33c], esi
je 0x1000baad
push dword [ebp - 0x33c]
call edi
mov byte [ebp - 4], 5
cmp dword [ebp - 0x338], esi
je 0x1000bac1
push dword [ebp - 0x338]
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.10011a47
jmp 0x1000b8d4
mov byte [ebp - 4], 0xe
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x33c], esi
je 0x1000baef
push dword [ebp - 0x33c]
call edi
mov byte [ebp - 4], 5
cmp dword [ebp - 0x338], esi
je 0x1000bb03
push dword [ebp - 0x338]
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34c]
call fcn.10011a47
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x218], 8
je 0x1000bb2b
push dword [ebp - 0x214]
call fcn.1000bf2a
pop ecx
xor al, al
call fcn.10012927
ret