Function at 0x405bf0
Capabilities:
Check os version
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2778]
mov eax, 0x2778
call fcn.00408420
push 0xffffffffffffffff
push 0x409380
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x40e4b8]
xor eax, ebp
mov dword [ebp + 0x2774], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x2780]
mov edi, dword [ebp + 0x2784]
mov dword [ebp - 0x48], edi
xor ebx, ebx
cmp edi, ebx
je 0x405d5a
cmp dword [0x40e560], ebx
jne 0x405c7a
push 0x40e560
push 1
push ebx
push 0x40ab34
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [0x40e560], ebx
setne al
test al, al
je 0x405d5a
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0x250], 0x114
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405cc4
cmp dword [ebp + 0x260], 2
jne 0x405cc4
mov eax, dword [ebp + 0x254]
cmp eax, 0xa
jb 0x405cc4
ja 0x405cbd
cmp dword [ebp + 0x25c], 0x70b
jb 0x405cc4
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x40], 4
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x3c]
push edx
push ebx
push ebx
push str.LanguageID
mov eax, dword [0x40e560]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405d5a
mov eax, dword [ebp - 0x3c]
movzx ecx, ax
mov dword [ebp - 0x34], ecx
mov edx, 9
cmp dx, ax
je 0x405d5a
mov dword [ebp - 0x14], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push esi
mov edx, dword [eax + 0x24]
call edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x405d5a
cmp eax, ebx
jne 0x405d5a
push ecx
push str._sLanguagesidm_.lng
push 0x104
lea eax, [ebp + 0x256c]
push eax
call dword [sym.imp.MSVCR90.dll_swprintf_s]
add esp, 0x10
lea ecx, [ebp]
push ecx
lea edx, [ebp + 0x256c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x30], esi
cmp esi, 0xffffffff
jne 0x405d86
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2774]
xor ecx, ebp
call fcn.0040840e
add ebp, 0x2778
mov esp, ebp
pop ebp
ret 8
mov ebx, 1
mov dword [ebp - 0x28], ebx
xor ecx, ecx
mov word [edi], cx
lea edx, [ebp + 0x2c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x40ae38
push 0x104
lea ecx, [ebp + 0x2364]
push ecx
call dword [sym.imp.MSVCR90.dll_swprintf_s]
xor edi, edi
mov dword [ebp - 0x18], edi
push 0x40ae34
lea edx, [ebp + 0x2364]
push edx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR90.dll__wfopen_s]
add esp, 0x20
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x406063
push eax
push 0x2000
lea ecx, [ebp + 0x364]
push ecx
call dword [sym.imp.MSVCR90.dll_fgets]
add esp, 0xc
test eax, eax
je 0x40604f
mov dword [ebp - 0x4c], edi
xor esi, esi
mov dword [ebp - 0x44], esi
cmp byte [ebp + 0x364], 0xef
jne 0x405e3e
cmp byte [ebp + 0x365], 0xbb
jne 0x405e3e
cmp byte [ebp + 0x366], 0xbf
jne 0x405e3e
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0xfde9
jne 0x405e36
cmp dword [ebp - 0x20], esi
je 0x405e36
mov esi, 3
mov dword [ebp - 0x44], esi
mov edi, 1
mov dword [ebp - 0x4c], edi
cmp dword [ebp + esi + 0x364], 0x676e616c
jne 0x40604f
push 0x3d
lea edx, [ebp + esi + 0x368]
push edx
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
test eax, eax
je 0x40604f
lea ecx, [ebp - 0x54]
push ecx
push 0x40ae30
inc eax
push eax
call dword [sym.imp.MSVCR90.dll_sscanf_s]
add esp, 0xc
cmp eax, 1
jne 0x40604f
movzx esi, word [ebp - 0x34]
cmp esi, dword [ebp - 0x54]
jne 0x40604f
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0xfde9
jne 0x405ef8
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x405ef8
cmp edi, eax
jne 0x405ef8
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov edx, 0x400
cmp word [ebp - 0x34], dx
mov eax, esi
ja 0x405ede
lea eax, [esi + 0x400]
push 0x1000
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x405ef8
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x24], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], 0x1e
lea eax, [ebp - 0x5c]
push eax
push 1
push 8
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x40604f
mov ecx, dword [ebp - 0x18]
push ecx
push 0x2000
lea edx, [ebp + 0x364]
push edx
call dword [sym.imp.MSVCR90.dll_fgets]
add esp, 0xc
test eax, eax
je 0x406039
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0x40ae2c
lea ecx, [ebp + 0x364]
push ecx
call dword [sym.imp.MSVCR90.dll_sscanf_s]
add esp, 0xc
cmp eax, 1
jne 0x405f20
push 0x3d
lea edx, [ebp + 0x364]
push edx
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
test eax, eax
je 0x405f20
mov eax, dword [ebp - 0x38]
cmp eax, 0x517e
jg 0x40608e
cmp eax, 0x5171
jge case.0x40609f.20903
cmp eax, 0x5137
jg 0x405fbd
cmp eax, 0x5136
jge case.0x40609f.20903
add eax, 0xffffb03b
cmp eax, 0x9e
ja case.0x40609f.20904
movzx eax, byte [eax + 0x4060bc]
jmp dword [eax*4 + 0x4060b4]
cmp eax, 0x514a
jne case.0x40609f.20904
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp + 0x364]
push edx
push 0
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call ebx
mov edi, eax
test edi, edi
je case.0x40609f.20904
push edi
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
je case.0x40609f.20904
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp + 0x364]
push ecx
push 0
mov edx, dword [ebp - 0x24]
push edx
call ebx
test eax, eax
je 0x406024
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x50], edi
push esi
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc edi
mov dword [ebp - 0x1c], edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 0x1e
cmp dword [ebp - 0x1c], eax
jl 0x405f20
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov edx, 0x2008
mov eax, dword [ebp - 0x48]
mov word [eax], dx
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov esi, dword [ebp - 0x30]
test ebx, ebx
je 0x406076
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405d93
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
jmp 0x405d5f
add eax, 0xffffae59
cmp eax, 0x27
ja case.0x40609f.20904
movzx ecx, byte [eax + 0x406164]
jmp dword [ecx*4 + 0x40615c]