Function at 0x76ef713c
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [0x76f11060], 0x76f11d94
mov dword [0x76f11064], 0x76f1127c
mov dword [0x76f11054], 0x76f11d5c
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
lea eax, [ebp - 8]
push eax
push 1
push ebx
jae 0x76efd04c
push 0x76ef7250
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x76ef7203
cmp dword [ebp - 8], ebx
je 0x76ef7203
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov esi, 0x76ef723c
push esi
push dword [ebp - 8]
call edi
test eax, eax
je 0x76efd056
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov esi, 0x76ef7224
push esi
push dword [ebp - 8]
call edi
test eax, eax
je 0x76efd106
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov esi, 0x76ef7208
push esi
push dword [ebp - 8]
call edi
test eax, eax
je 0x76efd1b6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
push 0x76efd258
jmp 0x76ef7185
cmp dword [ebp - 0xc], ebx
je 0x76ef71be
push dword [ebp - 0xc]
call fcn.76ef3634
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x76ef71be
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x76efd0f9
cmp dword [ebp - 0x10], 7
jne 0x76efd0f9
mov ebx, dword [ebp - 4]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
je 0x76efd0cf
jmp 0x76efd097
cmp dword [ebp - 0x14], 0xa
jae 0x76efd0d5
push ebx
call dword [sym.imp.msvcrt.dll_atoi]
test eax, eax
pop ecx
je 0x76efd0bf
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov dword [ecx*4 + 0x76f13200], eax
lea ebx, [ebx + esi + 1]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x76efd0c8
sub eax, esi
mov esi, eax
jne 0x76efd0a0
mov eax, dword [ebp - 0x14]
push dword [ebp - 4]
and dword [eax*4 + 0x76f13200], 0
mov dword [0x76f11060], 0x76f13200
call fcn.76ef262e
xor ebx, ebx
jmp 0x76ef71be
push dword [ebp - 4]
call fcn.76ef262e
jmp 0x76ef71be
cmp dword [ebp - 0xc], ebx
je 0x76ef71db
push dword [ebp - 0xc]
call fcn.76ef3634
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x76ef71db
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x76efd1a9
cmp dword [ebp - 0x10], 7
jne 0x76efd1a9
mov ebx, dword [ebp - 4]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
je 0x76efd17f
jmp 0x76efd147
cmp dword [ebp - 0x14], 0xa
jae 0x76efd185
push ebx
call dword [sym.imp.msvcrt.dll_atoi]
test eax, eax
pop ecx
je 0x76efd16f
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov dword [ecx*4 + 0x76f131c0], eax
lea ebx, [ebx + esi + 1]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x76efd178
sub eax, esi
mov esi, eax
jne 0x76efd150
mov eax, dword [ebp - 0x14]
push dword [ebp - 4]
and dword [eax*4 + 0x76f131c0], 0
mov dword [0x76f11064], 0x76f131c0
call fcn.76ef262e
xor ebx, ebx
jmp 0x76ef71db
push dword [ebp - 4]
call fcn.76ef262e
jmp 0x76ef71db
cmp dword [ebp - 0xc], ebx
je 0x76ef71f8
push dword [ebp - 0xc]
call fcn.76ef3634
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x76ef71f8
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x76efd24b
cmp dword [ebp - 0x10], 7
jne 0x76efd24b
mov eax, dword [ebp - 4]
mov edi, eax
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
je 0x76efd22f
jmp 0x76efd1f7
cmp dword [ebp - 0x14], 0xa
jae 0x76efd237
push edi
call dword [sym.imp.msvcrt.dll_atoi]
cmp eax, ebx
pop ecx
je 0x76efd21f
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov dword [ecx*4 + 0x76f13180], eax
lea edi, [edi + esi + 1]
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x76efd228
sub eax, esi
mov esi, eax
cmp esi, ebx
jne 0x76efd200
mov eax, dword [ebp - 0x14]
mov dword [eax*4 + 0x76f13180], ebx
mov dword [0x76f11054], 0x76f13180
push dword [ebp - 4]
call fcn.76ef262e
jmp 0x76ef71f8