Function at 0x5a8180
Capabilities:
Check os version
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6a00e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
mov eax, dword [0x6f872c]
xor eax, ebp
push ebx
push edi
mov dword [esp + 0x144], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.kernel32.dll_GetVersionExA]
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], 0x9c
call edi
mov ebx, eax
test ebx, ebx
jne 0x5a820f
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x54], 0x94
call edi
test eax, eax
jne 0x5a820f
push 0x19b
push str..gsSystem.cpp
push str.gs_Interior::QueryOSInfo
push 0x10022
call fcn.005af2b0
add esp, 0x10
xor al, al
jmp 0x5a8714
movzx edi, word [esp + 0xe4]
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esi + 0x114], edi
movzx edi, word [esp + 0xe6]
mov dword [esi + 0x118], edi
movzx edi, word [esp + 0xe8]
mov dword [esi + 0x11c], edi
movzx edi, byte [esp + 0xea]
mov dword [esi + 0x10c], eax
mov eax, dword [esp + 0x60]
mov dword [esi + 0x120], edi
xor edi, edi
mov dword [esi + 0x104], edx
mov dword [esi + 0x108], ecx
mov dword [esi + 0x110], eax
mov word [esi + 0x124], di
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], edi
mov byte [esp + 0x38], 0
sub eax, edi
mov dword [esp + 0x154], edi
mov dword [esp + 0xc], edi
je 0x5a868c
dec eax
je 0x5a8570
dec eax
je 0x5a82b2
push 0x16
push str.Unknown_Window_System
jmp 0x5a8693
cmp edx, 5
jne 0x5a82e0
cmp ecx, edi
jne 0x5a82cb
push str.Microsoft_Windows_2000
lea ecx, [esp + 0x38]
call fcn.00409830
jmp 0x5a82f0
cmp ecx, 1
jne 0x5a82e0
push str.Microsoft_Windows_XP
lea ecx, [esp + 0x38]
call fcn.00409830
jmp 0x5a82f0
push 0x15
push str.Microsoft_Windows_NT
lea ecx, [esp + 0x3c]
call fcn.00405710
cmp ebx, edi
je 0x5a837c
mov al, byte [esp + 0xea]
cmp al, 1
jne 0x5a8327
mov eax, dword [esp + 0xe8]
test ah, 2
lea ecx, [esp + 0x34]
je 0x5a831d
push str.Personal
jmp 0x5a844c
push str.Professional
jmp 0x5a844c
cmp al, 3
jne 0x5a8451
cmp dword [esp + 0x54], 5
jne 0x5a834b
cmp dword [esp + 0x58], 1
jne 0x5a834b
push str.Microsoft_Windows.NET
lea ecx, [esp + 0x38]
call fcn.00409830
mov al, byte [esp + 0xe8]
test al, al
jns 0x5a8360
push str.DataCenter_Server
jmp 0x5a8448
test al, 2
lea ecx, [esp + 0x34]
je 0x5a8372
push str.Advanced_Server
jmp 0x5a844c
push str.Server
jmp 0x5a844c
lea ecx, [esp + 8]
push ecx
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xf4]
push eax
push edi
push edi
push str.ProductType
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edi, dword [sym.imp.kernel32.dll_lstrcmpiA]
lea eax, [esp + 0xf0]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x5a83e5
push str.Professional
lea ecx, [esp + 0x38]
call fcn.005a4bf0
lea ecx, [esp + 0xf0]
push ecx
push str.LANMANNT
call edi
test eax, eax
jne 0x5a841b
cmp dword [esp + 0x54], 5
jne 0x5a840d
cmp dword [esp + 0x58], 1
jne 0x5a840d
push str.Standard_Server
jmp 0x5a8412
push str.Server
lea ecx, [esp + 0x38]
call fcn.005a4bf0
lea edx, [esp + 0xf0]
push edx
push str.SERVERNT
call edi
test eax, eax
jne 0x5a8451
cmp dword [esp + 0x54], 5
jne 0x5a8443
cmp dword [esp + 0x58], 1
jne 0x5a8443
push str.Enterprise_Server
jmp 0x5a8448
push str.Advanced_Server
lea ecx, [esp + 0x38]
call fcn.005a4bf0
mov eax, dword [esp + 0x4c]
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x38]
jae 0x5a8466
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x5c]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x68]
push edx
mov edx, dword [esp + 0x5c]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
push str._sVersion__d._d__s__Build__d_
push eax
call fcn.005a9d40
add esp, 0x1c
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x160], 1
call fcn.00405620
cmp dword [esp + 0x30], edi
mov byte [esp + 0x154], 0
jb 0x5a84c4
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.005b806d
add esp, 4
cmp dword [esp + 0x54], 5
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
jne 0x5a854b
cmp dword [esp + 0x58], 1
jne 0x5a854d
push str.kernel32
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x5a8529
push str.IsWow64Process
push ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5a851a
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call edi
jmp 0x5a8522
mov dword [esp + 0xc], 0
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
test eax, eax
lea ecx, [esp + 0x34]
je 0x5a853c
push str.64_Bit
jmp 0x5a8541
push str.32_Bit
call fcn.005a4bf0
cmp dword [esp + 0x54], 5
jb 0x5a855f
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
mov word [esi + 0x124], ax
jmp 0x5a869c
call fcn.005a79f0
mov word [esi + 0x124], ax
jmp 0x5a869c
cmp edx, 4
jne 0x5a85f2
cmp ecx, edi
jne 0x5a85b3
push str.Microsoft_Windows_95
lea ecx, [esp + 0x38]
call fcn.00409830
mov al, byte [esp + 0x65]
cmp al, 0x43
jne 0x5a859f
push str.OSR_2.5
lea ecx, [esp + 0x38]
call fcn.005a4bf0
jmp 0x5a8602
cmp al, 0x42
jne 0x5a8602
push str.OSR_2
lea ecx, [esp + 0x38]
call fcn.005a4bf0
jmp 0x5a8602
cmp ecx, 0xa
jne 0x5a85dd
push str.Microsoft_Windows_98
lea ecx, [esp + 0x38]
call fcn.00409830
cmp byte [esp + 0x65], 0x41
jne 0x5a8602
push 0x6baa20
lea ecx, [esp + 0x38]
call fcn.005a4bf0
jmp 0x5a8602
cmp ecx, 0x5a
jne 0x5a85f2
push str.Microsoft_Windows_Me
lea ecx, [esp + 0x38]
call fcn.00409830
jmp 0x5a8602
push 0x12
push str.Microsoft_Windows
lea ecx, [esp + 0x3c]
call fcn.00405710
lea eax, [esp + 8]
push eax
push 1
push edi
push str.DefaultControl_PanelDesktopResourceLocale
push 0x80000001
mov dword [esp + 0x24], 0x50
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5a869c
mov edx, dword [esp + 8]
push edi
push edi
lea ecx, [esp + 0x1c]
push ecx
push edi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
push edx
call edi
test eax, eax
jne 0x5a867f
cmp dword [esp + 0x14], 1
jne 0x5a867f
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push eax
call edi
test eax, eax
jne 0x5a867f
lea ecx, [esp + 0xf0]
push ecx
call fcn.005b8a6a
add esp, 4
mov word [esi + 0x124], ax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x5a869c
push 0x16
push str.Microsoft_Windows_3.1
lea ecx, [esp + 0x3c]
call fcn.00405710
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x38]
test ecx, ecx
setne al
mov byte [esi + 0x126], al
cmp dword [esp + 0x4c], 0x10
jae 0x5a86ba
lea ebx, [esp + 0x38]
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a86c0
sub eax, edx
mov edi, eax
cmp edi, 0x104
jbe 0x5a86d8
mov edi, 0x104
push edi
push ebx
push esi
call fcn.005b87f0
add esp, 0xc
mov byte [edi + esi], 0
cmp word [esi + 0x124], 0
jne 0x5a86fe
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov word [esi + 0x124], ax
cmp dword [esp + 0x4c], 0x10
jb 0x5a8712
mov ecx, dword [esp + 0x38]
push ecx
call fcn.005b806d
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x14c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x144]
pop edi
xor ecx, ebp
pop ebx
call fcn.005bbd6d
mov esp, ebp
pop ebp
ret