Function at 0x4adbb0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5027d0
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0xfde9
je 0x4adbf1
cmp eax, 0x4e4
jne 0x4adbf8
mov byte [0x607530], 1
push str.kernel32.dll
call fcn.004a4f90
add esp, 4
test eax, eax
je 0x4adc1a
push str.SetThreadDescription
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x607534], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x3c], 0xf
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x2bd], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
push 0x5b659c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x4add03
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4add03
shr eax, 1
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00424d00
add esp, 8
test al, al
je 0x4add03
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push eax
push 0
push 2
push 0x5b659c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call esi
test eax, eax
jne 0x4add03
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x2d8]
mov byte [ebp - 0x2bd], 1
push eax
call fcn.00494380
add esp, 0xc
lea ecx, [ebp - 0x50]
push eax
call fcn.00405710
lea ecx, [ebp - 0x2d8]
call fcn.00404db0
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 4], 0
cmp ecx, 8
jb 0x4add41
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4add37
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae272
push ecx
push edx
call fcn.004d36cd
add esp, 8
cmp byte [ebp - 0x2bd], 0
je 0x4adddd
cmp dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x20], str.S:KBT_third_partykbtkbt_platform_win32.cpp
cmovae eax, dword [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x1c], str.OS_Init
push str.OS_Product:__s
push eax
call fcn.004b96e0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 2
jb 0x4add85
mov eax, dword [eax]
movq xmm0, qword [ebp - 0x20]
push eax
sub esp, 0xc
mov eax, esp
push 0
movq qword [eax], xmm0
mov dword [eax + 8], 0x7f
call fcn.0041b440
mov ecx, dword [ebp - 0x24]
add esp, 0x14
mov byte [ebp - 4], 0
cmp ecx, 0x10
jb 0x4adddd
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4addd3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae277
push ecx
push edx
call fcn.004d36cd
add esp, 8
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0x10
jb 0x4ade18
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ade0e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae27c
push ecx
push edx
call fcn.004d36cd
add esp, 8
push 0x110
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.004d65b0
add esp, 0xc
mov dword [ebp - 0x2bc], 0x114
lea eax, [ebp - 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ae059
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
push 0x100
lea eax, [ebp - 0x194]
mov dword [ebp - 4], 3
push 0
push eax
mov dword [ebp - 0x1a8], 0x11c
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0
call fcn.004d65b0
add esp, 0xc
mov dword [ebp - 0x90], 0x10000
xor eax, eax
mov dword [ebp - 0x94], eax
push 1
push 0x80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x80
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x14]
mov ecx, str.Client
push eax
push 0
push 0x10
push 0x5b65dc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov edi, str.Server
push 0x80000002
cmovne edi, ecx
call esi
test eax, eax
jne 0x4adf7c
push dword [ebp - 0x14]
lea eax, [ebp - 0x2d8]
push str.._lu
push eax
call fcn.004b96e0
mov esi, eax
add esp, 0xc
lea eax, [ebp - 0x68]
cmp eax, esi
je 0x4adf71
mov ecx, eax
call fcn.00404db0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x68], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x58], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea ecx, [ebp - 0x2d8]
call fcn.00404db0
cmp dword [ebp - 0x54], 0x10
lea eax, [ebp - 0x68]
mov dword [ebp - 0x20], str.S:KBT_third_partykbtkbt_platform_win32.cpp
cmovae eax, dword [ebp - 0x68]
push eax
push dword [ebp - 0x2b0]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], str.OS_Init
push dword [ebp - 0x2b4]
push dword [ebp - 0x2b8]
push edi
push str.OS_Version:__s__lu._lu._lu_s
push eax
call fcn.004b96e0
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 4
jb 0x4adfc6
mov eax, dword [eax]
movq xmm0, qword [ebp - 0x20]
push eax
sub esp, 0xc
mov eax, esp
push 0
movq qword [eax], xmm0
mov dword [eax + 8], 0x96
call fcn.0041b440
mov ecx, dword [ebp - 0x3c]
add esp, 0x14
mov byte [ebp - 4], 3
cmp ecx, 0x10
jb 0x4ae01e
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ae014
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae281
push ecx
push edx
call fcn.004d36cd
add esp, 8
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0x10
jb 0x4ae059
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ae04f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae286
push ecx
push edx
call fcn.004d36cd
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea eax, [ebp - 0x8c]
push eax
movups xmmword [ebp - 0x8c], xmm0
movups xmmword [ebp - 0x7c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [ebp - 0x8c]
mov edx, str.Unknown
mov esi, 0x5b662c
cmp cx, 9
jne 0x4ae099
mov eax, str.x86_64
jmp 0x4ae0c8
cmp cx, 5
jne 0x4ae0a6
mov eax, str.arm32
jmp 0x4ae0c8
cmp cx, 0xc
jne 0x4ae0b3
mov eax, str.arm64
jmp 0x4ae0c8
cmp cx, 6
jne 0x4ae0c0
mov eax, str.ia64
jmp 0x4ae0c8
test cx, cx
mov eax, esi
cmovne eax, edx
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x2c], str.S:KBT_third_partykbtkbt_platform_win32.cpp
push str.OS_Architecture:__s
push eax
mov dword [ebp - 0x28], str.OS_Init
call fcn.004b96e0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 5
jb 0x4ae0f7
mov eax, dword [eax]
movq xmm0, qword [ebp - 0x2c]
push eax
sub esp, 0xc
mov eax, esp
push 0
movq qword [eax], xmm0
mov dword [eax + 8], 0xaa
call fcn.0041b440
mov ecx, dword [ebp - 0x3c]
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0x10
jb 0x4ae152
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ae148
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae28b
push ecx
push edx
call fcn.004d36cd
add esp, 8
push 8
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push 9
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessInformation]
test eax, eax
je 0x4ae257
mov ax, word [ebp - 0x1c]
mov ecx, 0x8664
mov edx, str.Unknown
cmp ax, cx
jne 0x4ae191
mov esi, str.x86_64
jmp 0x4ae1cf
mov ecx, 0x1c0
cmp ax, cx
jne 0x4ae1a2
mov esi, str.arm32
jmp 0x4ae1cf
mov ecx, 0xaa64
cmp ax, cx
jne 0x4ae1b3
mov esi, str.arm64
jmp 0x4ae1cf
mov ecx, 0x200
cmp ax, cx
jne 0x4ae1c4
mov esi, str.ia64
jmp 0x4ae1cf
mov ecx, 0x14c
cmp ax, cx
cmovne esi, edx
push esi
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2c], str.S:KBT_third_partykbtkbt_platform_win32.cpp
push str.Process_Architecture:__s
push eax
mov dword [ebp - 0x28], str.OS_Init
call fcn.004b96e0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 6
jb 0x4ae201
mov eax, dword [eax]
movq xmm0, qword [ebp - 0x2c]
push eax
sub esp, 0xc
mov eax, esp
push 0
movq qword [eax], xmm0
mov dword [eax + 8], 0xbf
call fcn.0041b440
mov ecx, dword [ebp - 0x2c4]
add esp, 0x14
cmp ecx, 0x10
jb 0x4ae257
mov edx, dword [ebp - 0x2d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4ae24d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ae290
push ecx
push edx
call fcn.004d36cd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
call fcn.004d826f
call fcn.004d826f
call fcn.004d826f
call fcn.004d826f
call fcn.004d826f
call fcn.004d826f
call fcn.004d826f
int3