Function at 0x4ed850
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eddfc
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x170], esi
lea edi, [esi + 0x28]
mov dword [esi], 0
xorps xmm0, xmm0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x40], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push str.kernel32.dll
mov dword [ebp - 0x168], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ed917
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], 0
push ecx
push dword [ebp - 0x168]
call eax
test eax, eax
jne 0x4ed90c
mov eax, 2
jmp 0x4ed917
xor eax, eax
cmp dword [ebp - 0x164], eax
setne al
mov dword [esi + 0x4c], eax
xorps xmm0, xmm0
movups xmmword [esi + 0x50], xmm0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
push 0x118
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x160], 0x11c
push 0
push eax
call fcn.005c0be0
add esp, 0xc
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x15c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x158]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x154]
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
xor ecx, ecx
test edx, edx
jne 0x4ed9bc
mov eax, dword [ebp - 0x164]
mov ecx, eax
mov dword [ebp - 0x16c], eax
jmp 0x4ed9be
xor eax, eax
test edx, edx
je 0x4ed9d5
mov byte [ebp - 4], 1
test ecx, ecx
je 0x4ed9d1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4eda4a
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x168], 0
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 4
push ecx
push 0
push 0x79723c
push eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4eda2f
mov eax, dword [ebp - 0x18]
cmp eax, 4
je 0x4eda1f
cmp eax, 3
jne 0x4eda2f
xor eax, eax
cmp dword [ebp - 0x1c], 4
cmove eax, dword [ebp - 0x20]
mov dword [ebp - 0x168], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x16c]
test eax, eax
je 0x4eda44
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x168]
push dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], eax
call fcn.004ed5b0
mov dword [esi], eax
movzx eax, word [ebp - 0x4c]
mov dword [esi + 0x20], eax
movzx eax, word [ebp - 0x4a]
push ecx
mov edx, esp
mov dword [esi + 0x24], eax
lea eax, [ebp - 0x14c]
xor ecx, ecx
mov dword [edx], eax
cmp word [ebp - 0x14c], cx
je 0x4eda8b
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x4eda81
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x188]
call fcn.004e2de0
add esp, 8
mov dword [ebp - 0x168], eax
cmp edi, eax
je 0x4edb11
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x4edadf
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x4edacf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4edc77
mov eax, edx
push ecx
push eax
call fcn.005be247
mov eax, dword [ebp - 0x168]
add esp, 8
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x174]
cmp ecx, 0x10
jb 0x4edb4b
mov edx, dword [ebp - 0x188]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4edb41
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4edc77
push ecx
push edx
call fcn.005be247
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x44]
push eax
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [ebp - 0x44]
movzx eax, cx
test eax, eax
je 0x4edb8e
cmp eax, 6
je 0x4edb85
cmp eax, 9
jne 0x4edb95
mov dword [esi + 0x40], 1
jmp 0x4edb95
mov dword [esi + 0x40], 2
jmp 0x4edb95
mov dword [esi + 0x40], 0
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x15c]
cmp eax, 6
je 0x4edbf3
cmp eax, 0xa
je 0x4edbf3
cmp eax, 5
jne case.0x4edc32.2
mov eax, dword [ebp - 0x158]
cmp eax, 2
jne 0x4edbe1
cmp byte [ebp - 0x46], 1
jne 0x4edbd1
cmp cx, 9
je case.0x4edc32.1
test dword [ebp - 0x48], 0x8000
jne case.0x4edc32.2
mov eax, 2
jmp 0x4edc57
cmp eax, 1
jne case.0x4edc32.2
mov eax, dword [ebp - 0x48]
not eax
shr eax, 9
and eax, 1
jmp 0x4edc57
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push dword [ebp - 0x158]
push dword [ebp - 0x15c]
call eax
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, 0x81
ja case.0x4edc32.2
movzx eax, byte [eax + 0x4edc94]
jmp dword [eax*4 + 0x4edc7c]
mov eax, 2
jmp 0x4edc57
mov eax, 1
jmp 0x4edc57
mov eax, 3
jmp 0x4edc57
mov eax, 4
jmp 0x4edc57
xor eax, eax
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret
call fcn.005c44be
inc eax
fmul qword [esi]
push ebp
fmul qword [esi]
inc edi
fmul qword [esi]
cmp esp, ebx
dec esi
add byte [esi - 0x24], cl
dec esi
add byte [ebp - 0x24], dl
dec esi
add byte [eax], al
add dword [ecx], eax
add al, byte [50529026]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [84215045]
add eax, 84018435
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 328965
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84018434
add eax, 84215045
add eax, 84215045
add al, byte [84215045]
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84214788
add al, byte [edx]
add eax, -872283643
int3