Function at 0x417c9c
Capabilities:
Check os version
Get common file path
Get memory capacity
Identify system language via api
Query or enumerate registry value

Disassembly:
push 0x634
mov eax, 0x4a07b1
call fcn.0047bb4d
push 0x4b0658
mov edi, ecx
push 3
pop ecx
mov dword [ebp - 0x634], edi
call fcn.0040d57f
pop ecx
call fcn.004080c8
lea ecx, [ebp - 0x434]
push ecx
call fcn.00404cae
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea ecx, [edi + 0x6c]
push 0
lea eax, [ebp - 0x434]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00403d16
lea eax, [ebp - 0x60]
push eax
call fcn.0041fb77
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x60]
push eax
mov edx, 0x4b0578
mov ecx, 0x4b0418
call fcn.0041fc6f
mov bl, al
test bl, bl
jne 0x417d28
push 0x4b05d0
mov ecx, esi
jmp 0x417d4f
push 0x4a9ef8
lea eax, [edi + 0x88]
push eax
mov edx, 0x4ab4a8
lea ecx, [ebp - 0x60]
call fcn.00420247
mov bl, al
test bl, bl
jne 0x417d55
push 0x4b0630
push 2
pop ecx
call fcn.0040d57f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.0041fbdf
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test bl, bl
jne 0x417df3
call esi
mov ebx, eax
lea eax, [ebp - 0xa8]
push eax
call fcn.004090fb
mov dword [ebp - 0x628], eax
mov dword [ebp - 4], 2
push 0x4b06a4
push eax
call fcn.0040b677
pop ecx
pop ecx
push ebx
push dword [ebp - 0x628]
call fcn.0040a33c
mov ecx, dword [ebp - 0x628]
lea ebx, [ebp - 0x434]
call fcn.00409165
mov byte [ebp - 4], 3
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x417dcb
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa8]
call fcn.00407bad
mov ebx, 0x114
push ebx
lea eax, [ebp - 0x618]
push 0
push eax
call fcn.00475a50
add esp, 0xc
lea eax, [ebp - 0x618]
push eax
mov dword [ebp - 0x618], ebx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x417ea0
call esi
mov edi, eax
lea eax, [ebp - 0xa8]
push eax
call fcn.004090fb
mov esi, eax
mov dword [ebp - 4], 4
push 0x4b06d0
push esi
call fcn.0040b677
pop ecx
pop ecx
push edi
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x434]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 5
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x417e70
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa8]
call fcn.00407bad
push 2
pop eax
jmp 0x418959
mov eax, dword [ebp - 0x614]
mov dword [edi + 0xc0], eax
mov eax, dword [ebp - 0x610]
mov dword [edi + 0xc4], eax
mov eax, dword [ebp - 0x60c]
mov dword [edi + 0xc8], eax
mov eax, dword [ebp - 0x608]
mov dword [edi + 0xcc], eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x604]
call fcn.00404cae
mov dword [ebp - 4], 6
push 0xffffffffffffffff
lea ecx, [edi + 0xf8]
push 0
lea eax, [ebp - 0x434]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00403d16
lea ebx, [edi + 0x1d98]
call fcn.00417c0b
test al, al
jne 0x417fa4
call esi
mov ebx, eax
lea eax, [ebp - 0xa8]
push eax
call fcn.004090fb
mov dword [ebp - 0x628], eax
mov dword [ebp - 4], 7
push 0x4b06fc
push eax
call fcn.0040b677
pop ecx
pop ecx
push ebx
push dword [ebp - 0x628]
call fcn.0040a33c
mov ecx, dword [ebp - 0x628]
lea ebx, [ebp - 0x434]
call fcn.00409165
mov byte [ebp - 4], 8
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x417f7c
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa8]
call fcn.00407bad
mov eax, dword [edi + 0xc0]
cmp eax, 5
ja 0x417fba
jne 0x418028
cmp dword [edi + 0xc4], 1
jb 0x418028
push 0x11c
xor ebx, ebx
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.00475a50
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0x130], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x417ffc
xor ecx, ecx
push 0x4b0724
inc ecx
call fcn.0040d57f
pop ecx
jmp 0x41802a
mov ax, word [ebp - 0x1c]
mov word [edi + 0xd0], ax
mov ax, word [ebp - 0x1a]
mov word [edi + 0xd2], ax
mov ax, word [ebp - 0x18]
mov word [edi + 0xd4], ax
mov al, byte [ebp - 0x16]
mov byte [edi + 0xd6], al
jmp 0x41802a
xor ebx, ebx
push pe_nt_image_headers32
lea eax, [ebp - 0x490]
push ebx
push eax
call fcn.00475a50
add esp, 0xc
lea eax, [ebp - 0x490]
push eax
mov dword [ebp - 0x490], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
test eax, eax
jne 0x4180d0
call esi
mov ebx, eax
lea eax, [ebp - 0xa8]
push eax
call fcn.004090fb
mov esi, eax
mov dword [ebp - 4], 9
push 0x4b0750
push esi
call fcn.0040b677
pop ecx
pop ecx
push ebx
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x434]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x4180a6
mov eax, ebx
xor ecx, ecx
push eax
inc ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa8]
call fcn.00407bad
xor ebx, ebx
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x484]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [edi + 0xdc], ecx
mov ecx, dword [ebp - 0x47c]
mov dword [edi + 0xd8], eax
mov eax, dword [ebp - 0x480]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [edi + 0xe0], eax
mov eax, dword [ebp - 0x468]
mov dword [edi + 0xe4], ecx
mov ecx, dword [ebp - 0x464]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov dword [edi + 0xe8], eax
mov eax, dword [ebp - 0x460]
mov dword [edi + 0xec], ecx
mov ecx, dword [ebp - 0x45c]
shrd eax, ecx, 0xa
mov dword [edi + 0xf0], eax
lea eax, [ebp - 0x450]
shr ecx, 0xa
push eax
mov eax, 0x4b0790
mov dword [edi + 0xf4], ecx
mov dword [ebp - 0x640], ebx
call fcn.00404cae
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x434]
push eax
mov eax, 0x4b07b8
call fcn.00404cae
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x450]
push eax
mov edx, 0x200
lea ecx, [ebp - 0x434]
call fcn.0042901e
pop ecx
pop ecx
mov byte [ebp - 0x629], al
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.00403d16
cmp byte [ebp - 0x629], bl
je 0x418250
lea eax, [ebp - 0xa8]
push eax
call fcn.004090fb
mov esi, eax
mov dword [ebp - 4], 0xd
push 0x4b0820
push esi
call fcn.0040b677
pop ecx
pop ecx
push dword [ebp - 0x640]
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x434]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x420], 8
mov eax, dword [ebp - 0x434]
jae 0x41821f
mov eax, ebx
push eax
xor ecx, ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xa8]
call fcn.00407bad
mov eax, dword [ebp - 0x640]
xor ebx, ebx
jmp 0x418259
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [edi + 0x130], eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
push dword [edi + 0x130]
movzx eax, ax
lea esi, [edi + 0x138]
mov dword [edi + 0x134], eax
call fcn.00417b9c
pop ecx
push dword [edi + 0x134]
lea esi, [edi + 0x154]
call fcn.00417b9c
pop ecx
lea eax, [ebp - 0x434]
push eax
mov esi, 0x4a9a00
mov eax, esi
call fcn.00404cae
mov dword [ebp - 4], 0xf
push 0xffffffffffffffff
lea ecx, [edi + 0x114]
push ebx
lea eax, [ebp - 0x434]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00403d16
mov ecx, edi
call fcn.004176f3
test al, al
jne 0x4182e8
push 0x4b0860
push 4
pop ecx
call fcn.0040d57f
pop ecx
call fcn.004179d9
mov edi, dword [ebp - 0x634]
test al, al
jne 0x4182fd
mov byte [edi + 0x190], bl
xor eax, eax
push 0x206
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.00475a50
add esp, 0xc
push 0x104
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
jne 0x418368
lea eax, [ebp - 0x434]
push eax
mov eax, esi
call fcn.00404cae
mov dword [ebp - 4], 0x10
push 0xffffffffffffffff
lea ecx, [edi + 0x34]
push ebx
lea eax, [ebp - 0x434]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00403d16
jmp 0x418388
lea eax, [ebp - 0x418]
push eax
call fcn.00477a67
pop ecx
lea esi, [edi + 0x34]
lea ecx, [ebp - 0x418]
call fcn.004051e0
mov esi, 0x4a9a00
lea eax, [ebp - 0x434]
push eax
mov eax, esi
call fcn.00404cae
mov dword [ebp - 4], 0x11
push 0xffffffffffffffff
lea ecx, [edi + 0x18]
push ebx
lea eax, [ebp - 0x434]
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00403d16
lea eax, [ebp - 0x624]
push eax
push 0x20019
push ebx
push 0x4afb20
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x41849f
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push ebx
push 0x4ab4e0
push dword [ebp - 0x624]
mov dword [ebp - 0x61c], ebx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
cmp eax, ebx
jne 0x418480
lea eax, [ebp - 0x620]
push eax
mov eax, dword [ebp - 0x61c]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x620], ebx
call fcn.0040cddb
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x444]
push ebx
push ebx
push 0x4ab4e0
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 0x444]
call fcn.00477a67
pop ecx
mov ecx, dword [ebp - 0x444]
lea esi, [edi + 0x18]
call fcn.004051e0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x444]
call fcn.00419335
mov esi, 0x4a9a00
jmp 0x418493
lea eax, [edi + 0x18]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x41848e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea eax, [ebp - 0x434]
push eax
mov eax, esi
call fcn.00404cae
mov dword [ebp - 4], 0x13
push 0xffffffffffffffff
lea esi, [edi + 0x50]
push ebx
lea eax, [ebp - 0x434]
mov ecx, esi
call fcn.00404d40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.00403d16
lea eax, [ebp - 0x624]
push eax
push 0x20019
push ebx
push 0x4afac8
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x4185ad
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push ebx
push 0x4acff8
push dword [ebp - 0x624]
mov dword [ebp - 0x61c], ebx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x418591
lea eax, [ebp - 0x620]
push eax
mov eax, dword [ebp - 0x61c]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x620], ebx
call fcn.0040cddb
mov dword [ebp - 4], 0x14
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x444]
push ebx
push ebx
push 0x4acff8
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
push dword [ebp - 0x444]
call fcn.00477a67
pop ecx
mov ecx, dword [ebp - 0x444]
call fcn.004051e0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x444]
call fcn.00419335
jmp 0x4185a1
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x41859c
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
lea eax, [ebp - 0x624]
push eax
push 0x20019
push ebx
push dword [0x4c53b0]
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
jne 0x418817
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push ebx
mov esi, 0x4b0888
push esi
push dword [ebp - 0x624]
mov dword [ebp - 0x61c], ebx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x620]
push eax
mov eax, dword [ebp - 0x61c]
shr eax, 1
inc eax
push eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x620], ebx
call fcn.0040cddb
mov dword [ebp - 4], 0x15
cmp dword [ebp - 0x628], ebx
jne 0x418648
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x444]
push ebx
push ebx
push esi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
mov eax, dword [ebp - 0x444]
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x63c], eax
call fcn.00404c9b
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x628], ebx
cmp dword [ebp - 0x61c], ebx
jbe 0x4187ed
mov eax, dword [ebp - 0x630]
cmp word [eax], bx
jne 0x4187ce
push dword [ebp - 0x63c]
call fcn.00477a67
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x63c]
sub eax, dword [ebp - 0x630]
pop ecx
sar eax, 1
inc eax
cmp dword [ebp - 0x620], eax
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x620]
jb 0x4186c5
lea eax, [ebp - 0x638]
push dword [eax]
mov ecx, dword [ebp - 0x63c]
lea eax, [ebp - 0x4ac]
call fcn.00409d53
mov byte [ebp - 4], 0x18
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4ac]
lea ecx, [ebp - 0x434]
call fcn.00404d40
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4ac]
call fcn.00403d16
cmp dword [ebp - 0x424], ebx
je 0x4187ed
mov eax, dword [ebp - 0x630]
add eax, 2
push 0x24
mov dword [ebp - 0x63c], eax
call fcn.00477df1
mov esi, eax
pop ecx
mov dword [ebp - 0x638], esi
mov byte [ebp - 4], 0x19
cmp esi, ebx
je 0x41873f
mov ecx, esi
call fcn.00404c9b
mov byte [ebp - 4], 0x19
jmp 0x418741
xor esi, esi
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x638], esi
cmp esi, ebx
je 0x4187ce
mov dword [esi + 0x1c], ebx
xor eax, eax
mov dword [esi + 0x20], ebx
push 0x1fe
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00475a50
mov ecx, dword [ebp - 0x434]
add esp, 0xc
cmp dword [ebp - 0x420], 8
jae 0x418788
lea ecx, [ebp - 0x434]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x4b08a0
push ecx
call fcn.00478215
lea eax, [ebp - 0x210]
add esp, 0x14
push eax
call fcn.00477a67
pop ecx
lea ecx, [ebp - 0x210]
call fcn.004051e0
lea esi, [edi + 0x1dd4]
lea ecx, [ebp - 0x638]
call fcn.00415524
add dword [ebp - 0x630], 2
inc dword [ebp - 0x628]
mov eax, dword [ebp - 0x628]
cmp eax, dword [ebp - 0x61c]
jb 0x41867b
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x434]
call fcn.00403d16
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x444]
call fcn.00419335
call fcn.00407e5c
push 2
pop ecx
cmp eax, ecx
jl 0x418844
cmp eax, 3
jle 0x41883c
add eax, 0xfffffffb
cmp eax, 5
ja 0x418844
mov dword [edi + 0x1dc8], 0x10
jmp 0x41884a
mov dword [edi + 0x1dc8], ecx
jmp 0x41884a
mov dword [edi + 0x1dc8], ebx
mov eax, dword [edi + 0xd8]
mov ecx, dword [edi + 0xdc]
shrd eax, ecx, 0xa
shr ecx, 0xa
mov ecx, eax
shr ecx, 1
add ecx, eax
lea eax, [ebp - 0x500]
push eax
mov dword [edi + 0x1dcc], ecx
call fcn.0041fb77
mov dword [ebp - 4], 0x1b
lea eax, [ebp - 0x500]
push eax
mov edx, 0x4b08b8
mov ecx, 0x4b0418
call fcn.0041fc6f
cmp al, bl
jne 0x4188a6
xor ecx, ecx
push 0x4b0920
inc ecx
call fcn.0040d57f
pop ecx
jmp 0x4188ee
push ebx
lea edi, [ebp - 0x620]
mov edx, 0x4b09b4
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x620], ebx
call fcn.00420481
cmp al, bl
je 0x4188d9
mov ecx, dword [ebp - 0x620]
mov eax, dword [ebp - 0x634]
add dword [eax + 0x1dd0], ecx
lea ecx, [ebp - 0x500]
call fcn.00420792
test al, al
jne 0x4188a6
mov edi, dword [ebp - 0x634]
mov esi, dword [sym.imp.USER32.DLL_GetSystemMetrics]
push 0x43
call esi
push 0x2001
mov dword [edi + 0x1db4], eax
call esi
push 0x1000
mov dword [edi + 0x1db8], eax
call esi
push 0x2000
mov dword [edi + 0x1dbc], eax
call esi
mov dword [edi + 0x1dc0], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x4b09d8
push 3
pop ecx
mov dword [edi + 0x1dc4], eax
call fcn.0040d57f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x500]
call fcn.0041fbdf
xor eax, eax
call fcn.0047bbd0
ret