Function at 0x41cb67
Capabilities:
Check os version
Delete file
Get file size
Get system information on windows
Query or enumerate registry value
Read file on windows

Disassembly:
sub esp, 0x52c
mov eax, dword [0x5107c0]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
mov ebx, dword [esp + 0x538]
push ebp
push esi
push edi
mov edi, dword [esp + 0x540]
push edi
mov dword [esp + 0x1c], ebx
call fcn.00415e01
cmp dword [edi + 8], 0
pop ecx
je 0x41cd36
push 0x64
pop edx
push 0x62
pop eax
push 0x67
mov word [esp + 0x20a], ax
pop eax
push 0x68
mov word [esp + 0x20c], ax
pop eax
push 0x65
mov word [esp + 0x20e], ax
pop eax
push 0x6c
pop ecx
push 0x70
mov word [esp + 0x210], ax
pop eax
mov word [esp + 0x210], ax
push 0x2e
pop eax
mov word [esp + 0x212], ax
xor eax, eax
mov word [esp + 0x21a], ax
lea eax, [esp + 0x204]
push eax
mov word [esp + 0x208], dx
mov word [esp + 0x212], cx
mov word [esp + 0x218], dx
mov word [esp + 0x21a], cx
mov word [esp + 0x21c], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x41cd36
movdqa xmm0, xmmword [str.MiniDumpWriteDum_u._u._u._u]
lea ecx, [esp + 0x21c]
push ecx
push eax
movdqu xmmword [esp + 0x224], xmm0
mov word [esp + 0x234], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x41cd2c
lea eax, [esp + 0x330]
push eax
call fcn.0041d1f5
pop ecx
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [esp + 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [edi + 4]
mov esi, eax
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x24]
mov ecx, dword [edi + 8]
mov dword [esp + 0x28], ecx
xor ecx, ecx
push ecx
push ecx
push eax
push ecx
push esi
push dword [edi]
mov dword [esp + 0x44], 1
push dword [edi + 0x9c]
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x41ccdd
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x334]
push eax
call fcn.0041b72e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x41cd1e
mov ecx, dword [edi + 0xa4]
xor eax, eax
push eax
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x64
push esi
push eax
call fcn.0041a544
push esi
call fcn.0040746c
pop ecx
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esp + 0xf4], 0
lea eax, [esp + 0xf8]
push 0x10c
push 0
push eax
mov dword [esp + 0xfc], 0x114
call fcn.004b6030
add esp, 0xc
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
imul eax, dword [esp + 0xf4], 0xa
lea esi, [edi + 0x5c]
add eax, dword [esp + 0xf8]
mov dword [edi + 0x58], eax
lea eax, [esp + 0x20]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41ce12
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 1
push eax
lea eax, [esp + 0x234]
mov dword [esp + 0x18], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x4d08c0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xa
lea ebp, [esp + 0x234]
mov eax, ebp
push str.Microsoft
push eax
call fcn.004b4fb0
add esp, 0xc
lea ecx, [esp + 0x23a]
test eax, eax
mov edx, esi
cmovne ecx, ebp
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x41cdf8
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ce07
sub ecx, edx
add esi, ecx
push 0x98
lea eax, [esp + 0x5c]
mov dword [esp + 0x58], 0x9c
push 0
push eax
call fcn.004b6030
add esp, 0xc
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp byte [esp + 0x68], 0
je 0x41ce56
mov byte [esi], 0x5f
lea ecx, [esp + 0x68]
inc esi
mov eax, ecx
sub esi, eax
mov al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
test al, al
jne 0x41ce4c
mov eax, dword [esp + 0x60]
mov dword [edi + 0x54], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [esp + 0x30]
push 3
pop esi
test eax, eax
je 0x41cea1
cmp eax, 5
je 0x41ce95
cmp eax, 9
je 0x41ce8c
cmp eax, 0xc
jne 0x41ce98
mov dword [edi + 0x50], 2
jmp 0x41cea5
mov dword [edi + 0x50], 1
jmp 0x41cea5
mov dword [edi + 0x50], esi
mov dword [edi + 0x50], 4
jmp 0x41cea5
and dword [edi + 0x50], 0
push edi
call fcn.0041624e
pop ecx
test ebx, ebx
je 0x41cf73
push 0
push 0x80
push esi
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41cf73
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
lea ecx, [ebp - 1]
cmp ecx, 0xffffe
ja 0x41cf6c
lea ecx, [ebp + 1]
push ecx
call fcn.00407458
mov esi, eax
pop ecx
test esi, esi
je 0x41cf6c
push 0
lea eax, [esp + 0x18]
push eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [esi + ebp], 0
mov ebp, dword [esp + 0x18]
push 0x5c
push ebp
call fcn.004b3fe0
pop ecx
pop ecx
test eax, eax
jne 0x41cf2a
mov eax, ebp
jmp 0x41cf2d
add eax, 2
xor edx, edx
lea ecx, [esp + 0x230]
push edx
push edx
push 0x100
push ecx
push 0xffffffffffffffff
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [edi + 0xa4]
lea eax, [esp + 0x230]
push 0
push 0
push dword [esp + 0x1c]
push esi
push eax
call fcn.0041a544
push esi
call fcn.0040746c
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x538]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b35e5
add esp, 0x52c
ret