Function at 0x100dc280
Capabilities:
Check os version
Get common file path
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x4c0], eax
xor ebx, ebx
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp + 0x10]
push 0x118
mov dword [ebp - 0x4ac], eax
lea eax, [ebp - 0x388]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x118
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x38c], 0x11c
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x18
mov dword [ebp - 0x4a8], 0x11c
push str.RtlGetVersion
push 0x10204308
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x100dc39d
lea ecx, [ebp - 0x4a8]
push ecx
call eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x384], eax
mov al, byte [ebp - 0x38e]
mov byte [ebp - 0x272], al
movzx eax, word [ebp - 0x394]
mov word [ebp - 0x278], ax
movzx eax, word [ebp - 0x392]
mov word [ebp - 0x276], ax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x378]
push 0x80
push eax
call fcn.101ef650
mov eax, dword [ebp - 0x498]
add esp, 0xc
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x380], eax
movzx eax, word [ebp - 0x390]
mov word [ebp - 0x274], ax
jmp 0x100dc3aa
lea eax, [ebp - 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x4c8], eax
call esi
push eax
call edi
test eax, eax
je 0x100dc400
lea ecx, [ebp - 0x4e8]
push ecx
call eax
jmp 0x100dc40d
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0x4ac]
movzx eax, word [ebp - 0x278]
push 0x208
push 0
mov dword [esi], eax
mov eax, dword [ebp - 0x388]
lea ecx, [eax + eax*4]
mov eax, dword [ebp - 0x384]
lea edi, [eax + ecx*2]
lea eax, [ebp - 0x270]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x100dc58e
push str._ntoskrnl.exe
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x100dc58e
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.100dac10
add esp, 8
test eax, eax
je 0x100dc58e
mov eax, dword [ebp - 0x4b8]
mov ecx, eax
shr ecx, 0x10
movzx edx, ax
lea eax, [ecx + ecx*4]
lea eax, [edx + eax*2]
cmp edi, eax
jge 0x100dc58e
mov dword [ebp - 0x388], ecx
mov dword [ebp - 0x384], edx
mov dword [esi], ebx
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
push str.Service_Pack
lea ecx, [ebp - 0x4b8]
lea edi, [eax + 0x10]
call fcn.10002490
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x4b4], 1
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x4b0], 0x64
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4b4]
push eax
push str.CSDVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [ebp - 0x4b8]
test eax, eax
jne 0x100dc55f
push dword [esi - 0xc]
push esi
push edi
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x100dc55f
mov eax, dword [esi - 0xc]
lea eax, [edi + eax*2]
push eax
call sub.msvcrt.dll__wtoi
mov ecx, dword [ebp - 0x4ac]
add esp, 4
mov dword [ecx], eax
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100dc579
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x100dc58e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4c0]
mov edx, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x388]
mov dword [eax], ecx
mov eax, dword [ebp - 0x384]
mov dword [edx], eax
cmp ecx, 5
jne 0x100dc5f0
test eax, eax
jne 0x100dc5bb
lea ebx, [ecx - 4]
jmp 0x100dc676
cmp eax, 1
jne 0x100dc5ca
mov ebx, 2
jmp 0x100dc676
cmp eax, 2
jne 0x100dc676
cmp byte [ebp - 0x272], 1
jne 0x100dc5e6
cmp word [ebp - 0x4e8], 9
je 0x100dc5c0
mov ebx, 4
jmp 0x100dc676
cmp ecx, 6
jne 0x100dc65f
test eax, eax
jne 0x100dc613
mov al, byte [ebp - 0x272]
cmp al, 3
je 0x100dc60c
cmp al, 2
je 0x100dc60c
lea ebx, [ecx - 3]
jmp 0x100dc676
mov ebx, 6
jmp 0x100dc676
cmp eax, 1
jne 0x100dc634
mov al, byte [ebp - 0x272]
cmp al, 3
je 0x100dc62d
cmp al, 2
je 0x100dc62d
mov ebx, 5
jmp 0x100dc676
mov ebx, 7
jmp 0x100dc676
cmp eax, 2
jne 0x100dc647
cmp byte [ebp - 0x272], 1
jne 0x100dc676
lea ebx, [eax + 6]
jmp 0x100dc676
cmp eax, 3
jne 0x100dc65a
cmp byte [ebp - 0x272], 1
jne 0x100dc676
lea ebx, [eax + 6]
jmp 0x100dc676
cmp eax, 4
jmp 0x100dc666
cmp ecx, 0xa
jne 0x100dc676
test eax, eax
jne 0x100dc676
cmp byte [ebp - 0x272], 1
jne 0x100dc676
mov ebx, 0xa
mov al, byte [ebp - 0x274]
mov ecx, dword [ebp - 4]
and al, 0x40
movzx eax, al
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
not eax
and eax, ebx
pop esi
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret