Function at 0x419d90
Capabilities:
Check os version
Get common file path
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444d66
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x4629b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x41a766
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0042f620
add esp, 0xc
lea eax, [ebp - 0x90]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x318]
call fcn.00405090
push 1
push 0x4610a4
lea eax, [ebp - 0x318]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.0040c410
add esp, 0x10
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 2
call fcn.004050d0
push 0xffffffffffffffff
lea ecx, [ebp - 0x1b0]
call fcn.00409580
push eax
push 0x46b05c
call fcn.0040d940
push 0xffffffffffffffff
lea eax, [ebp - 0x90]
push eax
push 0x46afdc
call fcn.00406830
add esp, 0x18
mov ecx, 0x469ae4
push 0x15
call fcn.0040df90
mov ecx, eax
call fcn.00409570
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x469998], eax
test eax, eax
je 0x419e9e
push 0x46c178
push 0x46c174
push 0x46c170
call eax
mov ecx, dword [0x46c170]
xor eax, eax
mov edx, dword [0x46c174]
mov word [0x46c17a], ax
mov esi, dword [0x46c178]
cmp ecx, 6
jle 0x419ec9
mov dword [0x46c12c], 1
jmp 0x419ef0
cmp ecx, 5
jne 0x419ef0
test edx, edx
jle 0x419ef0
mov eax, dword [0x46c12c]
cmp esi, 1
mov dword [ebp - 0x194], 1
cmovg eax, dword [ebp - 0x194]
mov dword [0x46c12c], eax
push esi
push edx
push ecx
push str._lu._lu._lu
push 0xffffffffffffffff
push 0x469dd4
call fcn.00401430
add esp, 0x18
mov dword [ebp - 0x2fc], 0
lea eax, [ebp - 0x2fc]
mov dword [ebp - 0x198], 8
mov ecx, 0x469a38
mov dword [ebp - 0x1b4], 4
push eax
push 0x20119
push 0
push 0x5b
call fcn.0040df90
mov ecx, eax
call fcn.00409580
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x419f8f
lea eax, [ebp - 0x198]
push eax
push 0x46c17c
lea eax, [ebp - 0x1b4]
push eax
push 0
push 0x4545ec
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2fc]
call esi
jmp 0x41a040
push 0x46afdc
lea ecx, [ebp - 0x1b0]
call fcn.00405130
push str._ntoskrnl.exe
lea ecx, [ebp - 0x1b0]
call fcn.00405200
lea eax, [ebp - 0x1b0]
push eax
call fcn.00414f40
add esp, 4
cmp eax, 1
je 0x41a017
push 0x46afdc
lea ecx, [ebp - 0x1b0]
call fcn.00405130
push str._ntkrnlpa.exe
lea ecx, [ebp - 0x1b0]
call fcn.00405200
lea eax, [ebp - 0x1b0]
push eax
call fcn.00414f40
add esp, 4
cmp eax, 1
je 0x41a017
push 0x46afdc
lea ecx, [ebp - 0x1b0]
call fcn.00405130
push str.Kernel32.dll
lea ecx, [ebp - 0x1b0]
call fcn.00405200
push 0x46c17c
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.00413c10
add esp, 0x14
inc dword [0x46c1f4]
lea eax, [ebp - 0x2f0]
push 0x118
push 0
push eax
call fcn.0042f620
add esp, 0xc
mov dword [ebp - 0x2f4], 0x11c
lea eax, [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x46c170], 9
jbe 0x41a0a1
cmp dword [0x46c178], 0x55ef
mov ecx, 0x46b4dc
jbe 0x41a097
push str.Windows_11
jmp 0x41a129
push str.Windows_10
jmp 0x41a129
cmp dword [0x46c170], 6
jne 0x41a570
cmp dword [0x46c174], 0
jne 0x41a0d6
cmp byte [ebp - 0x1da], 1
mov ecx, 0x46b4dc
jne 0x41a0cc
push str.Windows_Vista
jmp 0x41a0d1
push str.Windows_Server_2008
call fcn.00405130
cmp dword [0x46c174], 1
jne 0x41a0fe
cmp byte [ebp - 0x1da], 1
mov ecx, 0x46b4dc
jne 0x41a0f4
push str.Windows_7
jmp 0x41a0f9
push str.Windows_Server_2008_R2
call fcn.00405130
cmp dword [0x46c174], 2
jne 0x41a116
push str.Windows_8
mov ecx, 0x46b4dc
call fcn.00405130
cmp dword [0x46c174], 3
jne 0x41a12e
push str.Windows_8.1
mov ecx, 0x46b4dc
call fcn.00405130
cmp dword [0x46c170], 5
jbe 0x41a75b
push str.GetProductInfo
push str.Kernel32
mov dword [ebp - 0x194], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4699e4], eax
test eax, eax
je 0x41a75b
lea ecx, [ebp - 0x194]
push ecx
push dword [0x46c17c]
push dword [0x46c178]
push dword [0x46c174]
push dword [0x46c170]
call eax
mov eax, dword [ebp - 0x194]
dec eax
cmp eax, 0xbe
ja case.0x41a1a3.16
movzx eax, byte [eax + 0x41a818]
jmp dword [eax*4 + 0x41a780]
push str.Ultimate
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Professional
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Home_Premium
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Home_Basic
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Enterprise
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Business
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Starter
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Cluster_Server
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Datacenter
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Datacenter_Edition__core_installation_
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Enterprise_Edition__core_installation_
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Enterprise_Edition_for_Itanium_based_Systems
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Small_Business_Server
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Small_Business_Server_Premium
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Standard
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Standard_Edition__core_installation_
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Web_Server
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x45698c
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456998
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x4569b4
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x4569c4
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Storage_Server_2008_R2_Essentials
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.Hyper___V_Server
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456a50
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456a60
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.IoT_Core
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push str.IoT
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456aa8
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456ab0
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456abc
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456ac8
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456ad4
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456ae0
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456af4
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456b08
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456b24
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x456b3c
mov ecx, 0x46b4dc
call fcn.00405200
jmp 0x41a75b
push 0x100
lea eax, [ebp - 0x190]
mov dword [ebp - 0x2f8], 0
push 0
push eax
call fcn.0042f620
add esp, 0xc
mov dword [ebp - 0x198], 0x100
lea eax, [ebp - 0x2f8]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a75b
push 0x3c
mov ecx, 0x469a38
call fcn.0040df90
mov ecx, eax
call fcn.00409580
lea ecx, [ebp - 0x198]
push ecx
lea ecx, [ebp - 0x190]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x2f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a563
lea eax, [ebp - 0x190]
mov ecx, 0x46b4dc
push eax
call fcn.00405130
cmp dword [0x46c170], 9
jbe 0x41a563
cmp dword [0x46c178], 0x55ef
jbe 0x41a563
push str.Windows_11
push str.Windows_10
lea eax, [ebp - 0x1cc]
push 0x46b4dc
push eax
call fcn.0040c750
add esp, 0x10
lea ecx, [ebp - 0x1cc]
call fcn.004050d0
push dword [ebp - 0x2f8]
call esi
jmp 0x41a75b
xorps xmm0, xmm0
mov dword [ebp - 0x1b8], 0
lea eax, [ebp - 0x1d8]
push eax
movups xmmword [ebp - 0x1d8], xmm0
movups xmmword [ebp - 0x1c8], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x46c170], 5
jne 0x41a6b5
cmp dword [0x46c174], 2
jne 0x41a6b5
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41a5c5
push str.Windows_Server_2003_R2
jmp 0x41a606
mov eax, dword [ebp - 0x1dc]
test eax, 0x2000
je 0x41a5d9
push str.Windows_Storage_Server_2003
jmp 0x41a606
test eax, 0x8000
je 0x41a5e7
push str.Windows_Home_Server
jmp 0x41a606
cmp byte [ebp - 0x1da], 1
jne 0x41a601
cmp word [ebp - 0x1d8], 9
jne 0x41a601
push str.Windows_Professional
jmp 0x41a606
push str.Windows_Server_2003
mov ecx, 0x46b4dc
call fcn.00405130
cmp byte [ebp - 0x1da], 1
je 0x41a6b5
mov ax, word [ebp - 0x1d8]
cmp ax, 6
jne 0x41a646
mov eax, dword [ebp - 0x1dc]
test al, al
jns 0x41a63b
push str.Windows_Datacenter_Edition_for_Itanium_based_Systems
jmp 0x41a6ab
test al, 2
je 0x41a6b5
push str.Windows_Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41a6ab
cmp ax, 9
mov eax, dword [ebp - 0x1dc]
jne 0x41a674
test al, al
jns 0x41a65d
push str.Windows_Datacenter_x64
jmp 0x41a6ab
mov ecx, 0x46b4dc
test al, 2
je 0x41a66d
push str.Windows_Enterprise_x64
jmp 0x41a6b0
push str.Windows_Standard_x64
jmp 0x41a6b0
test eax, 0x4000
je 0x41a682
push str.Windows_Compute_Cluster
jmp 0x41a6ab
test al, al
jns 0x41a68d
push str.Windows_Datacenter
jmp 0x41a6ab
test al, 2
je 0x41a698
push str.Windows_Enterprise
jmp 0x41a6ab
test eax, 0x400
je 0x41a6a6
push str.Windows_Web
jmp 0x41a6ab
push str.Windows_Standard
mov ecx, 0x46b4dc
call fcn.00405130
cmp dword [ebp - 0x2f0], 5
jne 0x41a75b
mov eax, dword [ebp - 0x2ec]
cmp eax, 1
jne 0x41a70d
push str.Windows_XP
mov ecx, 0x46b4dc
call fcn.00405130
test dword [ebp - 0x1dc], 0x200
mov ecx, 0x46b4dc
je 0x41a6f4
push str.Windows_Home
jmp 0x41a6f9
push str.Windows_Professional
call fcn.00405130
cmp dword [ebp - 0x2f0], 5
jne 0x41a75b
mov eax, dword [ebp - 0x2ec]
test eax, eax
jne 0x41a75b
push str.Windows_2000
mov ecx, 0x46b4dc
call fcn.00405130
cmp byte [ebp - 0x1da], 1
jne 0x41a730
push str.Windows_Professional
jmp 0x41a751
mov eax, dword [ebp - 0x1dc]
test al, al
jns 0x41a741
push str.Windows_Datacenter_Server
jmp 0x41a751
test al, 2
je 0x41a74c
push str.Windows_Advanced_Server
jmp 0x41a751
push str.Windows_Server
mov ecx, 0x46b4dc
call fcn.00405130
lea ecx, [ebp - 0x1b0]
call fcn.004050d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d960
mov esp, ebp
pop ebp
ret