Function at 0x5bc480
Capabilities:
Check os version
Identify system language via api
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6b4c06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
mov eax, dword [0x70e4ec]
xor eax, ebp
push ebx
push edi
mov dword [esp + 0x144], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x54], 0x9c
call edi
mov ebx, eax
test ebx, ebx
jne 0x5bc50f
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x54], 0x94
call edi
test eax, eax
jne 0x5bc50f
push 0x19b
push str.D:ENGLISHCoreLibsgsCommongsSystem.cpp
push str.gs_Interior::QueryOSInfo
push 0x10022
call fcn.005be960
add esp, 0x10
xor al, al
jmp 0x5bca14
movzx edi, word [esp + 0xe4]
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov dword [esi + 0x114], edi
movzx edi, word [esp + 0xe6]
mov dword [esi + 0x118], edi
movzx edi, word [esp + 0xe8]
mov dword [esi + 0x11c], edi
movzx edi, byte [esp + 0xea]
mov dword [esi + 0x10c], eax
mov eax, dword [esp + 0x60]
mov dword [esi + 0x120], edi
xor edi, edi
mov dword [esi + 0x104], edx
mov dword [esi + 0x108], ecx
mov dword [esi + 0x110], eax
mov word [esi + 0x124], di
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], edi
mov byte [esp + 0x38], 0
sub eax, edi
mov dword [esp + 0x154], edi
mov dword [esp + 0xc], edi
je 0x5bc98c
dec eax
je 0x5bc870
dec eax
je 0x5bc5b2
push 0x16
push str.Unknown_Window_System
jmp 0x5bc993
cmp edx, 5
jne 0x5bc5e0
cmp ecx, edi
jne 0x5bc5cb
push str.Microsoft_Windows_2000
lea ecx, [esp + 0x38]
call fcn.0040aef0
jmp 0x5bc5f0
cmp ecx, 1
jne 0x5bc5e0
push str.Microsoft_Windows_XP
lea ecx, [esp + 0x38]
call fcn.0040aef0
jmp 0x5bc5f0
push 0x15
push str.Microsoft_Windows_NT
lea ecx, [esp + 0x3c]
call fcn.00405710
cmp ebx, edi
je 0x5bc67c
mov al, byte [esp + 0xea]
cmp al, 1
jne 0x5bc627
mov eax, dword [esp + 0xe8]
test ah, 2
lea ecx, [esp + 0x34]
je 0x5bc61d
push str.Personal
jmp 0x5bc74c
push str.Professional
jmp 0x5bc74c
cmp al, 3
jne 0x5bc751
cmp dword [esp + 0x54], 5
jne 0x5bc64b
cmp dword [esp + 0x58], 1
jne 0x5bc64b
push str.Microsoft_Windows.NET
lea ecx, [esp + 0x38]
call fcn.0040aef0
mov al, byte [esp + 0xe8]
test al, al
jns 0x5bc660
push str.DataCenter_Server
jmp 0x5bc748
test al, 2
lea ecx, [esp + 0x34]
je 0x5bc672
push str.Advanced_Server
jmp 0x5bc74c
push str.Server
jmp 0x5bc74c
lea ecx, [esp + 8]
push ecx
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.ijl15.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xf4]
push eax
push edi
push edi
push str.ProductType
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [esp + 0xf0]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x5bc6e5
push str.Professional
lea ecx, [esp + 0x38]
call fcn.005b8f50
lea ecx, [esp + 0xf0]
push ecx
push str.LANMANNT
call edi
test eax, eax
jne 0x5bc71b
cmp dword [esp + 0x54], 5
jne 0x5bc70d
cmp dword [esp + 0x58], 1
jne 0x5bc70d
push str.Standard_Server
jmp 0x5bc712
push str.Server
lea ecx, [esp + 0x38]
call fcn.005b8f50
lea edx, [esp + 0xf0]
push edx
push str.SERVERNT
call edi
test eax, eax
jne 0x5bc751
cmp dword [esp + 0x54], 5
jne 0x5bc743
cmp dword [esp + 0x58], 1
jne 0x5bc743
push str.Enterprise_Server
jmp 0x5bc748
push str.Advanced_Server
lea ecx, [esp + 0x38]
call fcn.005b8f50
mov eax, dword [esp + 0x4c]
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x38]
jae 0x5bc766
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x5c]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esp + 0x68]
push edx
mov edx, dword [esp + 0x5c]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
push str._sVersion__d._d__s__Build__d_
push eax
call fcn.005bf5d0
add esp, 0x1c
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x160], 1
call fcn.00405620
cmp dword [esp + 0x30], edi
mov byte [esp + 0x154], 0
jb 0x5bc7c4
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.005cc620
add esp, 4
cmp dword [esp + 0x54], 5
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
jne 0x5bc84b
cmp dword [esp + 0x58], 1
jne 0x5bc84d
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x5bc829
push str.IsWow64Process
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5bc81a
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
jmp 0x5bc822
mov dword [esp + 0xc], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
test eax, eax
lea ecx, [esp + 0x34]
je 0x5bc83c
push str.64_Bit
jmp 0x5bc841
push str.32_Bit
call fcn.005b8f50
cmp dword [esp + 0x54], 5
jb 0x5bc85f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [esi + 0x124], ax
jmp 0x5bc99c
call fcn.005bbcf0
mov word [esi + 0x124], ax
jmp 0x5bc99c
cmp edx, 4
jne 0x5bc8f2
cmp ecx, edi
jne 0x5bc8b3
push str.Microsoft_Windows_95
lea ecx, [esp + 0x38]
call fcn.0040aef0
mov al, byte [esp + 0x65]
cmp al, 0x43
jne 0x5bc89f
push str.OSR_2.5
lea ecx, [esp + 0x38]
call fcn.005b8f50
jmp 0x5bc902
cmp al, 0x42
jne 0x5bc902
push str.OSR_2
lea ecx, [esp + 0x38]
call fcn.005b8f50
jmp 0x5bc902
cmp ecx, 0xa
jne 0x5bc8dd
push str.Microsoft_Windows_98
lea ecx, [esp + 0x38]
call fcn.0040aef0
cmp byte [esp + 0x65], 0x41
jne 0x5bc902
push 0x6cfc5c
lea ecx, [esp + 0x38]
call fcn.005b8f50
jmp 0x5bc902
cmp ecx, 0x5a
jne 0x5bc8f2
push str.Microsoft_Windows_Me
lea ecx, [esp + 0x38]
call fcn.0040aef0
jmp 0x5bc902
push 0x12
push str.Microsoft_Windows
lea ecx, [esp + 0x3c]
call fcn.00405710
lea eax, [esp + 8]
push eax
push 1
push edi
push str.DefaultControl_PanelDesktopResourceLocale
push Ordinal_3
mov dword [esp + 0x24], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5bc99c
mov edx, dword [esp + 8]
push edi
push edi
lea ecx, [esp + 0x1c]
push ecx
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
call edi
test eax, eax
jne 0x5bc97f
cmp dword [esp + 0x14], 1
jne 0x5bc97f
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xf4]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push eax
call edi
test eax, eax
jne 0x5bc97f
lea ecx, [esp + 0xf0]
push ecx
call fcn.005cd365
add esp, 4
mov word [esi + 0x124], ax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5bc99c
push 0x16
push str.Microsoft_Windows_3.1
lea ecx, [esp + 0x3c]
call fcn.00405710
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0x38]
test ecx, ecx
setne al
mov byte [esi + 0x126], al
cmp dword [esp + 0x4c], 0x10
jae 0x5bc9ba
lea ebx, [esp + 0x38]
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5bc9c0
sub eax, edx
mov edi, eax
cmp edi, 0x104
jbe 0x5bc9d8
mov edi, 0x104
push edi
push ebx
push esi
call fcn.005cd0f0
add esp, 0xc
mov byte [edi + esi], 0
cmp word [esi + 0x124], 0
jne 0x5bc9fe
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [esi + 0x124], ax
cmp dword [esp + 0x4c], 0x10
jb 0x5bca12
mov ecx, dword [esp + 0x38]
push ecx
call fcn.005cc620
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x14c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x144]
pop edi
xor ecx, ebp
pop ebx
call fcn.005d0efa
mov esp, ebp
pop ebp
ret