Function at 0x494d70
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0xb0
mov eax, dword [0x670f1c]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x19c]
push 0x507d72
mov ecx, ebp
mov dword [esp + 0x18], ebp
call fcn.00410c90
lea ecx, [esi + 0x1a0]
push 0x507d73
call fcn.00410c90
xor eax, eax
push 0x11c
push eax
lea edi, [esi + 0x58]
push edi
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x198], eax
call fcn.004c16f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
push edi
mov dword [edi], 0x11c
call ebx
test eax, eax
mov dword [esi + 0x1a4], eax
jne 0x493aed
push edi
mov dword [edi], 0x114
call ebx
test eax, eax
jne 0x493aed
xor al, al
jmp 0x494143
push 0x50847c
push 0x508490
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
lea edi, [esi + 0x174]
push edi
je 0x493b13
call eax
jmp 0x493b19
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x68]
sub eax, 0
mov ecx, 1
je 0x494051
sub eax, ecx
je 0x493fe6
sub eax, ecx
jne 0x49405b
mov eax, dword [esi + 0x5c]
cmp eax, 7
lea edx, [ecx + 0x11]
lea ebp, [ecx + 0x12]
lea ebx, [ecx + 1]
jb 0x493b5a
mov dword [esi + 0x198], 0x34
jmp 0x493c0c
cmp eax, 6
jne 0x493ba8
cmp dword [esi + 0x60], ecx
jb 0x493b82
mov cl, byte [esi + 0x172]
sub cl, 1
neg cl
sbb ecx, ecx
and ecx, 0xfffffff2
add ecx, 0x34
mov dword [esi + 0x198], ecx
jmp 0x493c0c
cmp eax, 6
jne 0x493ba8
cmp dword [esi + 0x60], 0
jne 0x493ba8
mov cl, byte [esi + 0x172]
sub cl, 1
neg cl
sbb ecx, ecx
and ecx, 9
add ecx, 0x1d
mov dword [esi + 0x198], ecx
jmp 0x493c0c
cmp eax, 5
jne 0x493bfd
cmp dword [esi + 0x60], ebx
jne 0x493bd0
cmp byte [esi + 0x172], cl
jne 0x493bc8
cmp word [edi], 9
jne 0x493bc8
mov dword [esi + 0x198], edx
jmp 0x493c0c
mov dword [esi + 0x198], ebp
jmp 0x493c0c
cmp eax, 5
jne 0x493bfd
cmp dword [esi + 0x60], ecx
jne 0x493be6
mov dword [esi + 0x198], 0x10
jmp 0x493c0c
cmp eax, 5
jne 0x493bfd
cmp dword [esi + 0x60], 0
jne 0x493bfd
mov dword [esi + 0x198], 0xb
jmp 0x493c0c
cmp eax, 4
ja 0x493c0c
mov dword [esi + 0x198], 6
cmp dword [esi + 0x1a4], 0
je 0x493e12
mov cl, byte [esi + 0x172]
cmp cl, 1
jne 0x493cb6
sub eax, 4
je 0x493ca7
sub eax, 1
je 0x493c59
sub eax, 1
jne 0x493f2f
test word [esi + 0x170], 0x200
je 0x493f2f
mov dword [esi + 0x198], 0x22
jmp 0x493f2f
test word [esi + 0x170], 0x200
je 0x493c7d
cmp dword [esi + 0x60], 1
jne 0x493f2f
mov dword [esi + 0x198], 0x11
jmp 0x493f2f
mov eax, dword [esi + 0x60]
cmp eax, 1
jne 0x493c90
mov dword [esi + 0x198], edx
jmp 0x493f2f
test eax, eax
jne 0x493f2f
mov dword [esi + 0x198], 0xc
jmp 0x493f2f
mov dword [esi + 0x198], 8
jmp 0x493f2f
cmp cl, 3
je 0x493cc3
cmp cl, bl
jne 0x493f2f
cmp eax, 6
jne 0x493cfe
cmp dword [esi + 0x60], 0
jne 0x493cfe
movzx eax, word [esi + 0x170]
test al, al
jns 0x493ce8
mov dword [esi + 0x198], 0x2c
jmp 0x493f2f
and al, bl
neg al
sbb eax, eax
and eax, ebx
add eax, 0x26
mov dword [esi + 0x198], eax
jmp 0x493f2f
cmp eax, 5
jne 0x493df6
cmp dword [esi + 0x60], ebx
jne 0x493dbe
movzx eax, word [edi]
cmp ax, 6
jne 0x493d49
movzx eax, word [esi + 0x170]
test al, al
jns 0x493d33
mov dword [esi + 0x198], 0x19
jmp 0x493f2f
and al, bl
neg al
sbb eax, eax
neg eax
add eax, 0x17
mov dword [esi + 0x198], eax
jmp 0x493f2f
cmp ax, 9
movzx eax, word [esi + 0x170]
jne 0x493d7e
test al, al
jns 0x493d69
mov dword [esi + 0x198], 0x1c
jmp 0x493f2f
movzx edx, al
and edx, ebx
or edx, 0x34
shr edx, 1
mov dword [esi + 0x198], edx
jmp 0x493f2f
test al, al
jns 0x493d91
mov dword [esi + 0x198], 0x15
jmp 0x493f2f
test bl, al
je 0x493da4
mov dword [esi + 0x198], 0x14
jmp 0x493f2f
sub ax, 0x400
neg ax
sbb eax, eax
and eax, 0xfffffffd
add eax, 0x16
mov dword [esi + 0x198], eax
jmp 0x493f2f
cmp eax, 5
jne 0x493df6
cmp dword [esi + 0x60], 0
jne 0x493df6
movzx eax, word [esi + 0x170]
test al, al
jns 0x493de3
mov dword [esi + 0x198], 0xe
jmp 0x493f2f
movzx eax, al
and eax, ebx
or eax, 0xd
mov dword [esi + 0x198], eax
jmp 0x493f2f
mov cl, byte [esi + 0x170]
and cl, bl
neg cl
sbb ecx, ecx
neg ecx
add ecx, 9
mov dword [esi + 0x198], ecx
jmp 0x493f2f
lea edx, [esp + 0x10]
push edx
push 1
push 0
push 0x5084b0
mov edi, 0x50
push 0x80000002
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493ae6
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0x508510
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x493ae6
cmp dword [esp + 0x18], edi
ja 0x493ae6
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea ecx, [esp + 0x1c]
push ecx
push 0x508528
call edi
test eax, eax
jne 0x493e9d
cmp dword [esi + 0x5c], 4
ja 0x493e9d
mov dword [esi + 0x198], 8
lea edx, [esp + 0x1c]
push edx
push 0x508534
call edi
test eax, eax
jne 0x493ee4
mov eax, dword [esi + 0x5c]
cmp eax, 5
jne 0x493ed5
cmp dword [esi + 0x60], ebx
jne 0x493ec0
mov dword [esi + 0x198], ebp
cmp eax, 5
jne 0x493ed5
cmp dword [esi + 0x60], 0
jne 0x493ed5
mov dword [esi + 0x198], 0xd
cmp eax, 4
ja 0x493ee4
mov dword [esi + 0x198], 9
lea eax, [esp + 0x1c]
push eax
push 0x508548
call edi
test eax, eax
jne 0x493f2f
mov eax, dword [esi + 0x5c]
cmp eax, 5
jne 0x493f20
cmp dword [esi + 0x60], ebx
jne 0x493f0b
mov dword [esi + 0x198], 0x14
cmp eax, 5
jne 0x493f20
cmp dword [esi + 0x60], 0
jne 0x493f20
mov dword [esi + 0x198], 0xf
cmp eax, 4
ja 0x493f2f
mov dword [esi + 0x198], 0xa
cmp dword [esi + 0x5c], 4
jne 0x493fc3
push 0x50855c
lea edi, [esi + 0x6c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x493fc3
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push 0x508568
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x493f95
movzx edx, word [esi + 0x64]
push edx
lea eax, [esi + 0x1a0]
push 0x5085e0
push eax
call fcn.00406da0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x14]
jmp 0x49405b
movzx eax, word [esi + 0x64]
push eax
push edi
lea eax, [esi + 0x1a0]
push 0x508604
push eax
call fcn.00406da0
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x14]
jmp 0x49405b
movzx edx, word [esi + 0x64]
push edx
lea eax, [esi + 0x6c]
push eax
lea eax, [esi + 0x1a0]
push 0x508620
push eax
call fcn.00406da0
mov ebp, dword [esp + 0x24]
add esp, 0x10
jmp 0x49405b
mov ecx, dword [esi + 0x5c]
cmp ecx, 4
jne 0x49405b
cmp dword [esi + 0x60], 0
jne 0x494018
movzx eax, word [esi + 0x6e]
cmp ax, 0x43
mov dword [esi + 0x198], 1
je 0x49400e
cmp ax, 0x42
jne 0x494018
mov dword [esi + 0x198], 2
cmp ecx, 4
jne 0x49405b
cmp dword [esi + 0x60], 0xa
jne 0x49403a
cmp word [esi + 0x6e], 0x41
mov dword [esi + 0x198], 3
jne 0x49403a
mov dword [esi + 0x198], ecx
cmp ecx, 4
jne 0x49405b
cmp dword [esi + 0x60], 0x5a
jne 0x49405b
mov dword [esi + 0x198], 5
jmp 0x49405b
mov dword [esi + 0x198], 0x33
mov esi, dword [esi + 0x198]
lea eax, [esi - 1]
cmp eax, 0x33
ja case.0x494074.6
movzx ecx, byte [eax + 0x4941c0]
jmp dword [ecx*4 + 0x49415c]
push 0x50863c
jmp 0x49413a
push 0x508648
jmp 0x49413a
push 0x508654
jmp 0x49413a
push 0x508668
jmp 0x49413a
push 0x508678
jmp 0x49413a
push 0x508688
jmp 0x49413a
push 0x508698
jmp 0x49413a
push 0x5086a4
jmp 0x49413a
push 0x5086b4
jmp 0x49413a
push 0x5086c4
jmp 0x49413a
push 0x5086d8
jmp 0x49413a
push 0x5086fc
jmp 0x49413a
push 0x50871c
jmp 0x49413a
push 0x50872c
jmp 0x49413a
push 0x508744
jmp 0x49413a
push 0x50875c
jmp 0x49413a
push 0x508774
jmp 0x49413a
push 0x508790
jmp 0x49413a
push 0x5087a4
jmp 0x49413a
push 0x5087bc
jmp 0x49413a
push 0x5087d8
jmp 0x49413a
push 0x5087f0
jmp 0x49413a
push 0x508804
jmp 0x49413a
push 0x508818
jmp 0x49413a
push 0x508824
mov ecx, ebp
call fcn.00410c90
mov al, 1
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bfdfd
add esp, 0xb0
ret
push esi
mov esi, ecx
call 0x494740
mov ecx, esi
call fcn.00493940
mov ecx, esi
pop esi
jmp 0x493a60