Function at 0x4447b0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0234
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x63afd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x178], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xf
mov byte [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x40], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push 0x624308
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x444870
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x160], 0
push ecx
push edi
call eax
test eax, eax
jne 0x444865
mov eax, 2
jmp 0x444870
xor eax, eax
cmp dword [ebp - 0x160], eax
setne al
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
push 0x118
lea eax, [ebp - 0x158]
mov dword [ebp - 0x15c], 0x11c
push 0
push eax
call fcn.0057fb60
add esp, 0xc
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x158]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x154]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x150]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
jne 0x444984
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x174], eax
push ecx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x164], 4
push ecx
push edi
push 0x625dcc
push eax
mov dword [ebp - 0x168], 4
mov dword [ebp - 0x16c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44496d
mov eax, dword [ebp - 0x164]
cmp eax, 4
je 0x44495f
cmp eax, 3
jne 0x44496d
cmp dword [ebp - 0x168], 4
cmove edi, dword [ebp - 0x16c]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x174]
test eax, eax
je 0x444988
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x444988
mov byte [ebp - 4], 1
push dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], edi
call fcn.00444600
mov dword [esi], eax
lea ecx, [ebp - 0x148]
movzx eax, word [ebp - 0x48]
lea edx, [ecx + 2]
mov dword [esi + 0x20], eax
add esp, 4
movzx eax, word [ebp - 0x46]
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4449d0
sub ecx, edx
lea eax, [ebp - 0x148]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00403c20
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00427150
push eax
lea ecx, [esi + 0x28]
call fcn.004077c0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x444a3b
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x444a31
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444ba7
push edx
push ecx
call fcn.0057d721
add esp, 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 1
call fcn.00403bc0
xorps xmm0, xmm0
mov dword [ebp - 0x17c], 0
lea eax, [ebp - 0x19c]
push eax
movups xmmword [ebp - 0x19c], xmm0
movups xmmword [ebp - 0x18c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [ebp - 0x19c]
movzx eax, cx
test eax, eax
je 0x444aab
cmp eax, 6
je 0x444aa2
cmp eax, 9
jne 0x444ab2
mov dword [esi + 0x40], 1
jmp 0x444ab2
mov dword [esi + 0x40], 2
jmp 0x444ab2
mov dword [esi + 0x40], 0
mov eax, dword [ebp - 0x188]
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 0x180]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x158]
cmp eax, 6
je 0x444b1d
cmp eax, 0xa
je 0x444b1d
cmp eax, 5
jne case.0x444b62.2
mov eax, dword [ebp - 0x154]
cmp eax, 2
jne 0x444b0b
cmp byte [ebp - 0x42], 1
jne 0x444af4
cmp cx, 9
je case.0x444b62.1
test dword [ebp - 0x44], 0x8000
jne case.0x444b62.2
mov eax, 2
jmp 0x444b87
cmp eax, 1
jne case.0x444b62.2
mov eax, dword [ebp - 0x44]
not eax
shr eax, 9
and eax, 1
jmp 0x444b87
push str.GetProductInfo
push 0x624308
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x170]
push ecx
push 0
push 0
push dword [ebp - 0x154]
push dword [ebp - 0x158]
call eax
mov eax, dword [ebp - 0x170]
dec eax
cmp eax, 0x81
ja case.0x444b62.2
movzx eax, byte [eax + 0x444bc4]
jmp dword [eax*4 + 0x444bac]
mov eax, 2
jmp 0x444b87
mov eax, 1
jmp 0x444b87
mov eax, 3
jmp 0x444b87
mov eax, 4
jmp 0x444b87
xor eax, eax
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057d277
mov esp, ebp
pop ebp
ret
call fcn.005875f7
jo 0x444bf9
inc esp
add byte [ebp + 0x7700444b], al
dec ebx
inc esp
add byte [ecx + 0x4b], ch
inc esp
add byte [esi + 0x4b], bh
inc esp
add byte [ebp + 0x444b], al
add dword [ecx], eax
add al, byte [50529026]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [84215045]
add eax, 84018435
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 328965
add eax, 84215045
add eax, 0x5050505
add eax, 84215045
add eax, 84215045
add eax, 84018434
add eax, 84215045
add eax, 84215045
add al, byte [84215045]
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84214788
add al, byte [edx]
add eax, -872283643
int3