Function at 0x409850
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x0045f6c0]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor eax, eax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x9c
xor edi, edi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.004255a0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ebx, eax
jne 0x4098df
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4098df
xor eax, eax
jmp 0x409fbd
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40990a
lea rcx, [rsp + 0x40]
call rax
jmp 0x409915
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x409faf
sub eax, 1
je 0x409f3f
sub eax, 1
jne 0x409fbb
cmp dword [rsp + 0x74], 6
jne 0x409a85
cmp dword [rsp + 0x78], 2
jne 0x4099ac
cmp byte [rsp + 0x10a], 1
lea edi, [rax + 6]
mov rax, qword [rsp + 0x40]
jne 0x40997b
cmp ax, 9
jne 0x40997b
lea rcx, str.Windows_8_x64_n
mov dword [0x00454010], 9
call fcn.00404a90
jmp 0x409b97
test ax, ax
jne 0x40999b
lea rcx, str.Windows_8_x86_n
mov dword [0x00454010], 8
call fcn.00404a90
jmp 0x409b97
lea rcx, str.Get_System_Architecture_Err_n
call fcn.00404a90
jmp 0x409b97
cmp dword [rsp + 0x78], 1
jne 0x409a15
cmp byte [rsp + 0x10a], 1
mov edi, 6
jne 0x409a04
mov rax, qword [rsp + 0x40]
cmp ax, 9
jne 0x4099e8
lea rcx, str.Win7_x64_n
mov dword [0x00454010], 7
call fcn.00404a90
jmp 0x409b97
test ax, ax
jne 0x409a04
lea rcx, str.Win7_x86_n
mov dword [0x00454010], edi
call fcn.00404a90
jmp 0x409b97
lea rcx, str.Get_System_Architecture_Err_n
call fcn.00404a90
jmp 0x409b97
cmp dword [rsp + 0x78], edi
jne 0x409b97
cmp byte [rsp + 0x10a], 1
mov edi, 6
jne 0x409a74
mov rax, qword [rsp + 0x40]
cmp ax, 9
jne 0x409a54
lea rcx, str.Windows_Vista_x64_n
mov dword [0x00454010], 5
call fcn.00404a90
jmp 0x409b97
test ax, ax
jne 0x409a74
lea rcx, str.Windows_Vista_x86_n
mov dword [0x00454010], 4
call fcn.00404a90
jmp 0x409b97
lea rcx, str.Get_System_Architecture_Err_n
call fcn.00404a90
jmp 0x409b97
cmp dword [rsp + 0x74], 5
jne 0x409b75
cmp dword [rsp + 0x78], 2
jne 0x409aee
mov edi, 5
lea ecx, [rdi + 0x54]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x409aba
lea rcx, str.Microsoft_Windows_Server_2003__R2__n
call fcn.00404a90
jmp 0x409b97
cmp byte [rsp + 0x10a], 1
jne 0x409add
cmp word [rsp + 0x40], 9
jne 0x409add
lea rcx, str.Microsoft_Windows_XP_Professional_x64_Edition_n
call fcn.00404a90
jmp 0x409b97
lea rcx, str.Microsoft_Windows_Server_2003_n
call fcn.00404a90
jmp 0x409b97
cmp dword [rsp + 0x78], 1
jne 0x409b52
cmp byte [rsp + 0x10a], 1
mov edi, 5
jne 0x409b44
mov rax, qword [rsp + 0x40]
cmp ax, 9
jne 0x409b27
lea rcx, str.Microsoft_Windows_XP_x64_n
mov dword [0x00454010], 3
call fcn.00404a90
jmp 0x409b97
test ax, ax
jne 0x409b44
lea rcx, str.Microsoft_Windows_XP_x86_n
mov dword [0x00454010], 2
call fcn.00404a90
jmp 0x409b97
lea rcx, str.Get_System_Architecture_Err_n
call fcn.00404a90
jmp 0x409b97
cmp dword [rsp + 0x78], edi
jne 0x409b97
lea rcx, str.Microsoft_Windows_2000_n
mov edi, 5
mov dword [0x00454010], 1
call fcn.00404a90
jmp 0x409b97
cmp dword [rsp + 0x74], 4
ja 0x409b97
lea rcx, str.Microsoft_Windows_NT_n
mov edi, 4
mov dword [0x00454010], 0
call fcn.00404a90
test ebx, ebx
je 0x409d7f
movzx eax, byte [rsp + 0x10a]
cmp al, 1
jne 0x409bfd
cmp word [rsp + 0x40], 9
je 0x409e89
cmp dword [rsp + 0x74], 4
jne 0x409bcf
lea rcx, str.Workstation_4.0_n
call fcn.00404a90
jmp 0x409e89
bt word [rsp + 0x108], 9
jae 0x409bec
lea rcx, str.Home_Edition_n
call fcn.00404a90
jmp 0x409e89
lea rcx, str.Professional_n
call fcn.00404a90
jmp 0x409e89
cmp al, 3
je 0x409c09
cmp al, 2
jne 0x409e89
cmp dword [rsp + 0x74], 5
jne 0x409d53
cmp dword [rsp + 0x78], 2
jne 0x409d09
mov rax, qword [rsp + 0x40]
cmp ax, 6
jne 0x409c60
movzx eax, byte [rsp + 0x108]
test al, al
jns 0x409c47
lea rcx, str.Datacenter_Edition_for_Itanium_based_Systems_n
call fcn.00404a90
jmp 0x409e89
test al, 2
je 0x409f23
lea rcx, str.Enterprise_Edition_for_Itanium_based_Systems_n
call fcn.00404a90
jmp 0x409e89
cmp ax, 9
jne 0x409ca9
movzx eax, byte [rsp + 0x108]
test al, al
jns 0x409c83
lea rcx, str.Datacenter_x64_Edition_n
call fcn.00404a90
jmp 0x409e89
test al, 2
je 0x409c98
lea rcx, str.Enterprise_x64_Edition_n
call fcn.00404a90
jmp 0x409e89
lea rcx, str.Standard_x64_Edition_n
call fcn.00404a90
jmp 0x409e89
movzx eax, byte [rsp + 0x108]
test al, al
jns 0x409cc6
lea rcx, str.Datacenter_Edition_n
call fcn.00404a90
jmp 0x409e89
test al, 2
je 0x409cdb
lea rcx, str.Enterprise_Edition_n
call fcn.00404a90
jmp 0x409e89
bt word [rsp + 0x108], 0xa
jae 0x409cf8
lea rcx, str.Web_Edition_n
call fcn.00404a90
jmp 0x409e89
lea rcx, str.Standard_Edition_n
call fcn.00404a90
jmp 0x409e89
cmp dword [rsp + 0x78], 0
jne 0x409d53
movzx eax, byte [rsp + 0x108]
test al, al
jns 0x409d2d
lea rcx, str.Datacenter_Server_n
call fcn.00404a90
jmp 0x409e89
test al, 2
je 0x409d42
lea rcx, str.Advanced_Server_n
call fcn.00404a90
jmp 0x409e89
lea rcx, str.Server_n
call fcn.00404a90
jmp 0x409e89
test byte [rsp + 0x108], 2
je 0x409d6e
lea rcx, str.Server_4.0__Enterprise_Edition_n
call fcn.00404a90
jmp 0x409e89
lea rcx, str.Server_4.0_n
call fcn.00404a90
jmp 0x409e89
lea rax, [rsp + 0x38]
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 0x50
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4098d8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ProductType
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4098d8
cmp dword [rsp + 0x30], 0x50
ja 0x4098d8
lea rdx, [rsp + 0x110]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409e2a
lea rcx, str.Workstation_n
call fcn.00404a90
lea rdx, [rsp + 0x110]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409e4f
lea rcx, str.Server_n
call fcn.00404a90
lea rdx, [rsp + 0x110]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409e74
lea rcx, str.Advanced_Server_n
call fcn.00404a90
mov r8d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x74]
lea rcx, str._d._d
call fcn.00404a90
cmp dword [rsp + 0x74], 4
jne 0x409f23
lea rdx, str.Service_Pack_6
lea rcx, [rsp + 0x84]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409f23
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409ef9
movzx edx, word [rsp + 0x7c]
lea rcx, str.Service_Pack_6a__Build__d__n
call fcn.00404a90
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409fbb
movzx r8d, word [rsp + 0x7c]
lea rdx, [rsp + 0x84]
lea rcx, str._s__Build__d__n
call fcn.00404a90
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409fbb
movzx r8d, word [rsp + 0x7c]
lea rdx, [rsp + 0x84]
lea rcx, str._s__Build__d__n
call fcn.00404a90
jmp 0x409fbb
cmp dword [rsp + 0x74], 4
jne 0x409fbb
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x409f75
movzx eax, byte [rsp + 0x85]
cmp al, 0x43
je 0x409f5e
cmp al, 0x42
jne 0x409fbb
lea rcx, str.Microsoft_Windows_95_OSR2_n
call fcn.00404a90
cmp dword [rsp + 0x74], 4
jne 0x409fbb
mov eax, dword [rsp + 0x78]
cmp eax, 0xa
jne 0x409fa1
movzx eax, byte [rsp + 0x85]
cmp al, 0x41
je 0x409f8a
cmp al, 0x42
jne 0x409fbb
lea rcx, str.Microsoft_Windows_98_SE_n
call fcn.00404a90
cmp dword [rsp + 0x74], 4
jne 0x409fbb
mov eax, dword [rsp + 0x78]
cmp eax, 0x5a
jne 0x409fbb
lea rcx, str.Microsoft_Windows_Millennium_Edition_n
jmp 0x409fb6
lea rcx, str.Microsoft_Win32s_n
call fcn.00404a90
mov eax, edi
mov rdi, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.00425570
add rsp, 0x178
ret