Function at 0x41b0ec
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0x158
mov byte [esp + 0x14f], 1
mov dword [esp + 0x80], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 8], 0x9c
mov dword [esp + 4], 0
lea eax, [esp + 0xa8]
mov dword [esp], eax
call fcn.0041a59f
mov dword [esp + 0xa8], 0x9c
lea eax, [esp + 0xa8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
setne al
mov byte [esp + 0x14e], al
movzx eax, byte [esp + 0x14e]
xor eax, 1
test al, al
je 0x41b18e
mov dword [esp + 0xa8], 0x94
lea eax, [esp + 0xa8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
sete al
mov byte [esp + 0x14f], al
movzx eax, byte [esp + 0x14f]
xor eax, 1
test al, al
je 0x41b1a7
mov eax, 0
jmp 0x41b662
mov dword [esp], str.Ed5LC542dMZ65dlXR8W
call fcn.0040b60e
mov ebx, eax
mov dword [esp], str.wd0RdiNh.Sii
call fcn.0040b60e
mov dword [esp], eax
call fcn.0040b4e9
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0040b4ff
mov dword [esp + 0x148], eax
cmp dword [esp + 0x148], 0
je 0x41b1fe
lea eax, [esp + 0x84]
mov dword [esp], eax
mov eax, dword [esp + 0x148]
call eax
sub esp, 4
jmp 0x41b210
lea eax, [esp + 0x84]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
cmp byte [esp + 0x14e], 0
je 0x41b4d7
mov eax, dword [esp + 0xb8]
cmp eax, 1
je 0x41b247
cmp eax, 1
jb 0x41b23d
cmp eax, 2
je 0x41b2c9
jmp 0x41b65d
mov eax, 1
jmp 0x41b662
mov eax, dword [esp + 0xac]
cmp eax, 4
je 0x41b258
jmp 0x41b65d
mov eax, dword [esp + 0xb0]
cmp eax, 0xa
je 0x41b29f
cmp eax, 0x5a
je 0x41b2bf
test eax, eax
je 0x41b273
nop
jmp 0x41b65d
movzx eax, byte [esp + 0xbc]
cmp al, 0x42
je 0x41b28b
movzx eax, byte [esp + 0xbc]
cmp al, 0x43
jne 0x41b295
mov eax, 3
jmp 0x41b662
mov eax, 0x400
jmp 0x41b662
movzx eax, byte [esp + 0xbc]
cmp al, 0x41
jne 0x41b2b5
mov eax, 5
jmp 0x41b662
mov eax, 0x410
jmp 0x41b662
mov eax, 6
jmp 0x41b662
mov eax, dword [esp + 0xac]
cmp eax, 4
je 0x41b2ed
cmp eax, 5
je 0x41b31b
cmp eax, 3
jne 0x41b3aa
mov eax, 7
jmp 0x41b662
movzx eax, byte [esp + 0x142]
movzx eax, al
cmp eax, 1
je 0x41b307
cmp eax, 3
je 0x41b311
jmp 0x41b3aa
mov eax, 8
jmp 0x41b662
mov eax, 9
jmp 0x41b662
mov eax, dword [esp + 0xb0]
cmp eax, 1
je 0x41b33d
cmp eax, 1
jb 0x41b333
cmp eax, 2
je 0x41b347
jmp 0x41b3aa
mov eax, 0x500
jmp 0x41b662
mov eax, 0x501
jmp 0x41b662
movzx eax, word [esp + 0x140]
cmp ax, 0x8000
jne 0x41b35f
mov eax, 0xd
jmp 0x41b662
movzx eax, byte [esp + 0x142]
cmp al, 1
jne 0x41b383
movzx eax, word [esp + 0x84]
cmp ax, 9
jne 0x41b383
mov eax, 0xc
jmp 0x41b662
mov dword [esp], 0x59
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
test eax, eax
jne 0x41b3a0
mov eax, 0xe
jmp 0x41b662
mov eax, 0xf
jmp 0x41b662
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
lea eax, [esp + 0x80]
mov dword [esp], eax
call fcn.0041b081
test al, al
je 0x41b47c
mov eax, dword [esp + 0x80]
cmp eax, 6
jne 0x41b47c
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x41b401
movzx eax, byte [esp + 0x142]
cmp al, 1
jne 0x41b3f7
mov eax, 0x600
jmp 0x41b662
mov eax, 0x11
jmp 0x41b662
mov eax, dword [esp + 0x7c]
cmp eax, 1
jne 0x41b42a
movzx eax, byte [esp + 0x142]
cmp al, 1
jne 0x41b420
mov eax, 0x12
jmp 0x41b662
mov eax, 0x13
jmp 0x41b662
mov eax, dword [esp + 0x7c]
cmp eax, 2
jne 0x41b453
movzx eax, byte [esp + 0x142]
cmp al, 1
jne 0x41b449
mov eax, 0x14
jmp 0x41b662
mov eax, 0x16
jmp 0x41b662
mov eax, dword [esp + 0x7c]
cmp eax, 3
jne 0x41b47c
movzx eax, byte [esp + 0x142]
cmp al, 1
jne 0x41b472
mov eax, 0x15
jmp 0x41b662
mov eax, 0x18
jmp 0x41b662
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
lea eax, [esp + 0x80]
mov dword [esp], eax
call fcn.0041b081
test al, al
je 0x41b65c
mov eax, dword [esp + 0x80]
cmp eax, 0xa
jne 0x41b65c
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x41b65c
movzx eax, byte [esp + 0x142]
cmp al, 1
jne 0x41b4cd
mov eax, 0x17
jmp 0x41b662
mov eax, 0x19
jmp 0x41b662
mov dword [esp + 0x74], 0x50
mov dword [esp], str.MvMqjFPQ00dR5PWR50WiMd5PWR50Wi90WSQY5Ts54WR6
call fcn.0040b60e
lea edx, [esp + 0x78]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x41b58c
mov dword [esp], str.90WSQY5qZsd
call fcn.0040b60e
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x74]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [esp + 0x144], eax
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp dword [esp + 0x144], 0
jne 0x41b582
mov eax, dword [esp + 0x74]
cmp eax, 0x50
jbe 0x41b596
mov eax, 0
jmp 0x41b662
mov eax, 0
jmp 0x41b662
mov dword [esp], str.UXLLq
call fcn.0040b60e
lea edx, [esp + 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041a1d8
test eax, eax
jne 0x41b5cc
mov eax, dword [esp + 0xac]
cmp eax, 4
ja 0x41b5cc
mov eax, 8
jmp 0x41b662
mov dword [esp], str.mDLFDLLq
call fcn.0040b60e
lea edx, [esp + 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041a1d8
test eax, eax
je 0x41b60c
mov dword [esp], str.MjrzjrLq
call fcn.0040b60e
lea edx, [esp + 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0041a1d8
test eax, eax
jne 0x41b65d
mov eax, dword [esp + 0xac]
cmp eax, 5
jne 0x41b62b
mov eax, dword [esp + 0xb0]
cmp eax, 2
jne 0x41b62b
mov eax, 0xe
jmp 0x41b662
mov eax, dword [esp + 0xac]
cmp eax, 5
jne 0x41b649
mov eax, dword [esp + 0xb0]
test eax, eax
jne 0x41b649
mov eax, 0x500
jmp 0x41b662
mov eax, dword [esp + 0xac]
cmp eax, 4
ja 0x41b65d
mov eax, 8
jmp 0x41b662
nop
mov eax, 0
add esp, 0x158
pop ebx
ret