Function at 0x456230
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [0x597010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.0052c210
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x160], 0
lea eax, [ebp - 0x160]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.005283f4
add esp, 4
mov dword [ebp - 0x170], eax
mov esi, eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x178], eax
mov eax, dword [0x59b038]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x59cb90]
cmp ecx, dword [eax + 4]
jg 0x456905
mov dword [esi], 0
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
movaps xmm0, xmmword [0x580ae0]
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0x50], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x180], eax
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x168], eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x174], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x15c], 0
lea edi, [ebp - 0x15c]
push edi
push 1
push 0
push 0x580b00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4563ab
mov dword [ebp - 0x16c], 0
xor ecx, ecx
xor eax, eax
jmp 0x45647a
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x15c], 4
mov dword [ebp - 0x134], 4
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x138]
push ecx
push edx
push edi
push 0
push 0x580b5a
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x456427
mov eax, dword [ebp - 0x15c]
add eax, 0xfffffffd
xor edx, edx
cmp dword [ebp - 0x134], 4
mov ecx, 0
jne 0x456421
mov ecx, dword [ebp - 0x138]
cmp eax, 2
cmovb edx, ecx
mov dword [ebp - 0x16c], edx
lea ebx, [ebp - 0x144]
lea ecx, [ebp - 0x150]
push ebx
push str.DisplayVersion
call fcn.00456c00
movzx eax, byte [ebp - 0x139]
test al, al
mov ecx, dword [ebp - 0x140]
mov edx, eax
cmovs edx, ecx
test edx, edx
jne 0x45647a
lea ecx, [ebp - 0x150]
push ebx
push str.ReleaseId
call fcn.00456c00
movzx eax, byte [ebp - 0x139]
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x17c], esi
test al, al
lea ebx, [ebp - 0x144]
mov edx, dword [ebp - 0x144]
cmovns edx, ebx
movzx eax, al
cmovs eax, ecx
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x154], 0
push edi
push eax
push edx
call fcn.004648a0
add esp, 0xc
mov edi, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x155]
mov dword [ebp - 0x131], eax
movzx eax, byte [ebp - 0x151]
mov byte [ebp - 0x161], al
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x456510
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov ebx, dword [ebp - 0x148]
mov dword [ebp - 0x148], 0
test ebx, ebx
je 0x45653a
mov eax, dword [ebx]
mov esi, edi
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
push 1
call edi
mov edi, esi
cmp byte [ebp - 0x139], 0
jns 0x456551
push dword [ebp - 0x144]
call fcn.00528424
add esp, 4
mov eax, dword [ebp - 0x16c]
mov esi, dword [ebp - 0x17c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], edi
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x131]
mov dword [esi + 0x24], eax
mov dword [esi + 0x27], ecx
movzx eax, byte [ebp - 0x161]
mov byte [esi + 0x2b], al
mov eax, 0x16
mov ecx, dword [ebp - 0x180]
cmp ecx, 0xb
je 0x4566df
cmp ecx, 0xa
jne 0x456693
mov eax, 0x17
mov ecx, dword [ebp - 0x174]
cmp ecx, 0x585c
ja 0x4566df
mov eax, 0x16
cmp ecx, 0x55ef
ja 0x4566df
mov eax, 0x15
cmp ecx, 0x4f7b
ja 0x4566df
mov eax, 0x14
cmp ecx, 0x4a64
ja 0x4566df
mov eax, 0x13
je 0x4566df
mov eax, 0x12
cmp ecx, 0x4a62
ja 0x4566df
mov eax, 0x11
je 0x4566df
mov eax, 0x10
cmp ecx, 0x4a60
ja 0x4566df
mov eax, 0xf
cmp ecx, 0x47ba
ja 0x4566df
mov eax, 0xe
je 0x4566df
mov eax, 0xd
cmp ecx, 0x4562
ja 0x4566df
mov eax, 0xc
cmp ecx, 0x42ed
ja 0x4566df
mov eax, 0xb
cmp ecx, 0x3faa
ja 0x4566df
mov eax, 0xa
cmp ecx, 0x3ad6
ja 0x4566df
mov eax, 9
cmp ecx, 0x3838
ja 0x4566df
cmp ecx, 0x295a
mov eax, 7
sbb eax, 0xffffffff
jmp 0x4566df
cmp ecx, 7
jb 0x4566a4
call fcn.0047b030
mov eax, 0x18
jmp 0x4566df
cmp ecx, 6
jne 0x4566bf
mov eax, dword [ebp - 0x168]
lea ecx, [eax + 3]
cmp eax, 3
mov eax, 6
cmovb eax, ecx
jmp 0x4566df
xor eax, eax
mov edx, dword [ebp - 0x168]
test edx, edx
je 0x4566df
cmp ecx, 5
jne 0x4566df
xor ecx, ecx
cmp edx, 1
sete cl
mov eax, 2
sub eax, ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov eax, dword [0x59cb68]
mov ecx, dword [0x59b038]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x456957
add dword [ebp - 0x170], 0x2c
mov ecx, dword [0x59cb64]
test ecx, ecx
je 0x45676f
mov word [ebp - 0x144], 0
mov word [ebp - 0x150], 0
call dword [section..00cfg]
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x144]
push eax
push ebx
call ecx
test eax, eax
je 0x4567ec
movzx eax, word [ebp - 0x144]
lea ecx, [eax - 0x1c0]
cmp ecx, 4
ja 0x4567a4
mov edx, 0x15
bt edx, ecx
jae 0x4567a4
mov eax, 2
jmp 0x4567c4
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x144]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4567ec
cmp dword [ebp - 0x144], 0
je 0x4567b6
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 1
jmp 0x4567ec
test eax, eax
je 0x4567c4
cmp eax, 0x14c
jne 0x4567bf
mov eax, 1
jmp 0x4567c4
mov dword [esi + 0x40], 0
jmp 0x4567ec
mov eax, 3
mov dword [esi + 0x40], eax
movzx eax, word [ebp - 0x150]
xor ecx, ecx
cmp eax, 0x8664
sete cl
mov edx, 2
sub edx, ecx
xor ecx, ecx
cmp eax, 0xaa64
cmovne ecx, edx
mov dword [esi + 0x44], ecx
movzx eax, word [ebp - 0x18]
mov dword [esi + 0x18], eax
movzx eax, word [ebp - 0x16]
mov dword [esi + 0x1c], eax
lea edi, [ebp - 0x118]
push edi
call fcn.00542c14
add esp, 4
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x13c], 0
lea ecx, [ebp - 0x144]
push ecx
push eax
push edi
call fcn.004648a0
add esp, 0xc
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x170]
mov dword [ecx + 8], eax
movsd xmm0, qword [ebp - 0x144]
movsd qword [ecx], xmm0
mov eax, dword [0x59cb80]
mov dword [esi + 0x38], eax
mov eax, dword [0x59cb88]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x128]
cmp eax, 5
je 0x456896
cmp eax, 0xa
je 0x456878
cmp eax, 6
jne case.0x456886.2
mov eax, dword [ebp - 0x178]
dec eax
cmp eax, 0xa4
ja case.0x456886.2
jmp dword [eax*4 + 0x580bb4]
mov dword [esi + 0x14], 3
jmp 0x4568dc
mov eax, dword [ebp - 0x124]
cmp eax, 1
je 0x4568c6
cmp eax, 2
jne case.0x456886.2
cmp byte [ebp - 0x12], 1
jne 0x4568b6
cmp word [0x59cb6c], 9
je case.0x456886.1
cmp word [ebp - 0x14], 0
js case.0x456886.2
mov dword [esi + 0x14], 2
jmp 0x4568dc
test byte [ebp - 0x13], 2
jne case.0x456886.2
mov dword [esi + 0x14], 1
jmp 0x4568dc
mov dword [esi + 0x14], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00528e13
mov eax, esi
add esp, 0x174
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x14], 4
jmp 0x4568dc
mov dword [esi + 0x14], 5
jmp 0x4568dc
push 0x59cb90
call fcn.00528497
add esp, 4
cmp dword [0x59cb90], 0xffffffff
jne 0x4562d9
xorps xmm0, xmm0
movups xmmword [0x59cb7c], xmm0
movups xmmword [0x59cb6c], xmm0
mov dword [0x59cb8c], 0
push 0x59cb6c
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x59cb90
call fcn.0052850d
add esp, 4
jmp 0x4562d9
push 0x59cb68
call fcn.00528497
add esp, 4
cmp dword [0x59cb68], 0xffffffff
jne 0x45670a
push 0x57d4ca
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59cb64], eax
push 0x59cb68
call fcn.0052850d
add esp, 4
jmp 0x45670a