Function at 0x441ea0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4f8028]
xor eax, esp
mov dword [esp + 0xc20], eax
push esi
push edi
xor esi, esi
push 0x7fe
lea eax, [esp + 0x42e]
push esi
push eax
mov edi, ecx
mov word [esp + 0x434], si
call sub.ntdll.dll_memset
push 0xfe
lea ecx, [esp + 0x13a]
push esi
push ecx
mov word [esp + 0x140], si
call sub.ntdll.dll_memset
add esp, 0x18
xor eax, eax
jmp 0x441f00
movzx ecx, word [eax + 0x4ea098]
mov word [esp + eax + 0x128], cx
add eax, 2
cmp cx, si
jne 0x441f00
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServicesdmioBoot_InfoPrimary_Disk_Group]
mov word [esp + eax + 0x428], cx
add eax, 2
cmp cx, si
jne 0x441f20
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 6
jb 0x441f97
xor eax, eax
jmp 0x441f60
movzx ecx, word [eax + str.PrimaryPackId]
mov word [esp + eax + 0x128], cx
add eax, 2
cmp cx, si
jne 0x441f60
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.SYSTEMCurrentControlSetServices_volmgrx]
mov word [esp + eax + 0x428], cx
add eax, 2
cmp cx, si
jne 0x441f80
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x42c]
push ecx
push 0x80000002
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x44202e
mov eax, 1
test byte [0x503544], al
jne 0x441feb
or dword [0x503544], eax
push 0x4732e0
mov dword [0x503520], 0x4e7bc8
mov dword [0x503524], 0xffffffff
call fcn.0046d920
add esp, 4
mov esi, dword [0x503520]
push 0x185
mov ecx, str..disk.cpp
add esi, 8
call fcn.00441380
mov edx, dword [esi]
push eax
push str._s:_Failed_to_RegOpenKey_on_GetSysDgGuid.
push 0x503520
call edx
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc20]
xor ecx, esp
call fcn.0046d6fd
add esp, 0xc24
ret
push 0x1fe
lea eax, [esp + 0x22e]
push esi
push eax
mov word [esp + 0x234], si
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x22c]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x138]
push ecx
push edx
mov dword [esp + 0x24], 0x100
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4420cf
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x190
mov ecx, str..disk.cpp
add esi, 8
call fcn.00441380
push eax
mov eax, dword [esi]
push str._s:_Failed_to_RegQueryValueEx_on_GetSysDgGuid.
push edi
call eax
mov ecx, dword [esp + 0x18]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc20]
xor ecx, esp
call fcn.0046d6fd
add esp, 0xc24
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4420e4
sub eax, edx
sar eax, 1
cmp eax, 0x100
jbe 0x44213c
call fcn.004205a0
mov edi, eax
mov esi, dword [edi]
push 0x198
mov ecx, str..disk.cpp
add esi, 8
call fcn.00441380
push eax
mov eax, dword [esi]
push str._s:_Buffer_insufficient_
push edi
call eax
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc20]
xor ecx, esp
call fcn.0046d6fd
add esp, 0xc24
ret
lea ecx, [esp + 0x228]
push ecx
push 0x100
push edi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ecx, dword [esp + 0xc34]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0046d6fd
add esp, 0xc24
ret