Function at 0x10084a20
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x178], eax
lea eax, [esp + 0x60]
push 0x118
push 0
push eax
call fcn.10149430
add esp, 0xc
mov dword [esp + 0x5c], 0x11c
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0x24], 0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push dword [esp + 0x70]
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.10145ba4
add esp, 4
mov dword [esp + 0x10], eax
mov esi, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [0x101bd164]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x101bfbd8]
cmp ecx, dword [eax + 4]
jg 0x10085021
mov dword [esi], 0
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
movaps xmm0, xmmword [0x101a16b0]
movups xmmword [esi + 0x40], xmm0
mov dword [esi + 0x50], 0
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
mov dword [esi + 4], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 8], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x14], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x28], 0
lea edi, [esp + 0x28]
push edi
push 1
push 0
push 0x101a1756
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10084b70
mov dword [esp + 0xc], 0
xor ecx, ecx
xor eax, eax
jmp 0x10084c19
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x54], 4
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x54]
lea edx, [esp + 0x50]
push ecx
push edx
push edi
push 0
push 0x101a17b0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x10084bd6
mov eax, dword [esp + 0x28]
add eax, 0xfffffffd
xor edx, edx
cmp dword [esp + 0x54], 4
mov ecx, 0
jne 0x10084bd0
mov ecx, dword [esp + 0x50]
cmp eax, 2
cmovb edx, ecx
mov dword [esp + 0xc], edx
lea ebx, [esp + 0x40]
lea ecx, [esp + 0x34]
push ebx
push str.DisplayVersion
call fcn.10084690
movzx eax, byte [esp + 0x4b]
test al, al
mov ecx, dword [esp + 0x44]
mov edx, eax
cmovs edx, ecx
test edx, edx
jne 0x10084c19
lea ecx, [esp + 0x34]
push ebx
push str.ReleaseId
call fcn.10084690
movzx eax, byte [esp + 0x4b]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esi
test al, al
lea ebx, [esp + 0x40]
mov edx, dword [esp + 0x40]
cmovns edx, ebx
movzx eax, al
cmovs eax, ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
push edi
push eax
push edx
call fcn.10078390
add esp, 0xc
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x2f]
mov dword [esp + 0x57], eax
movzx eax, byte [esp + 0x33]
mov byte [esp + 7], al
mov eax, dword [esp + 0x34]
test eax, eax
je 0x10084c8f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x3c], 0
test ebx, ebx
je 0x10084cb5
mov eax, dword [ebx]
mov esi, edi
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
push 1
call edi
mov edi, esi
cmp byte [esp + 0x4b], 0
jns 0x10084cc8
push dword [esp + 0x40]
call fcn.10145bd4
add esp, 4
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], edi
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x57]
mov dword [esi + 0x24], eax
mov dword [esi + 0x27], ecx
movzx eax, byte [esp + 7]
mov byte [esi + 0x2b], al
mov eax, 0x15
mov ecx, dword [esp + 0x20]
cmp ecx, 0xb
je 0x10084e10
cmp ecx, 0xa
jne 0x10084dd1
mov ecx, dword [esp + 0x14]
cmp ecx, 0x55ef
ja 0x10084e10
mov eax, 0x14
cmp ecx, 0x4f7b
ja 0x10084e10
mov eax, 0x13
cmp ecx, 0x4a63
ja 0x10084e10
mov eax, 0x12
je 0x10084e10
mov eax, 0x11
cmp ecx, 0x4a61
ja 0x10084e10
mov eax, 0x10
je 0x10084e10
mov eax, 0xf
cmp ecx, 0x47ba
ja 0x10084e10
mov eax, 0xe
je 0x10084e10
mov eax, 0xd
cmp ecx, 0x4562
ja 0x10084e10
mov eax, 0xc
cmp ecx, 0x42ed
ja 0x10084e10
mov eax, 0xb
cmp ecx, 0x3faa
ja 0x10084e10
mov eax, 0xa
cmp ecx, 0x3ad6
ja 0x10084e10
mov eax, 9
cmp ecx, 0x3838
ja 0x10084e10
cmp ecx, 0x295a
mov eax, 7
sbb eax, 0xffffffff
jmp 0x10084e10
mov eax, 0x16
cmp ecx, 6
ja 0x10084e10
jne 0x10084df1
mov eax, dword [esp + 8]
lea ecx, [eax + 3]
cmp eax, 3
mov eax, 6
cmovb eax, ecx
jmp 0x10084e10
xor eax, eax
cmp dword [esp + 8], 0
je 0x10084e10
cmp ecx, 5
jne 0x10084e10
xor ecx, ecx
cmp dword [esp + 8], 1
sete cl
mov eax, 2
sub eax, ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov eax, dword [0x101bfbb0]
mov ecx, dword [0x101bd164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10085073
add dword [esp + 0x10], 0x2c
mov ecx, dword [0x101bfbac]
test ecx, ecx
je 0x10084e94
mov word [esp + 0x40], 0
mov word [esp + 0x34], 0
call dword [section..00cfg]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x44]
push eax
push ebx
call ecx
test eax, eax
je 0x10084f09
movzx eax, word [esp + 0x40]
lea ecx, [eax - 0x1c0]
cmp ecx, 4
ja 0x10084ec3
mov edx, 0x15
bt edx, ecx
jae 0x10084ec3
mov eax, 2
jmp 0x10084ee3
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x10084f09
cmp dword [esp + 0x40], 0
je 0x10084ed5
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 1
jmp 0x10084f09
test eax, eax
je 0x10084ee3
cmp eax, 0x14c
jne 0x10084ede
mov eax, 1
jmp 0x10084ee3
mov dword [esi + 0x40], 0
jmp 0x10084f09
mov eax, 3
mov dword [esi + 0x40], eax
movzx eax, word [esp + 0x34]
xor ecx, ecx
cmp eax, 0x8664
sete cl
mov edx, 2
sub edx, ecx
xor ecx, ecx
cmp eax, 0xaa64
cmovne ecx, edx
mov dword [esi + 0x44], ecx
movzx eax, word [esp + 0x170]
mov dword [esi + 0x18], eax
movzx eax, word [esp + 0x172]
mov dword [esi + 0x1c], eax
lea edi, [esp + 0x70]
push edi
call fcn.10163aa4
add esp, 4
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
lea ecx, [esp + 0x40]
push ecx
push eax
push edi
call fcn.10078390
add esp, 0xc
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], eax
movsd xmm0, qword [esp + 0x40]
movsd qword [ecx], xmm0
mov eax, dword [0x101bfbc8]
mov dword [esi + 0x38], eax
mov eax, dword [0x101bfbd0]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x60]
cmp eax, 5
je 0x10084fa7
cmp eax, 0xa
je 0x10084f8b
cmp eax, 6
jne case.0x10084f97.2
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 0xa4
ja case.0x10084f97.2
jmp dword [eax*4 + 0x101a17ec]
mov dword [esi + 0x14], 3
jmp 0x10084ff7
mov eax, dword [esp + 0x64]
cmp eax, 1
je 0x10084fdd
cmp eax, 2
jne case.0x10084f97.2
cmp byte [esp + 0x176], 1
jne 0x10084fc9
cmp word [0x101bfbb4], 9
je case.0x10084f97.1
cmp word [esp + 0x174], 0
js case.0x10084f97.2
mov dword [esi + 0x14], 2
jmp 0x10084ff7
test byte [esp + 0x175], 2
jne case.0x10084f97.2
mov dword [esi + 0x14], 1
jmp 0x10084ff7
mov dword [esi + 0x14], 0
mov ecx, dword [esp + 0x178]
xor ecx, ebp
call fcn.101465a3
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x14], 4
jmp 0x10084ff7
mov dword [esi + 0x14], 5
jmp 0x10084ff7
push 0x101bfbd8
call fcn.10145c47
add esp, 4
cmp dword [0x101bfbd8], 0xffffffff
jne 0x10084abc
xorps xmm0, xmm0
movups xmmword [0x101bfbc4], xmm0
movups xmmword [0x101bfbb4], xmm0
mov dword [0x101bfbd4], 0
push 0x101bfbb4
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x101bfbd8
call fcn.10145cbd
add esp, 4
jmp 0x10084abc
push 0x101bfbb0
call fcn.10145c47
add esp, 4
cmp dword [0x101bfbb0], 0xffffffff
jne 0x10084e3b
push 0x1019e09e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101bfbac], eax
push 0x101bfbb0
call fcn.10145cbd
add esp, 4
jmp 0x10084e3b