The GetProductInfo-value PRODUCT_PROFESSIONAL isn't implemented and thus the function which joins the OS-string returns "<Unknown>". However, it's incorrectly passed via the ebx- instead of via the eax-register, leading to a memory access violation:
Code:
0041A7ED | B8 A2694700 | MOV EBX,protecti.004769A2 ; ASCII "<Unknown>"
Here's a fix: