Function at 0x419e9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
and byte [ebp - 0x124], 0
push ebx
push esi
push edi
mov esi, ecx
push 0x31
pop ecx
xor eax, eax
lea edi, [ebp - 0x123]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x14]
sub eax, ebx
je 0x41a366
dec eax
je 0x41a244
dec eax
je 0x419f13
mov edi, str.Unknown
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xbc]
call fcn.0040372c
mov dword [esi + 0xa4], ebx
jmp 0x41a38b
cmp dword [esi + 8], 4
ja 0x419f3e
mov edi, str.Microsoft_Windows_NT
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 2
cmp dword [esi + 8], 5
jne 0x419fd4
cmp dword [esi + 0xc], ebx
jne 0x419f72
mov edi, str.Microsoft_Windows_2000
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 8
cmp dword [esi + 8], 5
jne 0x419fd4
cmp dword [esi + 0xc], 1
jne 0x419fa3
mov edi, str.Microsoft_Windows_XP
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 9
cmp dword [esi + 8], 5
jne 0x419fd4
cmp dword [esi + 0xc], 2
jb 0x419fd4
mov edi, str.Microsoft_Windows_Server_2003
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 0xa
push 6
pop ebx
cmp dword [esi + 8], ebx
jne 0x41a007
cmp dword [esi + 0xc], 0
jne 0x41a007
mov edi, str.Microsoft_Windows_Vista
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 0xb
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x41a01d
cmp dword [esi + 0xc], 1
jne 0x41a01b
mov edi, str.Microsoft_Windows_seven
jmp 0x41a02c
cmp eax, ebx
ja 0x41a027
jne 0x41a04c
cmp dword [esi + 0xc], 1
jbe 0x41a04c
mov edi, str.Unknown_Windows_version__but_above_Windows_7
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 0xc
cmp byte [esi + 0xa0], 0
je 0x41a10f
mov al, byte [esi + 0x9e]
cmp al, 1
jne 0x41a0a4
test byte [esi + 0x9d], 2
je 0x41a088
mov edi, str._Personal
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
jmp 0x41a1e3
mov edi, str._Professional
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
jmp 0x41a1e3
cmp al, 3
jne 0x41a1f1
mov ax, word [esi + 0x9c]
test al, 0x80
je 0x41a0d3
mov edi, str._DataCenter_Server
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
jmp 0x41a1e3
test al, 2
je 0x41a0f3
mov edi, str._Advanced_Server
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
jmp 0x41a1e3
mov edi, str._Server
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
jmp 0x41a1e3
lea eax, [ebp - 8]
xor edi, edi
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.MSVCRT.dll__strcmpi]
lea eax, [ebp - 0x5c]
push eax
push str.WINNT
call ebx
pop ecx
test eax, eax
pop ecx
jne 0x41a185
mov edi, str._Professional
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.00402262
lea eax, [ebp - 0x5c]
push eax
push str.LANMANNT
call ebx
pop ecx
test eax, eax
pop ecx
jne 0x41a1bb
mov edi, str._Server
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.00402262
lea eax, [ebp - 0x5c]
push eax
push str.SERVERNT
call ebx
pop ecx
test eax, eax
pop ecx
jne 0x41a1f1
mov edi, str._Advanced_Server
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.00402262
mov eax, dword [esi + 0x10]
and eax, 0xffff
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push str.Version__d._d__s__Build__d_
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x1c
lea eax, [ebp + eax - 0x124]
lea ecx, [esi + 0xbc]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0040372c
jmp 0x41a38b
cmp dword [esi + 8], 4
jne 0x41a349
cmp dword [esi + 0xc], ebx
jne 0x41a2b0
mov edi, str.Microsoft_Windows_95
lea ebx, [esi + 0xb0]
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
mov ecx, ebx
call fcn.0040372c
mov al, byte [esi + 0x19]
mov dword [esi + 0xa4], 3
cmp al, 0x43
je 0x41a285
cmp al, 0x42
jne 0x41a2b0
mov edi, str._OSR2
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push edi
mov ecx, ebx
call fcn.00402262
mov dword [esi + 0xa4], 4
cmp dword [esi + 8], 4
jne 0x41a349
cmp dword [esi + 0xc], 0xa
jne 0x41a318
mov edi, str.Microsoft_Windows_98
lea ebx, [esi + 0xb0]
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
mov ecx, ebx
call fcn.0040372c
cmp byte [esi + 0x19], 0x41
mov dword [esi + 0xa4], 5
jne 0x41a318
mov edi, 0x422290
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push edi
mov ecx, ebx
call fcn.00402262
mov dword [esi + 0xa4], 6
cmp dword [esi + 8], 4
jne 0x41a349
cmp dword [esi + 0xc], 0x5a
jne 0x41a349
mov edi, str.Microsoft_Windows_Me
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 7
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 0x10]
and eax, 0xffff
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push str.Version__d._d_Build__d__s
jmp 0x41a209
mov edi, str.Microsoft_Win32s
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0xb0]
call fcn.0040372c
mov dword [esi + 0xa4], 1
pop edi
pop esi
pop ebx
leave
ret