Function at 0x4279e0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x2dc
mov eax, dword [0x60bd28]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
mov ebx, dword [esp + 0x2e4]
push esi
push edi
push 0x105
lea eax, [esp + 0xdc]
push 0
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0
call fcn.0053fd60
xor eax, eax
push 0x9c
push eax
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.0053fd60
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0x18
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x427aab
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x94
call esi
test eax, eax
jne 0x427aab
push 0x596192
mov ecx, ebx
call fcn.00402a30
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.0053fab2
add esp, 0x2dc
ret
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x427acf
lea ecx, [esp + 0x18]
push ecx
call eax
jmp 0x427ada
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x4c]
sub eax, 0
je 0x427f5e
mov ebx, 1
sub eax, ebx
je 0x427ee6
sub eax, ebx
jne 0x427f78
cmp dword [esp + 0x40], 6
lea esi, [ebx + 3]
jne 0x427b47
cmp dword [esp + 0x44], eax
jne 0x427c27
cmp byte [esp + 0xd6], bl
jne 0x427b2d
push str.Windows_Vista
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427b3f
push str.Windows_Server__Longhorn_
push 0x5971b0
lea ecx, [esp + 0xe0]
push ecx
call fcn.00426110
add esp, 0xc
cmp dword [esp + 0x40], 5
jne 0x427c07
cmp dword [esp + 0x44], 2
jne 0x427bbf
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x427b79
push str.Microsoft_Windows_Server_2003__R2_
push 0x5971b0
lea edx, [esp + 0xe0]
push edx
jmp 0x427bb0
cmp byte [esp + 0xd6], bl
jne 0x427b9e
cmp word [esp + 0x18], 9
jne 0x427b9e
push str.Microsoft_Windows_XP_Professional_x64_Edition
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427bb0
push str.Microsoft_Windows_Server_2003
push 0x5971b0
lea ecx, [esp + 0xe0]
push ecx
call fcn.00426110
add esp, 0xc
cmp dword [esp + 0x40], 5
jne 0x427c07
cmp dword [esp + 0x44], ebx
jne 0x427be6
push str.Microsoft_Windows_XP_x32_bit
lea edx, [esp + 0xdc]
push 0x5971b0
push edx
call fcn.00426110
add esp, 0xc
cmp dword [esp + 0x40], 5
jne 0x427c07
cmp dword [esp + 0x44], 0
jne 0x427c27
push str.Microsoft_Windows_2000
lea eax, [esp + 0xdc]
push 0x5971b0
push eax
call fcn.00426110
add esp, 0xc
cmp dword [esp + 0x40], esi
ja 0x427c27
push str.Microsoft_Windows_NT
lea ecx, [esp + 0xdc]
push 0x5971b0
push ecx
call fcn.00426110
add esp, 0xc
test edi, edi
je 0x427df1
mov al, byte [esp + 0xd6]
cmp al, bl
jne 0x427c67
cmp word [esp + 0x18], 9
je 0x427f78
cmp dword [esp + 0x40], esi
jne 0x427f78
push str.Workstation_4.0
push 0x5971b0
lea edx, [esp + 0xe0]
push edx
jmp 0x427f70
cmp al, 3
je 0x427c73
cmp al, 2
jne 0x427f78
cmp dword [esp + 0x40], 5
jne 0x427dc6
mov eax, dword [esp + 0x44]
cmp eax, 2
jne 0x427d7b
mov eax, dword [esp + 0x18]
cmp ax, 6
jne 0x427cc9
mov al, byte [esp + 0xd4]
test al, al
jns 0x427cb7
push str.Datacenter_Edition_for_Itanium_based_Systems
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
test al, 2
je 0x427f78
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x427f63
cmp ax, 9
jne 0x427d16
mov al, byte [esp + 0xd4]
test al, al
jns 0x427cf1
push str.Datacenter_x64_Edition
push 0x5971b0
lea edx, [esp + 0xe0]
push edx
jmp 0x427f70
test al, 2
je 0x427d0c
push str.Enterprise_x64_Edition
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
push str.Standard_x64_Edition
jmp 0x427f63
mov ax, word [esp + 0xd4]
test al, al
jns 0x427d39
push str.Datacenter_Edition
push 0x5971b0
lea edx, [esp + 0xe0]
push edx
jmp 0x427f70
test al, 2
je 0x427d54
push str.Enterprise_Edition
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
cmp ax, 0x400
jne 0x427d64
push str.Web_Edition
jmp 0x427f63
push str.Standard_Edition
push 0x5971b0
lea edx, [esp + 0xe0]
push edx
jmp 0x427f70
test eax, eax
jne 0x427dc6
mov al, byte [esp + 0xd4]
test al, al
jns 0x427da1
push str.Datacenter_Server
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
test al, 2
je 0x427daf
push str.Advanced_Server
jmp 0x427f63
push str.Server
push 0x5971b0
lea edx, [esp + 0xe0]
push edx
jmp 0x427f70
test byte [esp + 0xd4], 2
je 0x427de7
push str.Server_4.0__Enterprise_Edition
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
push str.Server_4.0
jmp 0x427f63
lea edx, [esp + 0x14]
push edx
push ebx
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov edi, 0x104
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x427e20
push 0x596192
jmp 0x427f80
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1e4]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x427e16
cmp dword [esp + 0xc], edi
ja 0x427e16
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x1e0]
push ecx
push str.WINNT
call esi
test eax, eax
jne 0x427e8b
push str.Workstation
lea edx, [esp + 0xdc]
push 0x5971b0
push edx
call fcn.00426110
add esp, 0xc
lea eax, [esp + 0x1e0]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x427eb8
push str.Server
lea ecx, [esp + 0xdc]
push 0x5971b0
push ecx
call fcn.00426110
add esp, 0xc
lea edx, [esp + 0x1e0]
push edx
push str.SERVERNT
call esi
test eax, eax
jne 0x427f78
push str.Advanced_Server
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
mov esi, 4
cmp dword [esp + 0x40], esi
jne 0x427f78
cmp dword [esp + 0x44], 0
jne 0x427f1c
push str.Microsoft_Windows_95
lea ecx, [esp + 0xdc]
push 0x5971b0
push ecx
call fcn.00426110
add esp, 0xc
cmp dword [esp + 0x40], esi
jne 0x427f78
cmp dword [esp + 0x44], 0xa
jne 0x427f43
push str.Microsoft_Windows_98
lea edx, [esp + 0xdc]
push 0x5971b0
push edx
call fcn.00426110
add esp, 0xc
cmp dword [esp + 0x40], esi
jne 0x427f78
cmp dword [esp + 0x44], 0x5a
jne 0x427f78
push str.Microsoft_Windows_Millennium_Edition_n
push 0x5971b0
lea eax, [esp + 0xe0]
push eax
jmp 0x427f70
push str.Microsoft_Win32s_n
push 0x5971b0
lea ecx, [esp + 0xe0]
push ecx
call fcn.00426110
add esp, 0xc
lea edx, [esp + 0xd8]
push edx
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.00402a30
mov ecx, dword [esp + 0x2e4]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0053fab2
add esp, 0x2dc
ret