Function at 0x1800cecb
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3b8]
sub esp, 0x438
mov eax, dword [0x180af1d0]
xor eax, ebp
mov dword [ebp + 0x3b4], eax
mov eax, dword [ebp + 0x3c0]
push ebx
push esi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3c4]
push edi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x3c8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x80], eax
mov word [eax], cx
xor eax, eax
mov esi, 0x11c
push esi
push eax
mov word [ebp + 0x1ac], ax
lea eax, [ebp - 0x70]
push eax
mov ebx, edx
call fcn.18076d30
add esp, 0xc
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x1800cf57
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x114
call esi
test eax, eax
jne 0x1800cf57
xor al, al
jmp 0x1800d3e7
movzx eax, word [ebp + 0xa4]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x78]
mov dword [edi], ecx
mov dword [ebx], edx
mov dword [esi], eax
movzx eax, word [ebp + 0xa6]
mov esi, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x60]
sub eax, 0
je 0x1800d39f
dec eax
je 0x1800d312
dec eax
je 0x1800cf99
push str.Unknown_operating_system
jmp 0x1800d3a4
push 5
pop esi
cmp ecx, esi
jne 0x1800cff4
cmp edx, 2
jne 0x1800cfbd
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_Server_2003_family_
push eax
call fcn.18008ab3
pop ecx
pop ecx
cmp dword [ebp - 0x6c], esi
jne 0x1800cff4
cmp dword [ebp - 0x68], 1
jne 0x1800cfdb
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_XP
push eax
call fcn.18008ab3
pop ecx
pop ecx
cmp dword [ebp - 0x6c], esi
jne 0x1800cff4
cmp dword [ebp - 0x68], 0
jne 0x1800d00d
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_2000
push eax
call fcn.18008ab3
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
ja 0x1800d00d
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_NT
push eax
call fcn.18008ab3
pop ecx
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
cmp dword [ebp - 0x7c], eax
je 0x1800d124
cmp byte [ebp + 0xaa], 1
jne 0x1800d05d
cmp dword [ebp - 0x6c], 4
lea eax, [ebp + 0x1ac]
jne 0x1800d03d
push str.Workstation_4.0
jmp 0x1800d117
test dword [ebp + 0xa8], 0x200
je 0x1800d053
push str.Home_Edition
jmp 0x1800d117
push str.Professional
jmp 0x1800d117
cmp byte [ebp + 0xaa], 3
je 0x1800d073
cmp byte [ebp + 0xaa], 2
jne 0x1800d23a
cmp dword [ebp - 0x6c], esi
jne 0x1800d0fc
cmp dword [ebp - 0x68], 2
jne 0x1800d0ca
test byte [ebp + 0xa8], 0x80
je 0x1800d092
push str.Datacenter_Edition
jmp 0x1800d0a0
test byte [ebp + 0xa8], 2
je 0x1800d0a8
push str.Enterprise_Edition
lea eax, [ebp + 0x1ac]
jmp 0x1800d117
mov eax, 0x400
cmp word [ebp + 0xa8], ax
lea eax, [ebp + 0x1ac]
jne 0x1800d0c3
push str.Web_Edition
jmp 0x1800d117
push str.Standard_Edition
jmp 0x1800d117
cmp dword [ebp - 0x68], eax
jne 0x1800d0fc
test byte [ebp + 0xa8], 0x80
lea eax, [ebp + 0x1ac]
je 0x1800d0e5
push str.Datacenter_Server
jmp 0x1800d117
test byte [ebp + 0xa8], 2
je 0x1800d0f5
push str.Advanced_Server
jmp 0x1800d117
push str.Server
jmp 0x1800d117
test byte [ebp + 0xa8], 2
lea eax, [ebp + 0x1ac]
je 0x1800d112
push str.Server_4.0__Enterprise_Edition
jmp 0x1800d117
push str.Server_4.0
push eax
call fcn.18008ab3
pop ecx
pop ecx
jmp 0x1800d23a
push 0x7e
push eax
lea eax, [ebp + 0xae]
xor ecx, ecx
push eax
mov word [ebp + 0xac], cx
call fcn.18076d30
add esp, 0xc
push 0x40
pop esi
lea eax, [ebp - 0x78]
push eax
push 1
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 0x74], esi
call ebx
test eax, eax
jne 0x1800cf50
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xac]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800cf50
cmp dword [ebp - 0x74], esi
ja 0x1800cf50
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp + 0xac]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x1800d1c2
lea eax, [ebp + 0x1ac]
push str.Workstation
push eax
call fcn.18008ab3
pop ecx
pop ecx
lea eax, [ebp + 0xac]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x1800d1e7
lea eax, [ebp + 0x1ac]
push str.Server
push eax
call fcn.18008ab3
pop ecx
pop ecx
lea eax, [ebp + 0xac]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x1800d20c
lea eax, [ebp + 0x1ac]
push str.Advanced_Server
push eax
call fcn.18008ab3
pop ecx
pop ecx
push dword [ebp - 0x68]
lea eax, [ebp + 0x12c]
push dword [ebp - 0x6c]
push 0x1809d290
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008ab3
add esp, 0x18
cmp dword [ebp - 0x6c], 4
jne 0x1800d2dc
push str.Service_Pack_6
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800d2dc
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push 0x80000002
call ebx
test eax, eax
movzx eax, word [ebp - 0x64]
push eax
jne 0x1800d2a2
lea eax, [ebp + 0x12c]
push str.Service_Pack_6a__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008ab3
add esp, 0x14
jmp 0x1800d2ce
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x12c]
push str._s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008ab3
add esp, 0x18
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800d3b2
movzx eax, word [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x12c]
push str._s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008ab3
add esp, 0x18
jmp 0x1800d3b2
cmp ecx, 4
jne 0x1800d3b2
test edx, edx
jne 0x1800d359
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_95
push eax
call fcn.18008ab3
cmp word [ebp - 0x5a], 0x43
pop ecx
pop ecx
je 0x1800d340
cmp word [ebp - 0x5a], 0x42
jne 0x1800d353
lea eax, [ebp + 0x1ac]
push str.OSR2
push eax
call fcn.18008ab3
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
jne 0x1800d3b2
cmp dword [ebp - 0x68], 0xa
jne 0x1800d392
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_98
push eax
call fcn.18008ab3
cmp word [ebp - 0x5a], 0x41
pop ecx
pop ecx
jne 0x1800d38c
lea eax, [ebp + 0x1ac]
push 0x1809d3f0
push eax
call fcn.18008ab3
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
jne 0x1800d3b2
cmp dword [ebp - 0x68], 0x5a
jne 0x1800d3b2
push str.Microsoft_Windows_Millennium_Edition
jmp 0x1800d3a4
push str.Microsoft_Win32s
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008ab3
pop ecx
pop ecx
lea eax, [ebp + 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 + 0x1aa]
cmp word [eax], 0
jne 0x1800d3d1
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x80]
push 0x104
lea edx, [ebp + 0x1ac]
call fcn.18008327
pop ecx
mov al, 1
mov ecx, dword [ebp + 0x3b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.180761c5
add ebp, 0x3b8
leave
ret