Function at 0x4058d0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x174]
push 0
push eax
call fcn.00426340
add esp, 0xc
mov dword [ebp - 0x174], 0x11c
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40593d
lea eax, [ebp - 0x174]
mov dword [ebp - 0x174], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40593d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x164]
sub eax, 0
je 0x405b83
sub eax, 1
je 0x405ae1
sub eax, 1
jne 0x405b95
mov eax, dword [ebp - 0x170]
cmp eax, 4
ja 0x405981
push str.Microsoft_Windows_NT
push 0x4679c4
call fcn.00401710
mov eax, dword [ebp - 0x170]
add esp, 8
cmp eax, 5
jne 0x4059c8
mov eax, dword [ebp - 0x16c]
test eax, eax
jne 0x4059b1
push str.Microsoft_Windows_2000
push 0x4679c4
call fcn.00401710
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x4059c8
mov eax, dword [ebp - 0x16c]
cmp eax, 1
jne 0x4059c8
push str.Whistler
push 0x4679c4
call fcn.00401710
add esp, 8
lea eax, [ebp - 0x178]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x178]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x178]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x54]
mov eax, str.WINNT
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405a34
test dl, dl
je 0x405a30
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405a34
add eax, 2
add ecx, 2
test dl, dl
jne 0x405a14
xor eax, eax
jmp 0x405a39
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405a4f
push str.Workstation
push 0x4679c4
call fcn.00401710
add esp, 8
lea ecx, [ebp - 0x54]
mov eax, str.SERVERNT
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405a77
test dl, dl
je 0x405a73
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405a77
add eax, 2
add ecx, 2
test dl, dl
jne 0x405a57
xor eax, eax
jmp 0x405a7c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x405a92
push str.Server
push 0x4679c4
call fcn.00401710
add esp, 8
movzx eax, word [ebp - reloc.advapi32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x170]
push eax
lea eax, [ebp - 0x160]
push eax
cmp ecx, 4
ja 0x405aca
push dword [ebp - 0x16c]
push ecx
push str.version__d._d__s__Build__d__n
push 0x4679c4
call fcn.00401710
add esp, 0x18
jmp 0x405b95
push str._s__Build__d_
push 0x4679c4
call fcn.00401710
add esp, 0x10
jmp 0x405b95
cmp dword [ebp - 0x170], 4
jne 0x405b95
mov eax, dword [ebp - 0x16c]
test eax, eax
jne 0x405b35
push str.Microsoft_Windows_95
push 0x4679c4
call fcn.00401710
add esp, 8
cmp word [ebp - reloc.advapi32.dll_AdjustTokenPrivileges], 0x43
jne 0x405b26
push str.OSR2
push 0x4679c4
call fcn.00401710
add esp, 8
cmp dword [ebp - 0x170], 4
jne 0x405b95
mov eax, dword [ebp - 0x16c]
cmp eax, 0xa
jne 0x405b77
push str.Microsoft_Windows_98
push 0x4679c4
call fcn.00401710
add esp, 8
cmp word [ebp - reloc.advapi32.dll_AdjustTokenPrivileges], 0x41
jne 0x405b68
push 0x454830
push 0x4679c4
call fcn.00401710
add esp, 8
cmp dword [ebp - 0x170], 4
jne 0x405b95
mov eax, dword [ebp - 0x16c]
cmp eax, 0x5a
jne 0x405b95
push str.Microsoft_Windows_Me
jmp 0x405b88
push str.Microsoft_Win32s
push 0x4679c4
call fcn.00401710
add esp, 8
push 0x454860
push 0x4679c4
call fcn.00401710
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 1
call fcn.0042318e
mov esp, ebp
pop ebp
ret