Function at 0x404490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
mov edi, str.dows_NTCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.SOFTWAREMicrosoftWin
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
or ecx, 0xffffffff
mov edi, str.SOFTWAREMicrosoftWin
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.dows_NTCurrentVersion
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [ebp - 0x190]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebp - 4]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0xf003f
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x190]
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404604
btr ebx, 0xf4
xadd eax, ebx
xchg ebx, eax
test eax, 0x534f82bb
sub bl, dl
mov eax, edx
xchg al, bl
mov al, cl
movzx ebx, bx
not bh
rcl ebx, 0x4b
or eax, 0x393eeb01
imul ebx, ebp, 0x5a429437
movzx eax, si
mov eax, 0xfc226531
test ebx, edx
sub bh, 0x82
test bl, al
bsr eax, ebp
shr ebx, 1
imul ebx, eax, 0xd815a07e
sbb al, 0x7b
test edi, edi
shl bl, cl
movsx ebx, dx
neg bl
bswap ebx
add ah, al
not eax
xadd bl, al
shrd ebx, eax, cl
movzx eax, cx
mov bl, 0x5d
imul ebx, esi, 0x9c792c83
neg ah
movzx ebx, dh
inc eax
push 0
mov dword [ebp - 8], 0xc8
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
lea edx, [ebp - 8]
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 4]
push eax
push ecx
push 0
push str.ProductName
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea ecx, [ebp - 0x8c]
push str.2000
push ecx
call esi
add esp, 8
test eax, eax
je 0x404653
mov edi, str.Windows_Server_2000
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8c]
push 0x407424
push eax
call esi
add esp, 8
test eax, eax
je 0x40469c
mov edi, str.Windows_XP
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8c]
push str.2003
push eax
call esi
add esp, 8
test eax, eax
je 0x4046e5
mov edi, str.Windows_Server_2003
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8c]
push str.Vista
push eax
call esi
add esp, 8
test eax, eax
je 0x40472e
mov edi, str.Windows_Vista
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8c]
push str.2008
push eax
call esi
add esp, 8
test eax, eax
je 0x404777
mov edi, str.Windows_Server_2008
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8c]
push 0x4073c4
push eax
call esi
add esp, 8
test eax, eax
je 0x4047c0
mov edi, str.Windows_7
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Windows_NT
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404350
pop edi
mov dword [ebx + 0x40], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret