Function at 0x10029cd5
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x728
push ebx
push esi
push edi
mov esi, 0x11c
push esi
xor ebx, ebx
lea eax, [ebp - 0xb8]
push ebx
push eax
call fcn.10131950
add esp, 0xc
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
mov edi, eax
cmp edi, ebx
jne 0x10029d3d
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x114
call esi
test eax, eax
jne 0x10029d3d
push 0x1018a0dc
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x7c]
mov dword [ecx], eax
xor eax, eax
push 0x1fe
mov word [ebp - 0x2b8], ax
lea eax, [ebp - 0x2b6]
push ebx
push eax
call fcn.10131950
mov eax, dword [ebp - 0xa8]
add esp, 0xc
sub eax, ebx
je 0x1002a2c4
dec eax
je 0x1002a21a
dec eax
jne 0x1002a2d7
cmp dword [ebp - 0xb4], 6
jbe 0x10029da0
cmp byte [ebp + 0x62], 1
lea eax, [ebp - 0x2b8]
jne 0x10029d93
push str.Microsoft_Windows
jmp 0x10029d98
push str.Microsoft_Windows_Server
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], 6
push 5
pop esi
jne 0x10029e0a
cmp dword [ebp - 0xb0], 1
jne 0x10029dde
cmp byte [ebp + 0x62], 1
lea eax, [ebp - 0x2b8]
jne 0x10029dc8
push str.Microsoft_Windows_7
jmp 0x10029dcd
push str.Microsoft_Windows_Server_2008_R2
push eax
call fcn.10131845
cmp dword [ebp - 0xb4], 6
pop ecx
pop ecx
jne 0x10029e0a
cmp dword [ebp - 0xb0], ebx
jne 0x10029e91
cmp byte [ebp + 0x62], 1
lea eax, [ebp - 0x2b8]
jne 0x10029dfd
push str.Microsoft_Windows_Vista
jmp 0x10029e02
push str.Microsoft_Windows_Server_2008
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], esi
jne 0x10029e75
cmp dword [ebp - 0xb0], 2
jne 0x10029e36
lea eax, [ebp - 0x2b8]
push str.Microsoft_Windows_Server_2003_
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], esi
jne 0x10029e75
cmp dword [ebp - 0xb0], 1
jne 0x10029e5a
lea eax, [ebp - 0x2b8]
push str.Microsoft_Windows_XP
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], esi
jne 0x10029e75
cmp dword [ebp - 0xb0], ebx
jne 0x10029e91
lea eax, [ebp - 0x2b8]
push str.Microsoft_Windows_2000
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], 4
ja 0x10029e91
lea eax, [ebp - 0x2b8]
push str.Microsoft_Windows_NT
push eax
call fcn.10131845
pop ecx
pop ecx
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x10029fa1
cmp dword [ebp - 0xb4], esi
ja 0x10029fa1
cmp byte [ebp + 0x62], 1
jne 0x10029eec
cmp dword [ebp - 0xb4], 4
lea eax, [ebp - 0x2b8]
jne 0x10029ecf
push str.Workstation_4.0
jmp 0x10029f94
test dword [ebp + 0x60], 0x200
je 0x10029ee2
push str.Home_Edition
jmp 0x10029f94
push str.Professional
jmp 0x10029f94
cmp byte [ebp + 0x62], 3
je 0x10029efc
cmp byte [ebp + 0x62], 2
jne 0x1002a0bb
cmp dword [ebp - 0xb4], esi
jne 0x10029f7c
cmp dword [ebp - 0xb0], 2
jne 0x10029f4c
test byte [ebp + 0x60], 0x80
je 0x10029f1a
push str.Datacenter_Edition
jmp 0x10029f25
test byte [ebp + 0x60], 2
je 0x10029f2d
push str.Enterprise_Edition
lea eax, [ebp - 0x2b8]
jmp 0x10029f94
mov eax, 0x400
cmp word [ebp + 0x60], ax
lea eax, [ebp - 0x2b8]
jne 0x10029f45
push str.Web_Edition
jmp 0x10029f94
push str.Standard_Edition
jmp 0x10029f94
cmp dword [ebp - 0xb0], 0
jne 0x10029f7c
test byte [ebp + 0x60], 0x80
lea eax, [ebp - 0x2b8]
je 0x10029f68
push str.Datacenter_Server
jmp 0x10029f94
test byte [ebp + 0x60], 2
je 0x10029f75
push str.Advanced_Server
jmp 0x10029f94
push str.Server
jmp 0x10029f94
test byte [ebp + 0x60], 2
lea eax, [ebp - 0x2b8]
je 0x10029f8f
push str.Server_4.0__Enterprise_Edition
jmp 0x10029f94
push str.Server_4.0
push eax
call fcn.10131845
pop ecx
pop ecx
jmp 0x1002a0bb
lea eax, [ebp + 0x64]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x100
push ebx
mov dword [ebp + 0x68], esi
call edi
test eax, eax
jne 0x1002a2d7
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x6b8]
push eax
push 0
push 0
push str.ProductType
push dword [ebp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002a2d7
cmp dword [ebp + 0x68], esi
ja 0x1002a2d7
push dword [ebp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x6b8]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x1002a023
lea eax, [ebp - 0x2b8]
push str.Workstation
push eax
call fcn.10131845
pop ecx
pop ecx
lea eax, [ebp - 0x6b8]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x1002a048
lea eax, [ebp - 0x2b8]
push str.Server
push eax
call fcn.10131845
pop ecx
pop ecx
lea eax, [ebp - 0x6b8]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x1002a06d
lea eax, [ebp - 0x2b8]
push str.Advanced_Server
push eax
call fcn.10131845
pop ecx
pop ecx
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x4b8], ax
lea eax, [ebp - 0x4b6]
push eax
call fcn.10131950
push dword [ebp - 0xb0]
lea eax, [ebp - 0x4b8]
push dword [ebp - 0xb4]
push str._d._d
push eax
call fcn.10131892
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.10131845
add esp, 0x24
mov eax, dword [ebp + 0x78]
mov ecx, dword [eax]
lea edx, [ebp + 0x6c]
push edx
push eax
call dword [ecx + 0x130]
cmp word [ebp + 0x6c], 1
jne 0x1002a0e5
lea eax, [ebp - 0x2b8]
push str.x64_Edition
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], 4
jne 0x1002a1c4
push str.Service_Pack_6
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002a1c4
lea eax, [ebp + 0x78]
push eax
push 1
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push ebx
call edi
push 0x1fe
push esi
test eax, eax
jne 0x1002a16b
mov word [ebp - 0x4b8], ax
lea eax, [ebp - 0x4b6]
push eax
call fcn.10131950
movzx eax, word [ebp - 0xac]
push eax
lea eax, [ebp - 0x4b8]
push str.Service_Pack_6a__Build__d__n
push eax
call fcn.10131892
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.10131845
add esp, 0x20
jmp 0x1002a1b6
xor eax, eax
mov word [ebp - 0x4b8], ax
lea eax, [ebp - 0x4b6]
push eax
call fcn.10131950
movzx eax, word [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x4b8]
push str._s__Build__d__n
push eax
call fcn.10131892
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.10131845
add esp, 0x24
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002a2d7
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x4b8], ax
lea eax, [ebp - 0x4b6]
push eax
call fcn.10131950
movzx eax, word [ebp - 0xac]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x4b8]
push str._s__Build__d__n
push eax
call fcn.10131892
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.10131845
add esp, 0x24
jmp 0x1002a2d7
cmp dword [ebp - 0xb4], 4
jne 0x1002a2d7
cmp dword [ebp - 0xb0], ebx
jne 0x1002a272
lea eax, [ebp - 0x2b8]
push str.Microsoft_Windows_95
push eax
call fcn.10131845
cmp word [ebp - 0xa2], 0x43
pop ecx
pop ecx
je 0x1002a256
cmp word [ebp - 0xa2], 0x42
jne 0x1002a269
lea eax, [ebp - 0x2b8]
push str.OSR2
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], 4
jne 0x1002a2d7
cmp dword [ebp - 0xb0], 0xa
jne 0x1002a2b4
lea eax, [ebp - 0x2b8]
push str.Microsoft_Windows_98
push eax
call fcn.10131845
cmp word [ebp - 0xa2], 0x41
pop ecx
pop ecx
jne 0x1002a2ab
lea eax, [ebp - 0x2b8]
push 0x101915b4
push eax
call fcn.10131845
pop ecx
pop ecx
cmp dword [ebp - 0xb4], 4
jne 0x1002a2d7
cmp dword [ebp - 0xb0], 0x5a
jne 0x1002a2d7
push str.Microsoft_Windows_Millennium_Edition_n
jmp 0x1002a2c9
push str.Microsoft_Win32s_n
lea eax, [ebp - 0x2b8]
push eax
call fcn.10131845
pop ecx
pop ecx
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x7c]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
add ebp, 0x70
leave
ret 8