Function at 0x41e3d0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov eax, dword [0x44c060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x1f4], ecx
push edi
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1f0], ebx
mov edi, 1
mov dword [ebp - 0x1e8], 0x11c
call fcn.0041e2f0
test eax, eax
jne 0x41e43c
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], 0x114
call fcn.0041e2f0
test eax, eax
jne 0x41e43a
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e0d6
mov esp, ebp
pop ebp
ret
xor edi, edi
push str.GetNativeSystemInfo
push 0x436f7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41e462
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x41e46f
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1d8]
push esi
xor esi, esi
sub eax, esi
je 0x41e7d2
dec eax
je 0x41e78f
dec eax
jne 0x41e61e
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e0]
cmp edx, 5
ja 0x41e4a9
jne 0x41e4b9
test eax, eax
je 0x41e531
cmp word [ebp - 0xcc], 9
mov ecx, 0x80000
cmove esi, ecx
cmp edx, 6
jne 0x41e528
cmp eax, 3
jne 0x41e4ce
or esi, 0x1800
jmp 0x41e61e
cmp eax, 2
jne 0x41e4de
or esi, 0x1700
jmp 0x41e61e
cmp eax, 1
jne 0x41e501
cmp byte [ebp - 0xce], al
jne 0x41e4f6
or esi, 0x1600
jmp 0x41e61e
or esi, 0x150b
jmp 0x41e61e
test eax, eax
jne 0x41e61e
or esi, 0x1500
cmp byte [ebp - 0xce], 1
jne 0x41e520
or esi, 0xa
jmp 0x41e61e
or esi, 0xb
jmp 0x41e61e
cmp edx, 5
jne 0x41e665
cmp eax, 2
jne 0x41e5d7
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
test eax, eax
mov ax, word [ebp - 0xcc]
jne 0x41e580
mov edx, 0x2000
cmp cx, dx
je 0x41e580
mov edx, 0x8000
cmp cx, dx
je 0x41e580
cmp bl, 1
jne 0x41e580
cmp ax, 9
jne 0x41e580
or esi, 0x81300
jmp 0x41e5c0
or esi, 0x1400
test cl, cl
jns 0x41e58f
or esi, 4
jmp 0x41e5a9
test cl, 2
je 0x41e599
or esi, 5
jmp 0x41e5a9
test ecx, 0x400
je 0x41e5a6
or esi, 6
jmp 0x41e5a9
or esi, 7
cmp bl, 1
je 0x41e5c0
cmp ax, 6
je 0x41e5ba
cmp ax, 9
jne 0x41e5c0
or esi, 0x80000
mov edx, dword [ebp - 0x1e4]
cmp edx, 5
jne 0x41e671
mov eax, dword [ebp - 0x1e0]
jmp 0x41e5e3
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
cmp eax, 1
jne 0x41e606
mov ebx, dword [ebp - 0x1f0]
or esi, 0x1300
test ecx, 0x200
je 0x41e601
or esi, 2
jmp 0x41e61e
or esi, 3
jmp 0x41e61e
test eax, eax
jne 0x41e618
or esi, 0x1200
cmp bl, 1
jne 0x41e64c
or esi, 3
mov ebx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1f4]
test eax, eax
je 0x41e62a
mov dword [eax], esi
test ebx, ebx
je 0x41e636
mov eax, dword [ebp - 0x1dc]
mov dword [ebx], eax
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e0d6
mov esp, ebp
pop ebp
ret
test cl, cl
jns 0x41e655
or esi, 4
jmp 0x41e618
mov ebx, dword [ebp - 0x1f0]
test cl, 2
je 0x41e6bd
or esi, 8
jmp 0x41e61e
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
cmp edx, 4
jne 0x41e67e
or esi, 0x1100
jmp 0x41e68b
jae 0x41e686
or esi, 0x1000
cmp edx, 4
ja 0x41e618
test edi, edi
je 0x41e6c5
cmp bl, 1
jne 0x41e69c
or esi, 1
jmp 0x41e618
cmp bl, 3
je 0x41e6aa
cmp bl, 2
jne 0x41e618
mov ebx, dword [ebp - 0x1f0]
test cl, 2
je 0x41e6bd
or esi, 5
jmp 0x41e61e
or esi, 9
jmp 0x41e61e
lea eax, [ebp - 0x1ec]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xa8], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e77c
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e77c
cmp dword [ebp - 0xa8], 0x50
ja 0x41e77c
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0xa4]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x41e749
or esi, 1
lea eax, [ebp - 0xa4]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x41e75e
or esi, 9
lea eax, [ebp - 0xa4]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x41e618
or esi, 8
jmp 0x41e618
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0042e0d6
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1e4], 4
jne 0x41e61e
mov eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x41e7b0
mov esi, 0x200
jmp 0x41e61e
cmp eax, 0xa
jne 0x41e7bf
mov esi, 0x300
jmp 0x41e61e
cmp eax, 0x5a
jne 0x41e61e
mov esi, 0x400
jmp 0x41e61e
mov esi, 0x100
jmp 0x41e61e