Function at 0x1800cf7f
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3b8]
sub esp, 0x438
mov eax, dword [0x180af1d0]
xor eax, ebp
mov dword [ebp + 0x3b4], eax
mov eax, dword [ebp + 0x3c0]
push ebx
push esi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3c4]
push edi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x3c8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x80], eax
mov word [eax], cx
xor eax, eax
mov esi, 0x11c
push esi
push eax
mov word [ebp + 0x1ac], ax
lea eax, [ebp - 0x70]
push eax
mov ebx, edx
call fcn.180769e0
add esp, 0xc
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x1800d00b
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x114
call esi
test eax, eax
jne 0x1800d00b
xor al, al
jmp 0x1800d49b
movzx eax, word [ebp + 0xa4]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x78]
mov dword [edi], ecx
mov dword [ebx], edx
mov dword [esi], eax
movzx eax, word [ebp + 0xa6]
mov esi, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x60]
sub eax, 0
je 0x1800d453
dec eax
je 0x1800d3c6
dec eax
je 0x1800d04d
push str.Unknown_operating_system
jmp 0x1800d458
push 5
pop esi
cmp ecx, esi
jne 0x1800d0a8
cmp edx, 2
jne 0x1800d071
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_Server_2003_family_
push eax
call fcn.18008a4c
pop ecx
pop ecx
cmp dword [ebp - 0x6c], esi
jne 0x1800d0a8
cmp dword [ebp - 0x68], 1
jne 0x1800d08f
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_XP
push eax
call fcn.18008a4c
pop ecx
pop ecx
cmp dword [ebp - 0x6c], esi
jne 0x1800d0a8
cmp dword [ebp - 0x68], 0
jne 0x1800d0c1
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_2000
push eax
call fcn.18008a4c
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
ja 0x1800d0c1
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_NT
push eax
call fcn.18008a4c
pop ecx
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
cmp dword [ebp - 0x7c], eax
je 0x1800d1d8
cmp byte [ebp + 0xaa], 1
jne 0x1800d111
cmp dword [ebp - 0x6c], 4
lea eax, [ebp + 0x1ac]
jne 0x1800d0f1
push str.Workstation_4.0
jmp 0x1800d1cb
test dword [ebp + 0xa8], 0x200
je 0x1800d107
push str.Home_Edition
jmp 0x1800d1cb
push str.Professional
jmp 0x1800d1cb
cmp byte [ebp + 0xaa], 3
je 0x1800d127
cmp byte [ebp + 0xaa], 2
jne 0x1800d2ee
cmp dword [ebp - 0x6c], esi
jne 0x1800d1b0
cmp dword [ebp - 0x68], 2
jne 0x1800d17e
test byte [ebp + 0xa8], 0x80
je 0x1800d146
push str.Datacenter_Edition
jmp 0x1800d154
test byte [ebp + 0xa8], 2
je 0x1800d15c
push str.Enterprise_Edition
lea eax, [ebp + 0x1ac]
jmp 0x1800d1cb
mov eax, 0x400
cmp word [ebp + 0xa8], ax
lea eax, [ebp + 0x1ac]
jne 0x1800d177
push str.Web_Edition
jmp 0x1800d1cb
push str.Standard_Edition
jmp 0x1800d1cb
cmp dword [ebp - 0x68], eax
jne 0x1800d1b0
test byte [ebp + 0xa8], 0x80
lea eax, [ebp + 0x1ac]
je 0x1800d199
push str.Datacenter_Server
jmp 0x1800d1cb
test byte [ebp + 0xa8], 2
je 0x1800d1a9
push str.Advanced_Server
jmp 0x1800d1cb
push str.Server
jmp 0x1800d1cb
test byte [ebp + 0xa8], 2
lea eax, [ebp + 0x1ac]
je 0x1800d1c6
push str.Server_4.0__Enterprise_Edition
jmp 0x1800d1cb
push str.Server_4.0
push eax
call fcn.18008a4c
pop ecx
pop ecx
jmp 0x1800d2ee
push 0x7e
push eax
lea eax, [ebp + 0xae]
xor ecx, ecx
push eax
mov word [ebp + 0xac], cx
call fcn.180769e0
add esp, 0xc
push 0x40
pop esi
lea eax, [ebp - 0x78]
push eax
push 1
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 0x74], esi
call ebx
test eax, eax
jne 0x1800d004
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xac]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800d004
cmp dword [ebp - 0x74], esi
ja 0x1800d004
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp + 0xac]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x1800d276
lea eax, [ebp + 0x1ac]
push str.Workstation
push eax
call fcn.18008a4c
pop ecx
pop ecx
lea eax, [ebp + 0xac]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x1800d29b
lea eax, [ebp + 0x1ac]
push str.Server
push eax
call fcn.18008a4c
pop ecx
pop ecx
lea eax, [ebp + 0xac]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x1800d2c0
lea eax, [ebp + 0x1ac]
push str.Advanced_Server
push eax
call fcn.18008a4c
pop ecx
pop ecx
push dword [ebp - 0x68]
lea eax, [ebp + 0x12c]
push dword [ebp - 0x6c]
push 0x1809d248
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008a4c
add esp, 0x18
cmp dword [ebp - 0x6c], 4
jne 0x1800d390
push str.Service_Pack_6
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1800d390
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push 0x80000002
call ebx
test eax, eax
movzx eax, word [ebp - 0x64]
push eax
jne 0x1800d356
lea eax, [ebp + 0x12c]
push str.Service_Pack_6a__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008a4c
add esp, 0x14
jmp 0x1800d382
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x12c]
push str._s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008a4c
add esp, 0x18
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800d466
movzx eax, word [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x12c]
push str._s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008a4c
add esp, 0x18
jmp 0x1800d466
cmp ecx, 4
jne 0x1800d466
test edx, edx
jne 0x1800d40d
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_95
push eax
call fcn.18008a4c
cmp word [ebp - 0x5a], 0x43
pop ecx
pop ecx
je 0x1800d3f4
cmp word [ebp - 0x5a], 0x42
jne 0x1800d407
lea eax, [ebp + 0x1ac]
push str.OSR2
push eax
call fcn.18008a4c
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
jne 0x1800d466
cmp dword [ebp - 0x68], 0xa
jne 0x1800d446
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_98
push eax
call fcn.18008a4c
cmp word [ebp - 0x5a], 0x41
pop ecx
pop ecx
jne 0x1800d440
lea eax, [ebp + 0x1ac]
push 0x1809d3a8
push eax
call fcn.18008a4c
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
jne 0x1800d466
cmp dword [ebp - 0x68], 0x5a
jne 0x1800d466
push str.Microsoft_Windows_Millennium_Edition
jmp 0x1800d458
push str.Microsoft_Win32s
lea eax, [ebp + 0x1ac]
push eax
call fcn.18008a4c
pop ecx
pop ecx
lea eax, [ebp + 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 + 0x1aa]
cmp word [eax], 0
jne 0x1800d485
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x80]
push 0x104
lea edx, [ebp + 0x1ac]
call fcn.180082c0
pop ecx
mov al, 1
mov ecx, dword [ebp + 0x3b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18075e75
add ebp, 0x3b8
leave
ret