Function at 0x402bc0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x144
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x9c
push eax
call esi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x402c17
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x94
push ecx
call esi
test eax, eax
jne 0x402c17
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x144
ret
mov ebx, dword [esp + 0x158]
mov eax, dword [esp + 0x28]
sub eax, 0
mov byte [ebx], 0
je 0x4030d6
dec eax
je 0x40303e
dec eax
jne 0x403100
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
cmp eax, 5
jne 0x402c6c
cmp edx, 2
jne 0x402c55
mov edi, str.Microsoft_Windows_.NET_Server_2003_family_
jmp 0x402c76
cmp edx, 1
jne 0x402c61
mov edi, str.Microsoft_Windows_XP
jmp 0x402c76
test edx, edx
jne 0x402c9b
mov edi, str.Microsoft_Windows_2000
jmp 0x402c76
cmp eax, 4
ja 0x402c9b
mov edi, str.Microsoft_Windows_NT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402dff
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x402d0e
cmp dword [esp + 0x1c], 4
jne 0x402cee
mov edi, str.Workstation_4.0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x402f7b
mov eax, dword [esp + 0xb0]
test ah, 2
je 0x402d04
mov edi, str.Home_Edition
jmp 0x402f4b
mov edi, str.Professional
jmp 0x402f4b
cmp al, 3
jne 0x402f70
cmp dword [esp + 0x1c], 5
jne 0x402de1
cmp edx, 2
jne 0x402db0
mov eax, dword [esp + 0xb0]
test al, 0x80
je 0x402d91
mov edi, str.Datacenter_Edition
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2c]
and ecx, 0xffff
lea eax, [esp + 0xb4]
push ecx
push edx
push str._s__Build__d_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edi, [esp + 0xb4]
jmp 0x4030db
test al, 2
je 0x402d9c
mov edi, str.Enterprise_Edition
jmp 0x402d3a
cmp ax, 0x400
jne 0x402da9
mov edi, str.Web_Edition
jmp 0x402d3a
mov edi, str.Standard_Edition
jmp 0x402d3a
test edx, edx
jne 0x402de1
mov al, byte [esp + 0xb0]
test al, 0x80
je 0x402dc9
mov edi, str.Datacenter_Server
jmp 0x402d3a
test al, 2
je 0x402dd7
mov edi, str.Advanced_Server
jmp 0x402d3a
mov edi, str.Server
jmp 0x402d3a
test byte [esp + 0xb0], 2
je 0x402df5
mov edi, str.Server_4.0__Enterprise_Edition
jmp 0x402f4b
mov edi, str.Server_4.0
jmp 0x402f4b
lea eax, [esp + 0x10]
mov esi, 0x50
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [esp + 0x28], esi
call ebp
test eax, eax
je 0x402e31
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x144
ret
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x104]
push ecx
push edx
push 0
push 0
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402e21
cmp dword [esp + 0x14], esi
ja 0x402e21
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x104]
push edx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402ea6
mov edi, str.Workstation
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x104]
push eax
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402ee5
mov edi, str.Server
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x104]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402f24
mov edi, str.Advanced_Server
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0xbc]
push str._d._d
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x1c], 4
jne 0x402d5f
lea eax, [esp + 0x2c]
push str.Service_Pack_6
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402d5f
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push 0x80000002
call ebp
test eax, eax
jne 0x402fd5
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xb4]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edi, [esp + 0xb4]
jmp 0x403001
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
and eax, 0xffff
lea edx, [esp + 0xb4]
push eax
push ecx
push str._s__Build__d_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
cmp dword [esp + 0x1c], 4
jne 0x403100
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x40308c
mov edi, str.Microsoft_Windows_95
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x2d]
mov ecx, edx
and ecx, 3
cmp al, 0x43
rep movsb byte es:[edi], byte [esi]
je 0x403085
cmp al, 0x42
jne 0x403100
mov edi, str.OSR2
jmp 0x4030db
cmp eax, 0xa
jne 0x4030ca
mov edi, str.Microsoft_Windows_98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x2d]
mov ecx, edx
and ecx, 3
cmp al, 0x41
rep movsb byte es:[edi], byte [esi]
jne 0x403100
mov edi, 0x4072f0
jmp 0x4030db
cmp eax, 0x5a
jne 0x403100
mov edi, str.Microsoft_Windows_Millennium_Edition
jmp 0x4030db
mov edi, str.Microsoft_Win32s
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret