Function at 0x401356
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x1ac], 0x190
jg 0x40139a
lea eax, [ebp - 8]
add eax, dword [ebp - 0x1ac]
sub eax, 0x1a0
mov byte [eax], 0
lea eax, [ebp - 0x1ac]
inc dword [eax]
jmp 0x401373
mov dword [esp + 8], 0x24
mov dword [esp + 4], 0
lea eax, [ebp - 0x288]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x9c
mov dword [esp + 4], 0
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x258], 0x9c
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jne 0x40142e
mov dword [ebp - 0x258], 0x94
lea eax, [ebp - 0x258]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
jne 0x40142e
mov dword [ebp - 0x2f4], 0
jmp 0x401c83
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.GetNativeSystemInfo
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x401475
lea eax, [ebp - 0x288]
mov dword [esp], eax
mov eax, dword [ebp - 0x28c]
call eax
sub esp, 4
jmp 0x401486
lea eax, [ebp - 0x288]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
sub esp, 4
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
je 0x401ba7
cmp dword [ebp - 0x2f8], 1
jb 0x401c66
cmp dword [ebp - 0x2f8], 2
je 0x4014ba
jmp 0x401c79
cmp dword [ebp - 0x254], 6
jne 0x4014fd
cmp dword [ebp - 0x250], 0
jne 0x4014fd
cmp byte [ebp - 0x1be], 1
jne 0x4014ea
mov dword [esp + 4], str.Windows_Vista
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x4014fd
mov dword [esp + 4], str.Windows_Server__Longhorn_
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp dword [ebp - 0x254], 5
jne 0x401572
cmp dword [ebp - 0x250], 2
jne 0x401572
mov dword [esp], 0x59
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
test eax, eax
je 0x401537
mov dword [esp + 4], str.Microsoft_Windows_Server_2003__R2_
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x401572
cmp byte [ebp - 0x1be], 1
jne 0x40155f
cmp word [ebp - 0x288], 9
jne 0x40155f
mov dword [esp + 4], str.Microsoft_Windows_XP_Professional_x64_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x401572
mov dword [esp + 4], str.Microsoft_Windows_Server_2003_
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp dword [ebp - 0x254], 5
jne 0x401597
cmp dword [ebp - 0x250], 1
jne 0x401597
mov dword [esp + 4], str.Microsoft_Windows_XP
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp dword [ebp - 0x254], 5
jne 0x4015bc
cmp dword [ebp - 0x250], 0
jne 0x4015bc
mov dword [esp + 4], str.Microsoft_Windows_2000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp dword [ebp - 0x254], 4
ja 0x4015d8
mov dword [esp + 4], str.Microsoft_Windows_NT
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp dword [ebp - 0x290], 0
je 0x4018aa
cmp byte [ebp - 0x1be], 1
jne 0x40165a
cmp word [ebp - 0x288], 9
je 0x40165a
cmp dword [ebp - 0x254], 4
jne 0x401619
mov dword [esp + 4], str.Workstation_4.0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 9
and eax, 1
test al, al
je 0x401642
mov dword [esp + 4], str.Home_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
mov dword [esp + 4], str.Professional
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
cmp byte [ebp - 0x1be], 3
je 0x401671
cmp byte [ebp - 0x1be], 2
je 0x401671
jmp 0x401a48
cmp dword [ebp - 0x254], 5
jne 0x4017ef
cmp dword [ebp - 0x250], 2
jne 0x4017ef
cmp word [ebp - 0x288], 6
jne 0x4016ea
movzx eax, word [ebp - 0x1c0]
shr eax, 7
and eax, 1
test al, al
je 0x4016be
mov dword [esp + 4], str.Datacenter_Edition_for_Itanium_based_Systems
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 1
and eax, 1
test al, al
je 0x401a48
mov dword [esp + 4], str.Enterprise_Edition_for_Itanium_based_Systems
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
cmp word [ebp - 0x288], 9
jne 0x40175d
movzx eax, word [ebp - 0x1c0]
shr eax, 7
and eax, 1
test al, al
je 0x40171d
mov dword [esp + 4], str.Datacenter_x64_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 1
and eax, 1
test al, al
je 0x401745
mov dword [esp + 4], str.Enterprise_x64_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
mov dword [esp + 4], str.Standard_x64_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 7
and eax, 1
test al, al
je 0x401786
mov dword [esp + 4], str.Datacenter_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 1
and eax, 1
test al, al
je 0x4017ae
mov dword [esp + 4], str.Enterprise_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 0xa
and eax, 1
test al, al
je 0x4017d7
mov dword [esp + 4], str.Web_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
mov dword [esp + 4], str.Standard_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
cmp dword [ebp - 0x254], 5
jne 0x40186a
cmp dword [ebp - 0x250], 0
jne 0x40186a
movzx eax, word [ebp - 0x1c0]
shr eax, 7
and eax, 1
test al, al
je 0x40182a
mov dword [esp + 4], str.Datacenter_Server
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 1
and eax, 1
test al, al
je 0x401852
mov dword [esp + 4], str.Advanced_Server
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
mov dword [esp + 4], str.Server
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
movzx eax, word [ebp - 0x1c0]
shr eax, 1
and eax, 1
test al, al
je 0x401892
mov dword [esp + 4], str.Server_4.0__Enterprise_Edition
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
mov dword [esp + 4], str.Server_4.0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401a48
mov dword [ebp - 0x2ec], 0x50
lea eax, [ebp - 0x294]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlProductOptions
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0
je 0x401903
mov dword [ebp - 0x2f4], 0
jmp 0x401c83
lea eax, [ebp - 0x2ec]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2e8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProductType
mov eax, dword [ebp - 0x294]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x294]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp dword [ebp - 0x2f0], 0
jne 0x40196b
cmp dword [ebp - 0x2ec], 0x50
ja 0x40196b
jmp 0x40197a
mov dword [ebp - 0x2f4], 0
jmp 0x401c83
lea eax, [ebp - 0x2e8]
mov dword [esp + 4], eax
mov dword [esp], str.WINNT
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x4019a7
mov dword [esp + 4], str.Workstation
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x2e8]
mov dword [esp + 4], eax
mov dword [esp], str.LANMANNT
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x4019d4
mov dword [esp + 4], str.Server
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x2e8]
mov dword [esp + 4], eax
mov dword [esp], str.SERVERNT
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x401a01
mov dword [esp + 4], str.Advanced_Server
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x250]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x254]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d._d
mov dword [esp + 4], 0x190
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x1a8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
cmp dword [ebp - 0x254], 4
jne 0x401b57
mov dword [esp + 4], str.Service_Pack_6
lea eax, [ebp - 0x258]
add eax, 0x14
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x401b57
lea eax, [ebp - 0x2f0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jne 0x401af6
movzx eax, word [ebp - 0x24c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Service_Pack_6a__Build__d_
mov dword [esp + 4], 0x190
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x1a8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401b41
movzx eax, word [ebp - 0x24c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x258]
add eax, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s__Build__d_
mov dword [esp + 4], 0x190
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x1a8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x2f0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
jmp 0x401c79
movzx eax, word [ebp - 0x24c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x258]
add eax, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s__Build__d_
mov dword [esp + 4], 0x190
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x1a8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x401c79
cmp dword [ebp - 0x254], 4
jne 0x401bf3
cmp dword [ebp - 0x250], 0
jne 0x401bf3
mov dword [esp + 4], str.Microsoft_Windows_95
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x243], 0x43
je 0x401be0
cmp byte [ebp - 0x243], 0x42
je 0x401be0
jmp 0x401bf3
mov dword [esp + 4], str.OSR2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
cmp dword [ebp - 0x254], 4
jne 0x401c3f
cmp dword [ebp - 0x250], 0xa
jne 0x401c3f
mov dword [esp + 4], str.Microsoft_Windows_98
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x243], 0x41
je 0x401c2c
cmp byte [ebp - 0x243], 0x42
je 0x401c2c
jmp 0x401c3f
mov dword [esp + 4], 0x404387
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
cmp dword [ebp - 0x254], 4
jne 0x401c79
cmp dword [ebp - 0x250], 0x5a
jne 0x401c79
mov dword [esp + 4], str.Microsoft_Windows_Millennium_Edition_n
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x401c79
mov dword [esp + 4], str.Microsoft_Win32s
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 0x2f4]
leave
ret