Function at 0x4068e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5a574c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x9c
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.00526030
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
mov dword [ebp - 0x140], 0x9c
call esi
mov edi, eax
mov dword [ebp - 0x144], edi
test edi, edi
jne 0x40695e
lea edx, [ebp - 0x140]
push edx
mov dword [ebp - 0x140], 0x94
call esi
test eax, eax
jne 0x40695e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525222
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x130]
sub eax, 0
je 0x407137
dec eax
je 0x407018
dec eax
jne 0x40716a
mov esi, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x138]
cmp esi, 5
jne 0x406a4f
cmp edx, 2
jne 0x4069bd
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406998
mov ecx, 0xb
mov esi, str.Microsoft_Windows_Servernbsp_2003_family_
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x13c]
jmp 0x406a96
cmp edx, 1
jne 0x406a05
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4069c5
mov ecx, dword [str.Microsoft_Windows_XP]
mov dword [eax], ecx
mov ecx, dword [0x554c94]
mov dword [eax + 4], ecx
mov ecx, dword [0x554c98]
mov dword [eax + 8], ecx
mov ecx, dword [0x554c9c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x554ca0]
mov dword [eax + 0x10], ecx
mov cx, word [0x554ca4]
jmp 0x406a92
test edx, edx
jne 0x406a96
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406a10
mov ecx, dword [str.Microsoft_Windows_2000]
mov dword [eax], ecx
mov ecx, dword [0x554c7c]
mov dword [eax + 4], ecx
mov ecx, dword [0x554c80]
mov dword [eax + 8], ecx
mov ecx, dword [0x554c84]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x554c88]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x554c8c]
mov dword [eax + 0x14], ecx
jmp 0x406a96
cmp esi, 4
ja 0x406a96
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406a57
mov ecx, dword [str.Microsoft_Windows_NT]
mov dword [eax], ecx
mov ecx, dword [0x554c64]
mov dword [eax + 4], ecx
mov ecx, dword [0x554c68]
mov dword [eax + 8], ecx
mov ecx, dword [0x554c6c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x554c70]
mov dword [eax + 0x10], ecx
mov cx, word [0x554c74]
mov word [eax + 0x14], cx
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
je 0x406de7
mov al, byte [ebp - 0xa6]
cmp al, 1
jne 0x406b69
lea eax, [ebx - 1]
cmp esi, 4
jne 0x406af9
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406ac0
mov edx, dword [str.Workstation_4.0]
mov dword [eax], edx
mov ecx, dword [0x554c50]
mov dword [eax + 4], ecx
mov edx, dword [0x554c54]
mov dword [eax + 8], edx
mov ecx, dword [0x554c58]
mov dword [eax + 0xc], ecx
mov dl, byte [0x554c5c]
mov byte [eax + 0x10], dl
jmp 0x406f6b
test dword [ebp - 0xa8], 0x200
je 0x406b37
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406b05
mov ecx, dword [str.Home_Edition]
mov dword [eax], ecx
mov edx, dword [0x554c40]
mov dword [eax + 4], edx
mov ecx, dword [0x554c44]
mov dword [eax + 8], ecx
mov dx, word [0x554c48]
mov word [eax + 0xc], dx
jmp 0x406f62
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406b37
mov ecx, dword [str.Professional]
mov dword [eax], ecx
mov edx, dword [0x554c30]
mov dword [eax + 4], edx
mov ecx, dword [0x554c34]
mov dword [eax + 8], ecx
mov dx, word [0x554c38]
mov word [eax + 0xc], dx
jmp 0x406f62
cmp al, 3
jne 0x406f62
cmp esi, 5
jne 0x406d8e
cmp edx, 2
jne 0x406cd3
mov eax, dword [ebp - 0xa8]
test al, al
jns 0x406c1b
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406b94
mov ecx, dword [str.Datacenter_Edition]
mov dword [eax], ecx
mov edx, dword [0x554c1c]
mov dword [eax + 4], edx
mov ecx, dword [0x554c20]
mov dword [eax + 8], ecx
mov edx, dword [0x554c24]
mov dword [eax + 0xc], edx
mov ecx, dword [0x554c28]
mov dword [eax + 0x10], ecx
movzx ecx, word [ebp - 0x134]
push ecx
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x84]
push str._s__Build__d_
push eax
call fcn.00525791
lea eax, [ebp - 0x84]
add esp, 0x10
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406bf3
sub eax, esi
lea edi, [ebx - 1]
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406c00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40716a
test al, 2
je 0x406c5b
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406c22
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x554bf8]
mov dword [eax + 4], ecx
mov edx, dword [0x554bfc]
mov dword [eax + 8], edx
mov ecx, dword [0x554c00]
mov dword [eax + 0xc], ecx
mov edx, dword [0x554c04]
mov dword [eax + 0x10], edx
jmp 0x406bc8
mov ecx, 0x400
cmp ax, cx
lea eax, [ebx - 1]
jne 0x406c98
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406c68
mov edx, dword [str.Web_Edition]
mov dword [eax], edx
mov ecx, dword [0x554be8]
mov dword [eax + 4], ecx
mov edx, dword [0x554bec]
mov dword [eax + 8], edx
mov cl, byte [0x554bf0]
mov byte [eax + 0xc], cl
jmp 0x406bc8
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406c98
mov edx, dword [str.Standard_Edition]
mov dword [eax], edx
mov ecx, dword [0x554bd4]
mov dword [eax + 4], ecx
mov edx, dword [0x554bd8]
mov dword [eax + 8], edx
mov ecx, dword [0x554bdc]
mov dword [eax + 0xc], ecx
mov dx, word [0x554be0]
mov word [eax + 0x10], dx
jmp 0x406bc8
test edx, edx
jne 0x406d8e
mov al, byte [ebp - 0xa8]
test al, al
jns 0x406d2c
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406ce8
mov ecx, dword [str.Datacenter_Server]
mov dword [eax], ecx
mov edx, dword [0x554bc0]
mov dword [eax + 4], edx
mov ecx, dword [0x554bc4]
mov dword [eax + 8], ecx
mov edx, dword [0x554bc8]
mov dword [eax + 0xc], edx
mov cx, word [0x554bcc]
mov word [eax + 0x10], cx
mov dl, byte [0x554bce]
mov byte [eax + 0x12], dl
jmp 0x406bc8
test al, 2
lea eax, [ebx - 1]
je 0x406d70
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406d33
mov ecx, dword [str.Advanced_Server]
mov dword [eax], ecx
mov edx, dword [0x554bac]
mov dword [eax + 4], edx
mov ecx, dword [0x554bb0]
mov dword [eax + 8], ecx
mov edx, dword [0x554bb4]
mov dword [eax + 0xc], edx
mov cl, byte [0x554bb8]
mov byte [eax + 0x10], cl
jmp 0x406bc8
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406d70
mov edx, dword [str.Server]
mov dword [eax], edx
mov ecx, dword [0x554ba4]
mov dword [eax + 4], ecx
jmp 0x406bc8
test byte [ebp - 0xa8], 2
je 0x406db9
lea edi, [ebx - 1]
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406da0
mov ecx, 8
mov esi, str.Server_4.0__Enterprise_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x406f56
lea eax, [ebx - 1]
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406dc0
mov edx, dword [str.Server_4.0]
mov dword [eax], edx
mov ecx, dword [0x554b78]
mov dword [eax + 4], ecx
mov edx, dword [0x554b7c]
mov dword [eax + 8], edx
jmp 0x406f62
lea eax, [ebp - 0x144]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x148], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40694b
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x54]
push edx
push eax
push eax
mov eax, dword [ebp - 0x144]
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40694b
cmp dword [ebp - 0x148], esi
ja 0x40694b
mov ecx, dword [ebp - 0x144]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x54]
push edx
push str.WINNT
call edi
test eax, eax
jne 0x406e92
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406e67
mov ecx, dword [str.Workstation]
mov dword [eax], ecx
mov edx, dword [0x554b24]
mov dword [eax + 4], edx
mov ecx, dword [0x554b28]
mov dword [eax + 8], ecx
mov dl, byte [0x554b2c]
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x54]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x406ebd
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406ea4
mov ecx, dword [str.Server]
mov dword [eax], ecx
mov edx, dword [0x554ba4]
mov dword [eax + 4], edx
lea eax, [ebp - 0x54]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x406f04
lea eax, [ebx - 1]
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406ed0
mov ecx, dword [str.Advanced_Server]
mov dword [eax], ecx
mov edx, dword [0x554bac]
mov dword [eax + 4], edx
mov ecx, dword [0x554bb0]
mov dword [eax + 8], ecx
mov edx, dword [0x554bb4]
mov dword [eax + 0xc], edx
mov cl, byte [0x554bb8]
mov byte [eax + 0x10], cl
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x13c]
push edx
push eax
lea ecx, [ebp - 0xa4]
push str._d._d
push ecx
call fcn.00525791
lea eax, [ebp - 0xa4]
add esp, 0x10
mov esi, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f30
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406f40
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x13c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, 4
jne 0x406bc8
push str.Service_Pack_6
lea edx, [ebp - 0x12c]
push edx
call edi
test eax, eax
jne 0x406bc8
lea eax, [ebp - 0x144]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x84]
test eax, eax
jne 0x406fbe
movzx ecx, word [ebp - 0x134]
push ecx
push str.Service_Pack_6a__Build__d_
push edx
call fcn.00525791
add esp, 0xc
jmp 0x406fdb
movzx eax, word [ebp - 0x134]
push eax
lea ecx, [ebp - 0x12c]
push ecx
push str._s__Build__d_
push edx
call fcn.00525791
add esp, 0x10
lea eax, [ebp - 0x84]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406fe3
sub eax, esi
lea edi, [ebx - 1]
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406ff0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x144]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40716a
cmp dword [ebp - 0x13c], 4
jne 0x40716a
mov eax, dword [ebp - 0x138]
test eax, eax
jne 0x4070a7
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407036
mov ecx, dword [str.Microsoft_Windows_95]
mov dword [eax], ecx
mov edx, dword [0x554a84]
mov dword [eax + 4], edx
mov ecx, dword [0x554a88]
mov dword [eax + 8], ecx
mov edx, dword [0x554a8c]
mov dword [eax + 0xc], edx
mov ecx, dword [0x554a90]
mov dword [eax + 0x10], ecx
mov dx, word [0x554a94]
mov word [eax + 0x14], dx
mov al, byte [ebp - 0x12b]
cmp al, 0x43
je 0x407087
cmp al, 0x42
jne 0x40716a
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x407088
mov eax, dword [str.OSR2]
mov dword [ebx], eax
mov cx, word [0x554a7c]
mov word [ebx + 4], cx
jmp 0x40716a
cmp eax, 0xa
jne 0x407114
lea eax, [ebx - 1]
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4070b0
cmp byte [ebp - 0x12b], 0x41
mov edx, dword [str.Microsoft_Windows_98]
mov dword [eax], edx
mov ecx, dword [0x554a64]
mov dword [eax + 4], ecx
mov edx, dword [0x554a68]
mov dword [eax + 8], edx
mov ecx, dword [0x554a6c]
mov dword [eax + 0xc], ecx
mov edx, dword [0x554a70]
mov dword [eax + 0x10], edx
mov cx, word [0x554a74]
mov word [eax + 0x14], cx
jne 0x40716a
dec ebx
lea ecx, [ecx]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x407100
mov edx, dword [0x554a5c]
mov edi, ebx
mov dword [edi], edx
jmp 0x40716a
cmp eax, 0x5a
jne 0x40716a
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407120
mov ecx, 9
mov esi, str.Microsoft_Windows_Millennium_Edition
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40716a
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x407138
mov eax, dword [str.Microsoft_Win32s]
mov dword [ebx], eax
mov ecx, dword [0x554a24]
mov dword [ebx + 4], ecx
mov edx, dword [0x554a28]
mov dword [ebx + 8], edx
mov eax, dword [0x554a2c]
mov dword [ebx + 0xc], eax
mov cl, byte [0x554a30]
mov byte [ebx + 0x10], cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00525222
mov esp, ebp
pop ebp
ret