Function at 0x4097a0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0xf8
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
mov ebx, dword [esp + 0x100]
push ebp
push esi
push 0x9c
lea eax, [esp + 0x18]
push 0
push eax
mov byte [ebx], 0
call fcn.0040d5a0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x9c
call esi
mov ebp, eax
test ebp, ebp
jne 0x40981b
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0x94
call esi
test eax, eax
jne 0x40981b
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xf4]
xor ecx, esp
call fcn.0040d55f
add esp, 0xf8
ret
mov eax, dword [esp + 0x24]
sub eax, 0
push edi
je 0x409f98
sub eax, 1
je 0x409e7e
sub eax, 1
jne 0x409fd4
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
cmp eax, 6
jne 0x40988c
mov edi, ebx
dec edi
test edx, edx
jne 0x409870
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409850
mov ecx, 8
mov esi, str.Microsoft_Windows_Vista_family_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x409996
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409870
mov ecx, 0xa
mov esi, str.Microsoft_Windows_Vista_family___Unknown_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x409996
cmp eax, 5
jne 0x40994f
cmp edx, 2
jne 0x4098bc
mov edi, ebx
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4098a0
mov ecx, 9
mov esi, str.Microsoft_Windows_Server_2003_family_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x409996
cmp edx, 1
jne 0x409904
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4098c4
mov ecx, dword [str.Microsoft_Windows_XP]
mov dword [eax], ecx
mov ecx, dword [0x42ae04]
mov dword [eax + 4], ecx
mov ecx, dword [0x42ae08]
mov dword [eax + 8], ecx
mov ecx, dword [0x42ae0c]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x42ae10]
mov dword [eax + 0x10], ecx
mov cx, word [0x42ae14]
jmp 0x409992
test edx, edx
jne 0x409996
mov eax, ebx
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409910
mov ecx, dword [str.Microsoft_Windows_2000]
mov dword [eax], ecx
mov ecx, dword [0x42adec]
mov dword [eax + 4], ecx
mov ecx, dword [0x42adf0]
mov dword [eax + 8], ecx
mov ecx, dword [0x42adf4]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x42adf8]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x42adfc]
mov dword [eax + 0x14], ecx
jmp 0x409996
cmp eax, 4
ja 0x409996
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409957
mov ecx, dword [str.Microsoft_Windows_NT]
mov dword [eax], ecx
mov ecx, dword [0x42add4]
mov dword [eax + 4], ecx
mov ecx, dword [0x42add8]
mov dword [eax + 8], ecx
mov ecx, dword [0x42addc]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x42ade0]
mov dword [eax + 0x10], ecx
mov cx, word [0x42ade4]
mov word [eax + 0x14], cx
test ebp, ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x409c87
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x409a6a
mov eax, ebx
dec eax
cmp dword [esp + 0x1c], 4
jne 0x4099f9
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4099c0
mov edx, dword [str.Workstation_4.0]
mov dword [eax], edx
mov ecx, dword [0x42adc0]
mov dword [eax + 4], ecx
mov edx, dword [0x42adc4]
mov dword [eax + 8], edx
mov ecx, dword [0x42adc8]
mov dword [eax + 0xc], ecx
mov dl, byte [0x42adcc]
mov byte [eax + 0x10], dl
jmp 0x409dde
test dword [esp + 0xb0], 0x200
je 0x409a38
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a06
mov ecx, dword [str.Home_Edition]
mov dword [eax], ecx
mov edx, dword [0x42adb0]
mov dword [eax + 4], edx
mov ecx, dword [0x42adb4]
mov dword [eax + 8], ecx
mov dx, word [0x42adb8]
mov word [eax + 0xc], dx
jmp 0x409dd3
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a38
mov ecx, dword [str.Professional]
mov dword [eax], ecx
mov edx, dword [0x42ada0]
mov dword [eax + 4], edx
mov ecx, dword [0x42ada4]
mov dword [eax + 8], ecx
mov dx, word [0x42ada8]
mov word [eax + 0xc], dx
jmp 0x409dd3
cmp al, 3
jne 0x409dd3
cmp dword [esp + 0x1c], 5
jne 0x409c2e
cmp edx, 2
jne 0x409b72
mov al, byte [esp + 0xb0]
test al, al
jns 0x409af9
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a94
mov ecx, dword [str.Datacenter_Edition]
mov dword [eax], ecx
mov edx, dword [0x42ad8c]
mov dword [eax + 4], edx
mov ecx, dword [0x42ad90]
mov dword [eax + 8], ecx
mov edx, dword [0x42ad94]
mov dword [eax + 0xc], edx
mov ecx, dword [0x42ad98]
mov dword [eax + 0x10], ecx
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409ad0
movzx ecx, word [esp + 0x24]
sub eax, edx
push ecx
lea edx, [esp + 0x30]
push edx
add eax, ebx
push str._s__Build__d_
push eax
call fcn.0040e41b
add esp, 0x10
jmp 0x409fd4
test al, 2
mov eax, ebx
je 0x409b36
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409b00
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x42ad68]
mov dword [eax + 4], ecx
mov edx, dword [0x42ad6c]
mov dword [eax + 8], edx
mov ecx, dword [0x42ad70]
mov dword [eax + 0xc], ecx
mov edx, dword [0x42ad74]
mov dword [eax + 0x10], edx
jmp 0x409ac8
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409b37
mov ecx, dword [str.Standard_Edition]
mov dword [eax], ecx
mov edx, dword [0x42ad54]
mov dword [eax + 4], edx
mov ecx, dword [0x42ad58]
mov dword [eax + 8], ecx
mov edx, dword [0x42ad5c]
mov dword [eax + 0xc], edx
mov cx, word [0x42ad60]
mov word [eax + 0x10], cx
jmp 0x409ac8
test edx, edx
jne 0x409c2e
mov al, byte [esp + 0xb0]
test al, al
jns 0x409bcc
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409b88
mov edx, dword [str.Datacenter_Server]
mov dword [eax], edx
mov ecx, dword [0x42ad40]
mov dword [eax + 4], ecx
mov edx, dword [0x42ad44]
mov dword [eax + 8], edx
mov ecx, dword [0x42ad48]
mov dword [eax + 0xc], ecx
mov dx, word [0x42ad4c]
mov word [eax + 0x10], dx
mov cl, byte [0x42ad4e]
mov byte [eax + 0x12], cl
jmp 0x409ac8
test al, 2
mov eax, ebx
je 0x409c0c
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409bd3
mov edx, dword [str.Advanced_Server]
mov dword [eax], edx
mov ecx, dword [0x42ad2c]
mov dword [eax + 4], ecx
mov edx, dword [0x42ad30]
mov dword [eax + 8], edx
mov ecx, dword [0x42ad34]
mov dword [eax + 0xc], ecx
mov dl, byte [0x42ad38]
mov byte [eax + 0x10], dl
jmp 0x409ac8
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409c10
mov ecx, dword [str.Server]
mov dword [eax], ecx
mov edx, dword [0x42ad24]
mov dword [eax + 4], edx
jmp 0x409ac8
test byte [esp + 0xb0], 2
je 0x409c59
mov edi, ebx
dec edi
jmp 0x409c40
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409c40
mov ecx, 8
mov esi, str.Server_4.0__Enterprise_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x409dd3
mov eax, ebx
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409c60
mov ecx, dword [str.Server_4.0]
mov dword [eax], ecx
mov edx, dword [0x42acf8]
mov dword [eax + 4], edx
mov ecx, dword [0x42acfc]
mov dword [eax + 8], ecx
jmp 0x409dd3
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
call ebp
test eax, eax
jne 0x409e77
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xb8]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409e77
cmp dword [esp + 0x14], esi
ja 0x409e77
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0xb4]
push ecx
push str.WINNT
call esi
test eax, eax
jne 0x409d32
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409d07
mov edx, dword [str.Workstation]
mov dword [eax], edx
mov ecx, dword [0x42aca4]
mov dword [eax + 4], ecx
mov edx, dword [0x42aca8]
mov dword [eax + 8], edx
mov cl, byte [0x42acac]
mov byte [eax + 0xc], cl
lea edx, [esp + 0xb4]
push edx
push str.LANMANNT
call esi
test eax, eax
jne 0x409d61
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409d48
mov ecx, dword [str.Server]
mov dword [eax], ecx
mov edx, dword [0x42ad24]
mov dword [eax + 4], edx
lea eax, [esp + 0xb4]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x409dab
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409d77
mov ecx, dword [str.Advanced_Server]
mov dword [eax], ecx
mov edx, dword [0x42ad2c]
mov dword [eax + 4], edx
mov ecx, dword [0x42ad30]
mov dword [eax + 8], ecx
mov edx, dword [0x42ad34]
mov dword [eax + 0xc], edx
mov cl, byte [0x42ad38]
mov byte [eax + 0x10], cl
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409db0
mov ecx, dword [esp + 0x1c]
sub eax, edx
mov edx, dword [esp + 0x20]
push edx
push ecx
add eax, ebx
push str._d._d
push eax
call fcn.0040e41b
add esp, 0x10
cmp dword [esp + 0x1c], 4
jne 0x409ac8
push str.Service_Pack_6
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409ac8
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
mov eax, ebx
lea edx, [eax + 1]
jne 0x409e43
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409e14
movzx ecx, word [esp + 0x24]
push ecx
sub eax, edx
add eax, ebx
push str.Service_Pack_6a__Build__d_
push eax
call fcn.0040e41b
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409fd4
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409e43
sub eax, edx
movzx edx, word [esp + 0x24]
push edx
lea ecx, [esp + 0x30]
push ecx
add eax, ebx
push str._s__Build__d_
push eax
call fcn.0040e41b
mov edx, dword [esp + 0x20]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409fd4
xor eax, eax
jmp 0x409fd9
cmp dword [esp + 0x1c], 4
jne 0x409fd4
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x409f10
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409e98
mov ecx, dword [str.Microsoft_Windows_95]
mov dword [eax], ecx
mov edx, dword [0x42ac04]
mov dword [eax + 4], edx
mov ecx, dword [0x42ac08]
mov dword [eax + 8], ecx
mov edx, dword [0x42ac0c]
mov dword [eax + 0xc], edx
mov ecx, dword [0x42ac10]
mov dword [eax + 0x10], ecx
mov dx, word [0x42ac14]
mov word [eax + 0x14], dx
mov al, byte [esp + 0x2d]
cmp al, 0x43
je 0x409ee7
cmp al, 0x42
jne 0x409fd4
dec ebx
mov eax, ebx
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409ef0
mov ecx, dword [str.OSR2]
mov dword [eax], ecx
mov dx, word [0x42abfc]
mov word [eax + 4], dx
jmp 0x409fd4
cmp eax, 0xa
jne 0x409f79
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409f18
cmp byte [esp + 0x2d], 0x41
mov ecx, dword [str.Microsoft_Windows_98]
mov dword [eax], ecx
mov edx, dword [0x42abe4]
mov dword [eax + 4], edx
mov ecx, dword [0x42abe8]
mov dword [eax + 8], ecx
mov edx, dword [0x42abec]
mov dword [eax + 0xc], edx
mov ecx, dword [0x42abf0]
mov dword [eax + 0x10], ecx
mov dx, word [0x42abf4]
mov word [eax + 0x14], dx
jne 0x409fd4
dec ebx
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409f65
mov eax, dword [0x42abdc]
mov dword [edi], eax
jmp 0x409fd4
cmp eax, 0x5a
jne 0x409fd4
dec ebx
mov edi, ebx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409f81
mov ecx, 9
mov esi, str.Microsoft_Windows_Millennium_Edition
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x409fd4
dec ebx
mov eax, ebx
jmp 0x409fa0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409fa0
mov ecx, dword [str.Microsoft_Win32s]
mov dword [eax], ecx
mov edx, dword [0x42aba4]
mov dword [eax + 4], edx
mov ecx, dword [0x42aba8]
mov dword [eax + 8], ecx
mov edx, dword [0x42abac]
mov dword [eax + 0xc], edx
mov cl, byte [0x42abb0]
mov byte [eax + 0x10], cl
mov eax, 1
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040d55f
add esp, 0xf8
ret