Function at 0x46bc44
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x438
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov r12, r9
mov r15, r8
mov r13, rdx
mov rdi, rcx
mov ebp, 0xe
xor esi, esi
mov dword [r9], esi
mov ebx, 0x11c
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.00449860
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r14d, eax
cmp eax, esi
jne 0x46bcce
mov dword [rsp + 0x60], VarUI4FromDisp
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, esi
je 0x46c0f6
mov eax, dword [rsp + 0x70]
cmp eax, esi
je 0x46c0da
sub eax, 1
je 0x46bfae
cmp eax, 1
jne 0x46c0f6
lea r8, str.Win_NT
mov rbx, qword [rsp + 0x4a0]
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
mov eax, dword [rsp + 0x64]
cmp eax, 4
jae 0x46bd19
mov ebp, 1
jmp 0x46bea9
cmp eax, 4
jne 0x46bdc1
mov ebp, eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x180]
call fcn.00449860
mov dword [rsp + 0x20], ebp
lea r9, [0x0049bdfc]
or rdi, 0xffffffffffffffff
mov r8, rdi
mov rbx, qword [rsp + 0x4a8]
mov rdx, rbx
mov rcx, r13
call fcn.00445024
xor eax, eax
mov rcx, rdi
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdx, rbx
sub rdx, rcx
lea r8, [0x0049e5ac]
mov rcx, r13
call fcn.00444f54
mov edx, dword [rsp + 0x68]
mov dword [rsp + 0x20], edx
lea r9, [0x0049bdfc]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.00445024
lea r8, [rsp + 0x180]
mov rdx, rbx
mov rcx, r13
call fcn.00444f54
jmp 0x46bea9
mov ebp, 5
cmp eax, ebp
jne 0x46be47
mov eax, dword [rsp + 0x68]
cmp eax, esi
jne 0x46bde9
lea r8, str.Win_2k
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
jmp 0x46bea9
cmp eax, 1
jne 0x46be2b
cmp byte [rsp + 0x17a], 3
jne 0x46be12
lea ebp, [rax + 9]
lea r8, str.Win_XP_Server
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
jmp 0x46bea9
mov ebp, 9
lea r8, str.Win_XP
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
jmp 0x46bea9
cmp eax, 2
jne 0x46be92
lea ebp, [rax + 8]
lea r8, str.Win_XP_Server
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
jmp 0x46bea9
mov ebp, 6
cmp eax, ebp
jne 0x46be92
cmp dword [rsp + 0x68], esi
jne 0x46be92
cmp byte [rsp + 0x17a], 1
jne 0x46be79
mov ebp, 0xb
lea r8, str.Win_Vista
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
jmp 0x46bea9
mov ebp, 0xc
lea r8, str.Win_Longhorn_Server
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
jmp 0x46bea9
mov ebp, 8
lea r8, str.Win_NT_Next
mov rdx, rbx
mov rcx, rdi
call fcn.004444bc
cmp r14d, esi
je 0x46becb
mov al, byte [rsp + 0x17a]
cmp al, 2
je 0x46bebd
cmp al, 3
jne 0x46bec2
mov esi, 1
mov dword [r12], esi
jmp 0x46c0f6
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
jne 0x46c0f6
mov word [rsp + 0x180], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x182]
call fcn.00449860
mov dword [rsp + 0x3c], 0x208
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.ProductType
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x46bf9e
lea rdx, str.ServerNT
lea rcx, [rsp + 0x180]
call fcn.00446160
cmp eax, esi
je 0x46bf96
lea rdx, str.LanmanNT
lea rcx, [rsp + 0x180]
call fcn.00446160
cmp eax, esi
je 0x46bf96
lea rdx, str.LANSECNT
lea rcx, [rsp + 0x180]
call fcn.00446160
cmp eax, esi
jne 0x46bf9e
mov dword [r12], 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46c0f6
cmp dword [rsp + 0x68], esi
jne 0x46bfd5
lea r8, str.Win_95
mov r12, qword [rsp + 0x4a0]
mov rdx, r12
mov rcx, rdi
call fcn.004444bc
mov ebp, esi
jmp 0x46c0aa
mov rbx, rsi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], esi
lea rcx, [rsp + 0x390]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSetupOptionalComponentsICS
mov r8d, 0x8e
call fcn.00449960
lea r8, str.Win_98
mov r12, qword [rsp + 0x4a0]
mov rdx, r12
mov rcx, rdi
call fcn.004444bc
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0x390]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x46c076
mov dword [rsp + 0x48], esi
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], esi
mov ebp, 3
lea r8, str.Second_Edition
mov rdx, qword [rsp + 0x4a8]
mov rcx, r13
call fcn.004444bc
jmp 0x46c093
mov ebp, 2
lea r8, str.Gold
mov rdx, qword [rsp + 0x4a8]
mov rcx, r13
call fcn.004444bc
nop
cmp rbx, rsi
je 0x46c0a6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], esi
mov ecx, dword [rsp + 0x6c]
shr ecx, 0x10
movzx eax, cx
shr ax, 8
cmp al, 4
jne 0x46c0f6
cmp cl, 0x5a
jne 0x46c0f6
lea r8, str.Win_Millenium
mov rdx, r12
mov rcx, rdi
call fcn.004444bc
mov ebp, 6
jmp 0x46c0f6
lea r8, str.Win_3.1
mov rdx, qword [rsp + 0x4a0]
mov rcx, rdi
call fcn.004444bc
mov ebp, 0xd
lea r8, [rsp + 0x74]
mov rdx, qword [rsp + 0x4b0]
mov rcx, r15
call fcn.004444bc
mov eax, ebp
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x438
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret