Function at 0x406c70
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5a674c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x9c
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.00525ee0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
mov dword [ebp - 0x140], 0x9c
call esi
mov edi, eax
mov dword [ebp - 0x144], edi
test edi, edi
jne 0x406cee
lea edx, [ebp - 0x140]
push edx
mov dword [ebp - 0x140], 0x94
call esi
test eax, eax
jne 0x406cee
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525092
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x130]
sub eax, 0
je 0x4074c7
dec eax
je 0x4073a8
dec eax
jne 0x4074fa
mov esi, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x138]
cmp esi, 5
jne 0x406ddf
cmp edx, 2
jne 0x406d4d
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406d28
mov ecx, 0xb
mov esi, str.Microsoft_Windows_Servernbsp_2003_family_
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x13c]
jmp 0x406e26
cmp edx, 1
jne 0x406d95
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406d55
mov ecx, dword [str.Microsoft_Windows_XP]
mov dword [eax], ecx
mov ecx, dword [0x55610c]
mov dword [eax + 4], ecx
mov ecx, dword [0x556110]
mov dword [eax + 8], ecx
mov ecx, dword [0x556114]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x556118]
mov dword [eax + 0x10], ecx
mov cx, word [0x55611c]
jmp 0x406e22
test edx, edx
jne 0x406e26
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406da0
mov ecx, dword [str.Microsoft_Windows_2000]
mov dword [eax], ecx
mov ecx, dword [0x5560f4]
mov dword [eax + 4], ecx
mov ecx, dword [0x5560f8]
mov dword [eax + 8], ecx
mov ecx, dword [0x5560fc]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x556100]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x556104]
mov dword [eax + 0x14], ecx
jmp 0x406e26
cmp esi, 4
ja 0x406e26
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406de7
mov ecx, dword [str.Microsoft_Windows_NT]
mov dword [eax], ecx
mov ecx, dword [0x5560dc]
mov dword [eax + 4], ecx
mov ecx, dword [0x5560e0]
mov dword [eax + 8], ecx
mov ecx, dword [0x5560e4]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x5560e8]
mov dword [eax + 0x10], ecx
mov cx, word [0x5560ec]
mov word [eax + 0x14], cx
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
je 0x407177
mov al, byte [ebp - 0xa6]
cmp al, 1
jne 0x406ef9
lea eax, [ebx - 1]
cmp esi, 4
jne 0x406e89
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406e50
mov edx, dword [str.Workstation_4.0]
mov dword [eax], edx
mov ecx, dword [0x5560c8]
mov dword [eax + 4], ecx
mov edx, dword [0x5560cc]
mov dword [eax + 8], edx
mov ecx, dword [0x5560d0]
mov dword [eax + 0xc], ecx
mov dl, byte [0x5560d4]
mov byte [eax + 0x10], dl
jmp 0x4072fb
test dword [ebp - 0xa8], 0x200
je 0x406ec7
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406e95
mov ecx, dword [str.Home_Edition]
mov dword [eax], ecx
mov edx, dword [0x5560b8]
mov dword [eax + 4], edx
mov ecx, dword [0x5560bc]
mov dword [eax + 8], ecx
mov dx, word [0x5560c0]
mov word [eax + 0xc], dx
jmp 0x4072f2
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406ec7
mov ecx, dword [str.Professional]
mov dword [eax], ecx
mov edx, dword [0x5560a8]
mov dword [eax + 4], edx
mov ecx, dword [0x5560ac]
mov dword [eax + 8], ecx
mov dx, word [0x5560b0]
mov word [eax + 0xc], dx
jmp 0x4072f2
cmp al, 3
jne 0x4072f2
cmp esi, 5
jne 0x40711e
cmp edx, 2
jne 0x407063
mov eax, dword [ebp - 0xa8]
test al, al
jns 0x406fab
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406f24
mov ecx, dword [str.Datacenter_Edition]
mov dword [eax], ecx
mov edx, dword [0x556094]
mov dword [eax + 4], edx
mov ecx, dword [0x556098]
mov dword [eax + 8], ecx
mov edx, dword [0x55609c]
mov dword [eax + 0xc], edx
mov ecx, dword [0x5560a0]
mov dword [eax + 0x10], ecx
movzx ecx, word [ebp - 0x134]
push ecx
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0x84]
push str._s__Build__d_
push eax
call fcn.00525601
lea eax, [ebp - 0x84]
add esp, 0x10
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f83
sub eax, esi
lea edi, [ebx - 1]
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x406f90
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4074fa
test al, 2
je 0x406feb
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406fb2
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x556070]
mov dword [eax + 4], ecx
mov edx, dword [0x556074]
mov dword [eax + 8], edx
mov ecx, dword [0x556078]
mov dword [eax + 0xc], ecx
mov edx, dword [0x55607c]
mov dword [eax + 0x10], edx
jmp 0x406f58
mov ecx, 0x400
cmp ax, cx
lea eax, [ebx - 1]
jne 0x407028
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x406ff8
mov edx, dword [str.Web_Edition]
mov dword [eax], edx
mov ecx, dword [0x556060]
mov dword [eax + 4], ecx
mov edx, dword [0x556064]
mov dword [eax + 8], edx
mov cl, byte [0x556068]
mov byte [eax + 0xc], cl
jmp 0x406f58
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407028
mov edx, dword [str.Standard_Edition]
mov dword [eax], edx
mov ecx, dword [0x55604c]
mov dword [eax + 4], ecx
mov edx, dword [0x556050]
mov dword [eax + 8], edx
mov ecx, dword [0x556054]
mov dword [eax + 0xc], ecx
mov dx, word [0x556058]
mov word [eax + 0x10], dx
jmp 0x406f58
test edx, edx
jne 0x40711e
mov al, byte [ebp - 0xa8]
test al, al
jns 0x4070bc
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407078
mov ecx, dword [str.Datacenter_Server]
mov dword [eax], ecx
mov edx, dword [0x556038]
mov dword [eax + 4], edx
mov ecx, dword [0x55603c]
mov dword [eax + 8], ecx
mov edx, dword [0x556040]
mov dword [eax + 0xc], edx
mov cx, word [0x556044]
mov word [eax + 0x10], cx
mov dl, byte [0x556046]
mov byte [eax + 0x12], dl
jmp 0x406f58
test al, 2
lea eax, [ebx - 1]
je 0x407100
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4070c3
mov ecx, dword [str.Advanced_Server]
mov dword [eax], ecx
mov edx, dword [0x556024]
mov dword [eax + 4], edx
mov ecx, dword [0x556028]
mov dword [eax + 8], ecx
mov edx, dword [0x55602c]
mov dword [eax + 0xc], edx
mov cl, byte [0x556030]
mov byte [eax + 0x10], cl
jmp 0x406f58
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407100
mov edx, dword [str.Server]
mov dword [eax], edx
mov ecx, dword [0x55601c]
mov dword [eax + 4], ecx
jmp 0x406f58
test byte [ebp - 0xa8], 2
je 0x407149
lea edi, [ebx - 1]
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407130
mov ecx, 8
mov esi, str.Server_4.0__Enterprise_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x4072e6
lea eax, [ebx - 1]
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407150
mov edx, dword [str.Server_4.0]
mov dword [eax], edx
mov ecx, dword [0x555ff0]
mov dword [eax + 4], ecx
mov edx, dword [0x555ff4]
mov dword [eax + 8], edx
jmp 0x4072f2
lea eax, [ebp - 0x144]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x148], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406cdb
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x54]
push edx
push eax
push eax
mov eax, dword [ebp - 0x144]
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406cdb
cmp dword [ebp - 0x148], esi
ja 0x406cdb
mov ecx, dword [ebp - 0x144]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x54]
push edx
push str.WINNT
call edi
test eax, eax
jne 0x407222
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4071f7
mov ecx, dword [str.Workstation]
mov dword [eax], ecx
mov edx, dword [0x555f9c]
mov dword [eax + 4], edx
mov ecx, dword [0x555fa0]
mov dword [eax + 8], ecx
mov dl, byte [0x555fa4]
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x54]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x40724d
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407234
mov ecx, dword [str.Server]
mov dword [eax], ecx
mov edx, dword [0x55601c]
mov dword [eax + 4], edx
lea eax, [ebp - 0x54]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x407294
lea eax, [ebx - 1]
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407260
mov ecx, dword [str.Advanced_Server]
mov dword [eax], ecx
mov edx, dword [0x556024]
mov dword [eax + 4], edx
mov ecx, dword [0x556028]
mov dword [eax + 8], ecx
mov edx, dword [0x55602c]
mov dword [eax + 0xc], edx
mov cl, byte [0x556030]
mov byte [eax + 0x10], cl
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x13c]
push edx
push eax
lea ecx, [ebp - 0xa4]
push str._d._d
push ecx
call fcn.00525601
lea eax, [ebp - 0xa4]
add esp, 0x10
mov esi, eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4072c0
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4072d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x13c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, 4
jne 0x406f58
push str.Service_Pack_6
lea edx, [ebp - 0x12c]
push edx
call edi
test eax, eax
jne 0x406f58
lea eax, [ebp - 0x144]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x84]
test eax, eax
jne 0x40734e
movzx ecx, word [ebp - 0x134]
push ecx
push str.Service_Pack_6a__Build__d_
push edx
call fcn.00525601
add esp, 0xc
jmp 0x40736b
movzx eax, word [ebp - 0x134]
push eax
lea ecx, [ebp - 0x12c]
push ecx
push str._s__Build__d_
push edx
call fcn.00525601
add esp, 0x10
lea eax, [ebp - 0x84]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407373
sub eax, esi
lea edi, [ebx - 1]
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407380
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x144]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4074fa
cmp dword [ebp - 0x13c], 4
jne 0x4074fa
mov eax, dword [ebp - 0x138]
test eax, eax
jne 0x407437
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4073c6
mov ecx, dword [str.Microsoft_Windows_95]
mov dword [eax], ecx
mov edx, dword [0x555efc]
mov dword [eax + 4], edx
mov ecx, dword [0x555f00]
mov dword [eax + 8], ecx
mov edx, dword [0x555f04]
mov dword [eax + 0xc], edx
mov ecx, dword [0x555f08]
mov dword [eax + 0x10], ecx
mov dx, word [0x555f0c]
mov word [eax + 0x14], dx
mov al, byte [ebp - 0x12b]
cmp al, 0x43
je 0x407417
cmp al, 0x42
jne 0x4074fa
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x407418
mov eax, dword [str.OSR2]
mov dword [ebx], eax
mov cx, word [0x555ef4]
mov word [ebx + 4], cx
jmp 0x4074fa
cmp eax, 0xa
jne 0x4074a4
lea eax, [ebx - 1]
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407440
cmp byte [ebp - 0x12b], 0x41
mov edx, dword [str.Microsoft_Windows_98]
mov dword [eax], edx
mov ecx, dword [0x555edc]
mov dword [eax + 4], ecx
mov edx, dword [0x555ee0]
mov dword [eax + 8], edx
mov ecx, dword [0x555ee4]
mov dword [eax + 0xc], ecx
mov edx, dword [0x555ee8]
mov dword [eax + 0x10], edx
mov cx, word [0x555eec]
mov word [eax + 0x14], cx
jne 0x4074fa
dec ebx
lea ecx, [ecx]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x407490
mov edx, dword [0x555ed4]
mov edi, ebx
mov dword [edi], edx
jmp 0x4074fa
cmp eax, 0x5a
jne 0x4074fa
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4074b0
mov ecx, 9
mov esi, str.Microsoft_Windows_Millennium_Edition
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4074fa
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x4074c8
mov eax, dword [str.Microsoft_Win32s]
mov dword [ebx], eax
mov ecx, dword [0x555e9c]
mov dword [ebx + 4], ecx
mov edx, dword [0x555ea0]
mov dword [ebx + 8], edx
mov eax, dword [0x555ea4]
mov dword [ebx + 0xc], eax
mov cl, byte [0x555ea8]
mov byte [ebx + 0x10], cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00525092
mov esp, ebp
pop ebp
ret