Function at 0x561770
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571f0b
mov eax, dword fs:[0]
push eax
sub esp, 0x61c
mov eax, dword [0x5cf004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5e8], ecx
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5617bf
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5617d4
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x5617d8
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x5dc], eax
mov dword [ebp - 4], 0
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x561804
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x561819
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x56181d
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x5d8], eax
mov byte [ebp - 4], 1
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x561846
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x56185b
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x56185f
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x604], eax
mov byte [ebp - 4], 2
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x561888
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x56189d
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x5618a1
mov ecx, edx
call esi
lea edi, [eax + 0x10]
mov dword [ebp - 0x5e4], edi
mov byte [ebp - 4], 3
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5618ca
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5618df
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x5618e3
mov ecx, edx
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x5f8], esi
mov byte [ebp - 4], 4
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x56190c
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x5e0], ecx
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x561927
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x56192f
mov ecx, edx
call dword [ebp - 0x5e0]
add eax, 0x10
mov dword [ebp - 0x600], eax
mov byte [ebp - 4], 5
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x561958
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x5e0], ecx
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x561973
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x56197b
mov ecx, edx
call dword [ebp - 0x5e0]
add eax, 0x10
mov dword [ebp - 0x5f4], eax
mov byte [ebp - 4], 6
call fcn.00407579
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x5619a4
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x5e0], ecx
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5619bf
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x5619c7
mov ecx, edx
call dword [ebp - 0x5e0]
add eax, 0x10
mov dword [ebp - 0x5fc], eax
push 0x11c
lea eax, [ebp - 0x5d4]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.00536380
add esp, 0xc
mov dword [ebp - 0x5d4], 0x11c
lea eax, [ebp - 0x5d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x5e0], eax
test eax, eax
jne 0x561a22
lea eax, [ebp - 0x5d4]
mov dword [ebp - 0x5d4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x5c4]
sub eax, 1
je 0x5624cc
sub eax, 1
jne 0x5625d7
mov ecx, dword [ebp - 0x5d0]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ecx, 3
jne 0x561a6a
push dword [ebp - 0x5cc]
lea eax, [ebp - 0x5dc]
push str.Windows_NT3._d
push eax
call fcn.00402f90
add esp, 0xc
jmp 0x561c32
mov eax, dword [ebp - 0x5cc]
cmp ecx, 4
jne 0x561a92
test eax, eax
jne 0x561c1c
push str.Windows_NT4
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
cmp ecx, 5
jne 0x561b53
test eax, eax
jne 0x561ab4
push str.Windows_2000
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
cmp eax, 1
jne 0x561ace
push 0x5abdb0
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
cmp eax, 2
jne 0x561c1c
push 0x59
call esi
test eax, eax
je 0x561af4
push str.Windows_Server_2003_R2
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
mov eax, 0x2000
cmp word [ebp - 0x4bc], ax
jne 0x561b17
push str.Windows_Storage_Server_2003
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
cmp byte [ebp - 0x4ba], 1
jne 0x561b3e
call fcn.00561380
test eax, eax
je 0x561b3e
push str.Windows_XP
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
push str.Windows_Server_2003
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
jmp 0x561c32
cmp ecx, 6
jne 0x561cb0
test eax, eax
jne 0x561b8d
cmp byte [ebp - 0x4ba], 1
lea ecx, [ebp - 0x5dc]
je 0x561b7e
push str.Windows_Server_2008
call fcn.004021c0
jmp 0x561c32
push str.Windows_Vista
call fcn.004021c0
jmp 0x561c32
cmp eax, 1
jne 0x561bbb
lea ecx, [ebp - 0x5dc]
cmp byte [ebp - 0x4ba], al
je 0x561baf
push str.Windows_Server_2008_R2
call fcn.004021c0
jmp 0x561c32
push str.Windows_7
call fcn.004021c0
jmp 0x561c32
cmp eax, 2
jne 0x561be7
cmp byte [ebp - 0x4ba], 1
lea ecx, [ebp - 0x5dc]
je 0x561bdb
push str.Windows_Server_2012
call fcn.004021c0
jmp 0x561c32
push str.Windows_8
call fcn.004021c0
jmp 0x561c32
cmp eax, 3
jne 0x561c13
cmp byte [ebp - 0x4ba], 1
lea ecx, [ebp - 0x5dc]
je 0x561c07
push str.Windows_Server_2012_R2
call fcn.004021c0
jmp 0x561c32
push str.Windows_8.1
call fcn.004021c0
jmp 0x561c32
cmp eax, 4
je 0x561cc1
push eax
push ecx
lea eax, [ebp - 0x5dc]
push str.Windows_NT__d._d
push eax
call fcn.00402f90
add esp, 0x10
mov eax, dword [ebp - 0x5d0]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 6
jb 0x56201c
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov dword [0x5da270], eax
test eax, eax
je case.default.0x561e6e
lea ecx, [ebp - 0x5e0]
mov dword [ebp - 0x5e0], 0
push ecx
push 0
push 0
push dword [ebp - 0x5cc]
push dword [ebp - 0x5d0]
call eax
mov eax, dword [ebp - 0x5e0]
cmp eax, 0x11
ja 0x561e53
je 0x561e3e
dec eax
cmp eax, 0xf
ja case.default.0x561e6e
jmp dword [eax*4 + 0x562940]
cmp ecx, 0xa
jne 0x561c1c
test eax, eax
jne 0x561c1c
cmp byte [ebp - 0x4ba], 1
lea ecx, [ebp - 0x5dc]
je 0x561cdf
push str.Windows_Server_2016
call fcn.004021c0
jmp 0x561c32
push str.Windows_10
call fcn.004021c0
jmp 0x561c32
push str.Business
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Business_N
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Datacenter__Full_installation_
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Datacenter__Server_Core_installation_
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Enterprise
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Enterprise__Full_installation_
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Enterprise__Server_Core_installation_
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Datacenter_Enterprise_for_Itanium_based_Systems
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Home_Basic
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Home_Basic_N
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Home_Premium
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Small_Business_Server
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Server_Standard__full_installation_
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Server_Standard__core_installation_
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Starter
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Ultimate
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Web_Server
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
cmp eax, 0x19
ja 0x561f1d
je 0x561f08
add eax, 0xffffffee
cmp eax, 6
ja case.default.0x561e6e
jmp dword [eax*4 + 0x562980]
push str.Cluster_Server
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Home_Server
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Server_for_Small_Business
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Storage_Server_Enterprise
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Storage_Server_Express
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Storage_Server_Standard
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Storage_Server_Workgroup
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Small_Business_Server_Premium
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
cmp eax, 0x30
ja 0x561fa7
je 0x561f7a
sub eax, 0x1a
je 0x561f65
sub eax, 1
je 0x561f50
sub eax, 1
jne case.default.0x561e6e
push str.Ultimate_N
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Enterprise_N
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
push str.Home_Premium_N
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
cmp dword [ebp - 0x5cc], 2
lea ecx, [ebp - 0x5d8]
jb 0x561f98
push 0x5ac4ec
call fcn.004021c0
jmp case.default.0x561e6e
push 0x5ac4f4
call fcn.004021c0
jmp case.default.0x561e6e
cmp eax, 0x3e
ja 0x561ffc
cmp eax, 0x3b
jae 0x561fe7
cmp eax, 0x31
jne case.default.0x561e6e
cmp dword [ebp - 0x5cc], 2
lea ecx, [ebp - 0x5d8]
jb 0x561fd8
push str.Pro_N
call fcn.004021c0
jmp case.default.0x561e6e
push str.Professional_N
call fcn.004021c0
jmp case.default.0x561e6e
push str.Essentials
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
cmp eax, 0xabcdabcd
jne case.default.0x561e6e
push str.Unlicensed
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
cmp dword [ebp - 0x5e0], 0
je 0x562241
cmp eax, 5
jne case.default.0x561e6e
mov eax, dword [ebp - 0x5cc]
test eax, eax
jne 0x5620a4
mov al, byte [ebp - 0x4ba]
cmp al, 1
jne 0x56205b
push 0x5ac554
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
cmp al, 3
jne case.default.0x561e6e
mov eax, dword [ebp - 0x4bc]
lea ecx, [ebp - 0x5d8]
test al, al
jns 0x562082
push str.DataCenter_Server
call fcn.004021c0
jmp case.default.0x561e6e
test al, 2
je 0x562095
push 0x5ac594
call fcn.004021c0
jmp case.default.0x561e6e
push 0x5ac5b4
call fcn.004021c0
jmp case.default.0x561e6e
cmp eax, 1
jb case.default.0x561e6e
mov eax, dword [ebp - 0x4bc]
test eax, 0x200
je 0x5620c1
push str.Home_Edition
jmp 0x5620f3
test al, al
jns 0x5620cc
push str.Datacenter_Edition
jmp 0x5620f3
test al, 2
je 0x5620d7
push str.Enterprise_Edition
jmp 0x5620f3
test eax, 0x400
je 0x5620e5
push str.Web_Edition
jmp 0x5620f3
cmp byte [ebp - 0x4ba], 1
jne 0x5620fe
push str.Professional
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
push 0x57
call esi
test eax, eax
je 0x562220
push 0x104
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ehomeehshell.exe
lea eax, [ebp - 0x2b8]
push 0x104
push eax
call fcn.005399e6
add esp, 0xc
lea edx, [ebp - 0x4b8]
lea ecx, [ebp - 0x2b8]
call fcn.00561130
test eax, eax
je case.default.0x561e6e
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x5fc]
call fcn.004021c0
mov esi, dword [ebp - 0x5fc]
cmp dword [esi - 0xc], 0
jl case.default.0x561e6e
push 0x5ac68c
push esi
call fcn.00534314
add esp, 8
test eax, eax
je case.default.0x561e6e
sub eax, esi
sar eax, 1
jne case.default.0x561e6e
push str.Media_Center
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
push 0x5ac6b0
push str.5.1.
lea ecx, [ebp - 0x5fc]
call fcn.004028d0
push dword [ebp - 0x5fc]
call fcn.0053f5d5
movsd xmm0, qword [0x5ae8f0]
lea ecx, [ebp - 0x5d8]
fstp qword [ebp - 0x5f0]
movsd xmm1, qword [ebp - 0x5f0]
add esp, 4
comisd xmm0, xmm1
jb 0x5621f4
push str.2002
call fcn.004030b0
jmp case.default.0x561e6e
movsd xmm0, qword [0x5ae8f8]
comisd xmm0, xmm1
jb 0x562211
push str.2004
call fcn.004030b0
jmp case.default.0x561e6e
push str.2005
call fcn.004030b0
jmp case.default.0x561e6e
push 0x56
call esi
test eax, eax
je case.default.0x561e6e
push str.Tablet_PC
lea ecx, [ebp - 0x5d8]
call fcn.004021c0
jmp case.default.0x561e6e
lea eax, [ebp - 0x5e0]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.default.0x561e6e
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x5e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5622e5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0xb0]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x5622aa
push str.Workstation
jmp 0x5622da
lea eax, [ebp - 0xb0]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x5622c3
push str.Server
jmp 0x5622da
lea eax, [ebp - 0xb0]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x5622e5
push str.Advanced_Server
lea ecx, [ebp - 0x5d8]
call fcn.00403d70
push dword [ebp - 0x5e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x5c0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x562300
sub ecx, edx
lea eax, [ebp - 0x5c0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x604]
call fcn.004025d0
push 0x5ac7c8
push str.Service_Pack
lea ecx, [ebp - 0x604]
call fcn.004028d0
push dword [ebp - 0x5cc]
lea eax, [ebp - 0x5e4]
push dword [ebp - 0x5d0]
push str._d._d
push eax
call fcn.00402f90
push dword [ebp - 0x5c8]
lea eax, [ebp - 0x5f8]
push 0x5ac7f8
push eax
call fcn.00402f90
add esp, 0x1c
mov dword [ebp - 0x608], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x628], xmm0
push 0x5abbcc
push 0x5abbe0
movups xmmword [ebp - 0x618], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov dword [0x5da26c], eax
test eax, eax
je 0x5623cc
lea ecx, [ebp - 0x628]
push ecx
call eax
cmp word [ebp - 0x628], 9
jne 0x5623cc
push 3
push 0x5ac800
lea ecx, [ebp - 0x5f4]
call fcn.004025d0
jmp 0x5623ec
call fcn.00561320
lea ecx, [ebp - 0x5f4]
test eax, eax
je 0x5623e2
push str.IA64
jmp 0x5623e7
push 0x5ac814
call fcn.004021c0
mov eax, dword [ebp - 0x604]
push dword [ebp - 0x5f4]
mov esi, dword [ebp - 0x5f8]
mov edi, dword [ebp - 0x5e4]
cmp dword [eax - 0xc], 0
push esi
push edi
je 0x56242f
push eax
push dword [ebp - 0x5d8]
lea eax, [ebp - 0x600]
push dword [ebp - 0x5dc]
push str._s__s__s___s_Build__s____s_
push eax
call fcn.00402f90
add esp, 0x20
jmp 0x56244f
push dword [ebp - 0x5d8]
lea eax, [ebp - 0x600]
push dword [ebp - 0x5dc]
push str._s__s___s_Build__s____s_
push eax
call fcn.00402f90
add esp, 0x1c
mov edx, dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x600]
mov edx, dword [edx]
lea ecx, [eax - 0x10]
sub edx, 0x10
mov dword [ebp - 0x5e0], ecx
mov dword [ebp - 0x5ec], edx
cmp ecx, edx
je 0x5625d7
cmp dword [edx + 0xc], 0
jl 0x5624b8
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x5624b8
push dword [ebp - 0x5e0]
call fcn.00402690
mov ecx, dword [ebp - 0x5ec]
add esp, 4
mov dword [ebp - 0x5e0], eax
call fcn.00402820
mov ecx, dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x5e0]
add eax, 0x10
mov dword [ecx], eax
jmp 0x5625d7
push dword [eax - 0xc]
mov ecx, dword [ebp - 0x5e8]
push eax
call fcn.004025d0
jmp 0x5625d7
mov eax, dword [ebp - 0x5cc]
test eax, eax
je 0x562531
cmp eax, 0xa
je 0x5624fc
lea ecx, [ebp - 0x5dc]
cmp eax, 0x5a
je 0x5624f5
push str.Windows_9x
call fcn.00403d70
jmp 0x56257a
push str.Windows_Me
jmp 0x562575
mov eax, dword [ebp - 0x5c8]
mov ecx, 0x8ae
cmp ax, cx
jb 0x562513
push str.Windows_98_SE
jmp 0x56256f
mov ecx, 0x7d0
cmp ax, cx
lea ecx, [ebp - 0x5dc]
jb 0x56252a
push str.Windows_98_SP1
jmp 0x562575
push str.Windows_98
jmp 0x562575
mov eax, dword [ebp - 0x5c8]
mov ecx, 0x4be
cmp ax, cx
jb 0x562548
push str.Windows_95_OSR2.5
jmp 0x56256f
mov ecx, 0x4bc
cmp ax, cx
jb 0x562559
push str.Windows_95_OSR2.1
jmp 0x56256f
mov ecx, 0x457
cmp ax, cx
jne 0x56256a
push str.Windows_95_OSR2
jmp 0x56256f
push str.Windows_95
lea ecx, [ebp - 0x5dc]
call fcn.004021c0
push dword [ebp - 0x5cc]
lea eax, [ebp - 0x5e4]
push dword [ebp - 0x5d0]
push 0x5abd24
push eax
call fcn.00402f90
movzx eax, word [ebp - 0x5c8]
push eax
lea eax, [ebp - 0x5f8]
push 0x5abd30
push eax
call fcn.00402f90
mov esi, dword [ebp - 0x5f8]
mov edi, dword [ebp - 0x5e4]
push esi
push edi
push dword [ebp - 0x5dc]
push str._s___s_Build__s_
push dword [ebp - 0x5e8]
call fcn.00402f90
add esp, 0x30
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov edx, dword [ebp - 0x5fc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
mov ecx, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x562664
mov eax, dword [edx]
mov dword [ebp - 0x5e8], eax
push edx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x562656
mov eax, dword [ebp - 0x5e8]
mov edx, dword [ebp - 0x5e8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x56264b
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ecx
jmp 0x56265e
mov ecx, dword [edx + 4]
call dword [ebp - 0x5ec]
jmp 0x56265e
mov ecx, dword [edx]
call dword [ebp - 0x5ec]
mov ecx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x5f4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5626e5
mov eax, dword [edx]
mov dword [ebp - 0x5e8], eax
push edx
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5626dd
mov eax, dword [ebp - 0x5e8]
mov edx, dword [ebp - 0x5e8]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5626d2
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ecx
jmp 0x5626e5
mov ecx, dword [edx + 4]
call dword [ebp - 0x5ec]
jmp 0x5626e5
mov ecx, dword [edx]
call dword [ebp - 0x5ec]
mov byte [ebp - 4], 4
or eax, 0xffffffff
mov ecx, dword [ebp - 0x600]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x562754
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x56274c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x562742
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x562754
mov ecx, edx
call dword [ebp - 0x5ec]
jmp 0x562754
mov ecx, edx
call dword [ebp - 0x5ec]
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5627bb
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x5ec], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5627b3
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x5ec], edi
mov edi, dword [ebp - 0x5e4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5627a9
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x5627bb
mov ecx, edx
call dword [ebp - 0x5ec]
jmp 0x5627bb
mov ecx, edx
call dword [ebp - 0x5ec]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x5627fd
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5627fb
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5627fb
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call edi
jmp 0x562803
call edx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp - 0x604]
add ecx, 0xfffffff0
mov dword [ebp - 0x5ec], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x562870
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x5e0], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x562867
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x5e0], ecx
mov ecx, dword [ebp - 0x5ec]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x56285d
push 0
push dword [edx + 4]
call edi
jmp 0x562870
mov ecx, edx
call dword [ebp - 0x5e0]
jmp 0x562870
push ecx
mov ecx, edx
call dword [ebp - 0x5e0]
mov byte [ebp - 4], 0
mov eax, esi
mov ecx, dword [ebp - 0x5d8]
add ecx, 0xfffffff0
mov dword [ebp - 0x5ec], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x5628dd
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x5e0], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5628d4
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x5e0], ecx
mov ecx, dword [ebp - 0x5ec]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x5628ca
push 0
push dword [edx + 4]
call edi
jmp 0x5628dd
mov ecx, edx
call dword [ebp - 0x5e0]
jmp 0x5628dd
push ecx
mov ecx, edx
call dword [ebp - 0x5e0]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x5dc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x562922
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x56291e
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x56291e
push 0
push dword [edx + 4]
call edi
jmp 0x562922
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00531d62
mov esp, ebp
pop ebp
ret