Function at 0x403a3d
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
mov esi, 0x9c
xor edi, edi
push esi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.004040d0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
mov ebx, eax
cmp ebx, edi
jne 0x403a97
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call esi
test eax, eax
je 0x403cf2
mov eax, dword [ebp - 0x94]
sub eax, edi
je 0x403ce0
dec eax
je 0x403c4f
dec eax
jne 0x403cef
cmp dword [ebp - 0xa0], 4
ja 0x403ac3
push str.Microsoft_20Windows_20NT_20
jmp 0x403af0
cmp dword [ebp - 0xa0], 5
jne 0x403aeb
cmp dword [ebp - 0x9c], edi
jne 0x403adb
push str.Microsoft_20Windows_202000_20
jmp 0x403af0
cmp dword [ebp - 0x9c], 1
jne 0x403aeb
push str.Microsoft_20Windows_20XP_20
jmp 0x403af0
push str.Microsoft_20Windows_20vista_7_2008_20
push dword [ebp + 8]
call fcn.00404970
pop ecx
cmp ebx, edi
pop ecx
je 0x403b52
cmp byte [ebp - 0xa], 1
jne 0x403b1e
test byte [ebp - 0xb], 2
je 0x403b14
push str.Personal_20
jmp 0x403bec
push str.Professional_20
jmp 0x403bec
cmp byte [ebp - 0xa], 3
jne 0x403bf6
test byte [ebp - 0xc], 0x80
je 0x403b38
push str.DataCenter_20Server_20
jmp 0x403bec
test byte [ebp - 0xc], 2
je 0x403b48
push str.Advanced_20Server_20
jmp 0x403bec
push str.Server_20
jmp 0x403bec
lea eax, [ebp - 4]
push eax
push 1
push edi
push str.SYSTEM__CurrentControlSet__Control__ProductOptions
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xf4]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0xf4]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x403bb4
push str.Professional_20
push dword [ebp + 8]
call fcn.00404970
pop ecx
pop ecx
lea eax, [ebp - 0xf4]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x403bd5
push str.Server_20
push dword [ebp + 8]
call fcn.00404970
pop ecx
pop ecx
lea eax, [ebp - 0xf4]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x403bf6
push str.Advanced_Server_20
push dword [ebp + 8]
call fcn.00404970
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
mov eax, dword [ebp - 0x98]
ja 0x403c30
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push str.version__d._d__s__Build__d__n
call fcn.00404d8c
add esp, 0x14
jmp 0x403cef
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
push str._s__Build__d__n
call fcn.00404d8c
add esp, 0xc
jmp 0x403cef
cmp dword [ebp - 0xa0], 4
jne 0x403cef
cmp dword [ebp - 0x9c], edi
mov esi, dword [ebp + 8]
jne 0x403c9a
push str.Microsoft_20Windows_2095_20
call fcn.00404d8c
cmp byte [ebp - 0x8f], 0x43
pop ecx
je 0x403c84
cmp byte [ebp - 0x8f], 0x42
jne 0x403c91
push str.OSR2_20
push esi
call fcn.00404970
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x403cef
cmp dword [ebp - 0x9c], 0xa
jne 0x403ccf
push str.Microsoft_20Windows_2098_20
push esi
call fcn.00404970
cmp byte [ebp - 0x8f], 0x41
pop ecx
pop ecx
jne 0x403cc6
push str.SE_20
push esi
call fcn.00404970
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x403cef
cmp dword [ebp - 0x9c], 0x5a
jne 0x403cef
push str.Microsoft_20Windows_Me_20
push esi
jmp 0x403ce8
push str.Microsoft_20Win32s_20
push dword [ebp + 8]
call fcn.00404970
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret