Function at 0x42245b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x154]
sub esp, 0x1d4
mov eax, dword [0x5937d0]
xor eax, ebp
mov dword [ebp + 0x150], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, str.unknown
push esi
mov dword [ebp - 0x54], edi
call fcn.00401732
lea ecx, [edi + 4]
push esi
mov dword [ebp - 0x50], ecx
call fcn.00401732
lea ecx, [edi + 8]
push esi
mov dword [ebp - 0x5c], ecx
call fcn.00401732
lea ebx, [ebp - 0x58]
lea edi, [ebp - 0x4c]
call fcn.004223dd
test eax, eax
je 0x4228c1
lea esi, [ebp - 0x80]
call fcn.00422423
mov eax, dword [ebp - 0x3c]
xor edi, edi
sub eax, edi
je 0x422891
dec eax
je 0x4227ff
dec eax
jne 0x4228c1
cmp dword [ebp - 0x48], 6
push 5
pop esi
jne 0x422529
cmp dword [ebp - 0x44], 1
jne 0x422506
cmp byte [ebp + 0x4e], 1
mov ecx, dword [ebp - 0x54]
jne 0x4224f6
push str.Microsoft_Windows_Seven
jmp 0x4224fb
push str.Windows_Server_2008_R2
call fcn.00401732
cmp dword [ebp - 0x48], 6
jne 0x422529
cmp dword [ebp - 0x44], edi
jne 0x4225aa
cmp byte [ebp + 0x4e], 1
mov ecx, dword [ebp - 0x54]
jne 0x42251f
push str.Microsoft_Windows_Vista
jmp 0x422524
push str.Windows_Server_2008
call fcn.00401732
cmp dword [ebp - 0x48], esi
jne 0x422597
cmp dword [ebp - 0x44], 2
jne 0x42256d
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x422547
push str.Microsoft_Windows_Server_2003__R2_
jmp 0x422560
cmp byte [ebp + 0x4e], 1
jne 0x42255b
cmp word [ebp - 0x80], 9
jne 0x42255b
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x422560
push str.Microsoft_Windows_Server_2003
mov ecx, dword [ebp - 0x54]
call fcn.00401732
cmp dword [ebp - 0x48], esi
jne 0x422597
cmp dword [ebp - 0x44], 1
jne 0x422585
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_XP
call fcn.00401732
cmp dword [ebp - 0x48], esi
jne 0x422597
cmp dword [ebp - 0x44], edi
jne 0x4225aa
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_2000
call fcn.00401732
cmp dword [ebp - 0x48], 4
ja 0x4225aa
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_NT
call fcn.00401732
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x58], edi
je 0x4226f1
cmp byte [ebp + 0x4e], 1
jne 0x4225fa
cmp word [ebp - 0x80], 9
je 0x422798
cmp dword [ebp - 0x48], 4
mov ecx, dword [ebp - 0x50]
jne 0x4225dd
push str.Workstation_4.0
jmp 0x4226e7
test dword [ebp + 0x4c], 0x200
je 0x4225f0
push str.Home_Edition
jmp 0x4226e7
push str.Professional
jmp 0x4226e7
cmp byte [ebp + 0x4e], 3
je 0x42260a
cmp byte [ebp + 0x4e], 2
jne 0x422798
cmp dword [ebp - 0x48], esi
jne 0x4226d2
cmp dword [ebp - 0x44], 2
jne 0x4226a9
cmp word [ebp - 0x80], 6
jne 0x422642
test byte [ebp + 0x4c], 0x80
je 0x422631
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x42267b
test byte [ebp + 0x4c], 2
je 0x4227ec
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x42267b
cmp word [ebp - 0x80], 9
jne 0x422670
test byte [ebp + 0x4c], 0x80
mov ecx, dword [ebp - 0x50]
je 0x42265c
push str.Datacenter_x64_Edition
jmp 0x4226e7
test byte [ebp + 0x4c], 2
je 0x422669
push str.Enterprise_x64_Edition
jmp 0x4226e7
push str.Standard_x64_Edition
jmp 0x4226e7
test byte [ebp + 0x4c], 0x80
je 0x422680
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x50]
jmp 0x4226e7
test byte [ebp + 0x4c], 2
mov ecx, dword [ebp - 0x50]
je 0x422690
push str.Enterprise_Edition
jmp 0x4226e7
mov eax, 0x400
cmp word [ebp + 0x4c], ax
jne 0x4226a2
push str.Web_Edition
jmp 0x4226e7
push str.Standard_Edition
jmp 0x4226e7
cmp dword [ebp - 0x44], edi
jne 0x4226d2
test byte [ebp + 0x4c], 0x80
mov ecx, dword [ebp - 0x50]
je 0x4226be
push str.Datacenter_Server
jmp 0x4226e7
test byte [ebp + 0x4c], 2
je 0x4226cb
push str.Advanced_Server
jmp 0x4226e7
push str.Server
jmp 0x4226e7
test byte [ebp + 0x4c], 2
mov ecx, dword [ebp - 0x50]
je 0x4226e2
push str.Server_4.0__Enterprise_Edition
jmp 0x4226e7
push str.Server_4.0
call fcn.00401732
jmp 0x422798
lea eax, [ebp - 0x54]
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x100
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x58], esi
call ebx
test eax, eax
jne 0x422780
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x50]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x54]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x422780
cmp dword [ebp - 0x58], esi
ja 0x422780
lea eax, [ebp + 0x50]
push eax
push str.LANMANNT
call fcn.004f32ad
pop ecx
pop ecx
test eax, eax
jne 0x42275f
mov ecx, dword [ebp - 0x50]
push str.Server
call fcn.00401732
lea eax, [ebp + 0x50]
push eax
push str.SERVERNT
call fcn.004f32ad
pop ecx
pop ecx
test eax, eax
jne 0x422780
mov ecx, dword [ebp - 0x50]
push str.Advanced_Server
call fcn.00401732
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push str._d._d
push dword [ebp - 0x5c]
call fcn.004043ef
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x48], 4
jne 0x4227ec
lea eax, [ebp - 0x38]
push str.Service_Pack_6
push eax
call fcn.004f32ad
pop ecx
pop ecx
test eax, eax
jne 0x4227ec
lea eax, [ebp - 0x58]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
movzx eax, word [ebp - 0x40]
push eax
jne 0x4227f1
push str.Service_Pack_6a__Build__d_
push dword [ebp - 0x5c]
call fcn.004043ef
add esp, 0xc
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4228c1
movzx eax, word [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
push str._s__Build__d_
jmp 0x4228b6
cmp dword [ebp - 0x48], 4
jne 0x4228ab
mov esi, 0x53b9e7
cmp dword [ebp - 0x44], edi
jne 0x422842
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_95
call fcn.00401732
cmp byte [ebp - 0x37], 0x43
je 0x42282f
cmp byte [ebp - 0x37], 0x42
je 0x42282f
push esi
jmp 0x422834
push str.OSR2
mov ecx, dword [ebp - 0x50]
call fcn.00401732
cmp dword [ebp - 0x48], 4
jne 0x4228ab
cmp dword [ebp - 0x44], 0xa
jne 0x422877
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_98
call fcn.00401732
cmp byte [ebp - 0x37], 0x41
je 0x422864
cmp byte [ebp - 0x37], 0x42
je 0x422864
push esi
jmp 0x422869
push 0x542d98
mov ecx, dword [ebp - 0x50]
call fcn.00401732
cmp dword [ebp - 0x48], 4
jne 0x4228ab
cmp dword [ebp - 0x44], 0x5a
jne 0x4228ab
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_ME
call fcn.00401732
push str.Millennium_Edition
jmp 0x4228a3
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Win32s
call fcn.00401732
push 0x53b9e7
mov ecx, dword [ebp - 0x50]
call fcn.00401732
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push str._d._d
push dword [ebp - 0x5c]
call fcn.004043ef
add esp, 0x10
mov ecx, dword [ebp + 0x150]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f2b62
add ebp, 0x154
leave
ret