Function at 0x10017bf0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x284]
push 0x1005df52
push eax
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea ecx, [ebp - 0x84]
push 0x1005df52
push ecx
call sym.vmtools.dll_Str_Strcpy
push 0x9c
lea edx, [ebp - 0x44c]
push 0
mov edi, 0x1869f
push edx
mov dword [ebp - 0x450], edi
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0x24
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x44c], 0x9c
call esi
mov ebx, eax
mov dword [ebp - 0x454], ebx
test ebx, ebx
jne 0x10017ca2
lea ecx, [ebp - 0x44c]
push ecx
mov dword [ebp - 0x44c], 0x94
call esi
test eax, eax
jne 0x10017ca2
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x43c]
sub eax, 0
je 0x1001878c
sub eax, 1
je 0x10018638
sub eax, 1
jne 0x100187a5
mov ecx, dword [ebp - 0x448]
mov eax, dword [ebp - 0x444]
cmp ecx, 6
ja 0x10017dd4
jne 0x10017d79
cmp eax, 4
ja 0x10017df7
jne 0x10017d03
xor edx, edx
cmp byte [ebp - 0x3b2], 1
setne dl
add edx, 0x18
mov dword [ebp - 0x450], edx
jmp 0x10017e17
cmp eax, 2
je 0x10017d0d
cmp eax, 3
jne 0x10017d27
xor edx, edx
cmp byte [ebp - 0x3b2], 1
setne dl
add edx, 0x16
mov dword [ebp - 0x450], edx
jmp 0x10017e0c
cmp eax, 1
jne 0x10017d57
xor eax, eax
cmp byte [ebp - 0x3b2], 1
lea esi, [ebp - 0x284]
setne al
lea edi, [ebp - 0x84]
add eax, 0x14
mov dword [ebp - 0x450], eax
call fcn.100176d0
jmp 0x10017fc0
test eax, eax
jne 0x10017e0c
xor ecx, ecx
cmp byte [ebp - 0x3b2], 1
setne cl
add ecx, 0x12
mov dword [ebp - 0x450], ecx
jmp 0x10017e86
cmp ecx, 5
jne 0x10017dc3
mov eax, dword [ebp - 0x444]
cmp eax, 2
jb 0x10017d98
mov dword [ebp - 0x450], 0xd
jmp 0x10017eb1
cmp eax, 1
jne 0x10017dac
mov dword [ebp - 0x450], 9
jmp 0x10017eef
test eax, eax
jne 0x10017eb1
mov dword [ebp - 0x450], 5
jmp 0x10017f27
cmp ecx, 4
ja 0x10017dfd
mov dword [ebp - 0x450], 4
jmp 0x10017dfd
cmp ecx, 0xa
jne 0x10017df7
test eax, eax
jne 0x10017df7
xor edx, edx
cmp byte [ebp - 0x3b2], 1
setne dl
add edx, 0x18
mov dword [ebp - 0x450], edx
jmp 0x10017f92
mov dword [ebp - 0x450], edi
cmp ecx, 6
ja 0x10017f89
jne 0x10017ea8
cmp eax, 4
ja 0x10017faf
jne 0x10017e37
mov eax, dword [ebp - 0x450]
push eax
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.10017ae0
add esp, 4
jmp 0x10017fc0
cmp eax, 2
je 0x10017e41
cmp eax, 3
jne 0x10017e63
mov edx, dword [ebp - 0x450]
lea ecx, [ebp - 0x84]
push ecx
push edx
push eax
lea esi, [ebp - 0x284]
call fcn.10017900
add esp, 0xc
jmp 0x10017fc0
cmp eax, 1
jne 0x10017e7e
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.100176d0
jmp 0x10017fc0
test eax, eax
jne 0x10017f58
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
lea ebx, [ebp - 0x44c]
call fcn.100170a0
mov ebx, dword [ebp - 0x454]
jmp 0x10017fc0
cmp ecx, 5
jne 0x10017f58
cmp eax, 2
jne 0x10017eea
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_2003
push eax
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea ecx, [ebp - 0x84]
push str.win2003
push ecx
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
jmp 0x10017fc0
cmp eax, 1
jne 0x10017f23
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_XP
push edx
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea eax, [ebp - 0x84]
push str.winXP
push eax
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
jmp 0x10017fc0
test eax, eax
jne 0x10017f58
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_2000
push ecx
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea edx, [ebp - 0x84]
push str.win2000
push edx
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
jmp 0x10017fc0
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_NT
push eax
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea ecx, [ebp - 0x84]
push str.winNT
push ecx
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
jmp 0x10017fc0
cmp ecx, 0xa
jne 0x10017faf
test eax, eax
jne 0x10017faf
mov edx, dword [ebp - 0x450]
push edx
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.10017ae0
add esp, 4
jmp 0x10017fc0
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.10017b80
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x100183c2
mov al, byte [ebp - 0x3b2]
cmp al, 1
jne 0x1001812d
mov eax, dword [ebp - 0x448]
cmp eax, 4
jne 0x10018019
push 0x200
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x284]
push 0x1005de50
push eax
call sym.vmtools.dll_Str_Strcat
push 0x200
push str.Workstation_4.0
lea ecx, [ebp - 0x284]
push ecx
jmp 0x10018566
cmp eax, 5
jne 0x1001856e
mov eax, dword [ebp - 0x444]
cmp eax, 2
jne 0x10018068
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_XP_Professional_x64_Edition
push edx
mov dword [ebp - 0x450], 0xc
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea eax, [ebp - 0x84]
push str.winXPPro_64
push eax
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
cmp eax, 1
jne 0x100180ea
test dword [ebp - 0x3b4], 0x200
push 0x200
je 0x100180b4
lea ecx, [ebp - 0x284]
push str.Windows_XP_Home_Edition
push ecx
mov dword [ebp - 0x450], 0xa
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea edx, [ebp - 0x84]
push str.winXPHome
push edx
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
lea eax, [ebp - 0x284]
push str.Windows_XP_Professional
push eax
mov dword [ebp - 0x450], 0xb
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea ecx, [ebp - 0x84]
push str.winXPPro
push ecx
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
test eax, eax
jne 0x100185f1
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_2000_Professional
push edx
mov dword [ebp - 0x450], 6
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea eax, [ebp - 0x84]
push str.win2000Pro
push eax
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
cmp al, 3
je 0x10018139
cmp al, 2
jne 0x1001856e
cmp dword [ebp - 0x448], 5
jne 0x1001856e
mov eax, dword [ebp - 0x444]
cmp eax, 2
jne 0x10018305
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x450], 0xf
test al, al
jns 0x10018198
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Server_2003_Datacenter_Edition
push ecx
mov dword [ebp - 0x450], 0x11
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetDatacenter
jmp 0x100182bc
test al, 2
je 0x100181d2
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_Server_2003_Enterprise_Edition
push eax
mov dword [ebp - 0x450], 0x10
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetEnterprise
lea ecx, [ebp - 0x84]
push ecx
jmp 0x100182c3
test eax, 0x400
je 0x1001820f
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_Server_2003_Web_Edition
push edx
mov dword [ebp - 0x450], 0xe
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetWeb
lea eax, [ebp - 0x84]
push eax
jmp 0x100182c3
test eax, 0x4000
je 0x1001823b
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Server_2003_Compute_Cluster_Edition
push ecx
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetComputeCluster
jmp 0x100182bc
test eax, 0x2000
je 0x1001826b
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_Storage_Server_2003
push eax
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetStorageSvr
lea ecx, [ebp - 0x84]
push ecx
jmp 0x100182c3
test al, 1
je 0x1001829c
test al, 0x20
je 0x1001829c
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_Server_2003_Small_Business
push edx
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetBusiness
lea eax, [ebp - 0x84]
push eax
jmp 0x100182c3
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Server_2003_Standard_Edition
push ecx
call sym.vmtools.dll_Str_Strcpy
push 0x80
push str.winNetStandard
lea edx, [ebp - 0x84]
push edx
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
call sym.vmtools.dll_Hostinfo_GetSystemBitness
cmp eax, 0x40
jne 0x1001856e
push 0x80
lea eax, [ebp - 0x84]
push 0x10065e18
push eax
call sym.vmtools.dll_Str_Strcat
push 0x200
push str.__64_bit_
lea ecx, [ebp - 0x284]
push ecx
jmp 0x10018566
test eax, eax
jne 0x100185f1
mov al, byte [ebp - 0x3b4]
push 0x200
test al, al
jns 0x10018352
lea edx, [ebp - 0x284]
push str.Windows_2000_Data_Center_Server
push edx
mov dword [ebp - 0x450], 7
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea eax, [ebp - 0x84]
push str.win2000DataCentServ
push eax
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
test al, 2
je 0x1001838c
lea ecx, [ebp - 0x284]
push str.Windows_2000_Advanced_Server
push ecx
mov dword [ebp - 0x450], 8
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea edx, [ebp - 0x84]
push str.win2000AdvServ
push edx
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
lea eax, [ebp - 0x284]
push str.Windows_2000_Server
push eax
mov dword [ebp - 0x450], 7
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea ecx, [ebp - 0x84]
push str.win2000Serv
push ecx
call sym.vmtools.dll_Str_Strcpy
jmp 0x1001856b
lea edx, [ebp - 0x454]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x458], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10017c8f
mov edx, dword [ebp - 0x454]
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x3b0]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10017c8f
cmp dword [ebp - 0x458], 0x64
ja 0x10017c8f
mov eax, dword [ebp - 0x454]
push eax
call esi
lea ecx, [ebp - 0x3b0]
mov eax, str.WINNT
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10018466
test dx, dx
je 0x10018462
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10018466
add eax, 4
add ecx, 4
test dx, dx
jne 0x10018440
xor eax, eax
jmp 0x1001846b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001849b
push 0x200
lea ecx, [ebp - 0x284]
push 0x1005de50
push ecx
call sym.vmtools.dll_Str_Strcat
push 0x200
push str.Workstation
lea edx, [ebp - 0x284]
push edx
jmp 0x10018566
lea ecx, [ebp - 0x3b0]
mov eax, str.LANMANNT
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100184cc
test dx, dx
je 0x100184c8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100184cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x100184a6
xor eax, eax
jmp 0x100184d1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100184fe
push 0x200
lea eax, [ebp - 0x284]
push 0x1005de50
push eax
call sym.vmtools.dll_Str_Strcat
push 0x200
push str.Server
lea ecx, [ebp - 0x284]
push ecx
jmp 0x10018566
lea ecx, [ebp - 0x3b0]
mov eax, str.SERVERNT
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10018536
test dx, dx
je 0x10018532
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10018536
add eax, 4
add ecx, 4
test dx, dx
jne 0x10018510
xor eax, eax
jmp 0x1001853b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1001856e
push 0x200
lea edx, [ebp - 0x284]
push 0x1005de50
push edx
call sym.vmtools.dll_Str_Strcat
push 0x200
push str.Advanced_Server
lea eax, [ebp - 0x284]
push eax
call sym.vmtools.dll_Str_Strcat
add esp, 0x18
cmp dword [ebp - 0x448], 4
jne 0x100185f1
push str.Service_Pack_6
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100185f1
lea edx, [ebp - 0x45c]
push edx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call sym.vmtools.dll_Win32U_RegOpenKeyEx
add esp, 0x14
lea ecx, [ebp - 0x2e8]
test eax, eax
jne 0x100185c2
movzx eax, word [ebp - 0x440]
push eax
push str.Service_Pack_6a
jmp 0x100185d1
movzx edx, word [ebp - 0x440]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x1005de50
push str._s_s__Build__d_
push 0x64
push ecx
call sym.vmtools.dll_Str_Sprintf
mov edx, dword [ebp - 0x45c]
add esp, 0x18
push edx
call esi
jmp 0x1001861b
movzx eax, word [ebp - 0x440]
push eax
lea ecx, [ebp - 0x438]
push ecx
push 0x1005de50
push str._s_s__Build__d_
lea edx, [ebp - 0x2e8]
push 0x64
push edx
call sym.vmtools.dll_Str_Sprintf
add esp, 0x18
push 0x200
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x284]
push ecx
call sym.vmtools.dll_Str_Strcat
jmp 0x100187a2
cmp dword [ebp - 0x448], 4
jne 0x100187a5
mov eax, dword [ebp - 0x444]
test eax, eax
jne 0x100186c3
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_95
push edx
mov dword [ebp - 0x450], 1
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea eax, [ebp - 0x84]
push str.win95
push eax
call sym.vmtools.dll_Str_Strcpy
mov al, byte [ebp - 0x437]
add esp, 0x18
cmp al, 0x43
je 0x1001869a
cmp al, 0x42
jne 0x1001873d
push 0x200
lea ecx, [ebp - 0x284]
push 0x1005de50
push ecx
call sym.vmtools.dll_Str_Strcat
push 0x200
push str.OSR2
lea edx, [ebp - 0x284]
push edx
jmp 0x10018735
cmp eax, 0xa
jne 0x1001874c
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_98
push eax
mov dword [ebp - 0x450], 2
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea ecx, [ebp - 0x84]
push str.win98
push ecx
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
cmp byte [ebp - 0x437], 0x41
jne 0x1001873d
push 0x200
lea edx, [ebp - 0x284]
push 0x1005de50
push edx
call sym.vmtools.dll_Str_Strcat
push 0x200
push 0x10065c14
lea eax, [ebp - 0x284]
push eax
call sym.vmtools.dll_Str_Strcat
add esp, 0x18
cmp dword [ebp - 0x448], 4
jne 0x100187a5
mov eax, dword [ebp - 0x444]
cmp eax, 0x5a
jne 0x100187a5
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Me
push ecx
mov dword [ebp - 0x450], 3
call sym.vmtools.dll_Str_Strcpy
push 0x80
lea edx, [ebp - 0x84]
push str.winMe
push edx
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
jmp 0x100187a5
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_32s
push eax
call sym.vmtools.dll_Str_Strcpy
add esp, 0xc
mov ecx, dword [ebp - 0x450]
lea eax, [ecx - 1]
cmp eax, 0x18
ja case.default.0x100187ba
movzx edx, byte [eax + 0x100188b8]
jmp dword [edx*4 + 0x1001888c]
mov eax, 1
jmp 0x10018813
mov eax, 2
jmp 0x10018813
mov eax, 3
jmp 0x10018813
mov eax, 4
jmp 0x10018813
mov eax, 5
jmp 0x10018813
mov eax, 6
jmp 0x10018813
mov eax, 7
jmp 0x10018813
mov eax, 8
jmp 0x10018813
mov eax, 9
jmp 0x10018813
mov eax, 0xa
jmp 0x10018813
mov eax, 0xb
jmp 0x10018813
mov eax, 0x1869f
mov edx, 1
mov esi, 0x1008cf4c
xchg dword [esi], edx
test edx, edx
jne 0x10018813
mov dl, byte [0x1008cf78]
test dl, dl
jne 0x1001886e
mov dword [0x1008cf18], eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0x1008fd60
mov dword [0x1008cf28], ecx
call sym.vmtools.dll_Str_Strcpy
push 0x200
lea ecx, [ebp - 0x284]
push ecx
push 0x1008fb60
call sym.vmtools.dll_Str_Strcpy
add esp, 0x18
mov byte [0x1008cf78], 1
pop edi
mov dword [0x1008cf4c], 0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret