Function at 0x417460
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x4174af
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x94
call esi
test eax, eax
je 0x417824
mov eax, dword [esp + 0x28]
sub eax, 0
je 0x4178ac
dec eax
je 0x41782e
dec eax
jne 0x4178b9
mov eax, dword [esp + 0x1c]
mov esi, 5
cmp eax, esi
jne 0x417524
cmp dword [esp + 0x20], 2
jne 0x4174f3
push str.Microsoft_Windows_Servernbsp_2003_family_
call fcn.004bdcb0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x417524
cmp dword [esp + 0x20], 1
jne 0x41750f
push str.Microsoft_Windows_XP
call fcn.004bdcb0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x417524
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x417538
push str.Microsoft_Windows_2000
call fcn.004bdcb0
add esp, 4
cmp dword [esp + 0x1c], 4
ja 0x417538
push str.Microsoft_Windows_NT
call fcn.004bdcb0
add esp, 4
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x417695
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x4175a6
cmp dword [esp + 0x1c], 4
jne 0x417576
push str.Workstation_4.0
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
mov eax, dword [esp + 0xb0]
test ah, 2
je 0x417594
push str.Home_Edition
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
push str.Professional
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
cmp al, 3
jne 0x41776c
cmp dword [esp + 0x1c], esi
jne 0x417667
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x41761e
mov eax, dword [esp + 0xb0]
test al, al
jns 0x4175de
push str.Datacenter_Edition
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
test al, 2
je 0x4175f4
push str.Enterprise_Edition
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
cmp ax, 0x400
jne 0x41760c
push str.Web_Edition
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
push str.Standard_Edition
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
test eax, eax
jne 0x417667
mov al, byte [esp + 0xb0]
test al, al
jns 0x41763f
push str.Datacenter_Server
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
test al, 2
je 0x417655
push str.Advanced_Server
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
push str.Server
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
test byte [esp + 0xb0], 2
je 0x417683
push str.Server_4.0__Enterprise_Edition
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
push str.Server_4.0
call fcn.004bdcb0
add esp, 4
jmp 0x41776c
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x417824
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xbc]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417824
cmp dword [esp + 0x14], esi
ja 0x417824
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0xb8]
push ecx
push str.WINNT
call ebx
test eax, eax
jne 0x417715
push str.Workstation
call fcn.004bdcb0
add esp, 4
lea edx, [esp + 0xb8]
push edx
push str.LANMANNT
call ebx
test eax, eax
jne 0x417735
push str.Server
call fcn.004bdcb0
add esp, 4
lea eax, [esp + 0xb8]
push eax
push str.SERVERNT
call ebx
test eax, eax
jne 0x417755
push str.Advanced_Server
call fcn.004bdcb0
add esp, 4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push str._d._d
call fcn.004bdcb0
add esp, 0xc
cmp dword [esp + 0x1c], 4
jne 0x4177fb
push str.Service_Pack_6
lea eax, [esp + 0x30]
push eax
call ebx
test eax, eax
jne 0x4177fb
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x4177cb
mov edx, dword [esp + 0x24]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d__n
call fcn.004bdcb0
mov edx, dword [esp + 0x18]
add esp, 8
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004bdcb0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004bdcb0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov esi, 4
cmp eax, esi
jne 0x4178b9
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41786f
push str.Microsoft_Windows_95
call fcn.004bdcb0
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x43
je 0x41785c
cmp al, 0x42
jne 0x417869
push str.OSR2
call fcn.004bdcb0
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x4178b9
cmp dword [esp + 0x20], 0xa
jne 0x41789e
push str.Microsoft_Windows_98
call fcn.004bdcb0
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x41
jne 0x417898
push 0x591344
call fcn.004bdcb0
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x4178b9
cmp dword [esp + 0x20], 0x5a
jne 0x4178b9
push str.Microsoft_Windows_Millennium_Edition_n
jmp 0x4178b1
push str.Microsoft_Win32s_n
call fcn.004bdcb0
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret