Function at 0x403ab5
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
mov esi, 0x9c
xor edi, edi
push esi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.004041e0
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
mov ebx, eax
cmp ebx, edi
jne 0x403b0f
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call esi
test eax, eax
je 0x403d6a
mov eax, dword [ebp - 0x94]
sub eax, edi
je 0x403d58
dec eax
je 0x403cc7
dec eax
jne 0x403d67
cmp dword [ebp - 0xa0], 4
ja 0x403b3b
push str.Microsoft_20Windows_20NT_20
jmp 0x403b68
cmp dword [ebp - 0xa0], 5
jne 0x403b63
cmp dword [ebp - 0x9c], edi
jne 0x403b53
push str.Microsoft_20Windows_202000_20
jmp 0x403b68
cmp dword [ebp - 0x9c], 1
jne 0x403b63
push str.Microsoft_20Windows_20XP_20
jmp 0x403b68
push str.Microsoft_20Windows_20vista_7_2008_20
push dword [ebp + 8]
call fcn.00404a00
pop ecx
cmp ebx, edi
pop ecx
je 0x403bca
cmp byte [ebp - 0xa], 1
jne 0x403b96
test byte [ebp - 0xb], 2
je 0x403b8c
push str.Personal_20
jmp 0x403c64
push str.Professional_20
jmp 0x403c64
cmp byte [ebp - 0xa], 3
jne 0x403c6e
test byte [ebp - 0xc], 0x80
je 0x403bb0
push str.DataCenter_20Server_20
jmp 0x403c64
test byte [ebp - 0xc], 2
je 0x403bc0
push str.Advanced_20Server_20
jmp 0x403c64
push str.Server_20
jmp 0x403c64
lea eax, [ebp - 4]
push eax
push 1
push edi
push str.SYSTEM__CurrentControlSet__Control__ProductOptions
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xf4]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0xf4]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x403c2c
push str.Professional_20
push dword [ebp + 8]
call fcn.00404a00
pop ecx
pop ecx
lea eax, [ebp - 0xf4]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x403c4d
push str.Server_20
push dword [ebp + 8]
call fcn.00404a00
pop ecx
pop ecx
lea eax, [ebp - 0xf4]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x403c6e
push str.Advanced_Server_20
push dword [ebp + 8]
call fcn.00404a00
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
mov eax, dword [ebp - 0x98]
ja 0x403ca8
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push str.version__d._d__s__Build__d__n
call fcn.00404e1c
add esp, 0x14
jmp 0x403d67
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
push str._s__Build__d__n
call fcn.00404e1c
add esp, 0xc
jmp 0x403d67
cmp dword [ebp - 0xa0], 4
jne 0x403d67
cmp dword [ebp - 0x9c], edi
mov esi, dword [ebp + 8]
jne 0x403d12
push str.Microsoft_20Windows_2095_20
call fcn.00404e1c
cmp byte [ebp - 0x8f], 0x43
pop ecx
je 0x403cfc
cmp byte [ebp - 0x8f], 0x42
jne 0x403d09
push str.OSR2_20
push esi
call fcn.00404a00
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x403d67
cmp dword [ebp - 0x9c], 0xa
jne 0x403d47
push str.Microsoft_20Windows_2098_20
push esi
call fcn.00404a00
cmp byte [ebp - 0x8f], 0x41
pop ecx
pop ecx
jne 0x403d3e
push str.SE_20
push esi
call fcn.00404a00
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x403d67
cmp dword [ebp - 0x9c], 0x5a
jne 0x403d67
push str.Microsoft_20Windows_Me_20
push esi
jmp 0x403d60
push str.Microsoft_20Win32s_20
push dword [ebp + 8]
call fcn.00404a00
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret